Despite upgrades, IRS cyber program still ‘not effective,’ watchdog says
An ineffective IRS cybersecurity program in fiscal 2026 could leave taxpayer data vulnerable to bad actors, the agency’s watchdog warned in a report published Friday.
According to the Treasury Inspector General for Tax Administration, the IRS’s information security program was deemed “not effective” for the most recent fiscal year based on Federal Information Security Modernization Act assessments.
Under FISMA reporting metrics, agencies are judged on six areas spelled out in the National Institute of Standards and Technology’s cybersecurity framework: govern, identify, protect, detect, respond, and recover.
The IRS, per the TIGTA report, was rated effective in the govern, respond, and recover categories, but fell short of “an acceptable overall maturity level” on identify, protect, and detect.
“If the IRS does not take steps to mitigate these deficiencies, taxpayer data could be vulnerable to inappropriate and undetected use, modification, or disclosure,” the report said.
The watchdog did give the tax agency credit for making “some improvements” compared to fiscal 2025 cyber maturity level ratings — though it ultimately concluded that “further steps” must be taken.
Under the identify function, for example, TIGTA applauded the IRS’s move to add a unique system identifier to several agency repositories and to incorporate cyber risk information into a centralized reporting tool.
But it still needs to solidify its ties with those who oversee inventory management systems when it comes to efficiently resolving issues, and it needs to fully implement corrective actions on a few outstanding plans of action and milestones.
The IRS also made improvements in the function area of configuration management specifically, though it didn’t share an inventory of its critical software, and 6 of its 7 sampled information systems had critical vulnerabilities that weren’t remediated within 30 days, per FISMA requirements.
On the detect front, the IRS is updating security procedures and recently underwent a reorganization that prevented it from moving forward on an agencywide Information Security Continuous Monitoring (ISCM) strategy.
“The IRS needs to fully establish automated analysis tools,” TIGTA said. “The IRS stated that it is implementing a tool that will provide the capability to perform continuous control and system authorization.”
In a response letter to the watchdog, the IRS pushed back on the assessment of the maturity of the agency’s ISCM program, but said it “appreciates TIGTA’s feedback for continued improvement” and “remains committed to strengthening its cybersecurity program.”
“The IRS will continue enhancing its governance documentation and program artifacts to improve traceability and transparency,” CIO Kaschit Pandya wrote in the letter.
The release of Friday’s report follows a string of other TIGTA findings in recent months about shortcomings with the tax agency’s cybersecurity program. This summer alone, the watchdog detailed access control problems with an IRS data platform, security issues with the Zero Paper Initiative, and sustained access by departed agency staffers to sensitive internal systems.
