Watchdog flags security issues with IRS’s Zero Paper Initiative

The IRS is facing more hurdles in its lagging effort to transition from paperless processing to a fully digitized approach to tax returns.

A memo sent by the Treasury Inspector General for Tax Administration to the IRS commissioner last week flagged digital and physical security gaps at two contractor sites that support the agency’s Zero Paper Initiative, which the watchdog fears is behind the implementation eightball.

According to TIGTA, 48% of security vulnerabilities in IT systems used to process taxpayer information at one of the sites were not resolved in a timely fashion. At the other site, unauthorized software was used to scan IT systems for vulnerabilities. 

At the same time, TIGTA found that 14 employees across the two sites had access to taxpayer information without authorization from the IRS. The watchdog found 1,375 instances in which those staffers were in areas where taxpayer documents were being stored, scanned or digitized as part of the Zero Paper Initiative.

“During our discussions with contractor representatives, they stated that the loading dock is left open during the day and locked at night. Further, their contract did not require the use of guards within the facility. We disagree,” the memo stated. “Contractors are responsible for safeguarding taxpayer data. The ZPI requires contractors to implement security controls in accordance with IRS policies.”

Configuration vulnerabilities were also observed by TIGTA at both sites. One site, for example, failed to complete required monthly scans of IT systems. According to the memo, just one out of 203 devices was scanned in August 2025.

The other site, meanwhile, was dinged for using software that “did not capture sufficient details on configuration settings to determine how long a configuration weakness had existed on the system,” per the memo.

Cybersecurity personnel were aware of an “unauthorized tool” used for configuration scanning, but “no actions were initiated to ensure that the contractor complied with agency requirements,” the memo stated.

The Zero Paper Initiative has previously come under fire from TIGTA, which reported in February that the effort had made “limited progress,” sparking concerns that the IRS would be “unable to meet the federal mandate to have all records in a digital format by December 2030.”

In response to the new issues brought to light by TIGTA, the IRS said it has or will take “corrective actions.” For its part, the watchdog said it plans to visit other contractor facilities as the process of scanning paper returns begins.