Open Recommendations

The Chief Information Officer, in conjunction with the Chief Operating Officer, should revise the DLP rules to be more restrictive to help prevent intentional data exfiltration.

The Chief Information Officer, in conjunction with the Chief Operating Officer, should continue to ensure that the managers and executives responsible for reviewing and approving BEARS ********************** requests carefully review all requests and only approve requests with sufficient and appropriate responses to the required questions.

Update IRM 21.1.3, Operational Guidelines Overview, and IRM 21.3.4, Field Assistance, to include the information shown in IRM 21.6.8.3, Disclosing Taxpayer Data, as it provides examples of situations in which a contact representative or an ITAS can and cannot disclose taxpayer information pursuant to I.R.C. § 6103(e) requirements and defines mirrored accounts.

Update IRM 11.3.2, Disclosure to Persons with a Material Interest, to include a reference to the IRMs for AM and FA that provide examples of situations in which a contact representative or an ITAS can and cannot disclose taxpayer information pursuant to I.R.C. § 6103(e).

Provide refresher training on I.R.C. §§ 6103(e)(7) and (e)(8) to all contact representatives in the AM and to all ITASs in the FA. This training should include information about the usefulness and availability of the Disclosure Office and Disclosure Help Desk.

Update Revenue Procedure 2013-14 to include the language found in the Treasury Regulation § 301.7216-3 that the consent statement must identify the purpose of disclosure and specific recipient(s).

Evaluate whether any clarifications or updates to Revenue Procedure 2013-14 or Treasury Regulation § 301.7216-3 are needed to address concerns or raise awareness of data sharing practices with tax software companies that use pixels.

Identify and implement potential solutions that will ensure that Authorized e-file Providers comply with the regulatory requirements of taxpayer consent statements. This can include, for example, sample reviews of tax software companies’ taxpayer consent statements or creating a data element to track if taxpayers are consenting to sharing their information with third parties.

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, conduct an analysis to identify the root cause(s) of the geospatial dataset unavailability on GeoPlatform.

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, conduct an analysis to determine the costs, benefits, and feasibility of resolving the root causes identified with GeoPlatform.

We recommend that the Principal Deputy Assistant Secretary for Water and Science, as the delegated Federal Geographic Data Committee Chair, implement appropriate changes based on the root cause and cost benefit analyses to address dataset availability issues.

We recommend that the Office of the Chief Information Officer develop and implement a methodology for the bureaus to identify all DOI geospatial-related costs to ensure consistency.

We recommend that the Office of the Chief Information Officer, in the absence of Federal Geographic Data Committee standards, identify relevant best practices and develop requirements for specific data fields for National Geospatial Data Assets in alignment with best practices.

We recommend that the Office of the Chief Information Officer direct the bureaus to track all geospatial-related costs using the methodology developed in recommendation 4 and report these costs to the Office of the Chief Information Officer annually.

The Chief Information Officer should include updated defect remediation risk information in Information Technology Investment Reports.

The Chief, Transformation Strategy Office, should ensure that the plan to use IRA resources includes outcomes and key results that represent transformation priorities and that associated projects are managed in a consolidated portfolio and overseen by appropriate governance boards.

We recommend that the Federal Acquisition Service Commissioner conduct a review of all active AAS Level 2 contracts to ensure that all contract security classifications adhere to AAS’s current policy and definitions.

We recommend that the Federal Acquisition Service Commissioner consolidate and improve contract security classification guidance to provide more detail and clarity for AAS contracting personnel.

We recommend that the Federal Acquisition Service Commissioner update existing controls to monitor and ensure compliance with contract security classifications by including a review of the security classification level in contract file transfer checklists; verifying compliance with AAS security classification policies during existing internal contract reviews; and updating briefing templates to use consistent terminology.

We recommend that the Federal Acquisition Service Commissioner implement Assisted Services Shared Information System controls to ensure accuracy and integrity of contract security classifications by prioritizing the development of edit history for immediate visibility of changes to the contract security classification level; and limiting the ability to edit contract data to only the assigned acquisition personnel and their supervisory chain.

We recommend that the Federal Acquisition Service Commissioner strengthen AAS policy to require AAS Level 3 contracting officers to have adequate security clearances and establish a plan to initiate the security clearance process for affected contracting officers.

We recommend that the Federal Acquisition Service Commissioner provide AAS contracting personnel with training on any updated policies or guidance implemented in response to the audit findings.

Amend the GPO Finance Policy Manual to include the anti-gagprovision to ensure GPO employees fully understand what protections are afforded themunder WPEA.

Require a WPEA legal review for all future NDAs to ensure anti-gaglanguage is included.

Ensure that WPEA compliance is part of the GPO directive reviewprocess.