IRS & Taxpayer Data: Critical Weaknesses in Security

The Internal Revenue Service (IRS) has implemented access controls and other safeguards to help mitigate risks to taxpayer information, but continuing weaknesses pose a risk. Since fiscal year 2010, GAO has made 451 recommendations to IRS aimed at safeguarding taxpayer information. IRS has implemented many of these recommendations; however, 77 recommendations have not been implemented as of March 2023. GAO is making 15 additional recommendations that could help IRS better manage system security risks, implement safeguards to ensure protected service delivery, and identify cybersecurity events and incidents.