IRS Fails to Meet Cloud Security Requirements, Putting Taxpayers’ Personal Data at Risk

The Government Accountability Office (GAO) released a report in January 2023 on the Internal Revenue Service’s (IRS) move to cloud computing. It found that the IRS had not fully met federal cloud computing requirements, which raises concerns about how well taxpayers’ personal data is protected.

GAO found that the IRS fully addressed 11 of 14 requirements in the Office of Management and Budget’s 2019 cloud strategy, partially addressed one and did not address two. A separate September 2022 audit by the Treasury Inspector General for Tax Administration (TIGTA) was blunter. It found that the IRS had put cloud services holding taxpayer data into use before key security controls were fully in place. Encryption was one gap. Access management and monitoring were others.

That matters. The IRS holds Social Security numbers and income details for nearly every American. Criminals with that data could commit fraud and identity theft on a huge scale.

The IRS has acknowledged the findings and committed to fixing them. Taxpayers can protect themselves too. Check your credit reports and bank statements regularly for anything suspicious, and consider an IRS Identity Protection PIN.

Government agencies hold some of the most valuable personal data there is. The IRS needs to finish closing these gaps, and taxpayers should do their part to guard their own information.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.