The Identity Theft Tax Refund Fraud Information Sharing and Analysis Center Generally Adhered to Data Protection Standards, but Additional Actions Are Needed

The Director, Return Integrity and Compliance Services, should ensure that the ***2*** contractor fully implements required controls to include the ********2***** *********2*******, a privacy incident response plan, a risk assessment of the ISAC environment, and timely flaw remediation, and improves the POA&M process.

The Director, FMSS, should ensure that the physical security portion of the CSA is performed and ensure that physical security deficiencies are corrected in a timely manner.