The Process for Tracking Physical Security Weaknesses Identified in IRS Facilities Does Not Ensure That Vulnerabilities Are Properly Addressed

Ensure that countermeasure recommendations, approvals or denials, implementation decisions and actions, risk acceptance decisions, and the associated cost of countermeasure implementation are adequately tracked and maintained in a central location.

Update the policies and procedures for any changes related to the tracking of countermeasures identified in an FSA or FSAA and provide formalized training to the physical security specialists.

Ensure that all recommended countermeasures identified in the most recent risk assessment (i.e., FSA or FSAA) for each facility are tracked until a new risk assessment is completed using the new countermeasure tracking mechanism.

Ensure that the countermeasure tracking mechanism requires physical security specialists to document the reason and obtain approval for rejecting a recommended countermeasure.