Review of the System Failure That Led to the Tax Day Outage

The Chief Information Officer should ensure that the Director, Security Operations and Standards Division, collects and formally documents in one consolidated action plan any lessons learned for all major outages and implements the approved corrective action plan per the Major Outage SOP.

The Chief Information Officer should formalize the monthly microcode bundle meetings with IBM and Unisys to include documenting meeting participants, detailed meeting minutes, and discussions of risks identified in the release notes for the current microcode updates.

The Chief Information Officer should ensure that all decisions to not install the latest microcode bundle updates are documented and approved by the system Authorizing Official.

The Chief Information Officer should seek liquidated damages from the contractor per the ESS contract.

The Chief Information Officer should modify the ESS contract to require the contractor to provide the IRS with timely notifications of all alerts, to include "call home" events regardless of severity level.