The IRS Has Made Limited Progress Implementing Zero Trust Data Principles

Report Information

Summary

We agree with the IRS’s self-assessment that most of its data pillar maturity ratings are in either the Traditional or Initial maturity stage, meaning that most of its solutions and responses are manual or are in the process of becoming automated. We also found that the IRS has made little progress implementing the Zero Trust Data Pillar functions. The IRS is in the first stages of development for its Data Inventory Management and Categorization. The IRS developed the Enterprise Data Platform for its data inventory and has onboarded 41 (22 percent) of the 187 data repositories as of October 2025. The IRS has deployed two commercial software solutions for data categorization. However, the IRS has not implemented automated categorization of data due to challenges establishing related policies. The IRS encrypts data in transit between its locations, and we confirmed that encryption configuration settings are enabled for data transmitted between IRS locations. However, management personnel from the IRS Enterprise Operations function stated that they cancelled plans to encrypt any more systems past June 2025 due to changing priorities at the Department of the Treasury. In addition, we found that the IRS did not follow its internal policies to ensure the security of encryption keys. Specifically, the combinations for the cabinet locks that contain access cards necessary to log on to the encryption servers were not changed as required and our auditors were allowed to enter limited access areas without signing the appropriate log. Furthermore, we found that the majority of the IRS data were backed up. However, the IRS does not resolve the requests for data restoration within the required time frames. By not restoring the data in a timely manner, it could impact the ability of the IRS to conduct its business operations. Finally, the IRS did not meet the requirements to create an Information Resources Management Strategic plan as required by the Office of Management and Budget. The IRS presented different documents as its strategic plan. Our review of these documents found that they did not contain elements such as including the governance boards in these documents.