The Internal Revenue Service has a legal obligation to protect the confidentiality of tax returns and related information. The Service also has responsibility for protecting the entire Federal Tax Administration System, not just the individual components of the system, which includes employees, computer equipment, tax returns, monies, property, facilities and records.

The Service has taken the position of providing reasonable protection commensurate with the character and value of the information or property involved. For example, processing center operations require a high degree of physical protection to meet minimum security needs, while a small post-of-duty may require fewer protective measures.

The Office of Management and Budget (OMB) Circular A-130 requires that government information be protected commensurate with the magnitude of harm that could result from the loss, misuse, unauthorized access to or modification of such information. This responsibility includes establishing physical, administrative and technical safeguards to protect personal, proprietary or other sensitive data whether it is national defense information or not.

This IRM includes the physical security requirements for the entire Federal Tax Administration System as administered within the IRS. This includes all Service facilities (National Office, posts of duty, processing centers, computing centers and other Service offices or space).

This IRM establishes security guidelines for the reasonable protection of tax information, property, and facilities against disclosure, loss, damage, or destruction without unnecessarily restricting or interfering with operations. It also provides instructions on the Service's Minimum Security Standards (MSS) and serves as a procedural and technical guide for security personnel. It includes optional methods for providing security under varying local conditions, provides for specific items requiring protection and identifies the various methods for protection.

The Chief, Agency Wide Shared Services, is authorized to prescribe the Basic Security Concepts Program for use within the IRS. The Director, Physical Security and Emergency Preparedness, is responsible for oversight of this IRS Program. The Associate Director, Security and Emergency Programs Division, is responsible for planning, developing, implementing, evaluating, and controlling this IRS Program.

Area Directors of the Physical Security and Emergency Preparedness (PSEP) Operations offices, are responsible for assuring that offices are in compliance with Service policy and for providing guidance, oversight and assistance to their Territory offices on the physical security program. The Territory Offices are responsible for implementing, evaluating and managing the local physical security program and for providing guidance, oversight and assistance to client sites.

Submission Processing Center Directors, Computing Center and Customer Service Center Directors are responsible for implementing an effective physical security program and for ensuring that security measures taken are reasonable, adequate and effective.

The Business Units are responsible for implementing an effective physical security program within their functional areas; for ensuring that security measures taken are reasonable, adequate and effective; and, for notifying the Security and Emergency Programs (SEP) Division of any proposed protective changes.

To meet the obligation to provide necessary security protection to the Tax Administration System, the Service has determined that Service officials and managers are responsible for ensuring the continued operation of the Federal Tax Administration System by taking all responsible actions to prevent the loss of life and property, the disruption of services and functions and the unauthorized disclosure of documents and information. Managers are responsible for providing reasonable security for all information, documents, and property with which they are entrusted, for complying with all minimum security standards contained in 10.4.1, Managers Security Handbook, all local security requirements, and for reporting any violations to the local physical security office or other individuals who have security responsibilities. Managers must ensure that the physical security measures required for protecting information, property, and life are applied within their area of supervision and that those measures meet the established minimum security standards.

All employees are responsible for providing reasonable security for all information, documents and property with which they are entrusted, for complying with established security procedures, all local security requirements, and for reporting any violations to their manager or to their local physical security office or other individuals who have security responsibilities.

A security representative and alternate (if available) shall be appointed to and participate in the Building Security Committee (BSC) established for each building by the Federal Protective Service (FPS). The FPS Policy Directive FPS-05-002, Building Security Committees, dated February 16, 2005, will apply. Members of the BSC shall at a minimum focus their efforts on:

Basic security concepts have been adopted by the Service and applied to the various activities within the Service. These concepts provide management with the flexibility to provide the degree of security or protection commensurate with the degree of sensitivity of each particular activity.

Minimum security levels shall be established for each facility based first on the factors of occupancy, multi-agency tenancy, square footage, and amount of public contact. Security levels must then be adjusted and additional security measures implemented commensurate with the operation, personnel, resources, information systems, and/or mission of the facility. Each facility will be designated Level I, II, III, or IV, in accordance with the DOJ Vulnerability Assessment of Federal Facilities Report, and appropriate security measures shall be implemented. A designation of Level V is reserved for and assigned only to those facilities identified and prioritized as national security critical infrastructure assets in accordance with the Treasury Critical Infrastructure Protection Program. A Level V designation necessitates implementation of extensive security measures and such designation requires concurrence of Treasury’s Office of Security Programs and coordination with the Critical Infrastructure Physical Security Program Manager. IRS facilities identified as critical infrastructure and those housing critical infrastructure and key resources shall be designated and protected as Level IV, at a minimum.

Taking photographs within or recording images of the inside of Treasury bureau facilities shall be prohibited except when specifically authorized by the Internal Revenue Service Agency Wide Share Services Physical Security Emergency Preparedness Territory Managers, Area Director (AD), or National office (N.O.) PSEP SEP. Taking photographs of external features of a facility or other property which provides information not accessible to the public shall also be prohibited and must be reported to local Physical Security Office, and the Contracting Officer Technical Representative (COTR) who will then notify FPS and/or local law enforcement. Photography means any physical or electronically recorded image, including still photographs, x-ray images, video tapes or recordings, and motion pictures.

The Facility Security Plan (FSP) is an Operations Office level document that provides summary information used to describe all significant Safeguards and Security programs at applicable sites and facilities for PSEP Systems, Resources and Designs (SRD) review, track corrective actions and/or funding. The FSP will be completed for each IRS facility, including computing centers, campuses and critical post of duty (POD). This FSP documents the implementation of Physical Security and Environmental (PSE) and Media Protection (MP) Controls prescribed within the National Institute Standards and Technology (NIST SP 800-53), Treasury Department Publication (TDP 15-71), and Interagency Security Committee Design Criteria (ISCDC). Development and maintenance of the FSP is directed in Treasury Department Publication (TDP 15-71) Security Manual.

The purpose of the FSP template is to provide an overview of the appropriate physical security measures and requirements taken to minimize the threat to our facilities, employees, loss of assets, equipment, and material through terrorism, criminal activities and natural disasters.

The intent of the FSP template is to describe those programs used to form the basis for the site and facility protection and the basis for future changes and improvements. The description of how those programs are implemented should be contained in site and facility procedures, directives, supplemental orders or other authoritative documentation. While these documents may change, the FSP template should remain relatively constant describing the long term protection plan in place and envisioned for the site or facility.

At a minimum, the Facility Security Plan shall identify the following:

(5) At a minimum the plan will be reviewed on an annual basis, current and plan security controls shall address those security concerns that impact the physical security of the site/facility and the protection of media contained therein. PSEP Area Directors and PSEP Territory Managers will certify FSP annually and submit to PSEP SRD for accuracy, or identify changes and resolution strategy where applicable.

The Service has established minimum physical security standards and requirements for the protection of Service facilities, personnel and information. These standards are based on possible threats and identified countermeasures that could minimize the impact of an occurrence. Periodic risk management assessments provide security personnel and management officials with information on the effectiveness and appropriateness of existing standards and countermeasures, identifies risks, recommends additional upgrades, as needed, and provides guidance on how best to implement approved recommendations.

Evaluation of the risk is the first step in determining the degree of security required for a particular facility. Security measures should be relative to the type of risks to which the facility and its contents are exposed, the probability that these risks will occur, and the impact that an occurrence would have on the organization. The Service recognizes the value of this approach and has developed and implemented an automated risk assessment process, known as the FSR-Manager (Facility Security Risk-Manager). This risk assessment process, FSR-Manager, is to be used by the physical security personnel to develop a tailored physical protective system for the facility and associated annexes. The process provides an objective tool to assist in identifying and justifying security requirements for IRS assets and systems that can be substantiated as minimum requirements to support IRS security policy. It allows the security analyst to independently assess the security posture at a specific facility, annex, or group of facilities and, based on this assessment; determine security criteria to protect the facility(s).

At a minimum, risk/vulnerability assessments will be conducted at the following intervals, at a minimum: Level IV and V, every two (2) years; Level III, every three (3) years; and Level I and II, every four (4) years. Existing Risk Assessments that are less than 5 years old with no significant changes in the overall security posture at a security level I, II, or III facility may be re-validated. If the security posture has been enhanced by the addition of security countermeasures, those enhancements should be noted in the re-validation report. (see Exhibit 10.2.11-1). Security Level IV and V facilities must continue to be re-assessed at intervals of every 2 years or more frequently, if circumstances warrant and/or when the following condition occurred;

The risk assessment process will include the following steps:

Risk/vulnerability assessments will be conducted using the FSR-Manager automated tool and all completed risk assessment reports will carry the legend "For Official Use Only-Restricted Distribution" . Copies of the report will be forwarded to the National Office Security and Emergency Programs Division via secure E-mail or by a traceable means if sent through the postal system.

The SEP will perform a Risk Assessment Authority Review. The Risk Authority Review is conducted to confirm the recommended upgrades based on impact of loss and the risk of an occurrence happening. The Risk Authority Review will be objective and fiscally responsible and will assist in prioritizing the recommended upgrades that become authorized

The basic principle of security within IRS, or anywhere, is "limit access to assets based upon need." When protecting information, for example, access to documents should be limited to those persons with a need to know the information. When the asset to be protected is a room, an area, a building, a computer, or other such property, access to that property should be restricted to those persons who, due to their official duties and/or responsibilities, have a need for such access.

Whether a person needs to access an asset will depend upon whether that access is necessary to enable the person to perform his/her assigned duties and responsibilities. Management is responsible for determining such a need and for subsequently deciding to grant or deny access. Once this determination has been made, management should consult Security personnel for assistance in selecting the appropriate method of achieving the desired control.

Most of the methods of protection are designed for protection after normal duty hours or at any time the assets to be protected are not under the personal custody of authorized Service employees.

Because any single safeguard is often insufficient protection for any asset, the concept of layering of safeguards was developed to provide security-in-depth. To facilitate understanding of security-in-depth, the following functions of safeguards are presented.

Exhibit 10.2.11-3 shows the functions generally performed by certain physical security devices/techniques. No attempt is made to address the effectiveness of each, as this depends on the quality of the device selected monitoring activities and timely reactionary measures. Also most of the techniques/devices shown are primarily for use against any potential perpetrator (employee or outsider) during unoccupied times. Conversely, ID media, electronic access control systems, sign in and other audit trail procedures and task separation techniques are generally for use during occupied times to protect against "insiders. "