The Internal Revenue Service has a legal obligation to protect the confidentiality of tax returns and related information. The Service also has responsibility for protecting the entire Federal Tax Administration System, not just the individual components of the system -- employees, computer equipment, tax returns, monies, property, facilities and records.

The Service has taken the position of providing reasonable protection commensurate with the character and value of the information or property involved. For example, processing center operations require a high degree of physical protection to meet minimum security needs, while a small post-of-duty may require fewer protective measures.

The Office of Management and Budget (OMB) Circular A-130 requires that government information be protected commensurate with the magnitude of harm that could result from the loss, misuse, unauthorized access to or modification of such information. This responsibility includes establishing physical, administrative and technical safeguards to protect personal, proprietary or other sensitive data, whether it is national defense information or not.

This IRM includes Government Issue laptop random security screening requirements for the entire Federal Tax Administration System as administered within the IRS. This includes all Service facilities (National Office, posts of duty, processing centers, computing centers and other Service offices or space).

This IRM, along with IRM 10.8.26 Laptop Computer Security Policy, establishes laptop security guidelines for the reasonable protection of tax information, personal identifiable information (PII), and sensitive information against disclosure, loss, or damage without unnecessarily restricting or interfering with operations. It also provides instructions on key security preventive measures and serves as a procedural and technical guide for security personnel.

The Chief, Agency-Wide Shared Services, is authorized to prescribe the Laptop Random Security Screening Program for use within the IRS. The Director, Physical Security and Emergency Preparedness (PSEP), is responsible for oversight of this IRS Program. The Associate Director, Security and Emergency Programs Division, is responsible for planning, developing, implementing, evaluating, and controlling this IRS Program.

Area Directors of the Physical Security Emergency Preparedness (PSEP) Operations offices, Operational Assurance Areas, are responsible for assuring that offices are in compliance with Service policy and for providing guidance, oversight and assistance to their Territory offices on the laptop security program. The Territory Offices are responsible for implementing, evaluating and managing the local physical security program and for providing guidance, oversight and assistance to IRS sites.

PSEP staff on site is responsible for the program with input from or in coordination with the Campus Directors, Submission Processing Center Directors, Computing Center and Customer Service Center Directors, for implementing an effective laptop random screening program and for ensuring that security measures taken are reasonable, adequate and effective.

Business Unit managers are responsible for implementing an effective laptop security program within their functional areas; for ensuring that laptop security measures taken are reasonable, adequate and effective; and, for notifying the PSEP Security and Emergency Programs division of any proposed changes to items listed in this IRM.

To meet the obligation to provide necessary security protection to Taxpayer data, PII and Tax Administration System, the Service has determined that Service officials and managers are responsible for ensuring that employees and contractors protect government issue laptops and sensitive information of the Federal Tax Administration System by taking all responsible actions to prevent the loss of laptop, blackberry, thumb drive and property, the disruption of services and functions and the unauthorized disclosure of documents and information. Managers are responsible for enforcing laptop security procedures, and ensuring that employees and contractors are complying with the policy and procedures outlined in this IRM.

All employees are responsible for protecting Government Issue equipment such as but not limited to, laptop, blackberry, thumb drive and external hard drive property with which they are entrusted, for complying with established laptop security procedures, all local security requirements, and for reporting any loss, theft and violations to their manager, local physical security office, Computer Security Incident Response Center (CSIRC) and Treasury Inspector General for Tax Administration (TIGTA).

The theft or loss of laptop is a threat to our information and Taxpayer systems; therefore IRS employees and contractors who are issued government furnished equipment such as laptops, blackberry, thumb drive, external hard drives, satellite phone, and other electronic devices are responsible for securing this equipment at all times and for safeguarding such articles from loss, theft and/or damage. The accountability and security of IT resources, extends to your workplace, residence and/or other areas in which you use, travel and/or store the equipment.

Proper precautions must be consistently exercised to ensure that government equipment is not vulnerable to any negligence or potential criminal activity. If you are assigned an IRS laptop, you are responsible for its physical safety as well as the data stored on it. Below are some actions you can take to safeguard and secure the government equipment issued to you.

Employees and/or Contractors must never:

All employees and contractors issued IRS laptops are required to have a valid property pass to remove the item from the facility. IRS laptops will have a bar code with the following annotation Property of IRS and laptop Information Technology Asset Management System (ITAMS) number. Upon exiting the facility, IRS issued equipment must be accompanied by a Property pass/custody receipt Authorization (Form 1930) to record the removal from the facility, for the temporary removal of IRS property for authorized purposes. Form 1930 is available from Real Estate and Facilities Management.

Random Laptop screening will be determined by local PSEP staff and conducted in facilities where security guard force is under IRS control. All employees/contractors are subject to random screening and must:

If information on form 1930 does not match, the laptop may not be removed from the facility. Employees will be directed to return the equipment to the workstation and record their name on the event log. If employee refuses to comply:

All non-IRS issued laptops must be registered upon entry into the facility.

Custodial and property officers should obtain custody receipts for laptops.

Procedures for IRS Employees/Contractors are as follow; You’ll need to use the updated Form 1930, Property Pass/Custody Receipt for Government and Individually Owned Property, after July 23, 2007 if you are issued new equipment that you can remove from your workplace (for example, a laptop, Blackberry or cell phone). See IRM 1.14.4 for this requirement. Here’s what you have to do:

You won’t need to replace any Forms 1930 or other property passes that you have completed before July 23, 2007 with the new form. If you have questions, contact your local Real Estate office.

The custodial or property officer prepares an original only of Form 1930, secures the employee's signature, and files the signed form, by name, in a file maintained for this purpose on property removed from the premises.

Employees should not remove property from the premises except for conducting official business. As soon as practical, they should return the property.

The employee (recipient) is responsible for the property while it is in his/her possession. When the property is returned, the employee should obtain the custody receipt the custodial or property officer has been holding.

Supervisors must notify the custodial or property officer when an employee transfers or terminates employment. Such notification will enable the officer to check custody receipts to make sure that any property loaned to the employee has been returned.

The condition, status, etc. of loaned property must be verified during inventories by issuing authority.

Employees and contractors are responsible for safeguarding sensitive information stored on the government laptop. All sensitive information will be encrypted and password protected. Ensure that all sensitive information stored on laptops has been encrypted in accordance with cyber security IRM directives. Please follow these preventive measures to protect sensitive information stored on your laptop:

Sensitive information stored on any laptop computer that is outside of IRS facilities, or on travel, shall be encrypted using Federal Information Processing Standards (FIPS) 140-2 or later approved encryption. Contact the MITS Enterprise Service Desk at 1-866-7HELP4U (743-5748) or TDD/TTY at 1-866-HELP4U6 (1-866-435-7486) to ensure you have the latest encryption software installed.

Employees and Contractors are responsible for reporting the loss or theft of their government issued laptop or electronic device within 24 hours to their manager, and managers must ensure that employee/contractor submit an incident report to the local Physical Security Office, the Computer Security Incident Response Center (CSIRC) and TIGTA.

Reports must be submitted using the computer incident report form on the CSIRC website, https://www.csirc.web.irs.gov/incident/ Additionally, employees and contractors must file a complaint and/or incident report with TIGTA and provide complaint number to CSIRC for tracking and reporting purposes.