ensure IDRS Security policies and guidance are implemented in their jurisdiction;

identify at least one individual as the point of contact and coordinator for their organization's IDRS security activities. The security role of these individuals is IDRS Security Business Division Point-Of-Contact. The point of contact's name, Standard Employee Identifier (SEID), and contact information shall be provided to the IDRS Security Program Management Office;

ensure that Unit Security Representatives (USRs) and IDRS Online Reports Services (IORS) Primary Report Reviewers are appointed to cover all IDRS units and users;

ensure that for each IDRS unit, IDRS Security Account Administrators are provided with the name, SEID, and contact information for all current USRs, alternate USRs, Terminal Security Administrators, and IORS Security Report Reviewers;

ensure the IDRS Security Account Administrators or the IDRS Security Program Management Office are notified of any business division reorganizations that may require the realignment or renumbering of IDRS units;

ensure that, at least annually, IDRS security issues are the topic of discussion at managerial meetings;

ensure that IDRS security reports are reviewed, and certified timely; and that any required report actions are completed timely;

ensure that corrective actions are taken when IDRS security report reviewers fail to meet their IDRS security report responsibilities;

ensure that required responses related IDRS security report compliance are timely submitted to the IDRS Security Program Management Office and/or Cybersecurity Operations staff;

ensure that all reported accesses and violations for USRs and alternate USRs are independently reviewed at the next management level that is higher than the USR's or Alternate USR's level;

ensure that any user who is being investigated for a UNAX violation is promptly removed from IDRS;

ensure that all users who are re- added to IDRS after having a proven UNAX violation have satisfied all requirements of their disciplinary actions before being added to IDRS;

ensure that USRs and Alternate USRs complete the required initial and annual refresher training;

ensure that IDRS users complete the required initial and annual refresher awareness training;

ensure that IDRS users recertify (re-acknowledge) the rules of behavior annually in order to maintain access privileges; and

fulfill any additional IDRS security responsibilities of the Senior Management/Executive stated elsewhere in the IRM.

ensure IDRS Security policies and guidance are implemented in their unit/group;

reinforce employee awareness and compliance to the prohibition that employees shall not access any taxpayer or personnel data not required to accomplish official duties;

conduct periodic re-orientation sessions to ensure that employees remain alert to and aware of IDRS security requirements;

ensure that employees who are IDRS users complete the required initial and annual refresher training;

ensure weekly and monthly IDRS Security reports are reviewed and certified timely and that any required report actions are completed timely;

ensure the Maximum Profile Authorization File (MPAF), the Unit Command Code Profile (UCCP), and the Employee Security Record File (ESRF) for all employees and IDRS units are reviewed at least monthly and any necessary corrective actions are competed timely;

ensure the command code usage of employees with sensitive command code combinations in their profiles is reviewed at least monthly;

ensure new IDRS users review the rules of behavior and that each IDRS user recertifies the rules of behavior annually via the Online 5081 (OL5081) application;

ensure questionable activity or potential UNAX violations are timely reported to TIGTA;

report any IDRS user who refuses to certify or recertify the rules of behavior to employees' division management for appropriate disciplinary action. Users who refuse to certify or recertify the rules of behavior will not be allowed to access IDRS. Their IDRS user account shall be deleted;

ensure that all requirements associated with a disciplinary action have been met prior to reinstating an IDRS user who has been deleted from IDRS because of an illegal or improper activity. If the employee's disciplinary action resulted because of one or more unauthorized actions, the manager shall ensure that the employee has met the recertification requirements, which includes having had the employee review the UNAX briefing and signed the UNAX Recertification Certificate before the employee may be added or re-added to IDRS or receives access to taxpayer information and return information. The manager's signature on the UNAX Recertification form indicates that the employee has met all disciplinary actions for Recertification; and

fulfill any additional IDRS security responsibilities of the Front/First Line Manager stated elsewhere in the IRM.

coordinate with the USR to help ensure that IDRS security is effectively implemented for the unit/group;

ensure the USR is notified immediately, when an IDRS user no longer needs system access; and

provide the USR with written or electronic documentation for all requests to update the unit's MPAF or UCCP or to update an employee's ESRF.

IDRS Security Program Officer - the senior manager/executive (or designee) responsible for ensuring that the appropriate IDRS security posture is maintained.

IDRS Security Program Manager - the individual who coordinates day-to-day IDRS Security Program Management Office activity.

IDRS Security Program Analyst(s) - individuals who support the day-to-day IDRS Security Program Management Office activity.

establish policy and procedures for managing the IRS IDRS Security Program;

identify security activities that will help improve IDRS security;

perform activities that promote and maintain a continuing awareness of IDRS security;

disseminate information to IRS management, IDRS Security personnel, and IDRS users regarding changes in policy, procedures, and practices;

provide IDRS Security subject matter expert support to IRS management and staffs;

define the minimum content required for IDRS user security awareness training;

develop, review, update the required initial and annual refresher for Unit Security Representatives; and monitor compliance with the training requirement;

review the implementation of IDRS security at IRS campuses, computing centers, field offices, and other locations;

evaluate the implementation of IDRS security by IDRS Security Account Administrators, IDRS Security Analysts, Unit Security Representatives, and business unit management. Any oversight and evaluation activities performed by or for the IDRS Security Program Management Office will not substitute or replace any monitoring, training, or oversight activities required to be performed by IDRS Security Account Administrators, IDRS Security Analysts, Unit Security Representatives, or business unit management;

support Cybersecurity staffs in the review of requests to deviate from IDRS security policy stated in IRM 10.8.34, IDRS Security Controls; and

fulfill any additional IDRS security responsibilities of the IDRS Security Program Management Office stated elsewhere in the IRM.

serve as their business organization's point of contact with the IDRS Security Program Management Office;

serve as a liaison between the IDRS Security Program Management Office and their business organization in addressing IDRS security issues;

coordinate their business organization's response to IDRS security related issues;

coordinate their business organization's response to IORS security report certification related issues;

represent their business organization at IDRS Security related stakeholder meetings; and

fulfill any additional IDRS security responsibilities of the IDRS Security Business Division Point-Of-Contact stated elsewhere in the IRM.

ensure that IDRS Security Account Administrators and Computing Center IDRS Security Administrators are properly trained to perform the necessary IDRS Security related tasks;

monitor the activity of IDRS Security Account Administrators and Computing Center IDRS Security Administrators to ensure that activity is both effective and appropriate;

ensure that IDRS Security Account Administrators and Computing Center IDRS Security Administrators are not assigned duties that conflict with their security responsibilities. Any security matters that arise shall be given priority consideration over non-security duties or assignments; and

fulfill any additional IDRS security responsibilities of MITS EOPS-OSPMO Management stated elsewhere in the IRM.

ensure that Campus IDRS Security Analysts and Computing Center IDRS Security Analysts are properly trained to perform the necessary IDRS Security related tasks;

monitor the activity of Campus IDRS Security Analysts and Computing Center IDRS Security Analysts to ensure that activity is both effective and appropriate;

ensure that Campus IDRS Security Analysts and Computing Center IDRS Security Analysts are not assigned duties that conflict with their security responsibilities. Any security matters that arise shall be given priority consideration over non-security duties or assignments; and

fulfill any additional IDRS security responsibilities of MITS Cybersecurity Operations Management stated elsewhere in the IRM.

The IDRS Security Account Administrator performs the user and unit account administration tasks previously performed by the IDRS Security Officer.

The IDRS Security Analyst performs the policy support and oversight tasks previously performed by the IDRS Security Officer.

process, maintain (or be able to acquire), and explain how to complete and submit IDRS security related requests that are submitted via OL5081, Form 13230, and Form 9937;

add, modify, or delete employee access to IDRS; ensuring that user accounts are established in the proper unit, Office Identifier (OI), and organization code range;

review and update, at a minimum semi-annually, pertinent IDRS user information in the Master Register of Active IDRS Users report for completeness and accuracy. This includes Employee Name, SEID, Social Security Number (SSN), and background investigation status;

assign temporary passwords when adding users to IDRS, or as requested per an OL5081 request;

add or delete security command codes to user profiles;

ensure that employees designated as USRs or Alternate USRs have completed the required training before adding security command codes to their profile;

ensure, in coordination with the IDRS Security Program Management Office, that security command codes are removed from the profiles of USRs and Alternate USRs who have not completed the required training.

ensure that employees designated as primary USRs are non-bargaining employees with a "completed" background investigation status before adding security command codes to their profile;

coordinate with USRs and Front/First Line Managers to create new IDRS units that fall under the Front/First Line Managers’ jurisdictions; ensuring the Office Identifier (OI) and Organization code for the new unit are consistent with the unit number ranges established by in IRM 10.8.34. See IRM 10.8.34.6.2.1.6 # for more information on IDRS Organization Code Management;

develop or update the Maximum Profile Authorization File (MPAF) and the Unit Command Code Profile (UCCP) based on signed Form 9937 requests;

lock any unit that has active IDRS users, but does not have a designated USR or IORS Primary Report Reviewer; and

add or delete terminals to IDRS (in coordination with a Computing Center IDRS Security Administrator);

maintain a current record of Unit Security Representatives (USRs), Alternate USRs, Terminal Security Administrators (TSAs), managers, and the designated Primary Report Reviewers for all IDRS units in the IUUD;

for all persons listed, ensure the IUUD includes their name, SEID, address, and phone number; indicate when command code ASNPW is in the individual’s profile;

for all IDRS units listed, ensure the IUUD includes the USR, manager, IORS Primary Report Reviewers, and any Alternate USRs, TSAs; to the extent possible include a description of the unit and any alternate unit mailing address; and

assist managers and business organization security personnel in getting access to, using, and requesting updates to information in the IUUD.

review and certify IDRS security reports requiring IDRS Security Account Administrator action;

assist managers and business organization security personnel in getting access to IORS;

add or delete employee access to the IORS. Ensure employees designated as IORS Primary Report Reviewer are non-bargaining employees before adding command code REPTS to their profile (REPTS is added to a user's profile to allow IORS access); and

lock any unit that has active IDRS users, but where no IORS Primary Report Reviewer has been designated to review/certify IDRS security reports. The IDRS Security Account Administrator will also designate the primary USR for the unit as the IORS Primary Report Reviewer until the IDRS Security Account Administration staff is notified to the contrary.

assist USRs and Front/First Line Managers in addressing issues relating to the administration of IDRS user and unit accounts;

support the IDRS Security Program Management Office as reviewers of policy and procedural documents, SACS and IORS system changes, job aids, and training material related to the administration of IDRS user and unit accounts;

identify potential and actual IDRS security administration related problems, probable causes, and recommend corrective actions;

have access to all necessary security command codes pertaining to IDRS security;

have access to all security reports, forms, manuals, and handbooks pertaining to the administration of IDRS user and unit accounts; and

fulfill any additional IDRS security responsibilities of the IDRS Security Account Administrator stated elsewhere in the IRM.

add console operators, using command code TPFCN;

add/change host-to-host passwords using command code UPHPW;

change or display the list of command codes in a host profile using command code UPHST;

add/delete command codes from the prohibited command code tables for various employee role restrictions based on direction from the MITS, International Business Machines (IBM) Support Services Branch and the IDRS Security Program Management Office;

have access to all necessary security command codes pertaining to Computing Center IDRS Security Administration; and

fulfill any additional IDRS security responsibilities of the Computing Center IDRS Security Administrator stated elsewhere in the IRM.

Approve OL5081 add user requests for all users to be added to IDRS units covered by the USR; or for any action that requires an OL5081 request be submitted to an IDRS Security Account Administrator with the exception of a request for a temporary password for an existing IDRS user;

Update a current user's IDRS profile for the command codes that are available in the unit's MPAF as appropriate for the user to perform their assigned work; the USR shall add or delete command codes to and from user profiles, with the exception of security command codes, which shall be added or deleted by an IDRS Security Account Administrator;

With the concurrence of the unit manager, prepare, approve, and submit requests to the IDRS Security Account Administrator to add or delete command codes to/from the MPAF and the UCCP. USRs are authorized to approve Form 9937 in IORS for the unit manager if the USR has written or electronic documentation that supports the managers concurrence with the action taken. Documentation shall include the date, action to be taken, the IDRS unit number, and validation of the manager agreement such as an e-mail or a signed or initialed memo from the manager;

Ensure that user profiles are locked no later than the first day the employee is on leave if the employee is going to be on leave for 15 consecutive calendar days or more or goes into non-pay status with an expectation of returning to duty within 60 consecutive calendar days. Users going on leave are to be encouraged to lock their own profiles if the leave is not expected to exceed 45 days. For users who are going into non-pay status for less than 60 days, the USR shall lock the user's IDRS profile to prevent the user from being deleted from IDRS;

Delete employees from IDRS who either do not need access to IDRS for a period of 60 consecutive calendar days or longer or who do not need future access to IDRS. The employee shall be removed from IDRS on the first day they no longer need access to IDRS;

Unlock the profile of employees at the request of the employee or manager, if there is no cause to keep the profile locked;

Unlock IDRS terminals when requested to do so by a manager or known user and notify the Front/First Line Manager of any questionable activity that caused the workstation to be locked;

initiate the transfer of employee profiles into an IDRS unit under the USR's jurisdiction when requested to do so by a known manager. This task is the responsibility of the receiving unit's USR;

coordinate the creation of new IDRS units and the deletion of deactivated IDRS units with the IDRS Security Account Administrators;

ensure that IDRS users who meet the criteria for restricted roles, have the appropriate restrictions added to their profiles; and

modify IDRS terminal availability times to be consistent with the need to access IDRS. USRs shall set time off-the-air/on-the-air to coincide with access need, using command code UPTRM.

monitor each IDRS user's command code usage/non-usage, and coordinate with the Front/First Line Manager to delete command codes from the employee's profile that are not being used and are no longer needed;

timely review various IDRS security reports for the unit/group and take appropriate action to correct security weaknesses and breaches;

review the command code usage via the Monthly IDRS Security Profile Report, and in coordination with the Front/First Line Manager, submit requests to the IDRS Security Account Administrator to delete the command codes that were not used or no longer needed in the MPAF and UCCP;

review the profile of each IDRS user at least monthly to identify any unauthorized command codes;

ensure that command codes are not in the training mode unless the employee is in training, except for the specific case of User Support Specialists;

ensure that managers are aware of and monitor command code usage of employees with sensitive command code combinations in their profiles;

monitor compliance with sign-off requirements by reviewing the IDRS Security Profile Reports to determine if IDRS users have 15 or more automatic sign-offs for the month. IDRS users meeting this criteria shall be advised of the need to sign-off IDRS when IDRS is not needed and how to refresh their IDRS activity clock if the user needs to have continuous access to IDRS;

ensure, in coordination with the Front/First Line Manager, that any questionable activity or potential UNAX violations are timely reported to TIGTA;

review the Master Register of Active IDRS Users at least monthly to ensure that only authorized users are in their IDRS units and all information included in this report is correct and complete; and

review the IUUD at least monthly to ensure the accuracy of information for their IDRS unit(s); submit updates and corrections to the IDRS Security Account Administration staff.

ensure that management annually reviews the rules of behavior with IDRS users;

ensure that security procedures and instructions that relate to IDRS security are explained to the users prior to adding the user to IDRS;

perform periodic security awareness training (at least annually) for each IDRS user;

ensure that Front/First Line Managers are aware of their IDRS security responsibilities; and

train Terminal Security Administrators on when and how to unlock IDRS terminals and user profiles; and train Terminal Security Administrators to report any unusual circumstances to the USR.

USRs are to encourage all users to activate their IDRS password management capability.

USRs, who are authorized to provide temporary passwords to IDRS users, shall maintain documentation to support user requests.

If a USR provides a temporary password, the issuance of the temporary password shall be supported by an OL5081 request, e-mail, or written notification from a manager. At a minimum, the documentation shall include the following:

identify potential and actual IDRS security related problems, probable causes, and recommend corrective actions;

support the IDRS Security Program Management Office as reviewers of policy and procedural documents, SACS and IORS system changes, job aids, and training material related to IDRS security;

have access to all manuals and handbooks pertaining to IDRS security; and

fulfill any additional IDRS security responsibilities of the USR stated elsewhere in the IRM.

The designation shall be submitted to a IDRS Security Account Administrator on a Form 13230.

Before submission, the Form 13230 shall be coordinated with the primary USR(s) to ensure that the primary USR(s) is aware of who is being designated as an Alternate USR.

initial USR training prior to performing USR duties; and

shall complete USR refresher training at least annually.

IORS Primary Report Reviewer

IORS Secondary Report Reviewer

Prior to being added to IDRS, users shall sign the OL5081 rules of behavior statement acknowledging that they have read and understand the rules.

In order to maintain access privileges, IDRS users shall annually sign the OL5081 rules of behavior statement to recertify (re-acknowledge) they have read and understand the rules of behavior.