- TIGTA rated the IRS ‘identify,’ ‘protect’ and ‘detect’ functions not effective under FISMA metrics
- Six of seven sampled IRS systems had critical vulnerabilities left unremediated past 30 days
- IRS CIO Kaschit Pandya disputed TIGTA’s maturity ratings for its continuous monitoring program
The Treasury Inspector General for Tax Administration, or TIGTA, has rated the Internal Revenue Service’s cybersecurity program not effective for fiscal year 2026, citing shortfalls in three of six core security functions.
TIGTA’s annual audit report, released last week, measured the program against the Cybersecurity Framework 2.0 from the National Institute of Standards and Technology. The evaluation covers the safeguards protecting taxpayers’ personal and financial data at an agency that collected nearly $5.3 trillion in gross taxes and processed 271.4 million tax returns and other forms in fiscal 2025.
Visibility gaps like those TIGTA found at the IRS are a challenge across federal civilian agencies. See how leaders are addressing them at the Potomac Officers Club’s 2026 FedCiv Summit on Oct. 29. The day includes a panel on observability as the foundation for federal shared services and keynotes from DOE CIO Dawn Zimmer and DOL CIO Mangala Kuppa. Register today to secure your spot!
What Did TIGTA’s FISMA Evaluation of the IRS Find?
The report found that the IRS did not reach an effective rating in the ‘identify,’ ‘protect’ and ‘detect’ function areas. The Federal Information Security Modernization Act, or FISMA, reporting metrics define an effective rating as Level 4, Managed and Measurable, or above.
Protect posted a core maturity score of 2.6, and auditors found that 86 percent of sampled information systems had critical vulnerabilities left unremediated past the required 30-day window. Identify averaged 3.0 on core metrics, with open program-level plans of action and milestones tied to the agency’s lack of tools to detect unauthorized hardware and software on its network. Detect also scored 3.0 because the IRS did not maintain an updated organization-wide continuous monitoring strategy after its reorganization.
The IRS earned effective ratings in the ‘govern,’ ‘respond’ and ‘recover’ function areas, each with a core score of 4.0. Its incident handling capabilities received the top rating of Level 5, Optimized, for using dynamic network reconfiguration to isolate threats and misdirect attackers.
Which IRS Cybersecurity Gaps Did the Report Identify?
The IRS could not provide an inventory of its critical software, and two of seven high-value asset systems lacked endpoint detection and response tools. The agency also managed 841 privileged service accounts across 313 systems outside its privileged account management system.
Procurement and acquisition timelines have pushed the agency’s data-at-rest encryption target from fiscal 2024 to fiscal 2027. Less than 1 percent of IRS assets operate in an Internet Protocol version 6-only environment, short of the Office of Management and Budget’s 80 percent target for the end of fiscal 2025. The Treasury Department chief information officer directed the IRS to delay that transition to avoid disrupting public services.
What Cybersecurity Progress Has the IRS Made?
The IRS reorganized its IT division, released a new cybersecurity strategic plan in January 2026 and established a risk executive function to analyze risk agencywide. As of March, 314 of 336 systems, or 93 percent, met phishing-resistant multifactor authentication requirements, and the agency reported a 95 percent enterprise configuration compliance rate.
Audit logging also improved: 16 of 413 systems holding personally identifiable or federal tax information were not sending logs to the agency’s security information and event management tool as of July, down from 53 of 389 a year earlier.
TIGTA also cited open Government Accountability Office findings that the IRS’s artificial intelligence inventory omitted use cases and did not always contain quality information.
How Did IRS CIO Kaschit Pandya Respond to the Findings?
In an Aug. 31 response, IRS Chief Information Officer Kaschit Pandya disputed TIGTA’s ratings for two ‘detect’ metrics covering the agency’s continuous monitoring strategy and ongoing system assessments. Pandya said the IT reorganization did not materially alter the strategy and that the IRS “remains committed to strengthening its cybersecurity program.”
TIGTA said the strategy, last updated in March 2025, still references roles and software tools no longer in use. The watchdog also said the IRS has not completed assessments of two-thirds of the security and privacy controls in NIST Special Publication 800-53 Rev. 5. TIGTA made no recommendations, consistent with its annual FISMA practice, and forwarded the report to the Treasury Office of Inspector General for consolidation.
