1901 Access Control Policy

Senior management, management, and all organization entities are required to coordinate and implement necessary controls for providing authorized access and preventing unauthorized access to IT resources and information systems on the basis of business and security requirements.

Periodic reviews of this policy shall be performed and documented at least within every three years, or when there is a significant change.

Periodic review of access control procedures shall be performed at least annually.

Manage through a life cycle consisting of establishing, activating and modifying accounts; periodically reviewing accounts; and disabling, removing or terminating information system accounts, defined as individual, group, system and role-based accounts defined as administrator, application, guest and temporary.

Users who require access to FTI data shall be assigned to agency specific account types with access to Federal Tax Information (FTI) to support agency missions/business functions.

Conditions for user assignment to group membership shall be established and maintained.

Document within applicable system security plans a description of authorized system users criteria group and role accounts’ membership with access privileges, and other applicable account attributes.

Require System Administrators, Account Managers, managers and supervisors to adhere to the following requirements regarding creating, enabling, modifying, disabling or removing accounts:

Users must obtain appropriate approvals for requests to establish accounts, to include, but not limited to, supervisor approval, management approval, and agency approval.

Agency IT administrators shall establish, activate, modify, disable, and remove accounts in accordance with documented account management procedures.

Explicit authorization and monitoring of the use of temporary accounts. The use of guest/anonymous accounts is prohibited.

Agency users are responsible for immediately notifying account managers when:

The agency explicitly authorizes access to information systems that receive, process, store, or transmit FTI based on a valid access authorization, need-to-know permission, and under the authority to re-disclose FTI under the provisions of IRC 6103.

Accounts shall be reviewed periodically or at least annually to ensure compliance with account management requirements. Shared/Group account credentials shall be established or reissued in accordance with established account management procedures.

Information Systems that host, store and transmit FTI shall be automatically disabled and de-provisioned after 120 days of inactivity.

The agency shall employ formal registration and de-registration procedures for granting and revoking access to all information systems and services, in accordance with applicable policy.

Established role-based access controls (RBAC) for employee user accounts requiring access to information systems and data that contain FTI upon authorization shall be employed exercised.

Explicitly approved authorizations for controlling the flow of FTI information within the system and between interconnected systems shall be maintained in accordance with applicable policy and the technical safeguards in place to protect FTI.

The agency separates duties of individuals as necessary, to prevent malevolent activity without collusion.

Documented separation of duties shall be maintained.

Implement separation of duties through assigned information system access authorizations shall be employed and maintained.

The agency continuously utilizes the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Access to FTI must be explicitly authorized prior to individuals gaining access to FTI.

Access to FTI by contractors is prohibit, unless authorized by the IRS Office of Safeguards, as identified in IRS Publication 1075.

Users of information system accounts, roles, with access to FTI, are required to use non- privileged accounts or roles when accessing non-security functions.

Role-based account assignment and usage is required to restrict user access, privilege accounts to privileges necessary to accomplished assigned tasks.

Automatic lockout mechanisms for information systems that host, store and transmit FTI data when the maximum number of unsuccessful attempts are exceeded is enforced.

Repeated access attempts by locking out the user ID is limited to no more than three consecutive unsuccessful attempts during a 120 minute period.

Automatically lock the account for a period of at least 15 minutes.

Agency information systems display an approved system use notification banner before granting access to the system. This banner provides privacy and security notices consistent with regulations, standards, and policies. The system use notification shall state:

The notification banner remains on the screen of agency information systems until users take explicit actions to log on to or further access the information system.

For publicly accessible systems:

Further access to the information system is prohibited by the initiation of a session lock after 15 minutes of inactivity or upon receiving a request from a user.

The session lock is maintained until the user reestablishes access using established identification and authentication methods.

DHS shall enforce the automatic termination of user sessions after 30 minutes of inactivity.

The agency does not permit actions within agency information systems without proper identification and authentication. Sensitive data disclosure is prohibited to individuals on the information system without identification and authorization.

Documentation and rationale supporting the decision to deny actions on information systems without identification and authentication is documented and maintained in the agency’s SSRs.

Remote access to agency information systems is authorized only through the use of established VPN. If remote transmission of sensitive data is required, it shall only be transferred through the use of VPN, and shall utilize multi-factor authentication.

FTI access offshores (outside of the United States territories, embassies or military installations) is prohibited by agency employees, agents, representatives, or contractors.

Sensitive data may not be received, processed, stored, transmitted, or disposed of by information technology (IT) systems located offshore (outside of the United States territories, embassies or military installations).

Users requiring remote access have been assigned VPN accounts which facilitate remote access to agency information systems. VPN traffic is routed through a limited number of managed network access points, such that authorized personnel shall only have access to the information systems or services required to perform their job functions.

Privileged commands and access to security-relevant information via remote access must be explicitly approved by management and documented prior to performing those functions. Authorization shall only be granted under compelling operational needs.

DHS capabilities for wireless access are limited to only establish connections to guest networks only.

Access to agency internal information systems and data via wireless is prohibited.

Access to sensitive data via wireless is prohibited.

Only agency provided mobile devices are authorized for connection and use within the agency’s network/information systems.

Mobile devices authorized for use within the agency’s network/information system must utilize encryption in order to protect the confidentiality and integrity of information on authorized mobile devices.

After 10 consecutive, unsuccessful device logon attempts, mobile devices shall be purged/wiped. (Laptop computers are excluded from this requirement.)

Unless approved by the IRS Office of Safeguards, Social Security Administration, or other applicable governing entities, the following are strictly prohibited:

The sharing/re-disclosure of FTI is restricted only to personnel authorized in IRC 6103, and as approved by the IRS Office of Safeguards.

The sharing/re-disclosure of other sensitive data is restricted to personnel authorized in contractual agreements and approved by that governing entity.

Only agency authorized personnel shall post information onto an organizational information system that is publicly accessible. Agency/organizational units shall maintain listings of authorized personnel.

All personnel identified in the authorized list shall receive training to ensure that publicly accessible information does not contain sensitive data.

Content that shall be posted to publicly accessible information to ensure it contains no sensitive data information prior to posting.

If publicly accessible information is found to have sensitive data information, authorized personnel shall remove it immediately.