I. Is the FTI, sent to an offsite storage facility, Section protected from access by unauthorized individuals at 4.6 all times? (If the answer is no, offsite storage facility must be reviewed.) J. Are employees allowed to work at an alternate work Section site? Is the FTI, at the alternate work site, safeguarded 4.7 in accordance with Pub 1075? K. Does the agency retain ownership and control of Sections all hardware, software and equipment 4.7.1 receiving, storing, processing or transmitting FTI? If 9.4.13 the answer is no, is the agency using Virtual Desktop Infrastructure (VDI)? IV. Restricting Access (Publication 1075 section 5.0) IRC Section 6103(p)(4)(C) Objective: To determine whether access to FTI is adequately controlled and restricted. A. Is access to FTI restricted to only authorized Section personnel who have a need to know? 5.1 B. Is all FTI clearly labeled Tax Section “Federal Information” in accordance with Pub 1075 (paper and 5.1 electronic)? C. Has the agency initiated background investigations Section for all employees and contractors with access to FTI 5.1.1 in accordance with Pub 1075? Sections D. Is FTI commingled with information? 5.2 Can FTI within agency records be located and 5.2.1 separated easily? 5.3 E. Is FTI disclosed to personnel outside of the agency Section (contractors, other agencies, etc.)? Are the disclosures 5.3 tracked in accordance with Pub 1075? List personnel/offices (which FTI is disclosed). F. Are personnel following the agency policy for Section transmitting FTI via email? (policy in preliminary 9.4.3 section)
I. Is the FTI, sent to an offsite storage facility, protected from access by unauthorized individuals at all times? (If the answer is no, offsite storage facility must be reviewed.) Section 4.6 J. Are employees allowed to work at an alternate work site? Is the FTI, at the alternate work site, safeguarded in accordance with Pub 1075? Section 4.7 K. Does the agency retain ownership and control of all hardware, software and equipment receiving, storing, processing or transmitting FTI? If the answer is no, is the agency using Virtual Desktop Infrastructure (VDI)? Sections 4.7.1 9.4.13 IV. Restricting Access (Publication 1075 section 5.0) IRC Section 6103(p)(4)(C) Objective: To determine whether access to FTI is adequately controlled and restricted. A. Is access to FTI restricted to only authorized personnel who have a need to know? Section 5.1 B. Is all FTI clearly labeled “Federal Tax Information” in accordance with Pub 1075 (paper and electronic)? Section 5.1 C. Has the agency initiated background investigations for all employees and contractors with access to FTI in accordance with Pub 1075? Section 5.1.1 D. Is FTI commingled with information? Can FTI within agency records be located and separated easily? Sections 5.2 5.2.1 5.3 E. Is FTI disclosed to personnel outside of the agency (contractors, other agencies, etc.)? Are the disclosures tracked in accordance with Pub 1075? List personnel/offices (which FTI is disclosed). Section 5.3 F. Are personnel following the agency policy for transmitting FTI via email? (policy in preliminary section) Section 9.4.3