microfilms, photo impressions, or other formats (including tape reformatting or The Vendor or agency-shared computer reproduction or conversion to punch cards, facility is also subject to IRS safeguard digital images or hard copy printout) will be reviews. performed pursuant to one of the following procedures: The above rules also apply to Note: releasing electronic media to a private Agency Owned and Operated Facility Vendor or other agency office even if the purpose is merely to erase the old media for reuse. Processing under this method will take place in a manner that will protect the confidentiality of the information on the Agencies utilizing consolidated data electronic media. All safeguards outlined in centers must implement appropriate this publication also must be followed and controls to ensure the protection of FTI, will be subject to IRS safeguard reviews. including a service agreement (SLA) between the agency authorized to receive FTI and the consolidated data center. The Vendor or Agency Shared Facility – SLA should cover the following: Consolidated Data Centers The consolidated data center is Recipients of FTI are allowed to use a considered to be a of the “Vendor” shared facility but only in a manner that agency receiving FTI. The agency does not access to FTI by employees, receiving FTI whether it is a state – agents, representatives or Vendors of revenue, workforce, child support other agencies using the shared facility. enforcement or human services agency is responsible for ensuring – the protection of all FTI received. Note: For purposes of applying sections However, as the for the “Vendor” 6103(l), (m) and (n), the term “agent” agency receiving FTI, the includes Vendors. Access restrictions consolidated data center shares pursuant to the IRC authority by which the responsibility for safeguarding FTI FTI is received continue to apply. For as well. example, since human services agencies administering benefit eligibility programs may not allow Vendor access to any FTI Provide written notification to the received, their data within the consolidated data center consolidated data center may not be management that they are bound by accessed by any Vendor of the data the provisions of Publication 1075, center. relative to protecting all federal tax information within their possession or control. The SLA should also The requirements in Exhibit 7, Contract include details concerning the Language for General Services, must be consolidated data center’s included in the Contract in accordance responsibilities during a safeguard with IRC Section 6103(n).
microfilms, photo impressions, or other formats (including tape reformatting or reproduction or conversion to punch cards, digital images or hard copy printout) will be performed pursuant to one of the following procedures: Agency Owned and Operated Facility Processing under this method will take place in a manner that will protect the confidentiality of the information on the electronic media. All safeguards outlined in this publication also must be followed and will be subject to IRS safeguard reviews. Vendor or Agency Shared Facility – Consolidated Data Centers Recipients of FTI are allowed to use a shared facility but only in a manner that does not access to FTI by employees, agents, representatives or Vendors of other agencies using the shared facility. Note: For purposes of applying sections 6103(l), (m) and (n), the term “agent” includes Vendors. Access restrictions pursuant to the IRC authority by which the FTI is received continue to apply. For example, since human services agencies administering benefit eligibility programs may not allow Vendor access to any FTI received, their data within the consolidated data center may not be accessed by any Vendor of the data center. The requirements in Exhibit 7, Contract Language for General Services, must be included in the Contract in accordance with IRC Section 6103(n). The Vendor or agency-shared computer facility is also subject to IRS safeguard reviews. Note: The above rules also apply to releasing electronic media to a private Vendor or other agency office even if the purpose is merely to erase the old media for reuse. Agencies utilizing consolidated data centers must implement appropriate controls to ensure the protection of FTI, including a service agreement (SLA) between the agency authorized to receive FTI and the consolidated data center. The SLA should cover the following: The consolidated data center is considered to be a “Vendor” of the agency receiving FTI. The agency receiving FTI – whether it is a state revenue, workforce, child support enforcement or human services agency – is responsible for ensuring the protection of all FTI received. However, as the “Vendor” for the agency receiving FTI, the consolidated data center shares responsibility for safeguarding FTI as well. Provide written notification to the consolidated data center management that they are bound by the provisions of Publication 1075, relative to protecting all federal tax information within their possession or control. The SLA should also include details concerning the consolidated data center’s responsibilities during a safeguard
SIMM-45A-IVV-SOW_2017-0808-1.docx