Accessibility Skip to Top Navigation Skip to Main Content Home  |  Change Text Size  |  Contact IRS  |  About IRS  |  Site Map  |  Español  |  Help  

Part 4. Examining Process

Chapter 3. Midwest Automated Compliance System (MACS)

Section 3. MACS Security

4.3.3  MACS Security

4.3.3.1  (11-13-2008)
Overview

  1. This section discusses MACS security and procedures for controlling access.

4.3.3.2  (05-18-1999)
C2 Security

  1. C2 Security is a government wide requirement for all computer systems containing sensitive information. C2 requirements are a combination of physical and logical security that includes having a controlled environment, controlled access and an audit trail.

  2. Annual security awareness training is required for all employees.

4.3.3.2.1  (05-18-1999)
Controlled Environment

  1. MACS computers should be located in PSP/Compliance Services area or an IS computer room. Any additional PC terminals must be hard-wired to the MACS computer. Remote access to MACS via modem, TCS, LAN or any other means is not permitted. If the system is not in a secured computer room, the computer should be placed in a locked cabinet.

  2. The disk drives on the computer must be set up in a secure mode so a floppy disk cannot be used to boot the computer and circumvent the password protection system.

4.3.3.2.1.1  (05-18-1999)
System Control Point (SCP)/CONFIGURATION MANAGEMENT

  1. Transfer of all electronic MACS data must be made via the System Control Point (SCP)/Configuration Management. The SCP is usually located within the IS function.

  2. Transmittal forms must be used whenever shipping MACS data or programs. IS uses Form 3220, Mass Storage Media Transmittal. Non-IS functions may use Form 3210, Document Transmittal.

4.3.3.2.2  (05-18-1999)
Controlled Access

  1. To obtain access to the MACS computer, each user and system administrator must complete Form 5081, Information System User Registration/Change Request and acknowledge that they understand the security rules located on the reverse side of the form.

  2. A Personnel function employee or someone authorized by Personnel to review TIMIS personnel records should complete the background investigation section of Form 5081.

  3. All Form 5081 approvals must be secured and in the possession of the system administrator before the user is allowed access to the system. Requests for access by persons outside Compliance/Compliance Services require approval by the PSP Territory Manager/Compliances Services Exam Operation. Temporary access may be granted to manipulate subsets, extracts and third-party data.

    If the access request is from: Then after approval Form 5081 must be
    A Compliance employee Routed to the PSP Area Support Manager
    A Compliance Services employee Routed to the Compliance Services Exam Operation
    An employee from a function other than Compliance/Compliance Services Routed to the user’s Field Territory Manager. Form 5081 will then be forwarded to the PSP Territory Manager/Complaince Services Exam Operation Manager for approval and routed to the Manager PSP Area Support/ Compliance Services.

4.3.3.2.2.1  (05-18-1999)
Password Needed To Use System

  1. Every user must have a unique login and password. The password must be changed every six months or anytime the user believes the password may have been compromised. The password will not be shared. See IRM 25.10, Password Standards for information regarding protection of passwords.

4.3.3.2.3  (05-18-1999)
Audit Trails

  1. C2 security requires the system be able to record and protect from destruction or modification a record of selected activities. The record includes:

    • Control number

    • Time and date of activity

    • Identification of the user

    • Source of the input (i.e., terminal ID)

    • Name of taxpayer

    • Type of access

    • Print indicator

    • Key indicator and TIN (to link related returns)

    • Opening of files

    • Initiation of programs

    • Addition and/or deletion of data

  2. MACS audit trails record the activities of computer users, system administrators and security personnel. Further, the system administrator is able to selectively review the activities of any one or more users.

  3. MACS audit trails are generated for all user activity. Audit trail records are viewed and backed up via a menu made accessible only to the system administrator and security officer. Audit trails should be backed up weekly by the system administrator unless extenuating circumstances such as vacation, illness, system failure, etc., do not permit. In those circumstances, the system administrator should note the reason in the system log. They should be reviewed on a regular basis, but not less than monthly, by the security officer and the system administrator, and a report should be provided to the PSP Area Support Manager/Compliance Services Exam Operation Program Manager.

  4. The Control Number Log book is an index and quick reference guide to the MACS paper trail. The log book is used when comparing the MACS system trail to the paper trail. See IRM Section 4.3.4.4, Control Numbers of this handbook.


More Internal Revenue Manual