The Internal Revenue Service has a legal obligation to protect the confidentiality of tax returns and related information. The Service also has responsibility for protecting the entire Federal Tax Administration System, not just the individual components of the system—employees, computer equipment, tax returns, monies, property, facilities and records.

The Service has taken the position of providing reasonable protection commensurate with the character and value of the information or property involved. For example, processing center operations require a high degree of physical protection to meet minimum security needs, while a small post-of-duty may require fewer protective measures.

The Office of Management and Budget (OMB) has issued requirements for security of all Federal automated systems in OMB Circular A–130. OMB uses the term "Automated Information Systems Security Program" to refer to all security measures, including physical security safeguards. The Circular requires the head of each executive branch, department and agency to ensure that agency data (automated information) is adequately secured. This responsibility includes establishing physical, administrative and technical safeguards to protect personal, proprietary or other sensitive data whether it is national defense information or not.

This handbook includes the physical security requirements for the entire Federal Tax Administration System as administered within the IRS. This includes all Service facilities (National Office, posts of duty, processing centers, computing centers and other Service offices or space).

This handbook establishes security guidelines for the reasonable protection of tax information, property, and facilities against disclosure, loss, damage, or destruction without unnecessarily restricting or interfering with operations. It also provides instructions on the Service's Minimum Security Standards (MSS) and serves as a procedural and technical guide for security personnel. It includes optional methods for providing security under varying local conditions, provides for specific items requiring protection and identifies the various methods for protection.

The Chief, Agency Wide Shared Services, has overall responsibility for the Servicewide physical security program. The Director, Real Estate and Facilities Management, is responsible for planning, developing, monitoring, evaluating and managing the Servicewide physical security program.

Submission Processing Center Directors, Computing Center and Customer Service Center Directors are responsible for implementing an effective physical security program and for ensuring that security measures taken are reasonable, adequate and effective. Associate Directors Facilities Operations are responsible for assuring that Facilities Management Offices are in compliance with Service policy and for providing guidance, oversight and assistance to these offices on the physical security program. Facilities Management Offices are responsible for implementing, evaluating and managing the physical security program and for providing guidance, oversight and assistance to client sites.

The Businesses are responsible for implementing an effective physical security program within their functional areas; for ensuring that security measures taken are reasonable, adequate and effective; and, for notifying the Real Estate and Facilities Management of any proposed protective changes to items listed in Exhibit 1.16.15–2.

To meet the obligation to provide necessary security protection to the Tax Administration System, the Service has determined that Service officials and managers are responsible for ensuring the continued operation of the Federal Tax Administration System by taking all responsible actions to prevent the loss of life and property, the disruption of services and functions and the unauthorized disclosure of documents and information.

Managers are responsible for providing reasonable security for all information, documents, and property with which they are entrusted, for complying with all minimum security standards contained in 1.4.6, Managers Security Handbook, all local security requirements, and for reporting any violations to the respective Security function or other individuals who have security responsibilities. Managers must ensure that the physical security measures required for protecting information, property, and life are applied within their area of supervision and that those measures meet the established minimum security standards.

All employees are responsible for providing reasonable security for all information, documents and property with which they are entrusted, for complying with established security procedures, all local security requirements, and for reporting any violations to their manager or to their respective Security functions or other individuals who have security responsibilities.

Basic security concepts have been adopted by the Service and applied to the various activities within the Service. These concepts provide management with the flexibility to provide the degree of security or protection commensurate with the degree of sensitivity of each particular activity.

Evaluation of the risk is the first step in determining the degree of security required for a particular office. Security measures should be relative to the type of risks to which the facility and its contents are exposed, the probability that these risks will occur, and the impact that an occurrence would have on the organization. The Service recognizes the value of this approach and has developed a automated risk assessment process, for use throughout the Service.

The next step is to review existing protective measures to determine their effectiveness. Security provided the facility as a whole and that provided by other tenants (if applicable) will affect the program developed for each office. Steps must be taken to maintain and evaluate protective measures implemented.

The risk assessment process is to be used by the security personnel to develop a tailored physical protective system for the facility and associated annexes. The process provides an objective tool to identify and justify security requirements for IRS assets and systems that can be substantiated as minimum requirements to support IRS security policy. It allows the security analyst to independently assess the security situation at a specific facility, annex, or group of facilities and, based on this assessment, determine security criteria to protect the site(s).

The basic principle of security within IRS, or anywhere, is "limit access to assets based upon need." When protecting information, for example, access to documents should be limited to those persons with a need to know the information. When the asset to be protected is a room, an area, a building, a computer, or other such property, access to that property should be restricted to those persons who, due to their official duties and/or responsibilities, have a need for such access.

Whether a person needs to access an asset will depend upon whether that access is necessary to enable the person to perform his/her assigned duties and responsibilities. Management is responsible for determining such a need and for subsequently deciding to grant or deny access. Once this determination has been made, management should consult Security personnel for assistance in selecting the appropriate method of achieving the desired control.

Most of the methods of protection are designed for protection after normal duty hours or at any time the assets to be protected are not under the personal custody of authorized Service employees.

Because any single safeguard is often insufficient protection for any asset, the concept of layering of safeguards was developed to provide security-in-depth. To facilitate understanding of security-in-depth, the following functions of safeguards are presented.

Exhibit 1.16.11–1 shows the functions generally performed by certain physical security devices/techniques. No attempt is made to address the effectiveness of each, as this depends on the quality of the device selected. Also most of the techniques/devices shown are primarily for use against any potential perpetrator (employee or outsider) during unoccupied times. Conversely, ID media, electronic access control systems, sign in and other audit trail procedures and task separation techniques are generally for use during occupied times to protect against "insiders. "

A security program is enhanced when all managers and all employees are aware of security requirements including the reasons for each of the security requirements they are expected to follow or enforce. Each manager must know the general security requirements as well as the specific security measures which apply to his/her particular area of responsibility. The key to an awareness program is to show how the requirements relate to the work in which an employee is involved. For example, awareness efforts directed toward computer room employees should relate to security requirements in a computer room, while those efforts directed toward a tax auditor should relate to protecting the privacy of the taxpayer and the sensitivity to the tax return and return information.

To ensure that all employees and managers are made aware of security requirements each security program will include an awareness program.