IRS Watchdog: Systems Not Effective to Identify, Protect, and Detect 3 Critical Vulnerabilities

The Treasury Inspector General for Tax Administration rated the IRS cybersecurity program “not effective” for fiscal year 2026, citing weaknesses that could leave taxpayer information exposed. TIGTA identified gaps in identify, protect, and detect.

The agency received an effective rating in three other functions: govern, respond, and recover. TIGTA dated its cybersecurity review September 15, 2026.

The watchdog warned that unresolved weaknesses could put taxpayer data at risk. It described the potential exposure this way:

“If the IRS does not take steps to mitigate these deficiencies, taxpayer data could be vulnerable to inappropriate and undetected use, modification, or disclosure.”

The assessment found missed deadlines on nearly all sampled systems. Six of seven, or 86%, had critical vulnerabilities that the IRS did not remediate within its required 30 days.

Six of seven sampled systems missed the 30-day repair window

The missed fixes were one part of the watchdog’s findings on identifying and managing security risks. The IRS also could not provide an inventory of its critical software, leaving a basic accounting gap in its security controls.

TIGTA linked weaknesses in continuous monitoring to an organizational change. The agency had not updated its monitoring strategy after a reorganization.

“The IRS was unable to maintain an organization-wide strategy,” TIGTA said.

The review did not describe that as a standalone software problem. It connected the monitoring weakness to the broader challenge of tracking security risks across the agency.

Accounts and detection tools remain outside key safeguards

The review also found 841 privileged service accounts across 313 systems outside the IRS privileged account management system. Those accounts had not been brought under the agency’s central safeguards for privileged access.

Cloud security checks remained incomplete. The IRS had finished only about one-third of the required assessments of security and privacy controls across its cloud systems.

Detection coverage had gaps, too. Endpoint detection and response tools were missing from 29% of the seven high-value asset systems TIGTA reviewed.

The figures point to weaknesses in different parts of the agency’s security work: tracking software and vulnerabilities, controlling powerful accounts, assessing cloud protections, and monitoring systems for threats. The watchdog warned that taxpayer data could face inappropriate or undetected use, modification or disclosure if the IRS did not address the deficiencies.

The annual review rated performance but made no formal recommendations

TIGTA issued the findings through its annual FISMA review, which assesses the agency’s cybersecurity performance rather than serving as a corrective-action audit. The report therefore made no formal recommendations.

That left the findings with the IRS to address through its own security work. TIGTA’s assessment covered both the shortcomings behind the overall rating and the areas it judged effective: govern, respond, and recover.

The agency has also moved its target for completing data-at-rest encryption to fiscal year 2027. Its earlier goal had been the end of fiscal year 2024.

Separate reviews also flagged building access and missing equipment

A separate TIGTA report released September 25, 2026, found that employees on administrative leave could still access IRS buildings. The finding concerned facility access, a different control area from the cybersecurity review’s systems and data safeguards.

Another TIGTA review, dated August 24, 2026, focused on equipment assigned to former employees. It found 594 IT assets remained unaccounted for as of April 2026, with a total value of $274,822.

Together, the reviews described gaps involving digital systems, physical access and government equipment. The encryption target now sits in fiscal year 2027, after the agency missed its earlier end-of-fiscal-year-2024 goal.