IRS Cybersecurity Rated “Not Effective” for Fiscal Year 2026

The Internal Revenue Service (IRS) received a “not effective” rating for its cybersecurity program in fiscal year 2026. This assessment comes from the Treasury Inspector General for Tax Administration (TIGTA), which identified significant weaknesses in how the agency identifies, protects, and detects critical vulnerabilities. While the IRS performed well in governing, responding to, and recovering from security incidents, the core functions of maintaining security were found lacking. These findings raise concerns about the safety of taxpayer information.

Gaps in Identifying and Protecting Data

A major issue highlighted by TIGTA is the IRS’s struggle to identify and manage security risks effectively. The review found that six out of seven sampled systems, or 86%, had critical vulnerabilities that were not fixed within the required 30-day window. This failure to address known issues promptly leaves taxpayer data exposed to potential misuse, modification, or disclosure.

Furthermore, the IRS could not provide a complete inventory of its critical software. This lack of a basic accounting for its software assets represents a significant gap in its security controls. The agency also faced challenges with continuous monitoring, as its strategy had not been updated following an organizational change. This means the IRS was unable to maintain a consistent, agency-wide approach to tracking security risks.

Weaknesses in Detection and Safeguards

Beyond identification and protection, the IRS also showed weaknesses in its detection capabilities and the safeguards it has in place. The review discovered 841 privileged service accounts across 313 systems that were not managed under the IRS’s central safeguards for privileged access. These powerful accounts, if compromised, could grant unauthorized access to sensitive systems and data.

Cloud security assessments were also incomplete, with the IRS having finished only about one-third of the required security and privacy control evaluations for its cloud systems. Additionally, endpoint detection and response tools were missing from 29% of the seven high-value asset systems examined. These gaps in detection tools mean that threats might go unnoticed, increasing the risk of data breaches.

Broader Security Concerns

These cybersecurity findings are part of a larger picture of security concerns at the IRS. A separate TIGTA report from September 25, 2026, noted that employees on administrative leave could still access IRS buildings, indicating issues with physical access controls. Another review dated August 24, 2026, found that 594 IT assets assigned to former employees were unaccounted for, with a total value of $274,822.

Adding to these concerns, the IRS has also pushed back its target for completing data-at-rest encryption to fiscal year 2027. This goal was originally set for the end of fiscal year 2024. The combination of these issues across digital systems, physical access, and equipment management suggests a need for a more robust and coordinated approach to security across the agency.

Frequently Asked Questions