The Treasury Inspector General for Tax Administration rated the IRS information security program ineffective for the second consecutive year in a report dated September 15, 2026. The watchdog found that six of seven sampled systems had critical vulnerabilities that were not fixed within the required 30-day window. Additionally, 841 privileged service accounts across 313 systems were operating outside the agency's management system. The report noted that encryption of stored data remains unfinished, with the target date moved to fiscal 2027, and endpoint detection software is missing from 29 percent of high-value systems. Despite these gaps, the IRS received credit for improvements in multifactor authentication and audit log collection.
Read the full story at thefinancialwire.com.
Photo: Schäferle / Pixabay
