On September 15, 2026, the Treasury Inspector General for Tax Administration rated the IRS cybersecurity program not effective for fiscal year 2026. Report 2026-200-053 says three of six functions fell short: Identify, Protect, and Detect. Govern, Respond, and Recover were rated effective. The finding is an audit of the IRS under the Federal Information Security Modernization Act. It does not create a new rule for CPA firms. The taxpayer data on your own systems is still your responsibility, under the safeguarding duties you already have.
Last verified: September 29, 2026. Primary source: TIGTA Report 2026-200-053, The IRS's Cybersecurity Program Was Not Effective for Fiscal Year 2026 (September 15, 2026).
What "not effective" means in this report
TIGTA reviews the IRS each year under FISMA. A function is effective when it reaches maturity Level 4, "Managed and Measurable," or above. For fiscal 2026, TIGTA tested 20 core metrics, 5 supplemental metrics, and 10 editorial metrics. The overall program was not effective because Identify, Protect, and Detect missed that bar. The report also says the IRS improved on some ratings from the prior year, and that 72 percent of the metrics landed at Level 3 or higher. This is a maturity scorecard with specific gaps. It is not a finding that every IRS system is unsecured.
TIGTA made no new recommendations in this cycle. It reports the level the IRS reached. In its response, IRS management disagreed with the maturity scores for two Detect metrics, 26 and 28, both about information-security continuous monitoring. TIGTA's appendix explains why it kept those scores: the organization-wide monitoring strategy still reflected a March 2025 update, including roles and tools that did not survive the IRS reorganization, and the IRS expects to finish assessing cloud-system controls in FISMA fiscal year 2027.
TIGTA's own warning, from the highlights: if the IRS does not mitigate the deficiencies, taxpayer data could be vulnerable to inappropriate and undetected use, modification, or disclosure.
The three areas rated not effective
| Function | Core maturity | What TIGTA weighed | Why it missed Level 4 |
|---|---|---|---|
| Identify | 3.0 (supplemental 2.0) | Risk and asset management | Inventory gaps, including systems that hold personally identifiable information and federal tax information |
| Protect | 2.6 | Configuration, access, data protection, training | Critical vulnerabilities left open on sampled systems; flaw remediation scored at Level 2 |
| Detect | 3.0 (supplemental 4.0) | Continuous monitoring | Organization-wide monitoring strategy not updated after the reorganization |
Identify
Identify is whether the agency knows what systems it has and what data sits on them. The core average was 3.0 and the supplemental average was 2.0, so the function was not effective. An open recommendation from March 2025 still stands: the IRS should validate, every year, that systems holding personally identifiable information and federal tax information are designated consistently across its inventories. A March 2026 Government Accountability Office report, cited by TIGTA, found gaps in the IRS artificial-intelligence inventory. TIGTA also notes the IRS lacks a tool that detects unauthorized software on the network. The January 2026 IRS cybersecurity strategic plan aims to put that control in place by June 2027.
Protect
Protect covers configuration, identity and access, data protection and privacy, and security training. The core average was 2.6, the lowest of the six functions. On flaw remediation, TIGTA scored the IRS at Level 2, "Defined": policies exist, and the IRS could scan the seven sampled systems, but 86 percent of those systems (6 of 7) still had critical vulnerabilities open past the required 30 days. The IRS also did not provide an inventory of critical software, so TIGTA could not tell whether all of it was on a vendor-supported version. The same section records a counterweight: a 95 percent enterprise configuration-compliance rate. The weakness TIGTA emphasizes is time. Critical flaws, including known exploited vulnerabilities, were not fixed inside the window the IRS's own policy sets.
Security training is part of this function and was also at Level 2. TIGTA says the fiscal 2026 skills assessment was started in June 2026 and still needed to be finished.
Detect
Detect is continuous monitoring: can the agency see an incident while it is happening. The core average was 3.0, which TIGTA treated as not effective, even though the supplemental average was 4.0. After the IT reorganization, the IRS could not keep an updated organization-wide monitoring strategy. The plan TIGTA reviewed was last updated in March 2025 and named roles and software no longer in use. The IRS told TIGTA it plans to update that strategy in FISMA fiscal year 2027. These are the two metrics IRS management disputed. TIGTA left the rating in place.
What this changes for a CPA firm
The report audits the IRS. Circular 230, the preparer penalty statutes, and the FTC Safeguards Rule are unchanged.
The useful reading is about the data, not the agency's grade. Federal tax information, in IRS Publication 1075, is return or return information received from the IRS, or from a secondary source, under Internal Revenue Code §6103. Publication 1075 is the safeguard rulebook for agencies and for contractors that receive that information. It is the right publication when a firm actually receives FTI under an agency contract. It is the wrong publication to treat as a new badge every CPA must earn because TIGTA scored the IRS.
The data a typical firm already holds — organizers, wage statements, prior-year returns, identity documents — is taxpayer data the firm collected. The duties on that data are the ones preparers already carry:
- IRS Publication 4557, Safeguarding Taxpayer Data, is the baseline.
- IRS Publication 5708 is the template for the Written Information Security Plan the FTC Safeguards Rule requires. The practical version is in WISP requirements for tax firms.
- Internal Revenue Code §7216 makes knowing or reckless unauthorized disclosure of tax return information a crime, and §6713 is the civil penalty. See Section 7216 explained.
Those rules apply on the firm's own systems, whatever maturity score the IRS receives. The Identify finding is a fair prompt: a firm should be able to name every system that holds a client file, including email, a personal messaging app, a desktop, and the portal. A WISP that omits one of those is describing a different firm.
A second September report, on identity-theft cases
Later the same month, TIGTA published a separate audit, The Process to Resolve Identity Theft Cases Is Long, Costly, and Frustrating for Taxpayers. According to the Journal of Accountancy summary (September 25, 2026), taxpayers waited an average of nearly 20 months for identity-theft case resolution across fiscal years 2023 through 2025, against an IRS goal of 120 days. In a review of 114 cases closed in fiscal 2023, average processing was 655 days, and 4 cases met the 120-day goal. TIGTA estimated about $124.2 million in interest on delayed refunds for cases closed from fiscal 2023 through fiscal 2025, and nearly 316,000 identity-theft cases still open at the end of September 2025. Those figures match the TIGTA report itself, Report 2026-100-050, issued September 21, 2026.
That audit is about how long the IRS takes to work a victim's case. It is not a cybersecurity maturity score. For a firm, the operational point is the phone calls those delays produce. Helping a client through them still means the documents move on a channel you control, which is covered in how to send tax documents securely.
What to do this month
- Read Report 2026-200-053 as an audit of the IRS, then open your WISP. Map every place a client file can sit: portal, email, desktop, shared drive, personal phone, tax software.
- Put public email and consumer chat on the prohibited list for tax return information. Why email is not secure for tax documents is the short version.
- Match access to the matter. Each person who can open a client file should have their own login, a second factor, and a removal step when they leave.
- Ask the vendors that store returns for their patching practice and for an audit log you can actually export. The Protect finding that matters outside the IRS is unfixed critical vulnerabilities plus no inventory of the software that holds the data.
- Finish a staff training pass before the next filing season, and keep the roster. The report scored IRS security training at Level 2 because the skills assessment was unfinished. A firm policy nobody has been walked through is the same shape of gap.
- If the firm receives federal tax information from the IRS or from an agency that got it from the IRS, apply Publication 1075 to that flow and document it in the WISP. For client data the firm collected itself, lead with Publication 4557, Publication 5708, and §7216.
Where a secure client portal fits
XyloDocs is an AI client communication platform for tax firms. The client portal, document intake, e-signature, and bilingual calling, SMS, and WhatsApp run with AES-256 encryption, access controls, one-time-passcode logins, and an audit trail. Those controls are built to align with IRS Publication 4557 and IRS Publication 1075. The platform is available now, on its own, without tax software. Client accounts are included.
That is the path documents and messages travel. It does not raise the IRS FISMA score, and it does not replace the Written Information Security Plan. The security page states the controls in one place: how XyloDocs handles tax-document security. Pair it with the checklist above, not instead of it.
Frequently asked questions
What did the 2026 TIGTA IRS cybersecurity report find?
Report 2026-200-053, issued September 15, 2026, rated the IRS cybersecurity program not effective for fiscal year 2026. Identify, Protect, and Detect were below maturity Level 4. Govern, Respond, and Recover were rated effective. TIGTA also said the IRS had improved on some ratings from the prior year.
What are the three ineffective areas?
Identify (knowing which systems exist and what data they hold), Protect (configuration, access, data protection, and training), and Detect (continuous monitoring). The lowest core score was Protect, at 2.6. On the seven systems TIGTA sampled, 6 still had critical vulnerabilities open past 30 days.
Does IRS Publication 1075 apply to every CPA firm because of this report?
Publication 1075 applies to agencies and contractors that receive federal tax information from the IRS under §6103. A firm that receives FTI that way follows Publication 1075 for that flow. Client files the firm collected itself are covered by Publication 4557, the Written Information Security Plan in Publication 5708, and §7216. Safeguard controls can be built to align with Publication 1075. That phrase is not a certification.
What is federal tax information?
In Publication 1075, federal tax information is return or return information received from the IRS, or from a secondary source, under Internal Revenue Code §6103. A W-2 a client uploaded to your portal is taxpayer data you must safeguard. It is FTI in the Publication 1075 sense when it came from the IRS or from an agency that received it from the IRS.
What should a CPA firm do after the TIGTA report?
Inventory every system that holds client tax files, keep tax return information off email and consumer chat, require individual logins and a second factor, confirm vendors patch and log access, train staff, and update the WISP. If you receive FTI under §6103, apply Publication 1075 to that flow.
Sources and related reading
- TIGTA Report 2026-200-053 (September 15, 2026), and the oversight.gov record
- IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies
- IRS Publication 4557, Safeguarding Taxpayer Data
- IRS Publication 5708, Written Information Security Plan
- 26 U.S.C. §6103, §7216, and §6713
- Journal of Accountancy, September 25, 2026 — secondary account of the separate identity-theft audit; confirm the TIGTA PDF before publish
- WISP requirements for tax firms
- How to send tax documents securely
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.