IRS still losing laptops

The auditors also observed other computer devices, including as USB flash drives, CDs, and DVDs on which sensitive data were not always encrypted, and found in a test on the agency's off-site storage back-up operations that at least four of the sites lacked sufficient data encryption. 
At one location, non-IRS employees had full access to the storage infrastrucutre and the agency's backup media, the report said. In addition, envelopes and boxes with backup media onboard were left open and not resealed. 

At another back-up facility, a retired employee still retained full access rights to sensitive data. and inventory controls for backup media were found to be inadequate. 

"We attributed these weaknesses to a lack of emphasis by management," the auditors wrote.

Another problem isolated in the report is a lack of consistent reporting of device losses to the Treasury Department's Inspector General's office and the IRS Computer Security Incident Response Center (CSIRC), both of which are required to be notified in such incidents. Inadequate coordination between the two groups made it harder to determine what types of information were on each of the missing computers, according to the report.

In their final recommendations, the auditors recommend that IRS leaders refine their incident response procedures to ensure for better understanding of any potential data exposure and more frequently remind employees to use proper device security measures. The report also contends that the agency should consider implementing a "systemic disk encryption solution" on its laptops that does not rely on employee interaction to protect sensitive information.

Phillips writes that IRS management agreed with all of his office's findings, and most of its recommendations.