Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes. The Treasury Inspector General for Tax Administration (TIGTA) says the IRS has made measurable progress, but its tax-compliance controls and cybersecurity program still have material weaknesses. In TIGTA’s FY2026 Federal Information Security Modernization Act (FISMA) evaluation, the IRS cybersecurity program was rated not effective overall: IDENTIFY, PROTECT, and DETECT remained below the effective threshold, even though GOVERN, RESPOND, and RECOVER were effective. Separately, TIGTA’s current management-challenge report describes a projected $696 billion gross tax gap for Tax Year 2022, weak examination results for large partnerships, high improper-payment rates, incomplete access controls, and delayed vulnerability remediation.
What is TIGTA’s latest verdict on IRS cybersecurity?
TIGTA’s FY2026 FISMA evaluation found that the IRS cybersecurity program was not effective overall. Under TIGTA’s methodology, a function is effective only when it reaches NIST Cybersecurity Framework 2.0 maturity Level 4, “Managed and Measurable,” or Level 5, “Optimized.” Three of the six functions—IDENTIFY, PROTECT, and DETECT—did not meet that standard.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The other three functions, GOVERN, RESPOND, and RECOVER, were rated effective. TIGTA reported that 72 percent of FY2026 metrics were at Levels 3, 4, or 5, an improvement from FY2025, when 68 percent were at Level 3 or lower. That stronger metric distribution did not change the overall judgment because the three underperforming functions still pulled the program below the acceptable threshold.
| FISMA evaluation | Overall result | Functions below effective | Metric trend |
|---|---|---|---|
| FY2025 | Not effective | IDENTIFY, PROTECT, DETECT | 68% at Level 3 or lower |
| FY2026 | Not effective | IDENTIFY, PROTECT, DETECT | 72% at Levels 3–5 |
“Not effective” is a maturity assessment, not a finding that every IRS system has been breached. It means TIGTA found that required security capabilities were not consistently managed and measured at the level federal standards expect.
Popular on Amazon
How serious are the IRS’s overdue vulnerabilities?
The FY2026 review found critical vulnerabilities lingering beyond the required 30-day remediation period in six of seven sampled information systems, or 86 percent. That is a system-management problem as well as a technical one: an unpatched critical weakness can provide a path to inappropriate access, modification or disclosure of taxpayer information. TIGTA warned that, without mitigation, taxpayer data could remain vulnerable to “inappropriate and undetected use, modification, or disclosure.”
FISMA requires an annual independent evaluation of federal information-security programs. TIGTA evaluates the six NIST functions across maturity levels running from Ad Hoc through Optimized. The FY2026 report records performance against federal metrics and makes no formal recommendations, although it says the IRS must fully implement all FISMA security components. The IRS reorganized its Information Technology division, issued a Cybersecurity Strategic Plan in January 2026 and created a Risk Executive function; those steps are improvements, not proof that the underlying controls are complete.
What did TIGTA say about tax compliance and the tax gap?
TIGTA’s current management-challenge report projects a $696 billion gross tax gap for Tax Year 2022. About $63 billion, or 9 percent, is attributed to nonfilers. The size of the estimate represents taxes owed but not collected, rather than a bill that can automatically be recovered.
Enforcement capacity is uneven. The examination rate for partnerships with at least $10 million in assets dropped from 2.7 percent in 2011 to less than 0.1 percent in 2023. In the Large Partnership Compliance Program, 92 percent of closed examinations produced no changes, a result TIGTA says indicates that return-selection methods need refinement.
Also popular on Amazon
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Nonfiler follow-up also stalled. TIGTA identified nearly 33,700 taxpayers remaining in first-notice status and estimated that continued action could produce secured returns or assessments in about 10,500 cases involving 9,100 taxpayers, with roughly $321 million in potential additional tax. The IRS moved those cases out of first-notice status in March 2026, but TIGTA’s finding shows why timely escalation matters.
How large are improper payments?
For FY2025, the IRS estimated a 26.5 percent improper-payment rate, totaling $28.1 billion, across the Additional Child Tax Credit, American Opportunity Tax Credit, Earned Income Tax Credit and Net Premium Tax Credit. TIGTA reported that none of the high-risk programs had brought its estimated rate below the Payment Integrity Information Act’s 10 percent goal. Improper payments can include amounts issued to ineligible recipients or in incorrect amounts, so the measure signals control and verification risk rather than proven intentional fraud in every case.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThere has been measurable fraud prevention. For calendar years 2024 and 2025 through November 2025, the IRS protected about $7 billion in fraudulent refunds tied to individual identity theft. External alerts have contributed almost $278 million in protected revenue since 2017. Those results show that targeted controls can work even while broader compliance and payment-integrity measures remain above statutory targets.
Is taxpayer data secure inside IRS systems?
TIGTA says the IRS stores sensitive information across many systems used by employees and contractors, making unauthorized access and disclosure an ongoing challenge. The management-challenge report cites retained access for some employees on administrative leave, incomplete security-awareness training, weaknesses at contractor sites, fragmented data-sharing agreements and risks associated with a Treasury–DHS/ICE data-sharing arrangement.
Also popular on Amazon
Modernization has created additional gaps. Of more than 18,000 SharePoint Online sites reviewed, 99 percent either lacked audit logs or did not report an access-control method. The IRS could not migrate a scanner used to identify sensitive information; the migration ran two years longer than planned and cost $1 million to maintain the legacy system. TIGTA also found no evidence that privileged accounts on the Enterprise Data Platform were monitored.
Training coverage was incomplete as well. More than half of nearly 1,200 employees and contractors hired from January through August 2025 had not completed required security-awareness training before receiving access to sensitive systems. Access should be removed promptly when a worker separates or changes status, and privileged activity should be logged and reviewed; the findings show those basic controls are not consistently demonstrated.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat is the historical context?
A 2024 FedScoop account of an earlier TIGTA data-security review connected continuing access-control concerns to a contractor disclosure of taxpayer returns. It reported that separated-user access was not always removed promptly and that TIGTA investigated 1,028 apparent Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) cases from FY2018 through FY2023. That history helps explain why current findings about account removal, logging and monitoring remain significant, but the FY2026 TIGTA evaluation is the better measure of today’s program maturity.
What should taxpayers and IRS managers take from the reports?
Taxpayers should use an IRS account with multifactor authentication, avoid sending tax information through unverified channels and respond promptly to official identity-verification notices. Those steps reduce individual exposure but cannot substitute for agency controls. IRS managers need complete asset inventories, documented access-control methods, timely critical-patch remediation, monitored privileged accounts, current audit logs, mandatory training before sensitive access and better selection of high-risk returns. TIGTA’s metrics show progress, but the unresolved function-level weaknesses and compliance results mean improvement has not yet become effective performance.
Also popular on Amazon
Frequently Asked Questions
Does a “not effective” FISMA rating mean the IRS has been hacked?
No. The rating measures whether security processes and controls meet federal maturity requirements. It does not establish that all IRS systems are compromised, although weak controls can increase the chance that unauthorized activity will go undetected.
What does FISMA require the IRS to do each year?
The Federal Information Security Modernization Act requires an annual independent evaluation of an agency’s information-security program. TIGTA assesses the IRS against six NIST Cybersecurity Framework functions and assigns maturity levels from Ad Hoc through Optimized.
Why can the IRS show improvement while still being rated not effective?
The overall result depends on each function meeting the Level 4 or 5 threshold, not just on the average percentage of stronger metrics. Improvements in some measures cannot offset three functions that remain below the required maturity.
How many IRS systems had critical vulnerabilities overdue?
Six of seven sampled systems, or 86 percent, had critical vulnerabilities that were not remediated within the required 30 days.
Also popular on Amazon
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
What is the current IRS tax-gap estimate?
TIGTA’s current page reports a projected gross Tax Gap of $696 billion for Tax Year 2022, including approximately $63 billion, or 9 percent, attributed to nonfilers.
What is the IRS improper-payment rate?
For FY2025, the IRS estimated a 26.5 percent rate and $28.1 billion in improper payments across four major tax-credit programs. None of the high-risk programs was below the 10 percent statutory goal.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Are IRS SharePoint records fully logged?
No. TIGTA found that 99 percent of more than 18,000 SharePoint Online sites either lacked audit logs or did not report an access-control method.
What should taxpayers do about these findings?
Use an IRS account with multifactor authentication, avoid sending tax information through unverified channels and respond promptly to official identity-verification notices. These steps reduce individual exposure but do not replace the IRS’s responsibility to correct system-wide weaknesses.
The Bottom Line
TIGTA’s FY2026 scorecard is mixed: the IRS improved its metric distribution, strengthened governance and protected billions in fraudulent refunds, yet cybersecurity remains not effective because IDENTIFY, PROTECT and DETECT are below Level 4. A 86 percent overdue-vulnerability rate, widespread logging and access gaps, a $696 billion projected tax gap and $28.1 billion in improper payments show that substantial compliance and data-security work remains.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
