Annual Audit Plan -- FY2005 - Department of the Treasury

Treasury Inspector General for Tax Administration - Office of Audit
Penetration Test (Statutory Audit)
Audit Objective: Determine whether the IRS is improving its controls to detect and
prevent unauthorized accesses to the IRS’ data and systems from inside the IRS firewalls.
Computer Security Incident Response Center (Statutory Audit)
Audit Objective: Determine whether the IRS has an effective Computer Security
Incident Response Center.
Physical Security (Statutory Audit)
Audit Objective: Determine whether the IRS has effective physical security controls at
its campuses and offices.
Common Operating Environment (Statutory Audit)
Audit Objective: Determine whether the IRS has adequately secured and deployed the
common operating environment used on its end-user computers.
Federal Information Security Management Act (Statutory Audit)
Audit Objective: Provide an overall assessment of IRS security measures required by
the Federal Information Security Management Act.
Authorization for Access on Internal Revenue Computer Systems and Applications
(Statutory Audit)
Audit Objective: Assess the effectiveness of the IRS’ controls over authorizing user
access to its systems and applications.
Employee Susceptibility over Social Engineering (Statutory Audit)
Audit Objective: Determine whether employees are aware of their security
responsibilities by emulating methods often used by hackers to gain sensitive
information.
Transition to Active Directory (Statutory Audit)
Audit Objective: Determine whether the IRS is successfully deploying and adequately
securing the Windows Active Directory network infrastructure.
Fiscal Year 2005 Annual Audit Plan Page 30