Despite upgrades, IRS cyber program still ‘not effective,’ watchdog says

Executive Summary

The Treasury Inspector General for Tax Administration (TIGTA) found the IRS's cybersecurity program "not effective" in the fiscal 2026 FISMA assessment, with specific deficiencies mapped to the identify, protect, and detect functions of the NIST Cybersecurity Framework. Critical shortfalls cited in the Summary include configuration management, vulnerability remediation, and continuous monitoring capabilities. Contractors working with the IRS or handling taxpayer data should anticipate increased scrutiny of cybersecurity controls and potential changes to security requirements as the agency addresses these findings.

Market segments explicitly named in the Tags — including Cybersecurity, IT Services, Security Operations, Vulnerability Management, Continuous Monitoring, Configuration Management, Risk Management, Compliance and Assessment, and Federal Civilian IT — will see near-term demand shifts. The scale of change is medium (Summary severity MEDIUM) but concentrated where the IRS was found deficient: expect prioritization of work that raises maturity in configuration management, vulnerability remediation, and continuous monitoring, and heightened emphasis on demonstrating alignment to FISMA and NIST-based controls.

Impact Matrix

Cybersecurity

• Risk Level: High
• Opportunity: Increased demand for services that raise overall cybersecurity program maturity. Relevant NAICS: 541512, 541513, 541519, 541330, 518210, 541511, 541690, 561621. Relevant contract vehicles (per Tags): SEWP, GSA (General Services Administration) IT Schedule 70, OASIS+, Alliant 2, CIO-SP3.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Prepare evidence of program-level maturity improvements mapped to the NIST Cybersecurity Framework and FISMA assessment criteria; anticipate deeper audits/assessments from agency reviewers.
• Competitive Edge: Offer clear program-level roadmaps that map technical controls to NIST functions and demonstrate measurable maturity improvements.

IT Services

• Risk Level: Medium
• Opportunity: Contracts to support modernization and remediation efforts that intersect with cyber controls. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Review service offerings for alignment with agency expectations around configuration management, vulnerability remediation, and monitoring; be ready to incorporate stricter security baselines into delivery.
• Competitive Edge: Integrate security-by-design into standard IT service bundles and document how service delivery supports FISMA/NIST compliance.

Security Operations

• Risk Level: High
• Opportunity: Expanded need for staffing and tooling that improves detect/respond capabilities and continuous monitoring. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Ensure SOC capabilities explicitly address the detect function and continuous monitoring gaps noted by TIGTA; prepare playbooks and metrics to demonstrate effectiveness.
• Competitive Edge: Present measurable detection/response KPIs tied to NIST CSF detect and NIST SP 800-137 concepts.

Vulnerability Management

• Risk Level: High
• Opportunity: Remediation programs, scanning, triage services, and patch management support. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Demonstrate processes for end-to-end vulnerability lifecycle management, with evidence of reduction in time-to-remediate and prioritized remediation approaches.
• Competitive Edge: Demonstrate integration of asset inventory, risk-based prioritization, and remediation metrics that map to NIST 800-53 controls.

Continuous Monitoring

• Risk Level: High
• Opportunity: Services and tooling to implement continuous monitoring capabilities and dashboards that support FISMA reporting. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Validate monitoring architecture, telemetry coverage, and automated reporting aligned to continuous monitoring guidance (e.g., NIST 800-137 referenced in Tags).
• Competitive Edge: Provide turnkey continuous monitoring packages with demonstrable telemetry coverage, alert fidelity, and compliance reporting.

Configuration Management

• Risk Level: High
• Opportunity: Configuration baseline development, drift detection, and enforcement services. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Ensure configuration management services map to acceptable maturity levels and can be proven via audit artifacts and continuous controls validation.
• Competitive Edge: Offer automated configuration drift remediation tied to documented baselines and audit evidence suitable for FISMA reviews.

Risk Management

• Risk Level: Medium
• Opportunity: Risk assessment, risk posture improvement, and RMF/FISMA-aligned advisory services. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Provide risk-based prioritization frameworks that connect technical deficiencies to enterprise risk and remediation plans.
• Competitive Edge: Combine technical remediation with enterprise risk storytelling that helps decision-makers prioritize funding and program actions.

Compliance and Assessment

• Risk Level: Medium
• Opportunity: Independent assessment, audit preparation, and compliance engineering against FISMA, NIST SPs (800-53, 800-171, 800-137), IRS Publication 1075, and FedRAMP (Federal Risk and Authorization Management Program) requirements (all listed in Tags).
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Prepare assessment artifacts, gap analyses, and evidence packages; support agencies in addressing TIGTA-identified gaps.
• Competitive Edge: Deliver combined technical and compliance packages that map controls to FISMA/NIST artifacts and IRS Publication 1075 requirements.

Federal Civilian IT

• Risk Level: Medium
• Opportunity: Broader federal programs may reassess similar controls; potential demand for cross-agency lessons learned and remediation support. Relevant NAICS and vehicles listed above.
• Timeline: Referenced in Summary as fiscal 2026 FISMA assessment.
• Action Required: Monitor agency guidance and TIGTA follow-ups; update offerings to incorporate any new expectations that emerge from the IRS assessment.
• Competitive Edge: Position as a practitioner with demonstrated experience remediating gaps highlighted in federal FISMA assessments.

Cross-Segment Implications

• Deficiencies in configuration management, vulnerability remediation, and continuous monitoring create direct dependencies: improvement efforts in Configuration Management and Vulnerability Management will require expanded Security Operations and Continuous Monitoring capabilities to verify and sustain remediation.
• Compliance and Assessment functions will be central to validating remediation across all technical segments; demand for combined technical+compliance engagements will rise.
• IT Services and Federal Civilian IT offerings must embed improved security controls to remain competitive for IRS-related work; contract vehicles and NAICS listed in Tags are the likely routes for engagement, so contractors on those vehicles should prepare for deeper security scrutiny.
• Risk Management will need to translate technical remediation activities into program-level priorities and funding requests, linking technical segments to enterprise decision-making.