Known Exploited Vulnerabilities That Remain Unremediated Could Put the IRS Network at Risk

Submitting OIG:

Date Issued:

Monday, August 28, 2023

Agency Reviewed / Investigated:

Submitting OIG-Specific Report Number:

2023-20-048

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
202320048fr.pdf	661.16 KB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
2	Open	No
In accordance with the directive, immediately isolate or remove from the network all assets with KEVs not remediated by the established due date.
3	Open	No
The Chief Information Officer should assess attack signature changes to determine remediation time frames for each, and update data in the asset and vulnerability repository that include signature change dates applicable to KEVs and the remediation time frame allowed for each signature change as assessed.