IRS Publication 1075 tells agencies to conduct penetration testing every three years on the federal tax information environment. That sentence sits in control CA-8. Two other IRS pages create different purchase triggers: a pre-implementation test for a customer-facing FTI web portal, and pre-go-live plus annual production tests for contractors doing business directly with the IRS. A buyer who puts all three into a single generic annual pentest request risks buying the wrong scope or asking a bidder to promise a duty that does not apply to that contract.
Quick answer. Publication 1075 CA-8 requires a penetration test of the FTI environment every three years. The IRS web portal guidance calls for a thorough test before an agency opens a customer-facing portal that provides FTI. The IRS contractor procurement page calls for an independent third-party pre-go-live test and an annual test of production systems for contractors with the IRS. Scope the applicable track first, then procure testers and evidence for that track. Stingrai can scope human-led web, API, cloud and network testing to the approved boundary; access to FTI requires separate location and personnel arrangements.
The point of this guide is a purchase decision. It translates the three source documents into a scope, rules of engagement and evidence package. The exact contract, agency authorization and data flow determine which track applies. A statement on a general procurement page is not a blanket amendment to Publication 1075.
The three tracks at a glance
Buyer situation | Operative IRS text | Test trigger | What to request from the tester |
|---|---|---|---|
Agency or authorized recipient with an FTI environment | Publication 1075 CA-8 | Penetration testing every three years on that environment | A bounded test of the FTI systems, agreed rules of engagement, qualified testers, findings and remediation record |
Agency giving external customers FTI through a web portal | IRS guidance on FTI in web portals | A thorough web portal test before implementation; monthly vulnerability scanning is a separate activity | Portal and connected tier scope, internal and external exposure analysis, report and corrective action plan |
Company contracting directly with the IRS for a production environment | IRS contractor procurement requirements | Independent third-party test before go-live; annual test of production | Separate pre-production and production statements of work, coverage of web, network, database and host systems, remediation status |
Figure 1: The three testing triggers are separate. Sources: IRS Publication 1075, IRS FTI web portal guidance, and IRS contractor procurement requirements.
The first two tracks can apply to the same agency. The third applies to a different commercial relationship: a contractor with the IRS. A state agency's own contractor may still have Publication 1075 obligations when it receives FTI. It should not automatically inherit the direct IRS procurement page's annual production test language. Read the award documents and confirm the beneficiary, system owner and data recipient before deciding the cadence.
What Publication 1075 CA-8 actually requires
CA-8 in the IRS's current Publication 1075 PDF, revision 11-2021, says: "Conduct penetration testing every 3 years on the FTI environment." The object of the test is specific. It is the environment that receives, processes, stores or transmits federal tax information, including the controls that protect it. It is not an instruction to test an agency's entire technology estate every three years regardless of FTI flow.
The supplemental guidance matters when a procurement team compares bids. The IRS says a penetration test goes beyond automated vulnerability scanning and is performed by people with demonstrable skill in network, operating system or application security. It calls for all parties to agree on rules of engagement before testing. It also recognizes that testing can expose FTI and says contracts or other mechanisms should communicate how the information will be protected. The agency's risk assessment guides the level of tester independence required. CA-8 does not prescribe one named accreditation, one commercial methodology, or an external firm for every test.
An agency can therefore issue a focused request. Ask the bidder to show the people and methods behind its proposed coverage, identify which systems and data paths were excluded, and document how it will avoid unapproved access to taxpayer information. Ask for an SOW that names the FTI boundary instead of treating the words "IRS compliant" as scope. That is a buyer recommendation drawn from the rule's practical consequences, not another sentence of CA-8.
Inventory the environment before pricing the test
Start with the agency's data flow. Identify the systems that receive FTI from the IRS or another authorized source, the applications that display it, the databases that store it, the identity systems that grant access and the network controls that isolate them. Mark contractor-operated components and any export, reporting or backup path. Then decide which interfaces need direct testing and which will be assessed through configuration or architecture review because touching them would expose live FTI.
A useful procurement diagram has five columns: source of FTI, system or service, direction of transfer, owner, and permitted tester action. The diagram is not itself an IRS-prescribed artifact; it is a way to make the CA-8 boundary visible to a tester and the agency's approver. It also stops an attractive web-only quote from silently excluding the internal identity path or database access control that protects the same data.
The rules of engagement should identify live data, synthetic data, test accounts, excluded records, collection limits, evidence redaction, stop conditions and an agency contact who can authorize a pause. A penetration test is not a license to copy taxpayer records into a vendor's portal. The report needs enough proof to support remediation, with sensitive material protected by the buyer's approved handling procedure.
Do not confuse the test with a scanner subscription
Publication 1075's CA-8 guidance explicitly distinguishes a penetration test from automated vulnerability scanning. A scan may discover a known software weakness or exposed service, while a tester can evaluate whether a user with one role can cross an FTI authorization boundary or whether an internal access path defeats isolation. That distinction supports a manual test for the relevant environment. The exact scenarios belong in the rules of engagement, based on the agency's risk assessment and permission.
The IRS portal page separately says the portal architecture's vulnerability scanning frequency increases to monthly when FTI is provided to customers online. That is a scanning clock. It does not replace CA-8's three-year penetration test, and the CA-8 test does not replace monthly scanning. A proposal should put the two services on different lines with different deliverables and acceptance criteria.
What changes when an agency opens an FTI web portal
The IRS guidance for web portals addresses an agency that provides FTI to an external customer through a web portal. Before implementation, the agency must conduct a thorough penetration test of that portal environment against internal and external threats. The IRS says the results should be shared with the Office of Safeguards along with a corrective action plan. Notice the two verbs: the pre-implementation test is stated as "must"; sharing the report and plan is stated as "should" on the page. Keep those strengths distinct in a brief.
The portal page describes a three-tier architecture: web, application and database. It also calls for hardening of each system that receives, processes, stores or transmits FTI through the portal and monthly scanning of the portal architecture. A test of the public login screen alone would leave an important question unanswered: can a normal authenticated customer reach another customer's tax information through an application or API? The buyer should include at least two customer roles and a way to verify record isolation without showing real FTI to the testing team.
Scope the web tier, application tier, database access boundary, identity proofing flow, session management and associated APIs. Include the administration plane and any data export function. Decide who may run tests against a cloud host or third-party platform and get that permission in writing. These are recommended test scenarios, not a claim that the IRS page names every endpoint or technique.
For a procurement deadline, schedule the test far enough before opening the portal to repair and retest findings. The report should distinguish a weakness found, a fix planned and a fix verified. A corrective action plan that lists only a target date cannot prove that a flaw was removed. The agency's own approval process decides whether residual risk is acceptable; the vendor provides the observations and retest evidence.
A portal-specific acceptance checklist
Use this as an acceptance checklist for the work product:
The report identifies the exact portal build, connected services and test dates.
The tester identifies authorized user roles and the boundary between customers' FTI.
The rules of engagement show approved data, test accounts and stop conditions.
The methods distinguish manual authorization work from vulnerability scans.
Findings describe business impact without reproducing taxpayer information in the report.
Each finding has an owner, a remediation decision and a retest outcome.
The agency prepares its corrective action plan and handles any Office of Safeguards submission through its approved channel.
This list is an editorial buyer tool. It supplements, rather than quotes, the IRS's page.
What the IRS direct contractor procurement page adds
An IRS procurement page addresses contractors with the IRS. Under its penetration-testing heading it asks for independent third-party testing before go-live in an environment as close to production as possible. It then asks for annual penetration testing of the production environment, including web applications, network infrastructure, databases and host systems. It calls for documentation of findings, recommended mitigations and remediation status.
That is a broader technology scope and a shorter recurring cycle than CA-8. The reason is context, not a contradiction. One document defines a safeguard for FTI recipients, while the other describes cybersecurity requirements for companies contracting directly with the IRS. The final contract may add system-specific obligations. Procurement and legal teams should align the statement of work with the awarded contract, rather than pull the annual line out of context and publish it as a universal Publication 1075 rule.
For an IRS contractor, obtain two quote options if both stages are upcoming. The pre-go-live test should match the intended production architecture as closely as practical and leave time to fix issues before acceptance. The annual production test should name all four categories on the IRS page and show how the vendor will handle systems that cannot tolerate intrusive methods. If the application changes materially between those tests, request a delta scope instead of assuming the older report covers the new release.
The procurement page also describes frequent vulnerability scans for networks, hosts, applications and databases. Those intervals belong to the contractor's scanning program. Do not present a scanner report as the independent pre-go-live penetration test; the page lists them in separate sections.
FTI access changes the vendor shortlist
Publication 1075's Offshore Operations section says that agency employees, contractors and subcontractors located outside the legal jurisdictional boundary of the United States cannot access FTI. Its personnel-security section says an agency must complete a favorably adjudicated background investigation before giving FTI access to employees and contractors. These constraints apply to people who can actually reach FTI, not to a company's marketing location or a website screenshot.
Resolve the data exposure decision before requesting a price. A synthetic-data environment and tightly controlled test accounts may avoid the need for the tester to inspect live taxpayer records, but the agency must decide whether that environment still permits access to FTI or produces FTI in logs, error messages, exports and backups. If it does, establish where testers will be physically located and what screening and authorization the agency requires. A provider with Canadian headquarters cannot assume its Toronto team can access FTI remotely. A provider with a US office cannot assume the assigned people are approved either.
Publication 1075 also says an agency must notify the Office of Safeguards before re-disclosing FTI to contractors; a contractor's re-disclosure to a subcontractor requires written approval. A testing vendor should therefore name any subcontractor, cloud evidence store and report reviewer before the agency approves access. The buyer should decide which findings may be placed in a normal ticketing system and which require a restricted attachment or a redacted narrative.
Figure 2: Proposed evidence handoff for an FTI test. Regulatory anchors: Publication 1075 CA-8 and personnel rules; IRS portal guidance.
A statement of work that a buyer can evaluate
Write the request around decisions the bidder can answer. A clear SOW lets an agency compare depth and risk handling, rather than just day counts. The following fields are proposed procurement controls:
SOW field | Buyer question | Evidence to require at handoff |
|---|---|---|
Applicable IRS track | Is this CA-8, an FTI customer portal, an IRS direct contractor system, or more than one? | A table mapping each requirement to an asset and date |
FTI boundary | Which systems can receive or reveal FTI during testing? | Approved data-flow inventory and exclusions |
People and access | Who tests, from where, and under whose screening approval? | Named roles, access grants and revocation record |
Test method | What manual work distinguishes the test from a scan? | Methods and covered attack paths in the report |
Safety controls | Which operations are prohibited and who can stop a test? | Signed rules of engagement and escalation contacts |
Evidence handling | Where are logs, screenshots, reports and copies stored? | Redaction and retention instructions |
Findings | Who owns fixes and how are they prioritized? | Remediation tracker with dates and decisions |
Retest | What is retested, by whom and when? | Verification result for each remediated finding |
For a web application, the buyer can use Stingrai's web application testing service to describe authenticated role and API coverage. For a wider FTI boundary, the internal and external network service and cloud testing service show the relevant types of work. Those service pages do not determine whether the FTI handling arrangements are permissible. The agency must approve people, location, data access and report storage as part of the engagement.
Compare two quotes on equivalent scope
A cheap portal quote may cover only unauthenticated pages. A more expensive one may include user roles, APIs, the administrative plane and retesting. Normalize proposals by the number of environments, authenticated roles, data flows, test windows and reporting obligations. Ask each bidder to state exclusions in one table. If a proposed exclusion contains the database boundary, federation service or FTI export path, ask whether the remaining test still answers the procurement objective.
Tester independence deserves its own line. Publication 1075 leaves the level to risk assessment. The IRS direct contractor page expressly calls for independent third-party testing before go-live. A bidder who built the system may still offer useful remediation help, but the buyer should not assume that the same team satisfies an independence requirement without documented review. Record who approved the independence model.
For price, request a custom quote for the full FTI environment and its handling requirements. Stingrai's fixed web package is limited to one web application and associated APIs; an agency's network, database, screened-personnel and reporting requirements need their own scope and quote. The cost calculator can organize surface counts, but the FTI access design and contract terms must be settled in the actual proposal.
A practical procurement calendar
The calendar below is a planning example, not a regulatory deadline table beyond the three source triggers.
Stage | Agency FTI environment | New FTI web portal | Direct IRS contractor |
|---|---|---|---|
Before the RFP | Verify CA-8 due date and FTI boundary | Confirm planned opening date and customer data flow | Read the award's security clauses and production acceptance date |
At award | Approve tester access and rules of engagement | Reserve test, fix and retest windows before opening | Book independent pre-go-live testing |
After the report | Track findings and any residual-risk decision | Prepare corrective action plan and approved sharing route | Provide findings, mitigations and remediation status under the contract |
Recurring work | Keep the three-year CA-8 test on the schedule | Keep monthly scanning separate from the pentest | Schedule the annual production test and routine scans separately |
The value of a schedule is that it preserves time for repairs. A report delivered on the day of launch is evidence of discovery, not evidence of correction. Put a retest window and a decision owner into the purchase order.
Where Stingrai fits
Stingrai is a CREST-accredited penetration testing service provider headquartered in Toronto, with a London office. Two named penetration testers staff each human-led engagement, drawn from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications. Its human-led services cover authenticated web and API roles, cloud identity and workloads, internal and external networks, and Active Directory. Confirmed findings go to the PTaaS portal as they are found, and retesting of remediated findings is included. Human-led and hybrid reports include an attestation letter.
For an FTI project, the first scoping call should be about the data boundary and authorized tester access. Stingrai can deliver a one-time engagement or a continuous program for an approved web, cloud or network scope, but the agency must decide whether its FTI may be accessible and approve any location, screening, subcontractor and evidence-handling arrangements before work starts. If the work includes a portal, Snipe is available only for a web application and associated APIs, either on its own or testing together with human penetration testers in a Hybrid engagement. It does not cover an entire FTI network or database estate.
Frequently Asked Questions
Does IRS Publication 1075 require a penetration test?
Yes. Publication 1075 CA-8 says to conduct penetration testing every three years on the federal tax information environment. The test is distinct from automated vulnerability scanning.
Is Publication 1075 penetration testing annual?
No. CA-8 sets a three-year cadence for the FTI environment. A separate IRS contractor procurement page calls for annual production testing for contractors with the IRS, and a contract may impose its own additional terms.
Does an FTI web portal need testing before launch?
Yes. IRS guidance says an agency must conduct a thorough penetration test of a customer-facing FTI web portal environment before implementation. It separately calls for monthly vulnerability scanning of that architecture.
Must the pentest firm be an external third party?
Publication 1075 says the agency's risk assessment guides the required independence of testers. The separate IRS direct contractor procurement page expressly calls for an independent third-party test before go-live.
Can a tester outside the United States access FTI?
Publication 1075 bars FTI access by agency personnel, contractors and subcontractors located outside the legal jurisdictional boundary of the United States. The agency should settle potential access, personnel screening and approved test data before award.
Can a vulnerability scan count as the CA-8 test?
No. Publication 1075 describes penetration testing as going beyond automated vulnerability scanning. A bid should identify manual methods, authorized scope and qualified testers.
What must be in the test handoff?
For CA-8, agree rules of engagement and FTI protection before testing, then retain a scope and findings record that supports remediation. The IRS web portal guidance says the test results and corrective action plan should be shared with the Office of Safeguards. Direct IRS contractor procurement asks for findings, mitigations and remediation status.
How should an agency handle tester background checks?
Publication 1075 requires a favorably adjudicated background investigation before granting FTI access to employees or contractors. The agency decides whether the approved test design gives a tester such access and completes the required screening before that access occurs.
Related reading
References
Internal Revenue Service. Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies. Revision 11-2021. PDF. CA-8, personnel security and offshore operations reviewed 16 October 2026.
Internal Revenue Service. Protecting federal tax information in web portals. Agency guidance. Portal architecture, pre-implementation test and scanning reviewed 16 October 2026.
Internal Revenue Service. Scanning, compliance and vulnerability requirements. Contractor procurement page. Pre-go-live and annual production testing reviewed 16 October 2026.
Talk to Stingrai
Stingrai can scope human-led testing of a permitted FTI web, API, cloud or network boundary and produce findings and retest evidence for the buyer's safeguarding program. Get a Quote or book a free discovery call to discuss the applicable IRS track, access rules and deliverables.
