Supporting Statement
Information Collection Request (ICR) Approval Request to Conduct Cognitive & Psychological Research – Focus Groups/Interviews (OMB# 1545-1349)
Title: Got MFA? Why Multi-Factor Authentication is a must for tax professionals
Wage & Investment Division
Wage & Investment Strategies & Solutions (WISS)
JUSTIFICATION
Circumstances Making the Collection of Information Necessary
As the main IRS business representative for the Security Summit, Return Integrity and Compliance Services (RICS) has worked with state revenue departments and tax software companies to increase cybersecurity and taxpayer data protection for several years. One key initiative has focused on aligning tax software authentication processes to comply with NIST Special Publication 800-63-3 (NIST SP 800-63-3) Authentication Assurance Level 2 (AAL2) by 2021. This initiative supports the Secure Summit’s overarching goal to deter fraud in the tax ecosystem and reduce the number of fraudulent returns filed.
One key difference between older security standards for the tax software companies and SP 800-63-3B AAL2 requirements is the use of multi-factor authentication (MFA) as part of the login process. MFA strengthens the confidence that an account is being accessed by the correct account holder, but access also increases the time and effort for the user. Determining the appropriate level of MFA requirement for tax preparers has been part of ongoing discussions as there is a higher expectation and responsibility for data protection for practitioners.
As part of the effort to meet AAL2 by Filing Season 2021, RICS, in collaboration with Research, Applied Analytics, and Statistics (RAAS), collected data on the practices of the Security Summit tax software partners. During individual meetings, the IRS heard that in cases where MFA was mandatory, there was minimal pushback from users when the benefits and instructions had been explained. However, in cases where it was not mandatory, uptake was less than 5% and companies expressed concern that preparers may be reluctant to try or use a more involved MFA option.
To uncover the reasons for low uptake and to understand the current barriers to using MFA, RICS has partnered with Wage and Investment Strategies & Solutions (WISS) to conduct focus groups with tax preparers during the 2020 IRS Tax Forums. Information collected from these sessions will enable RICS to craft messaging for the IRS website, private sector, and tax professionals, which specifically addresses the current barriers to using MFA. Additionally, findings will guide the development of new requirements for preparers and Security Summit partners.
Purpose and Use of the Information Collection
The purpose of this project is to gather information from tax professionals regarding their concern about data breaches, current security practices, and their understanding and use of multi-factor authentication. Participants will also provide input on authenticator preferences (e.g., software- versus hardware-based applications) and other methods such as a code sent via SMS. Focus group findings will be utilized and distributed by RICS as part of their ongoing effort to provide the most up-to-date and accurate resources on multi-factor authentication.
Consideration Given to Information Technology
Data collection for this project will be completed during in-person or virtual focus groups coinciding with the 2020 IRS Nationwide Tax Forums. These are currently scheduled to be held:
City, State |
Dates |
Dallas, TX |
July 14-16 |
New Orleans, LA |
July 28-30 |
Atlanta, GA |
August 4-6 |
National Harbor, MD |
August 18-20 |
San Diego, CA |
August 25-27 |
Orlando, FL |
September 15-17 |
Duplication of Information
This focus group project will provide valuable information that has not been collected during previous focus group projects and is not available in any internal IRS data source.
Reducing the Burden on Small Entities
Participants for this project will be recruited from individual attendees at the 2020 IRS Nationwide Tax Forums. No small entities will be contacted or recruited for participation in these focus groups.
Consequences of Not Conducting Collection
If the requirement is not approved, RICS will not receive valuable feedback from tax preparers regarding their level of concern with data breeches, security practices, and understanding and use of multi-factor authentication. As such, RICS will not know which communication strategies or knowledge-sharing campaigns will help remove the barriers keeping tax preparers from using multi-factor authentication.
Special Circumstances
There are no special circumstances. The information collected will be voluntary. The findings from this project will be used for making management decisions regarding the inclusion of additional information on the IRS website and other IRS communications regarding multi-factor authentication, including to the Security Summit.
Consultation with Persons Outside the Agency
This project is being completed in partnership with the RICS office. There will be no consultation with persons outside the agency.
Payment or Gift
There will be no incentives given for participating in the focus groups.
Confidentiality
The IRS will apply and meet fair information and record-keeping practices to ensure privacy to the extent allowed by law. This includes criteria for disclosure, laid out in the Privacy Act of 1974, the Freedom of Information Act, and Section 6103 of the Internal Revenue Code—all of which provide for the protection of taxpayer information, as well as its release to authorized recipients.
Focus group participants will not be identified in any of the documents or files used for this project. The IRS will limit and control the amount of information we collect to those items that are necessary to accomplish the research questions. We will carefully safeguard the security of data utilized as well as the privacy to the extent allowed by law of the focus group participants.
Sensitive Nature
No questions will be asked that are of a personal or sensitive nature.
Burden of Information Collection
The focus group will be designed to minimize burden on participants, with each session lasting 60 minutes.
Participant recruitment will take place among attendees at the IRS Nationwide Tax Forums. We anticipate a 25% recruitment acceptance rate, thus we will talk to 288 Tax Forum attendees, to fill 72 total participant spots (12 attendees for each focus group session at six Tax Forums).
The contact time needed to recruit for participants could take up to two minutes, with the resulting burden being 288 x 2 minutes = 576 / 60 minutes = 9.6 burden hours.
For participants, total participation time in focus groups is 60 minutes. The time burden for participants is 72 x 60 = 4,320 / 60 minutes = 72 burden hours.
The total burden hours for the focus group is 9.6 + 72 = 81.6 burden hours
Category of Respondent |
No. of Respondents |
Participation Time (in minutes)* |
Burden (in hours) |
Soliciting Potential Participants |
288 |
2 |
9.6 |
Expected participants |
72 |
60 |
72 |
Totals |
|
|
81.6 |
Estimated Response Rate: 25%
Total Burden Estimate = 81.6 hours
Costs to Respondents
There is no dollar cost to respondents. The total estimated annual cost burden to respondents is $2,038.37. The surveys take place across the United States with all cross-sections of society. This estimate was created using the mean hourly wage for all occupations ($24.98) from the BLS May 2018 National Occupational Employment and Wage Estimates - United States.
Cost to Federal Government
The estimated cost is $9,000.
Reason for Change
No change is being requested. This is a new request.
Tabulation of Results, Schedule, Analysis Plans
This project will use a constant comparison analysis to analyze focus group data. This analysis initially groups data into smaller units and identifies each with a unique descriptor or code. Next, codes are placed into broader categories with the final goal of uncovering overall themes.
Display of OMB Approval Date
IRS is seeking approval to not display the expiration date for OMB approval, as this is a one-time, limited-duration collection occurring between July 14, 2020 and September 17, 2020.
Exceptions to Certification for Paperwork Reduction Act Submissions
These activities comply with the requirements in 5 CFR 1320.9.
Dates collection will begin and end
July 14, 2020 through September 17, 2020
B. STATISTICAL METHODS
Universe and Respondent Selection
Focus group participants will be solicited in-person or virtually from individuals attending the 2020 IRS Nationwide Tax Forums.
Procedures for Collecting Information
A WISS researcher will serve as the moderator for the focus group sessions. A RICS or other IRS employee will serve as a note taker/scribe for the sessions.
Methods to Maximize Response
The focus group sessions will be limited to one hour in length, and the session topic will be clearly communicated to potential participants to maximize participation. Participants will be assured anonymity of their responses, thus being free to express their thoughts and opinions.
Testing of Procedures
Focus groups are an established and tested qualitative research method. Questions contained within the moderator’s guide will be reviewed by RICS to assure the included topics meet the stated project goals. Only minor changes to the moderator’s guide are expected following submission of this supporting statement.
Contacts for Statistical Aspects and Data Collection
For questions regarding the study or the research and statistical methodology, contact:
Howard Rasey
Social Scientist
W&I
Strategies & Solutions (WISS)
Research Group 2
678.332.7874
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File Title | DOCUMENTATION FOR THE GENERIC CLEARANCE |
| Author | 558022 |
| File Modified | 0000-00-00 |
| File Created | 2021-01-14 |