_04 SC 5000220503 SOW SourcesSoughta.docx

STATEMENT OF WORK (SOW)

INTERNAL REVENUE SERVICE

ITS / IFS PROGRAM OFFICE

SAP / IFS LICENSING, CLOUD HOSTING AND MAINTENANCE

1.0 BACKGROUND

The Internal Revenue Service (IRS) Financial Services Branch (FSB) within the Information Technology (IT), Filing Season and Legislative Delivery, Travel and Procurement organization operates the Integrated Financial System (IFS) jointly with the Chief Financial Officer (CFO) organization. The CFO is the primary business customers of the solution. IFS is the core financial system for IRS administrative accounting, supporting budget formulation/labor forecasting and execution (funds management) of the IRS annual budget. Other financial functions include general ledger, managerial cost accounting, accounts payable, accounts receivable, purchase card transaction processing and payments, asset accounting, all financial reporting, and budgetary and management reporting. In addition, it provides functionality supporting the management and administration of the federal acquisition/ procurement processes.

The IFS application, under the existing contract, was migrated to National Security Services (NS2) cloud. The current contract provides services/solution - NS2 hosting (Platform as a Service), SAP (software licenses, maintenance etc.) and network connectivity and security solutions. This SOW is for continuation of the services/solution by SAP.

The following major business processes were implemented within IFS:

· SAP ECC (Enterprise Resource Planning Central Component) Budget Execution, Payroll, Procurement (Req-to-check), eTravel, Financial Reporting, Fund Accounting, Cost Accounting, Reimbursable Agreements, User Fees, Homeland Security Presidential Directive 12 (HSPD-12), Private Collection Agencies (PCA), Federal Highway Trust Fund, Direct Appropriations (annual/multi-year/no-year), Procurement Card Processing, Government-Wide Accounting, Healthcare Tax Credit.

· SAP Business Warehouse (BW): IFS data combined by users with other external data (e.g., payroll data) to provide accurate, informative, and timely financial reports; Budget Formulation; and 3-Year Rolling Forecast.

· SAP Enterprise Portal (EP): Access to single sign-on provided through the IRS Employee User Portal (EUP).

· SAP Supplier Relationship Management – Procurement Public Sector (SRM/PPS) – Supplies government compliant procurement services to the IRS.

The Department of Treasury, IRS is seeking an experienced and reliable provider of SAP Software subscriptions, cloud hosting, and maintenance. Currently IRS has access to the SAP platform as part of previous licensing and maintenance contracts. IRS seeks to continue services provided by the SAP platform.

In this document the term “solution” encompasses software licenses, software subscriptions, hosting environment, maintenance as required to maintain the solution.

The resulting contract will provide continued SAP-based solution that will meet immediate technology modernization goals and future operational needs.

The IRS seeks to acquire SAP-based solution that:

(1) Supports ongoing IFS and PPS systems

(2) Meets immediate needs of expanding capabilities and migrating to the SAP National Security Services (NS2) cloud (Government-standard cloud hosting environment)

(3) Provides ongoing maintenance and support for current SAP perpetual licenses

(4) Supports High-Performance Analytic Appliance (HANA).

.2.0 SCOPE OF WORK

In order to assure the IRS has the ability to perform basic operations such as pay bills, manage budgets, reimburse employees for travel, maintain legislatively mandated financial records and respond to General Accounting Office (GAO) audits, and modernize infrastructure. The IRS requires the SAP software to be covered by a maintenance contract that will provide support to the hosting environment in the Government community cloud and SAP software subscriptions to support the following business needs:

(1) Tools and updates including

· New software releases of the licensed Enterprise Support Solutions, as well as tools and procedures for upgrades.

· Support packages contain corrections to adapt existing functionality to changed legal and regulatory requirements. Support packages may also contain correction packages to reduce the effort of implementing single corrections or changes to existing functionality.

· Technology updates to support third-party operating systems and databases.

· Available Advanced Business Application Programming (ABAP) source code for Software applications and additionally released and supported function modules.

· Software change management processes and tools.

(2) Access to Global Support Backbone

· SAP Service Marketplace - SAP's knowledge database and SAP’s extranet for knowledge transfer on which SAP makes available content and services to IRSs and partners of SAP.

· SAP Notes on the SAP Service Marketplace document software errors and contain information on how to remedy, avoid and bypass errors. SAP Notes may contain coding corrections that customers can implement into their SAP system.

· SAP Note Assistant - a tool to install specific corrections and improvements to SAP components.

· SAP Solution Manager Enterprise Edition

(3) Mission Critical Support

· Global message handling by SAP for problems related to Enterprise Support Solutions (excluding software to which special support agreements apply), including Service Level Agreements for Initial Reaction Time and Corrective Action. This includes:

· Global 24x7 root cause analysis and escalation procedures for messages not handled under Secure Support.

· Secure Support – Secure Support elements consisting of Secure remote Connection and Secure Backoffice, Secure Support Advisor, Secure Support Setup, and Secure Continuous Quality Checks

(4) Cloud Hosting

· NS2 Cloud hosting in the FedRAMP high Certified Government Community Cloud Infrastructure and Cloud Products

(5) HANA O&M Support

· HANA Database support.

(6) Other Components, Methodologies, Content and Community Participation

· Monitoring components and agents for systems to help optimize available resources with SAP EarlyWatch Alert.

· Collector components for systems to report on the status of the Enterprise Support Solutions.

· Content and supplementary tools designed to help increase efficiency, which may include implementation methodologies and standard procedures, Best Practices, an Implementation Guide (IMG), Business Configuration (BC) Sets and Customizing Monitoring.

· Access to the SAP Service Marketplace, which may include implementation and operations processes and content designed to help reduce costs and risks.

· Participation in SAP's customer and partner community (via SAP Service Marketplace), which provides data about best business practices, service offerings, etc.

In addition, the contractor shall maintain the current fully managed service for NS2 with the existing Amazon Web Services (AWS) Cloud Services account, interconnected with the IRS Integrated Enterprise Portal (IEP).

With this approach, the contractor shall provide the software, the Platform as a Service infrastructure and the connection to the environment between the IFS managed service and IRS data centers in Martinsburg and Memphis. Specific services include -

(1) Networking Services

· Manage and configure compute instances to support IFS cloud managed services.

· Maintain network connectivity between the IFS cloud managed services and IFS tenants inSAPNS2.

· Provide active/active interconnection with the Integrated Enterprise Portals (IEP) Network, which will serve as the External Gateway between IFS and IRS data centers (Martinsburg and Memphis).

(2) Security Services

· Manage the NS2/Accenture managed services security package.

· Submit Security Change Management documentation and initiate the assessment process.

· Coordinate system level hardening.

· Support IRS Cybersecurity assessment activities to support Cybersecurity.

· Approval to Operate for NS2/Accenture managed services security boundary.

· Provide ongoing services for application security, risk management, incident management, and security engineering

· Maintain connection to share audit log and vulnerability information with the AWS Treasury Splunk enterprise service for monitoring, and maintain conformance with IRM 10.8.1 and 10.8.24 requirements for reporting and remediation

(3) Monitoring Services

· Configure/maintain solution to receive NS2 IFS logs and provide associated auditing and reporting services

· Configure/maintain Identity and Access Management Controls

· Provide ongoing AD and EOPs monitoring support services for the environment

A conceptual overview of the current solution is shown below:

3.0 PERIOD OF PERFORMANCE

The period of performance for this effort is a base year of twelve (12) months along with four twelve (12) month option periods.

4.0 PRODUCTS

4.1 Licenses and Infrastructure

The contractor shall furnish the items described below for the entirety of the period of performance. Pricing shall be provided on a per unit basis as defined below. Pricing should provide exact part number listed and any deviations, additions or omissions should be noted. IRS will negotiate all license terms and conditions along with individual prices of the resulting products/licenses with SAP prior to this contract being signed

ESSENTAIL PRODUCTS AND SERVCIES

OPTIONAL – PRODUCTS AND SERVICES

Executive Orders are mandating review, consolidation, and modernization of IRS Finance Solutions. The contractor shall provide all items listed above priced individually to enable compliance and execution of the EO.

4.2 Incoming Transition - Optional

Within two weeks of award, the contractor shall conduct a kick-off meeting for the Government. The Government does not desire an elaborate kick-off meeting, nor does the Government expect the contractor to expend significant resources in preparation for this briefing. The intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The Contractor shall identify all materials required for a successful ramp-up.

The contractor shall work with the Government to ensure all ramp-up activities are documented in the project schedule. Ramp-Up Knowledge Transfer is defined as the contractor acquiring and understanding the documentation, information, and processes related to any work in progress at the time of work initiation.

4.3 End of Contract Outgoing Transition - Optional

The contractor shall support transition efforts to assist the Government with the transition of work from the contractor to the Government or to a successor contractor. These activities will occur at such time as the Government decides to re-assign the effort to another contractor or in-house performance, as applicable, and at a minimum at the end of the period of performance.

5.0 SOLUTION REQUIREMENTS

5.1 Security and privacy

The contractor shall meet the following security controls and requirements:

5.1.1 Authoritative Security and Privacy Policies and Guidance

The contractor shall be compliant with the following Federal Information Processing Standards (FIPS), IRS Internal Revenue Manuals (IRS), National Institute of Standards and Technology (NIST) and federal policies and guidelines.

5.1.1.1 FIPS are publicly announced standardizations

developed by the United States Federal Government for use in computer systems. The purpose of FIPS is to ensure that all civilian Federal Government agencies adhere to the same guidelines regarding security.

Many FIPS documents are modified versions of standards used in the technical communities, such as the American National Standards Institute (ANSI), the Institute of Electrical and Electronics Engineers (IEEE) and the International Organization for Standardization (IOS). The contractor shall be compliant with the following FIPS documents:

5.1.1.2 IRS Internal Revenue Manuals (IRMs)

IRMs provide the foundation for implementing and managing security for information systems security within the IRS. They provide guidance on all aspects of security for the protection of Information Technology (IT) resources. IRM 10.8.1 Policy and Guidance (https://www.irs.gov/irm/part10/irm_10- 008-001r) establishes the IT security framework for the development of security controls for implementations of IRS information systems. Subordinate IRMs provide additional security controls for operating systems, hardware platforms and AD. Subordinate procedural guidance is used to provide detailed guidance for implementing and complying with the requirements of IRM 10.8.1. If there is a conflict with or variance from IRM 10.8.1 within the subordinate IRMs, IRS publications, or procedural guidance, IRM 10.8.1 has precedence unless specifically noted otherwise within IRM 10.8.1. The contractor shall be compliant with the following IRM documents:

5.1.1.3 National Institute of Standards and Technology (NIST) Special Publications (SP)

NIST’s Computer Security Division provides peer-reviewed publications to disseminate computer security standards and guidelines and present relevant supporting information and research. NIST’s SP 800 series provide computer security guidelines. These documents are a result of collaborative activities with industry, other government agencies and academic organizations. The contractor shall be compliant with the following NIST Special Publications:

5.1.1.4 Other Documents

In addition to the FIPS, IRS IRMs and NIST documents discussed above, the contractor shall be compliant with the following:

(3) Public Law. 107–347, 116 Stat. 2899, 44 U.S.C. § 101, H.R. 2458/S. 803, The E-Government Act of 2002 (https://www.govinfo.gov/app/details/PLAW-107publ347)

(4) Treasury Department Publication (TDP) 85-01, Treasury Information Technology Security Program (March 2008) (https://www.treasury.gov/about/role-of-treasury/orders-directives/Pages/td85-01.aspx).

5.1.2 Security Constraints and Assumptions

The contractor shall be compliant with the following additional security constraints:

(1) Enforce unauthorized access (UNAX) policies, procedures and requirements as stated in IRM

10.5.5. IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance and Requirements (https://www.irs.gov/irm/part10/irm_10-005-005).

5.1.3 Security and Privacy Assurance

To ensure that security and privacy requirements are met, the contractor shall

5.2 Hosting Environment

The contractor shall:

The contractor shall manage the redundancy, resiliency, and contingency capabilities to ensure software service availability that meets IRS and Taxpayer demand.

The contractor shall submit new software releases for review and approval through IRS change and configuration management processes before being deployed into operational use.

5.3 Privacy

The contractor shall adopt NIST-800-53 privacy controls. Specifically, the contractor shall:

5.4 Service Level Agreements

Global Message Handling and Service Level Agreement (SLA).

The contractor shall perform the following:

· When IRS reports malfunction(s) to SAP, or SAP identifies malfunction(s) through monitoring, SAP must support the IRS by providing information on how to remedy, avoid and bypass errors. The main channel for such support will be the support infrastructure provided by SAP. IRS may send an error message at any time. When IRS creates an error message, the system automatically collects the most important system data (transaction code, program ID, Support Package level, message number, etc.). All persons involved in the message solving process can access the status of the message at any time. In exceptional cases, IRS may also contact SAP by telephone. SAP Enterprise Support is provided exclusively to IRS’s Customer Center of Expertise.

· The following Service Level Agreements (“SLA” or “SLAs”) shall apply to all IRS support messages that SAP accepts as being Priority 1 and which fulfill the prerequisites specified herein. Such SLAs shall commence in the first full Calendar Quarter following the Effective Date of this Addendum. As used herein, “Calendar Quarter” is the three-month period ending on March 31, June 30, September 30 and December 31 respectively of any given calendar year. IRS understands and agrees that to the extent the SAP Software contains products and/or software components licensed or resold by SAP from a third party, SAP requires the support of such third party to meet the SLAs. The time frames as specified in the table below shall commence upon receipt of the message.

· SLA for Initial Response Times: Priority 1 Support Messages (“Very High”). SAP shall respond to Priority 1 support messages within one (1) hour of SAP’s receipt (twenty-four hours a day, seven days a week) of such Priority 1 support messages. A message is assigned Priority 1 if the problem has very serious consequences for normal business transactions and urgent, business critical work cannot be performed. This is generally caused by the following circumstances: complete system outage, malfunctions of central SAP functions in the Production System, or Top-Issues.

· SLA for Corrective Action Response Time for Priority 1 Support Messages: SAP shall provide a solution, work around or action plan for resolution (“Corrective Action”) of IRS’s Priority 1 support message within four (4) hours of SAP’s receipt (twenty-four hours a day, seven days a week) of such Priority 1 support message (“SLA for Corrective Action”). In the event an action plan is submitted to IRS as a Corrective Action, such action plan shall include: (i) status of the resolution process; (ii) planned next steps, including identifying responsible SAP resources; (iii) required IRS actions to support the resolution process; (iv) to the extent possible, due dates for SAP’s actions; and (v) date and time for next status update from SAP. Subsequent status updates shall include a summary of the actions undertaken so far; planned next steps; and date and time for next status update. The SLA for Corrective Action only refers to that part of the processing time when the message is being processed at SAP (“Processing Time”). Processing Time does not include the time when the message is on status “Partner Action”, “Customer Action” or “SAP Proposed Solution”, whereas (a) the status Partner Action means the support message was handed over to a technology or software partner of SAP or a third party vendor of SAP for further processing; (b) the status Customer Action means the support message was handed over to IRS; and (c) the status SAP Proposed Solution means SAP has provided a Corrective Action as outlined herein. The SLA for Corrective Action shall be deemed met if within four (4) hours of processing time: SAP proposes a solution (status “SAP Proposed Solution”), a workaround or an action plan; or if IRS agrees to reduce the priority level of the message.

The solution shall include the following SLAs:

Notes per SAP NS2 SLA Guidelines:

RPO Model for the Application product is database only Non-Prod Disaster Recovery/High Availability is available upon request

5.5 Capacity

The contractor’s infrastructure shall scale to meet capacity needs and maintain all, storage, processing and other business performance and technical performance needs.

The contractor shall store all data through the duration of the contract, or until the contractor working with IRS offloads it to an alternate location. All records shall be retained according to the policies and legislation that govern the manual/paper process that they supplement or as determined by official policy as it retains to digital document retention. The Government’s data shall not be permanently deleted unless mandated by legislation and/or policy.

5.6 Data/ Record Management and File Retention

The IRS retains ownership and rights to all data housed in the solution. The contractor shall retain IRS data housed in the solution, including attachments for the duration mutually agreed with IRS Contracting Officer Representative (COR) and according to IRS policies.

The contractor shall regularly backup IRS data and retain such backup data for the duration mutually agreed with IRS COR and according to IRS policies.

The solution shall encrypt (FIPS 140-2 compliant) all data at rest (minimum AES-256) and in transit.

Records Management and File Retention

(1) The contractor shall adhere to the applicable National Archives and Records Administration (NARA) Universal Electronic Records Management (ERM) requirements.

(2) The contractor shall retain all end-user communications.

(3) The contractor shall retain all system level data, transactions logs, audit events, and operating system data.

The contractor shall make all records and files available within the period of performance and according to the requirements/set standards (i.e. the solution shall be able to export communication records to the IRS records management environment, and the records and files shall be readable in common formats including pdf).

The solution shall maintain unlimited version history of each file.

5.7 Authentication, Authorization and Access Control

For IRS external users authentication, the contractor shall adhere to IRS authentication requirements set forth in IRM 10.8.1.4.1.1.8.1, IRM 10.8.1.4.3 and IRM 10.8.24 (https://www.irs.gov/irm/part10/irm_10- 008-001r and https://www.irs.gov/irm/part10/irm_10-008-024r): providing integration with multiple IRS user authentication services as necessary - Example IRS eAuthentication solution providing SAML based authentication.

The contractor shall provide secure provisioning between the IRS network and NS2 cloud.

5.8 Accountability/ Audit

The contractor shall meet the security requirements (including authentication, logging, data filtering, etc.) set forth in IRM 10.8.1.4.1.1.8.1, IRM 10.8.1.4.3 ((https://www.irs.gov/irm/part10/irm_10-008-001r) and IRM 10.8.24 https://www.irs.gov/irm/part10/irm_10-008-024r):

(1) The contractor shall adhere to auditing requirements and auditable events in IRM 10.8.1 (https://www.irs.gov/irm/part10/irm_10-008-001r)

(2) The contractor shall have ability to provide only IRS-selected audit data in a format and method that Enterprise Security Audit Trails (ESAT) accepts.

(3) The solution shall integrate with multiple IRS security and Audit systems including, but not necessarily limited to, user authentication, user authorization, Enterprise Security Audit Trails (ESAT).

(4) The contractor have the ability to ingest all system, application and dedicated infrastructure logs to support the current IRS cybersecurity monitoring program, cyber security incident response and unauthorized access to federal taxpayer information (FTI) UNAX capabilities in accordance with IRS policies contained in IRM 10.8.1.4.1.1.8.1 The log data may be collected via IRS approved agents or native forwarding capabilities.

(5) The solution shall transfer all platform log data from its FedRAMP certified cloud to an IRS AWS Cloud solution (for example via Net Hub) for IRS retrieval and further processing.

(6) The solution shall transfer the data on an agreed-upon interval between the contractor platform and IRS cybersecurity team suggested storage/system

(7) No data shall be permanently deleted from the system unless specifically directed by the IRS.

5.9 Disaster Recovery

Refer to section 5.4 Service Level Agreements for Disaster Recovery SLAs.

The contractor shall have high availability/disaster recovery infrastructure that mitigate environmental/physical threats to operate in multiple locations.

5.10 Section 508 Requirements

The contractor shall adhere to Section 508 of The Rehabilitation Act that requires Federal Agencies’ electronic and information technology accessible to people with disabilities. The solution platform shall meet accessibility requirements as outlined by in Section 508 of the Rehabilitation Act (29 U.S.C. 794d). Reference requirements can be found at: http://www.section508.gov. The solution shall be compliant for both users IRS employees & partners and taxpayers

5.11 Reporting Requirements

IRS may define in writing requirements for additional data elements and statistics at a later time.

The contractor shall maintain all data that is used to generate statistics for the fully managed solution as part of monitoring services. IRS retains the right to verify the contractor-provided summary data.

The contractor shall support creation of and updates to a standard set of reports for application, system and platform monitoring that will be agreed to during the incoming transition phase. The form of these reports and frequency of delivery will also be agreed during the incoming transition phase.

6.0 ADDITIONAL TERMS

6.1 Product Documentation

The contractor shall provide perpetual, worldwide, royalty free, irrevocable license to the IRS to use and make copies of user manuals, documentation, training materials and other information included with the software, together with any updates or enhancements.

6.2 Product Upgrades

The IRS reserves the rights to test any product upgrades prior to the upgrades being made to the production environment.

IRS shall be entitled to use the upgraded version(s) as they are made available or prior versions in any combination at any instant in time.

The contractor shall coordinate all upgrade activities with the IRS though the IRS’s change management process. The contractor shall implement all upgrades within a time frame agreed upon with the IRS COR.

The contractor shall not make upgrades to the licenses/subscriptions nor cloud environments without written agreement from the IRS COR.

7.0 AUDIT AND COMPLIANCE

7.1 License and/or Use Audits

The IRS shall not be subject to, and will not comply with, license use audits of any kind during the term of this agreement. Audits include any action that seeks to identify, confirm, validate, measure, or otherwise determine compliance with license terms or conditions that may involve disclosure of IRS internal operations, system attributes, system parameters, license deployment specifics, personally identifiable information (PII) of any IRS employee, IRS contractor, taxpayer, tax paying entity, or other potentially confidential or IRS sensitive information. Actions integral to the operation of the SAP licenses or cloud environment, such as periodic authorization within a SAP NS2 Cloud, user authentication for access to Cloud based systems or as needed to secure the transmittal of data to, from, or between SAP Cloud based capabilities, shall not be considered audit actions and shall not be used as audit mechanisms for license compliance purposes.

7.2 Compliance

Upon conclusion of the contract term, IRS may agree to provide information substantiating compliance with SAP licensing policies on a voluntary basis if the IRS determines this is in accordance with the rights of the government.

8.0 DELIVERABLES

8.1 Deliverables

The contractor shall provide licensed products to the IRS via electronic means. License activation shall be via secure, encrypted, connections and shall be arranged and implemented between the IRS COR and the contractor.

8.2 License Keys

The contractor shall provide each product and/or subscription with specific service level support that will be treated as its own discrete product and shall have its own unique license key or entitlement certificate.

8.3 IRS Contact

The contractor shall respond to requests for information or licenses, software and site access problems from only the IRS Contracting Officer’s Representative (COR). Any requests from other than the IRS COR shall not be honored by the contractor and shall be directed to the IRS COR/CO.

9.0 IRS CONTACT INFORMATION

Contracting Officer (CO)

TBD

Technical Point of Contact (TPOC)

Sanjay Mandhan - (240) 613-6580 sanjay.mandhan@irs.gov

Contracting Officers Technical Representative (COR) Herman S. Porshnikoff Herman.S.Porshnikoff@irs.gov Alternate Contracting Officers Technical Representative (ACOR) Kidd M. Elliott elliott.m.kidd@irs.gov

10.0 ADDITIONAL SURGE SUPPORT

The Government may require surge support during the base or any option period, and surge modifications will be in-scope to provide increased support for the defined task areas of the SOW. A surge modification will be issued within the scope of the contract and provide increased support for the defined requirement of the SOW. The Surge over the life of the contract will not exceed the Contractor’s total proposed cost/price for the base period and all option periods, excluding the six-month extension of services pursuant to FAR 52.217-8. The Government reserves the right to consolidate additional replacement with new technology into this delivery order in the future. Surge may also be used for other within-scope modifications of this requirement. Surge support is OPTIONAL and is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined in the SOW, the Government reserves the right to exercise the Surge Option unilaterally. The Contracting Officer will provide written notice to the Contractor at least 30 calendar days prior to any unilateral exercise of the Surge Option. In the event the Government does elect to exercise the Surge Option, surge support will be realigned under new or existing CLINs for the relevant task areas identified in the SOW, and an equal amount will be deducted from the Surge CLIN not-to-exceed amount.

image1.png