2032H5-22-Q-00108.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NAICS:

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8 (A)

EDWOSB

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

5000144593 197

2032H5-22-Q-00108

Leona M. Brown 240-613-5175 2050 100

See Attached Performance Work Statement

IRS Procurement 5000 Ellin Road Lanham, Maryland 20706

To All Offerors Invoices must be submitted via IPP.

The purpose of this Request for Quotation (RFQ) is to award a Firm Fixed Price (FFP) Task Order for information technology services in accordance with the attached performance work statement under the General Services Administration (GSA) Multiple Award Schedule (MAS) contract under Category 54151S, Information Technology Professional Services.

Leona M. Brown

541519

$30 Million

08/01/2022

08/17/2022

2:00 PM, EST

IRS Procurement 5000 Ellin Road Lanham, Maryland 20706-1348

Attn: Leona M. Brown

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

Base Period (09/16/2022 - 03/15/2023)

0001 Program Management 6 MO

0002 6 MO

Operations and Maintenance Support

Tiered Support 6 MO 0004 Rent Bill Support 6 MO

Transition-In 1 MO0005

Option Year 1 (03/16/2023 - 03/15/2024)

1001 Program Management 12 MO 1002 Operations and Maintenance Support 12 MO 1003 Tiered Support 12 MO 1004 Rent Bill Support 12 MO

Option Year 2 (03/16/2024 - 03/15/2025)

2001 Program Management 12 MO 2002 Operations and Maintenance Support 12 MO 2003 Tiered Support 12 MO 2004 Rent Bill Support 12 MO

Option Year 3 (03/16/2025 - 03/15/2026)

3001 Program Management 12 MO 3002 Operations and Maintenance Support 12 MO 3003 Tiered Support 12 MO

2032H5-22-Q-00108

FORM 1449 CONTINUE SHEET 1

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

3004 Rent Bill Support 12 MO

3005 Transition-Out (Optional) 1 MO

TABLE OF CONTENTS

Terms and Conditions

Performance Work Statement

Quality Assurance Surveillance Plan

RFQ Provisions

RFQ Notices, Conditions and Instructions

Evaluation Criteria for Award

The terms and conditions of the quoter’s Federal Supply Schedule shall be applicable to this Task Order.

52.252-2 Clauses Incorporated by Reference (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/

NUMBER TITLE DATE

52.204-13 System for Award Management Maintenance (OCT 2018)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (NOV 2021)

52.219-6 Notice of Total Small Business Set-Aside (NOV 2011) 52.219-14 Limitations on Subcontracting (JAN 2017) 52.224-1 Privacy Act Notification (APR 1984) 52.224-2 Privacy Act (APR 1984)

52.232-40 Providing Accelerated Payments to Small Business Subcontractors (DEVIATION APR 2020) (DEC 2013)

52.239-1 Privacy or Security Safeguards (AUG 1996) 52.245-1 Government Property, Alternate I (JAN 2017) 52.245-9 Use and Charges (APR 2012) 52.246-4 Inspection of Services--Fixed-Price (AUG 1996)

52.216-1 Type of Contract (APR 1984)

The Government contemplates award of a firm-fixed price contract resulting from this solicitation.

52.217-8 Option to Extend Services (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the contract’s expiration date.

(End of clause) https://www.acquisition.gov/

52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 42 months.

(End of Clause)

1052.201-70 Contracting Officer's Representative (COR) Appointment and Authority(APR 2015)

(a) The COR is ____ [To be appointed at award]

(b) Performance of work under this contract is subject to the technical direction of the COR identified above, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, and/or fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the contract specification(s)/work statement.

The COR does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the contract specification(s)/work statement;

(2) Constitutes a change as defined in the clause entitled “Changes”;

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR must confirm oral direction in writing within five workdays, with a copy to the Contracting Officer.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR or the designated representative falls within the limitations of (c) above, the Contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government workday.

(f) Failure of the Contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled “Disputes.”

(End of clause)

1052.210-70 Contractor Publicity (Apr 2015)

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the supplies or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such supplies or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government shall consider institution of all remedies available under applicable law, including 31 U.S.C. 333, and this contract. Further, any violation of this clause may be considered as part of the evaluation of past performance.

(End of clause)

IR1052.232-9001 Electronic Invoicing and Payment Requirements for the Invoice Processing Platform (IPP) (JUL 2019)

(a) Definitions:

"Short payment" as used in this clause means the partial payment of an invoice for goods/services actually rendered at the time of payment when the invoice includes additional goods/services that have not yet been provided/rendered.

“Short payment” example: The contract requires the delivery of a set number of items, with the price, delivery location, and delivery due date also specified. The vendor delivers 50% of the items as specified but invoices for 100% of the items. Before implementation of the IPP, the IRS would have paid the vendor for the items delivered and instructed the vendor to re-invoice the IRS when the balances of the items were delivered. In other words, the IRS would "short pay" the invoice since the IRS did not remit payment for the full invoice amount. With implementation of the IPP, the IRS can no longer do this because the IRS cannot accept an electronic invoice that includes items not yet received. The IRS will reject the invoice. The vendor needs to submit an invoice for only the items received by the IRS (in this case, 50%), and, if these items meet all other contract terms and conditions, the IRS will pay the invoiced amount. The vendor submits subsequent invoice(s) for items as they are delivered and accepted.

(b) The Invoice Processing Platform (IPP) is a secure Web-based electronic invoicing and payment information service available to all Federal agencies and their suppliers. Effective October 1, 2012, invoicing for payment through the IPP will be mandatory for all new contract awards. Additional information regarding the IPP may be found at the IPP website address https://www.ipp.gov. Contractors must complete the contractor point of contact information below and submit it with their proposal submissions. Contractors may contact the IPP Helpdesk for assistance via e-mail at ippgroup@stls.frb.org or via phone at (866) 973-3131. Once a contract award has been made, the contractor will be contacted by the IPP via e-mail to set-up an account. It will be necessary for contractors to login to their IPP accounts every 90 days to keep their IPP accounts active.

(c) Contractor Point of Contact Information

Contractor Name: ___________________________________________

Contractor IPP Point of Contact Name: __________________________

Contractor Phone Number: ____________________________________

Contractor E-mail Address: ____________________________________

(d) Electronic Invoicing and Payment Requirements

Vendor invoices submitted electronically through the IPP should be in the proper format and contain the information required for payment processing. To be approved for payment, a “proper invoice” must list the items specified in FAR 52.232-25 (a)(3)(i) through (a)(3)(x), or in the case of a Commercial Item Contract, the items included in 52.212-4(g)(1)(i) through (g)(1)(x).

If the vendor is offering a discount via the IPP, the discount must be reflected on the invoice.

The vendor will select 'Create Invoice'. The IPP system will default to ‘Net 30 Prompt Pay’ under the Payment Terms dropdown box. The vendor will select from 54 different discount options for the invoice that is being created. If the vendor chooses to offer a discount on the invoice screen, the information will interface to the payment system for processing.

Discounts that are offered on attachments rather than the invoice itself cannot be accepted.

Under this contract, the following documents are required to be submitted as an attachment to the invoice (Contracting Officer fills in additional documentation that must be furnished by the contractor (e.g. timesheet)). Please do not submit into IPP any documentation/attachments that conflict with what is stated on the invoice:

Payment and Invoice Questions:

For payment and invoice questions, contact the Ancillary Systems at (304) 254-3372 or via e- mail at cfo.fm.ipp.customer.support@irs.gov.

(e)Waiver

If the Contractor is unable to use the IPP for submitting payment requests starting on October 1, 2012, then a waiver form must be completed and submitted with the contractor’s proposal submission for review and approval by the Contracting Officer based on one of the conditions listed in the waiver. The vendor will be notified prior to award as to whether their request for waiver has been approved or denied. If the waiver is granted, then a copy of the waiver must be submitted with each paper invoice that the vendor submits to the payment office or the invoice will be returned.

(f) Short Payment

Short payment on vendor submitted invoices will no longer be processed or paid. If any portion of the invoice does not meet the requirements for a proper invoice, the entire invoice shall be rejected and returned to the vendor unpaid.

IRS Invoice Processing Platform (IPP) Waiver Form

The IRS invoicing and payment requirements clause (IR1052.232-9000) requires that all invoices under awards made (or effective) on or after October 1, 2012, be submitted electronically via the IPP unless a waiver is requested and granted. If the Contractor is unable to submit its invoice through the IPP, the Contractor shall complete this waiver form indicating the reason for the waiver request by selecting the appropriate box below and providing a narrative summarizing in detail the circumstances requiring a waiver. For a solicitation, submit the waiver form with the proposal submission. For a modification that incorporates the IPP clause into an existing contract, submit the waiver form with the modification. The CO will notify the vendor via e-mail or another appropriate means of communication prior to award as to whether their waiver has been approved or denied. If the waiver is granted, then a copy of the approved waiver must be submitted with each invoice that the vendor submits to the payment office or the invoice will be returned.

Reason for requesting a waiver of the requirement to submit an electronic invoice via the IPP:

1. Submission of invoices through IPP would impose a hardship on an individual (includes employees and sole proprietors) due to: either a physical or mental disability; a geographic, language, or literacy barrier; or an undue financial burden. The requirement to submit invoices through the IPP is automatically waived for all individuals who do not have payment capability using ACH with a U.S. financial institution.

2. The political, financial or communications infrastructure where the place of business is located does not support access to the IPP for submitting invoices electronically.

3. The contractor is located within an area designated by the President of the United States or an authorized agency administration as a disaster area. (Please identify area/location.)

4. The submission of invoices electronically may pose a threat to national security, the life or physical safety of an individual may be endangered, or a law enforcement action may be compromised.

5. The agency does not expect to receive more than one invoice from the same contractor within a one-year period. i.e., the invoice submission is non-recurring.

6. The contractor customarily submits a high volume of invoices on a regular basis via file format, not currently supported by the IPP (i.e., uses a file format other than XML or CSV) and the high volume of invoices would cause a significant burden to the contractor if submitted through the IPP individually. If utilizing this exception, please identify the file formats supported by your invoicing system so that the IPP may consider implementing the requested file format at a later date. File format(s) used: ____________________

7. Other - Please explain: Attach a separate sheet of paper with a summary narrative substantiating the circumstances for the waiver exception selected from above (1 through 7).

Waiver Submitted By:

Contractor Name

Name of Person Submitting Request for Waiver Title

Signature of Person Submitting Request for Waiver

E-mail Address Phone No.

Contract/Order No. Date Submitted

Waiver Approved By:

Contracting Officer’s Name Printed

Contracting Officer’s Signature Date

IR1052.204-9000 Submission of Security Forms and Related Materials (JUN 2021)

The Treasury Security Manual (TD P 15-71) sets forth investigative requirements for contractors and subcontractors who require staff-like access, wherever the location, to (1) IRS-owned or controlled facilities (unescorted); (2) IRS information systems (internal or external systems that store, collect, and/or process IRS information); and/or (3) IRS sensitive but unclassified (SBU) information.

“Staff-Like Access” is defined as authority granted to perform one or more of the following:

1. Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

2. Possess login credentials to information systems (internal or external systems that store, collect, and/or process IRS information);

3. Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) SBU data; (See IRM 10.5.1 for examples of SBU data);

4. Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room. These items include, but are not limited to security devices/records, computer equipment-and identification media. For details see IRM 1.4.6.5.1, Minimum Protection Standards); or,

5. Enter physical areas storing/processing SBU information (unescorted)

Staff-like access is granted to an individual who is not an IRS employee (and includes, but is not limited to: contractor/subcontractor personnel, whether procured by IRS or another entity, vendors, delivery persons, experts, consultants, paid/unpaid interns, other federal employee/contractor personnel, cleaning/maintenance personnel, etc.), and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

For security requirements at contractor facilities using contractor-managed resources, please reference Publication 4812, Contractor Security & Privacy Controls. The contractor shall permit access to IRS SBU information or information system/assets only to individuals who have received staff-like access approval (interim or final) from IRS Personnel Security.

Contractor/subcontractor personnel requiring staff-like access to IRS equities are subject to (and must receive a favorable adjudication or affirmative results with respect to) the following eligibility/suitability pre- screening criteria, as applicable:

6. IRS account history for federal tax compliance (for initial eligibility, as well as periodic checks for continued compliance while actively working on IRS contracts);

7. Selective Service registration compliance (for males born after 12/31/59); Contractors must provide proof of registration which can be obtained from the Selective Service website at

• www.sss.gov.;

• U.S. citizenship/lawful permanent residency compliance; If foreign-born, contractors must provide proof of U.S. citizenship or Lawful Permanent Residency status by providing their Alien Registration Number (“A” Number);

• Background investigation forms;

• Credit history;

• Federal Bureau of Investigation fingerprint results; and,

• Review of prior federal government background investigations.

In this regard, Contractor shall furnish the following electronic documents to Personnel Security (PS) at hco.ps.contractor.security.onboarding@irs.gov within 10 business days (or shorter period) of assigning (or reassigning) personnel to this contract/order/agreement and prior to the contractor (including subcontractor) personnel performing any work or being granted staff-like access to IRS SBU or IRS/contractor (including subcontractor) facilities, information systems/assets that process/store SBU information thereunder:

• IRS-provided Risk Assessment Checklist (RAC);

• Non-Disclosure Agreement (if contract terms grant SBU access); and,

• Any additional required security forms, which will be made available through PS and the

COR.

Contract Duration:

a. Contractor (including subcontractor) personnel whose duration of employment is 180 calendar days or more per year must meet the eligibility/suitability requirements for staff-like access and shall undergo a background investigation based on the assigned position risk designation as a condition of work under the Government contract/order/agreement.

b. If the duration of employment is less than 180 calendar days per year and the contractor requires staff-like access, the contractor (including subcontractor) personnel must meet the eligibility requirements for staff-like access (federal tax compliance, Selective Service Registration, and US Citizenship or Lawful Permanent Residency), as well as an FBI Fingerprint result screening.

c. For contractor (including subcontractor) personnel not requiring staff-like access to IRS facilities, IT systems, or SBU data, and only require infrequent access to IRS-owned or controlled facilities and/or equipment (e.g., a time and material maintenance contract that warrants access one or two days monthly), an IRS background investigation is not needed and will not be requested if a qualified escort, defined as an IRS employee or as a contractor who has been granted staff-like access, escorts a contractor at all times while the escorted contractor accesses IRS facilities, or vendor facilities where IRS IT systems hardware or SBU data is stored. As prescribed in IRM 10.23.2, escorting in lieu of staff-like access for IT systems and access to SBU data (escorted or unescorted) will not be allowed.

The contractor (including subcontractor) personnel will be permitted to perform under the contract/order/agreement and have staff-like access to IRS facilities, IT systems, and/or SBU data only upon notice of an interim or final staff-like approval from IRS Personnel Security, as defined in IRM 10.23.2 – Contractor Investigations, and is otherwise consistent with IRS security practices and related IRMs, to include, but not limited to:

• IRM 1.4.6 – Managers Security Handbook; IRM10.2.14 – Methods of Providing Protection; and, IRM 10.8.1 - Policy and Guidance.

Current Investigation Reciprocity: Individuals who possess a prior favorably adjudicated Government background investigation that meets the scope and criteria required for their position may be granted interim staff-like access approval upon verification of the prior investigation, receipt of all required contractor security forms, and favorable adjudication of IRS pre-screening eligibility/suitability checks. If their current investigation meets IRS established criteria for investigative reciprocity, individuals will be granted final staff-like access, and will not be required to undergo a new investigation beyond an approved pre-screening determination.

Flow down of clauses: The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

(End of clause)

IR1052.204-9001 Notification of Change in Contractor Personnel Employment Status, Assignment, or Standing (JUN 2021)

The contractor, via e-mail (hco.ps.contractor.security.onboarding@irs.gov), shall notify the Contracting Officer (CO), Contracting Officer's Representative (COR), and Personnel Security within one (1) business day of the contractor (including subcontractor) becoming aware of any change in the employment status, information access requirement, assignment, or standing of a contractor (or subcontractor) personnel under this contract or order – to include, but not limited to, the following conditions:

• Receipt of the personnel’s notice of intent to separate from employment or discontinue work under this contract/order;

• Knowledge of the personnel’s voluntary separation from employment or performance on this contract/order (if no prior notice was given);

• Transfer or reassignment of the personnel and performance of duties under this contract/order, in whole or in part, to another contract/order (and if possible, identify the gaining contract/order and representative duties/responsibilities to allow for an assessment of suitability based on position sensitivity/risk level designation);

• Denial of or revocation of staff-like access as determined by IRS Personnel Security;

• Separation, furlough or release from employment;

• Anticipated extended absence of more than 45 days;

• Change of legal name;

• Change to employment eligibility;

• Change in gender or other distinction when physical attributes figure prominently in the biography of an individual;

• Actual or perceived conflict of interest in continued performance under this contract/order

(provide explanation); or

• Death.

When required by the COR, the contractor may be required to provide the information required by this clause to the IRS using the Risk Assessment Checklist (RAC) or security documents as identified by Personnel Security. The notice shall include the following minimum information:

1) Name of contractor personnel;

2) Nature of the change in status, assignment or standing (i.e., provide a brief non-personal, broad-based explanation);

3) Affected contract/agreement/order number(s);

4) Actual or anticipated date of departure or separation;

5) When applicable, the name of the IRS facility or facilities this individual routinely works from or has staff-like access to when performing work under this contract/order;

6) When applicable, contractor (including subcontractor) using contractor (or subcontractor) owned systems for work must ensure that their systems are updated to ensure personnel no longer have continued staff-like access to IRS work, either for systems administration or processing functions; and

7) Identification of any Government Furnished Property (GFP), Government Furnished Equipment (GFE), or Government Furnished Information (GFI) (to include Personal Identity Verification (PIV) credentials or badges – also referred to as SmartID Cards) provided to the contractor personnel and its whereabouts or status.

In the event the subject contractor (including subcontractor) is working on multiple contracts, orders, or agreements, notification shall be combined, and the cognizant COR for each affected contract or order (using the Contractor Separation Checklist (Form 14604 (Rev. 8-2016)) shall be included in the joint notification along with Personnel Security. These documents (the RAC and security forms) are also available by email request to Personnel Security.

The vendor POC and the COR must ensure all badges, Smart Cards, equipment, documents, and other government furnished property items are returned to the IRS, systems accesses are removed, and Real Estate & Facilities Management is notified of federal workspace that is vacant.

As a rule, the change in the employment status, assignment, or standing of a contractor (or subcontractor) personnel to this contract or order would not form the basis for an excusable delay for failure to perform under the terms of this contract, order or agreement.

Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

(End of clause)

IR1052.204-9002 IRS Specialized Information Technology (IT) Security Training (Role-Based) Requirements (NOV 2021)

(a) Consistent with the Federal Information Security Modernization Act of 2014 (FISMA), specialized information technology (IT) security training (role-based) shall be completed prior to access to Information Systems and annually thereafter by contractor and subcontractor personnel who have an IT security role or responsibility.

(b) Identifying contractor/subcontractor with a role or responsibility for IT security is completed by the Contractor, and verified by the COR, by completing the Risk Assessment Checklist (RAC).

The roles listed in the RAC conform to those roles listed in the Internal Revenue Manual 10.8.1.2 that apply to contractor personnel. This process applies to new contractors/subcontractors, replacement personnel and for existing contractors/subcontractors whose roles change during their work on a contract. This includes, but is not limited to, having an approved elevated privilege to one or more IRS systems through the OL5081 process or Business Entitlement Access Request System (BEARS).

(c) Prior to accessing any IT system, all contractor/subcontractor personnel must successfully complete all provisions of IR1052.204-9000 Submission of Security Forms and Related Materials.

(d) In keeping with the Security Orientation outlined in IR1052.224-9001, contractors/subcontractors designated on the Risk Assessment Checklist as performing a role shall complete approved training equal to the assigned hours within 5 business days of receiving the Personnel Security’s memo approving staff-like access.

(e) Annual Requirements: Thereafter, on an annual basis within a FISMA year cycle beginning July 1st of each year, contractor/subcontractor personnel performing under this contract in the role identified herein is required to complete specialized IT security, role-based training by June 1st of the following year.

(f) Training Certificate/Notice: The contractor shall use the Government system identified by Cybersecurity to annually complete specialized IT security training (role- based). The COR will track the courses, hours completed and the adhere to the established due dates for each contractor/subcontractor personnel. Alternatively, courses may be completed outside of the Government system. Any courses taken outside of the Government system must be pre-approved by IRS Cybersecurity’s FISMA Training Compliance team via the COR. Adequate information such as course outline/syllabus must be provided for evaluation. Once a course is approved, certificates of completion provided for each contractor/subcontractor shall be provided to COR in order to receive credit toward the required hours for the contractor/subcontractor personnel.

Copies of completion certificates for externally completed course must be shared with the Contracting Officer upon request.

(g) Administrative Remedies: A contractor/subcontractor who fails to complete the specialized IT security training (role-based) requirements, within the timeframe specified, may be subject to suspension, revocation or termination (temporarily or permanently) of staff-like access to IRS IT systems.

(h) Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

(End of clause)

IR1052.224-9000 Safeguards Against Unauthorized Disclosure of Sensitive but Unclassified Information (NOV 2021)

1. Treasury Directive Publication 15-71 (TD P 15-71), Chapter III – Information Security, Section 24 – Sensitive But Unclassified Information defines SBU information as ‘any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.’ SBU may be categorized in one or more of the following groups—

• Federal Tax Information (FTI), including any information on or related to a tax return

• Returns and Return Information

• Sensitive Law Enforcement Information

• Employee and Personnel Information

• Personally Identifiable Information (PII)

• Information Collected or Created from Surveys

• Other Protected Information

2. Tax return or tax return information disclosed to the contractor can be used only for a purpose and to the extent authorized herein, and willful disclosure of any such tax return or tax return information for a purpose and to the extent unauthorized for provision of appraisal services to assist with the valuation of conservation easements constitutes a felony, punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as five (5) years, or both, together with the costs of prosecution. Any such knowing or negligent unauthorized disclosure of tax return or tax return information may also result in an award of civil damages in an amount not less than $1,000 plus costs with respect to each instance of unauthorized disclosure. These penalties are prescribed by the Internal Revenue Code, Sections 7213 and 7431; see also 26 CFR § 301.6103(n)-1.

3. Contractors who perform work at contractor (including subcontractor) managed sites using contractor or subcontractor managed IT resources shall adhere to the general guidance and specific privacy and security control requirements contained in Publication 4812, Contractor Security & Privacy Controls, IRM 10.23.2 - Personnel Security, Contractor Investigations, IRM 10.5.1 Privacy Policy, and IRM 10.8.1 - Information Technology (IT) Security, Policy and Guidance.

Publication 4812 and IRM 10.5.1, 10.8.1 and 10.23.2 provide comprehensive lists of all security, privacy, information protection and disclosure controls and guidance.

4. Eligibility, Fitness and Suitability. Contractor (including subcontractor) personnel hired for work within the United States or its territories and possessions and who require staff-like access, wherever the location, to IRS-owned or controlled facilities or work on contracts that involve the design, operation, repair, or maintenance of information systems, and/or require staff-like access to SBU information, must meet the eligibility requirements under IRM 10.23.2, Personnel Security, Contractor Investigations, and shall be subject to security screening and investigative processing, commensurate with the position sensitivity level, and in accordance with IRM 10.23.2, and TD P 15-71. Contractor (including subcontractor) personnel must be found both eligible and suitable, and approved for staff- like access (interim or final) by IRS Personnel Security prior to starting work on the contract/order, and before being granted access to IRS information systems or SBU information.

5. General Conditions for Allowed Disclosure. Any SBU information, in any format, made available to or created by the contractor (including subcontractor) personnel shall be treated as confidential information and shall be used only for the purposes of carrying out the requirements of this contract. Inspection by or disclosure to anyone other than duly authorized officer or personnel of the contractor (including subcontractor) shall require prior written approval of the IRS. Requests to make such inspections or disclosures shall be addressed to the CO. Access to SBU information shall be provided on a “need to know” basis. SBU information shall never be indiscriminately disseminated, and no person shall be given access to (or allowed to retain) more SBU information than is needed for performance of their duties, and for which that individual has been authorized to receive as a result of having been successfully investigated, adjudicated, trained to receive, and what is strictly necessary to accomplish the intended business purpose and mission.

6. Nondisclosure Agreement. Consistent with TD P 15-71, Chapter II, Section 2, and IRM

10.23.2.15 - Nondisclosure Agreement for Sensitive but Unclassified Information, each contractor (including subcontractor) personnel who requires staff-like access to SBU information shall complete, sign and submit to Personnel Security – through the CO (or COR, if assigned) — an approved Nondisclosure Agreement prior to being granted staff-like access to SBU information under any IRS contract or order.

7. Training. All Contractor personnel assigned to this contract with staff-like access to SBU information must complete IRS-provided privacy and security awareness training, including the Privacy, Information Protection, and Disclosure training, as outlined in IR1052.224-9001 Mandatory IRS Security Training for Information Systems, Information Protection and Facilities Physical Access. Contractor personnel required to take the Unauthorized Access to Taxpayer Data training must attest to understanding the penalties for unauthorized access, as instructed by the

COR.

8. Encryption. All SBU information must be protected at rest, in transit, and in exchanges (i.e., internal and external communications). The contractor (including subcontractor) shall employ encryption methods and tools to ensure the confidentiality, integrity, and availability of SBU information.

9. Particularly relevant to this clause are the updated sections to IRM 10.8.1 and Publication 4812 regarding email and text messages, alternative work sites, and incident management:

• For email and text messaging, the contractor shall abide by IRM 10.8.1.4.17.2.2 “Electronic Mail (Email) Security”, IRM 10.5.1.6.8 “Email” plus all subsections, and IRM

10.8.2.2.1.18 “Contractor”; or Pub. 4812 section 28.3.1 “Electronic Mail (Email) Security,”. Included are requirements on encryption, subject line content, and restrictions on personal email accounts.

• For alternate work sites the contractor shall abide by IRM 10.8.1.4.11.16 “PE-17 Alternate

Work Site” or Publication 4812 section 21.16 “PE-17 Alternate Work Site,”. Included are requirements for incident reporting, encryption, and secure access.

10. Incident and Situation Reporting. Contractors and subcontractors are required to report a suspected or confirmed breach in any medium or form, electronically, verbally or in hardcopy form immediately upon discovery. All incidents related to IRS processing, information or information systems shall be reported immediately upon discovery to the CO, COR, and CSIRC.

Contact the CSIRC through any of the following methods:

CSIRC Contacts: Telephone: 240.613.3606 E-mail to csirc@irs.gov

In addition, if the SBU information is or involves a loss or theft of an IRS IT asset, e.g., computer, laptop, router, printer, removable media (CD/DVD, flash drive, floppy, etc.), or non-IRS IT asset (BYOD device), or a loss or theft of hardcopy records/documents containing SBU data, including PII and tax information, the contractor shall report the incident/situation to the Treasury Inspector General for Tax Administration (TIGTA) hotline at (800) 366-4484.

11. Staff-Like Access to, Processing and Storage of Sensitive but Unclassified (SBU) Information.

The contractor (including subcontractor) shall not allow contractor or subcontractor personnel to access, process or store SBU on Information Technology (IT) systems or assets located outside the continental United States and its outlying territories.

Contractors (including subcontractors) utilizing their own IT systems or assets to receive or handle IRS SBU data shall not commingle IRS and non-IRS data.

12. Disposition of SBU Information. All SBU information processed during the performance of this contract, or to which the contractor (or subcontractor) was given staff-like access (as well as all related output, deliverables, or secondary or incidental by-products, information or data generated by the contractor or others directly or indirectly from the source material), regardless of form or format, shall be completely purged from all data storage components of the contractor’s or subcontractor facilities and computer systems, and no SBU/Personally Identifiable Information (PII) information will be retained by the contractor either—

• When it has served its useful, contractual purpose, and is no longer needed to meet the contractor’s (including subcontractor) other, continuing contractual obligations to the IRS or

• When the contract expires, or is terminated by the IRS (for convenience, default, or cause).

The contractor (including subcontractor) shall completely purge from its systems and any other storage, all SBU data, including PII and tax information (originals, copies, and derivative works) within 30 days of the point at which it has served its useful contractual purpose, or the contract mailto:csirc@irs.gov expires or is terminated by the IRS (unless, the CO determines, and establishes, in writing, a longer period to complete the disposition of SBU data including PII and tax information).

The contractor shall provide to the IRS a written and signed certification to the COR that all SBU materials/information (i.e., case files, receipt books, PII and material, tax information, removable media (disks, CDs, thumb drives)) collected by, or provided to, the contractor have been purged, destroyed or returned.

13. Records Management.

A. Applicability

This language applies to all Contractors whose personnel create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

Contractor/subcontractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

B. Definitions

"Federal record" as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes [Agency] records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their

[Agency] contract; and

• may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chapters. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Contractors shall ensure that all IRS data and IRS-derived data are in commercially available or open and non-proprietary format for transition (back to IRS) in accordance with the National Archives and Records Administration (NARA) disposition guidance.

4. IRS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of IRS or destroyed except for in accordance with the provisions of IRM 1.15.5, Relocating/Removing Records, the agency records schedules and with the written concurrence of the CO. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must immediately notify the appropriate CO. The CO must report the loss using the PII Breach Reporting Form. Privacy, Governmental Liaison and Disclosure (PGLD, Incident Management) will review the PII Breach Reporting Form and alert the Records and Information Management (RIM) Program Office that a suspected records loss has occurred. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate CO immediately upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to IRS control or the Contractor must hold it until otherwise directed.

Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the approval of the CO prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub- contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with IRS policy.

8. The Contractor shall not create or maintain any records containing any non-public IRS information that are not…