15 Amd 01 2032H8-24-R-00019 DOE College Scorecard.pdf

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

See Attached Schedule(s)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

2032H8-24-R-00019

Office of Procurement Operations-Support Contracts Branch 1003 Bishop St, Suite 1000 Honolulu, HI 96813

Attn: Rovella Malasa

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Steven Collum Contracting Officer

X X

X 1

The purpose of this amendment is to incorporate IRS requirements to Section IV - Clauses and Provisions of RFP 2032H8-24-R-00019, DOE College Scorecard.

8/07/2024

INTERNAL REVENUE SERVICE (IRS) REQUIREMENTS

Submission of Security Forms and Related Materials (APR 2024) The Treasury Security Manual (TD P 15-71) sets forth investigative requirements for contractors and subcontractors who require staff-like access, wherever the location, to (1) IRS-owned or controlled facilities (unescorted); (2) IRS information systems (internal or external systems that store, collect, and/or process IRS information); and/or (3) IRS sensitive but unclassified (SBU) information.

“Staff-Like Access” is defined as authority granted to perform one or more of the following:

• Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

• Possess login credentials to information systems (internal or external systems that store, collect, and/or process IRS information);

• Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) SBU data; (See IRM 10.5.1 for examples of

SBU data);

• Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room. These items include, but are not limited to security devices/records, computer equipment-and identification media. For details see IRM 1.4.6.5.1, Minimum Protection

Standards); or,

• Enter physical areas storing/processing SBU information (unescorted)

Staff-like access is granted to an individual who is not an IRS employee (and includes, but is not limited to: contractor/subcontractor personnel, whether procured by IRS or another entity, vendors, delivery persons, experts, consultants, paid/unpaid interns, other federal employee/contractor personnel, cleaning/maintenance personnel, etc.), and is approved upon required completion of a favorable suitability/fitness determination conducted by IRS Personnel Security.

For security requirements at contractor facilities using contractor-managed resources, please reference Publication 4812, Contractor Security & Privacy Controls. The contractor shall permit access to IRS SBU information or information system/assets only to individuals who have received staff-like access approval (interim or final) from

IRS Personnel Security.

Contractor/subcontractor personnel requiring staff-like access to IRS equities are subject to (and must receive a favorable adjudication or affirmative results with respect

to) the following eligibility/suitability pre- screening criteria, as applicable:

• IRS account history for federal tax compliance (for initial eligibility, as well as periodic checks for continued compliance while actively working on IRS contracts);

https://www.irs.gov/pub/irs-pdf/p4812.pdf

• Selective Service registration compliance (for males born after 12/31/59);

Contractors must provide proof of registration which can be obtained from the Selective Service website at www.sss.gov.;

• U.S. citizenship/lawful permanent residency compliance; If foreign-born, contractors must provide proof of U.S. citizenship or Lawful Permanent

Residency status by providing their Alien Registration Number (“A”

Number);

• Background investigation forms;

• Credit history;

• Federal Bureau of Investigation fingerprint results; and,

• Review of prior federal government background investigations.

In this regard, Contractor shall furnish the following electronic documents to

Personnel Security (PS) at hco.ps.contractor.security.onboarding@irs.gov within 10 business days (or shorter period) of assigning (or reassigning) personnel to this contract/order/agreement and prior to the contractor (including subcontractor) personnel performing any work or being granted staff-like access to IRS SBU or

IRS/contractor (including subcontractor) facilities, information systems/assets that process/store SBU information thereunder:

• IRS-provided Risk Assessment Checklist (RAC);

• Non-Disclosure Agreement (if contract terms grant SBU access); and,

• Any additional required security forms, which will be made available through

PS and the COR.

Contract Duration:

a. Contractor (including subcontractor) personnel whose duration of employment is 180 calendar days or more per year must meet the eligibility/suitability requirements for staff-like access and shall undergo a background investigation based on the assigned position risk designation as a condition of work under the Government contract/order/agreement.

b. If the duration of employment is less than 180 calendar days per year and the contractor requires staff-like access, the contractor (including subcontractor) personnel must meet the eligibility requirements for staff-like access (federal tax compliance, Selective Service Registration, and US Citizenship or Lawful Permanent

Residency), as well as an FBI Fingerprint result screening.

c. For contractor (including subcontractor) personnel not requiring staff-like access to IRS facilities, IT systems, or SBU data, and only require infrequent access to IRS-owned or controlled facilities and/or equipment (e.g., a time and material maintenance contract that warrants access one or two days monthly), an IRS background investigation is not needed and will not be requested if a qualified escort, defined as an IRS employee or as a contractor who has been granted staff-like http://www.sss.gov/ mailto:hco.ps.contractor.security.onboarding@irs.gov access, escorts a contractor at all times while the escorted contractor accesses IRS facilities, or vendor facilities where IRS IT systems hardware or SBU data is stored.

As prescribed in IRM 10.23.2, escorting in lieu of staff-like access for IT systems and access to SBU data (escorted or unescorted) will not be allowed.

The contractor (including subcontractor) personnel will be permitted to perform under the contract/order/agreement and have staff-like access to IRS facilities, IT systems, and/or SBU data only upon notice of an interim or final staff-like approval from IRS Personnel Security, as defined in IRM 10.23.2 – Contractor

Investigations, and is otherwise consistent with IRS security practices and related

IRMs, to include, but not limited to:

• IRM 1.4.6 – Managers Security Handbook; IRM10.2.14 – Methods of

Providing Protection; and IRM 10.8.1 - Policy and Guidance.

Current Investigation Reciprocity: Individuals who possess a prior favorably adjudicated Government background investigation that meets the scope and criteria required for their position may be granted interim staff-like access approval upon verification of the prior investigation, receipt of all required contractor security forms, and favorable adjudication of IRS pre-screening eligibility/suitability checks. If their current investigation meets IRS established criteria for investigative reciprocity, individuals will be granted final staff-like access, and will not be required to undergo a new investigation beyond an approved pre-screening determination.

Flow down of clauses: The contractor shall include and flow down, in its subcontracts

(or arrangements or outsourced service agreements) that entails access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation

(FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

Notification of Change in Contractor Personnel Employment Status, Assignment, or Standing (APR 2024)

The contractor, via e-mail (hco.ps.contractor.security.onboarding@irs.gov), shall notify the Contracting Officer (CO), Contracting Officer's Representative (COR), and

Personnel Security within one (1) business day of the contractor (including subcontractor) becoming aware of any change in the employment status, information access requirement, assignment, or standing of a contractor (or subcontractor) personnel under this contract or order – to include, but not limited to, the following conditions:

Receipt of the personnel’s notice of intent to separate from employment or discontinue work under this contract/order;

Knowledge of the personnel’s voluntary separation from employment or performance on this contract/order (if no prior notice was given);

Transfer or reassignment of the personnel and performance of duties under this contract/order, in whole or in part, to another contract/order (and if possible, identify the gaining contract/order and representative duties/responsibilities to allow for an assessment of suitability based on position sensitivity/risk level designation);

Denial of or revocation of staff-like access as determined by IRS Personnel Security;

Separation, furlough or release from employment;

Anticipated extended absence of more than 45 days;

Change of legal name;

Change to employment eligibility;

Change in gender or other distinction when physical attributes figure prominently in the biography of an individual;

Actual or perceived conflict of interest in continued performance under this contract/order (provide explanation); or

Death.

When required by the COR, the contractor may be required to provide the information required by this clause to the IRS using the Risk Assessment Checklist (RAC) or security documents as identified by Personnel Security. The notice shall include the following minimum information:

Name of contractor personnel;

Nature of the change in status, assignment or standing (i.e., provide a brief non- personal, broad-based explanation);

Affected contract/agreement/order number(s);

Actual or anticipated date of departure or separation;

When applicable, the name of the IRS facility or facilities this individual routinely works from or has staff-like access to when performing work under this contract/order;

When applicable, contractor (including subcontractor) using contractor (or subcontractor) owned systems for work must ensure that their systems are updated to ensure personnel no longer have continued staff-like access to IRS work, either for systems administration or processing functions; and

Identification of any Government Furnished Property (GFP), Government Furnished

Equipment (GFE), or Government Furnished Information (GFI) (to include Personal Identity Verification (PIV) credentials or badges – also referred to as SmartID Cards) provided to the contractor personnel and its whereabouts or status.

In the event the subject contractor (including subcontractor) is working on multiple contracts, orders, or agreements, notification shall be combined, and the cognizant

COR for each affected contract or order (using the Contractor Separation Checklist

(Form 14604 (Rev. 8-2016)) shall be included in the joint notification along with

Personnel Security. These documents (the RAC and security forms) are also available by email request to Personnel Security.

The vendor POC and the COR must ensure all badges, Smart Cards, equipment, documents, and other government furnished property items are returned to the IRS, systems accesses are removed, and Real Estate & Facilities Management is notified of federal workspace that is vacant.

As a rule, the change in the employment status, assignment, or standing of a contractor (or subcontractor) personnel to this contract or order would not form the basis for an excusable delay for failure to perform under the terms of this contract, order or agreement.

Flow down of clauses. The contractor shall include and flow down, in its subcontracts

(or arrangements or outsourced service agreements) that entails staff-like access to

SBU information by a subcontractor, at any tier, the same Federal Acquisition

Regulation (FAR) and local security or safeguard clauses or provisions for protecting

SBU information or information systems that apply to and are incorporated in its prime

IRS Specialized Information Technology (IT) Security Training (Role-Based)

Requirements (APR 2024)

(a) Consistent with the Federal Information Security Modernization Act of 2014

(FISMA), specialized information technology (IT) security training (role-based) shall be completed prior to access to Information Systems and annually thereafter by contractor and subcontractor personnel who have an IT security role or responsibility.

(b) Identifying contractor/subcontractor with a role or responsibility for IT security is completed by the Contractor, and verified by the COR, by completing the Risk

Assessment Checklist (RAC). The roles listed in the RAC conform to those roles listed in the Internal Revenue Manual 10.8.1.3 that apply to contractor personnel. This process applies to new contractors/subcontractors, replacement personnel and for existing contractors/subcontractors whose roles change during their work on a contract. This includes, but is not limited to, having an approved elevated privilege to one or more IRS systems through the Business Entitlement Access Request System

(BEARS).

(c) Prior to accessing any IT system, all contractor/subcontractor personnel must successfully complete all provisions of IR1052.204-9000 Submission of Security

Forms and Related Materials.

(d) In keeping with the Security Orientation outlined in IR1052.224-9001, contractors/subcontractors designated on the Risk Assessment Checklist as performing a role shall complete approved training equal to the assigned hours within

5 business days of receiving the Personnel Security’s memo approving staff-like access.

(e) Annual Requirements: Thereafter, on an annual basis within a FISMA year cycle beginning July 1st of each year, contractor/subcontractor personnel performing under this contract in the role identified herein is required to complete specialized IT security, role-based training by June 1st of the following year.

(f) Training Certificate/Notice: The contractor shall use the Government system identified by Cybersecurity to annually complete specialized IT security training (role-based). The COR will track the courses, hours completed and the adhere to the established due dates for each contractor/subcontractor personnel.

Alternatively, courses may be completed outside of the Government system. Any courses taken outside of the Government system must be pre-approved by IRS

Cybersecurity’s FISMA Training Compliance team via the COR. Adequate information such as course outline/syllabus must be provided for evaluation. Once a course is approved, certificates of completion provided for each contractor/subcontractor shall be provided to COR in order to receive credit toward the required hours for the contractor/subcontractor personnel. Copies of completion certificates for externally completed course must be shared with the Contracting Officer upon request.

(g) Administrative Remedies: A contractor/subcontractor who fails to complete the specialized IT security training (role-based) requirements, within the timeframe specified, may be subject to suspension, revocation or termination (temporarily or permanently) of staff-like access to IRS IT systems.

Flow down of clauses. The contractor shall include and flow down, in its subcontracts

(or arrangements or outsourced service agreements) that entails staff-like access to

SBU information by a subcontractor, at any tier, the same Federal Acquisition

Regulation (FAR) and local security or safeguard clauses or provisions for protecting

SBU information or information systems that apply to and are incorporated in its prime

Pre-Proposal Conference (MAY 2018)

Insert time conference will be held:

Insert date of conference:

Insert address where conference will be held:

Pre-proposal conference will be held at .

The purpose of this conference is to provide a briefing to prospective Offerors regarding the requirement and the requirement documents such as the scope of work or specifications the complexities and location of the services to be performed, along with the general and local conditions which could materially affect the services required and the cost thereof; and to provide a forum for questions concerning the Request for Proposal/Quotation and the proposed contract.

Amendments to Proposal (MAY 2018) Changes to the proposal by the offeror shall be accomplished by amended page(s). Changes from the original page shall be indicated by a vertical line, adjacent to the change, on the outside margin of the page. The Offeror shall include the date of the amendment on the lower right-hand edge of the page as well as the amendment number which caused the change.

Expense Related to Proposal Submissions (MAY 2018)

This solicitation does not commit the Government to pay any costs incurred in the submission of any proposal or bid, or in making necessary studies or design for the preparation thereof or to acquire or contract for any services.

Discussions and Correspondence (NOV 2020)

All communications concerning the solicitation, including any of a technical nature, must be made through the CO.

Correspondence, including written questions, shall be directed to the address shown in Block 8 of the Standard Form 33 and marked for the attention of the individual whose name appears in Block 10A of that form. All verbal communications shall also be directed to that individual.

Questions concerning any technical aspect of the solicitation must be in writing. In order to ensure a timely response, questions shall be received by the Contracting Officer at least days before the due date for receipt of proposals. After this date, the Government will make every effort, but cannot guarantee that questions submitted will be answered before the RFP closing date.

Key Personnel (MAY 2018)

The key personnel cited below are considered essential to the work being performed under this contract. If these individuals leave the Contractor's employ or are reassigned to other programs, the Contractor shall notify the Contracting Officer reasonably in advance and shall submit justification (including proposed substitutions) in enough detail to permit evaluation of the impact on the program. No diversion or replacement shall be made by the Contractor without the written consent of the Contracting Officer.

Key Personnel Title

Compliance with Proposal Instructions (MAY 2018)

Offerors whose proposal(s) are submitted in accordance with the instructions given in Section L and which meet the mandatory requirements in Section C shall be evaluated in accordance with the evaluation criteria presented in the solicitation.

Offerors whose proposals are not submitted in accordance with the instructions given in this RFP or which do not meet the mandatory requirements may not be considered for award.

Disposition of Proposals (MAY 2018)

After evaluation, selection, and contract award, printed copies of unsuccessful proposals will be returned to the contractor upon request. If no request for proposal return is received within 10 business days, proposal copies in excess of the retention requirements of FAR 8.403 and FAR 8.405 will be destroyed.

Safeguards Against Unauthorized Disclosure of Sensitive but Unclassified

Information (APR 2024)

1. Treasury Directive Publication 15-71 (TD P 15-71), Chapter III – Information

Security, Section 24 – Sensitive But Unclassified Information defines SBU information as ‘any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United

States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.’ SBU may be categorized in one or more of the following groups—

• Federal Tax Information (FTI), including any information on or related to a tax return

• Returns and Return Information

• Sensitive Law Enforcement Information

• Employee and Personnel Information

• Personally Identifiable Information (PII)

• Information Collected or Created from Surveys

• Other Protected Information

2. Tax return or tax return information disclosed to the contractor can be used only for a purpose and to the extent authorized herein, and willful disclosure of any such tax return or tax return information for a purpose and to the extent unauthorized for provision of appraisal services to assist with the valuation of conservation easements constitutes a felony, punishable upon conviction by a fine of as much as

$5,000 or imprisonment for as long as five (5) years, or both, together with the costs of prosecution. Any such knowing or negligent unauthorized disclosure of tax return or tax return information may also result in an award of civil damages in an amount not less than $1,000 plus costs with respect to each instance of unauthorized disclosure. These penalties are prescribed by the Internal Revenue Code, Sections

7213 and 7431; see also 26 CFR § 301.6103(n)-1.

3. Contractors who perform work at contractor (including subcontractor) managed sites using contractor or subcontractor managed IT resources shall adhere to the general guidance and specific privacy and security control requirements contained in Publication 4812, Contractor Security & Privacy Controls, IRM 10.23.2 -

Personnel Security, Contractor Investigations, IRM 10.5.1 Privacy Policy, and IRM

10.8.1 - Information Technology (IT) Security, Policy and Guidance. Publication 4812 and IRM 10.5.1, 10.8.1 and 10.23.2 provide comprehensive lists of all security, privacy, information protection and disclosure controls and guidance.

4. Eligibility, Fitness and Suitability. Contractor (including subcontractor) personnel hired for work within the United States or its territories and possessions and who require staff-like access, wherever the location, to IRS-owned or controlled facilities or work on contracts that involve the design, operation, repair, or maintenance of information systems, and/or require staff-like access to SBU information, must meet the eligibility requirements under IRM 10.23.2, Personnel https://portal.ds.irsnet.gov/sites/DCOSProcurement/Policy/Documents/Resources/TD%20P%2015-71.pdf

Security, Contractor Investigations, and shall be subject to security screening and investigative processing, commensurate with the position sensitivity level, and in accordance with IRM 10.23.2, and TD P 15-71. Contractor (including subcontractor) personnel must be found both eligible and suitable, and approved for staff- like access (interim or final) by IRS Personnel Security prior to starting work on the contract/order, and before being granted access to IRS information systems or SBU information.

5. General Conditions for Allowed Disclosure. Any SBU information, in any format, made available to or created by the contractor (including subcontractor) personnel shall be treated as confidential information and shall be used only for the purposes of carrying out the requirements of this contract. Inspection by or disclosure to anyone other than duly authorized officer or personnel of the contractor

(including subcontractor) shall require prior written approval of the IRS. Requests to make such inspections or disclosures shall be addressed to the CO. Access to SBU information shall be provided on a “need to know” basis. SBU information shall never be indiscriminately disseminated, and no person shall be given access to (or allowed to retain) more SBU information than is needed for performance of their duties, and for which that individual has been authorized to receive as a result of having been successfully investigated, adjudicated, trained to receive, and what is strictly necessary to accomplish the intended business purpose and mission.

6. Nondisclosure Agreement. Consistent with TD P 15-71, Chapter II, Section 2, and IRM 10.23.2.15 - Nondisclosure Agreement for Sensitive but Unclassified

Information, each contractor (including subcontractor) personnel who requires staff-like access to SBU information shall complete, sign and submit to Personnel Security

– through the CO (or COR, if assigned) — an approved Nondisclosure Agreement prior to being granted staff-like access to SBU information under any IRS contract or order.

7. Training. All Contractor personnel assigned to this contract with staff-like access to SBU information must complete IRS-provided privacy and security awareness training, including the Privacy, Information Protection, and Disclosure training, as outlined in IR1052.224-9001 Mandatory IRS Security Training for

Information Systems, Information Protection and Facilities Physical Access.

Contractor personnel required to take the Unauthorized Access to Taxpayer Data training must attest to understanding the penalties for unauthorized access, as instructed by the COR.

8. Encryption. All SBU information must be protected at rest, in transit, and in exchanges (i.e., internal and external communications). The contractor (including subcontractor) shall employ encryption methods and tools to ensure the confidentiality, integrity, and availability of SBU information.

9. Particularly relevant to this clause are the updated sections to IRM 10.8.1 and Publication 4812 regarding email and text messages, alternative work sites, and incident management:

• For email and text messaging, the contractor shall abide by IRM

10.8.1.4.17.2.2 “Electronic Mail (Email) Security”, IRM 10.5.1.6.8 “Email” plus all subsections, and IRM 10.8.2.2.1.18 “Contractor”; or Pub. 4812 section 28.3.1 “Electronic Mail (Email) Security,”. Included are requirements on encryption, subject line content, and restrictions on personal email accounts. 10

• For alternate work sites the contractor shall abide by IRM 10.8.1.4.11.16

“PE-17 Alternate Work Site” or Publication 4812 section 21.16 “PE-17

Alternate Work Site,”. Included are requirements for incident reporting, encryption, and secure access.

10. Incident and Situation Reporting. Contractors and subcontractors are required to report a suspected or confirmed breach in any medium or form, electronically, verbally or in hardcopy form immediately upon discovery. All incidents related to IRS processing, information or information systems shall be reported immediately upon discovery to the CO, COR, and CSIRC. Contact the CSIRC through any of the following methods:

CSIRC Contacts: Telephone: 240.613.3606 E-mail to csirc@irs.gov

In addition, if the SBU information is or involves a loss or theft of an IRS IT asset, e.g., computer, laptop, router, printer, removable media (CD/DVD, flash drive, floppy, etc.), or non-IRS IT asset (BYOD device), or a loss or theft of hardcopy records/documents containing SBU data, including PII and tax information, the contractor shall report the incident/situation to the Treasury Inspector General for

Tax Administration (TIGTA) hotline at (800) 366-4484.

11. Staff-Like Access to, Processing and Storage of Sensitive but Unclassified

(SBU) Information. The contractor (including subcontractor) shall not allow contractor or subcontractor personnel to access, process or store SBU on Information

Technology (IT) systems or assets located outside the continental United States and its outlying territories.

Contractors (including subcontractors) utilizing their own IT systems or assets to receive or handle IRS SBU data shall not commingle IRS and non-IRS data.

12. Disposition of SBU Information. All SBU information processed during the performance of this contract, or to which the contractor (or subcontractor) was given staff-like access (as well as all related output, deliverables, or secondary or incidental by-products, information or data generated by the contractor or others directly or indirectly from the source material), regardless of form or format, shall be completely purged from all data storage components of the contractor’s or subcontractor facilities and computer systems, and no SBU/Personally Identifiable Information (PII) information will be retained by the contractor either--

When it has served its useful, contractual purpose, and is no longer needed to meet the contractor’s (including subcontractor) other, continuing contractual obligations to the IRS or

When the contract expires, or is terminated by the IRS (for convenience, default, or cause).

The contractor (including subcontractor) shall completely purge from its systems and any other storage, all SBU data, including PII and tax information (originals, copies, and derivative works) within 30 days of the point at which it has served its useful contractual purpose, or the contract expires or is terminated by the IRS (unless, the

CO determines, and establishes, in writing, a longer period to complete the disposition of SBU data including PII and tax information).

mailto:csirc@irs.gov

The contractor shall provide to the IRS a written and signed certification to the COR that all SBU materials/information (i.e., case files, receipt books, PII and material, tax information, removable media (disks, CDs, thumb drives)) collected by, or provided to, the contractor have been purged, destroyed or returned.

13. Records Management.

A. Applicability

This language applies to all Contractors whose personnel create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists. Contractor/subcontractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C.

Chapter 31) regarding the care and retention of federal records.

B. Definitions

"Federal record" as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a

Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States

Government or because of the informational value of data in them.

The term Federal record:

1. includes [Agency] records;

2. does not include personal materials;

3. applies to records created, received, or maintained by Contractors pursuant to their [Agency] contract; and

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C.

chapters. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the

Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the

Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy

Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Contractors shall ensure that all IRS data and IRS-derived data are in commercially available or open and non-proprietary format for transition (back to IRS) in accordance with the National

Archives and Records Administration (NARA) disposition guidance.

4. IRS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of IRS or destroyed except for in accordance with the provisions of IRM 1.15.5, Relocating/Removing Records, the agency records schedules and with the written concurrence of the CO. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must immediately notify the appropriate CO. The CO must report the loss using the PII

Breach Reporting Form. Privacy, Governmental Liaison and Disclosure (PGLD, Incident Management) will review the PII Breach Reporting Form and alert the

Records and Information Management (RIM) Program Office that a suspected records loss has occurred. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate CO immediately upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to

IRS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the [contract vehicle].

Destruction of records is EXPRESSLY PROHIBITED unless in accordance with

Paragraph (4).

6. The Contractor is required to obtain the approval of the CO prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with IRS policy.

8. The Contractor shall not create or maintain any records containing any non-public IRS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974, Internal

Revenue Code section 6103 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. IRS owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which IRS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor personnel assigned to this contract who create, work with or otherwise handle records are required to take IRS-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flow down of requirements to subcontractors

1. The Contractor shall incorporate the substance of this language, its terms, and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this language will be attributed to the Contractor.

3. Other Safeguards. [Insert any additional disclosure safeguards provided by the Program Office/COR or that the CO determines are necessary and in the best interest of the Government and not addressed elsewhere in the contract. If none are entered here, there are no other safeguards applicable to this contract action.]

Mandatory IRS Security Training for Information Systems, Information Protection and Facilities Physical Access (APR 2024)

The Federal Information Security Modernization Act of 2014 (FISMA) requires each federal agency to provide periodic information security awareness training to all contractors/subcontractors involved in the management, use, or operation of Federal information and information systems. In addition, contractor/subcontractor personnel are subject to the Taxpayer Browsing

Protection Act of 1997, which prohibits willful unauthorized inspection of returns and return information and details that any violation of the Act could result in civil and criminal penalties. Contractor/subcontractor personnel are bound by the

Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

1. The contractor must ensure all new contractor/subcontractor personnel complete all assigned briefings which are based on the responses provided on the

Risk Assessment Checklist Form 14606. These responses pertaining to access to any IRS system, including basic LAN, email and internet; access to any Sensitive but

Unclassified (SBU) data; and access to any IRS facility.

Since new contractor/subcontractor personnel will not have access to the IRS training system, the COR shall provide softcopy versions of each briefing.

i. Exception: Contractor personnel (including subcontractors) performing under IRS contracts with Nonprofit Agencies Employing People Who Are

Blind or Severely Disabled (as described in FAR Subpart 8.7) are exempted from the aforementioned briefing requirements, unless the contractor requests access to the training, or there is a compelling justification for requiring the training that is approved by the Contracting

Officer (CO). An example of this would be in an instance where visually impaired personnel is assigned to perform systems development and has potential staff-like access to IRS information.

ii. Contractor/subcontractor personnel working with IRS information at contractor-controlled facilities with no access to the IRS network will be subject to all mandatory briefing excepting the Facilities

Management Physical Security briefing as outlined in Publication

4812.

iii. Service Personnel: Inadvertent Sensitive Information Access Training

Contractor personnel performing: (i) janitorial and cleaning services

(daylight operations), (ii) building maintenance, or (iii) other maintenance and repair and need staff-like access to IRS facilities are required to complete Inadvertent Access to Sensitive Information (SBU) Access training.

iv. Service Personnel Security Awareness Training: Contractor personnel providing services in the following categories are required to complete

FMSS Physical Security Training:

o Medical;

o Cafeteria;

o Landscaping;

o Janitorial and cleaning (daylight operations);

o Building maintenance; or o Other maintenance and repair

2. In combination these mandatory briefings are known as IRS Security

Awareness Training (SAT). The topics covered are: Cybersecurity Awareness, Privacy Information Protection and Disclosure, Unauthorized Access to Taxpayer

Data, Records Management, Inadvertent Sensitive Information Access, and/or

Facilities Physical Security. The completion of the assigned mandatory briefings constitutes the completion of the Security Orientation.

3. The SAT must be completed by contractor/subcontractor personnel within 10 business days of successful resolution of the suitability and eligibility for staff-like access as outlined in IR1052.204-9000 Submission of

Security Forms and Related Materials and before being granted access to

SBU data. The date listed on the memo provided by IRS Personnel Security shall be used as the commencement date.

4. Training completion process:

The contractor must submit confirmation of completed SAT mandatory briefings for each contractor/subcontractor personnel by either:

i. Using Form 14616 signed and dated by the individual and authorized contractor management entity and returned to the COR.

This option is used for new contractor/subcontractor personnel and any that do not have an IRS network account.

ii. Using the IRS training system which is available to all contractors with IRS network accounts

5. Annual Training. For contracts/orders/agreement exceeding one year in length, either on a multiyear or multiple year basis, the contractor must ensure that personnel complete assigned SAT mandatory briefings annually no later than October 31st of the current calendar year. The contractor must submit confirmation of completed annual SAT on all personnel unable to complete the briefings in the IRS training systems by submitting completed Form 14616 assigned to this contract/order/agreement, via email, to the COR, upon completion.

6. Contractor’s failure to comply with IRS security policy (to include completion and certification of SAT requirements within the timeframe specified) may be subject to suspension, revocation or termination

(temporarily or permanently) of staff-like access to IRS IT systems and facilities.

7. Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the substantially same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

Commercial Advanced Payments (JUN 2020)

Upon receipt of a proper contractor request for advance payment, in accordance with

FAR Clause 52.232-29(e), the advance payment is authorized against the following

CLINs:

CLIN DESCRIPTION ADVANCE PAYMENT AMOUNT

(Contracting Officer to insert each applicable CLIN and amount of advance payment to be made against that CLIN)

A. Date of start of performance of work [Insert start date].

B. Total contract price: [Insert Total KO price].

Total amount authorized for advance payment [Insert Amt].

Remaining Balance: [Insert Remaining Bal].

C. Advance Payment: [Insert Percentage] of total contract price.

D. Remaining payments will be:

(i) Delivery-based

(ii) Based upon a specific event or time

(iii) Interim payments made before any performance of any further work.

E. Payment schedule for remainder ofwork:

Type of Payment Amount of Payment

Date of Payment

F. Contractor will provide the following security for advance payment:

(CO to insert security and any terms and conditions applicable to that security).

(In accordance with FAR 32.206, if contractors’ financial condition is accepted as adequate security for advance payments, insert paragraph G in this clause.)

G. The contracting officer may exercise the Governments rights to require other security under 52.232-29 (c), Terms for Financing of Purchases of Commercial Items, in the event the contractors financial condition changes and is found not to be adequate security.

H. (In accordance with FAR 32.206(c), the contracting officer shall specify, to the extent access is necessary, Information and/or facilities to which the Government shall have access for the purpose of verifying the contractor’s entitlement to payment of contractfinancing.)

Electronic Invoicing and Payment Requirements for the Invoice Processing

Platform (IPP) (JUL 2019)

(a) Definitions:

"Short payment" as used in this clause means the partial payment of an invoice for goods/services rendered at the time of payment when the invoice includes additional goods/services that have not yet been provided/rendered.

“Short payment” example: The contract requires the delivery of a set number of items, with the price, delivery location, and delivery due date also specified. The vendor delivers 50% of the items as specified but invoices for 100% of the items.

Before implementation of the IPP, the IRS would have paid the vendor for the items delivered and instructed the vendor to re-invoice the IRS when the balances of the items were delivered. In other words, the IRS would "short pay" the invoice since the

IRS did not remit payment for the full invoice amount. With implementation of the

IPP, the IRS can no longer do this because the IRS cannot accept an electronic invoice that includes items not yet received. The IRS will reject the invoice. The vendor needs to submit an invoice for only the items received by the IRS (in this case, 50%), and, if these items meet all other contract terms and conditions, the IRS will pay the invoiced amount. The vendor submits subsequent invoice(s) for items as they are delivered and accepted.

(b) The Invoice Processing Platform (IPP) is a secure Web-based electronic invoicing and payment information service available to all Federal agencies and their suppliers. Effective October 1, 2012, invoicing for payment through the IPP will be mandatory for all new contract awards. Additional information regarding the

IPP may be found at the IPP website address https://www.ipp.gov. Contractors must complete the contractor point of contact information below and submit it with their proposal submissions. Contractors may contact the IPP Helpdesk for assistance via e-mail at ippgroup@stls.frb.org or via phone at (866) 973-3131.

Once a contract award has been made, the contractor will be contacted by the

IPP via e-mail to set-up an account. It will be necessary for contractors to login to their IPP accounts every 90 days to keep their IPP accounts active.

(c) Contractor Point of Contact Information

Contractor Name:

Contractor IPP Point of Contact Name:

Contractor Phone Number:

Contractor E-mail Address:

(d) Electronic Invoicing and Payment Requirements

Vendor invoices submitted electronically through the IPP should be in the proper format and contain the information required for payment processing. To be approved for payment, a “proper invoice” must list the items specified in FAR 52.232-25

(a)(3)(i) through (a)(3)(x), or in the case of a Commercial Item Contract,…