205AE9-26-Q-00018-0002.pdf

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

PAGE OF PAGES

1 103

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

5000216045

12/8/2025

12/15/2025

See Attached Schedule(s)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.1

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

205AE9-26-Q-00018

Office of Procurement Operations-Office of Procurement Operations 5218 Atlantic Avenue Mays Landing, NJ 08330-2003 Attn: Jillian Staskin

Office of Procurement Operations-Office of Procurement Operations 5218 Atlantic Avenue Mays Landing, NJ 08330-2003 Attn: Jillian Staskin

The purpose of this amendment is to answer questions received from industry and update the solicitation accordingly. Changes to the solicitation are in blue text following the Q&A pages.

As a result of this amendment, the quote due date has been extended to NLT 1:00pm EST on Thursday, December 18, 2025.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Jillian Staskin Contracting Officer

Amendment 0002

The purpose of this amendment is to answer questions received from industry and update the solicitation accordingly. Changes to the solicitation are in blue text following the Q&A pages.

As a result of this amendment, the quote due date has been extended to NLT 1:00pm EST on Thursday, December 18, 2025.

Question & Answer:

1. Labor Standards and Wage Determination

1.1 Please confirm whether this procurement is subject to the Service Contract Labor Standards (SCLS) or the Davis-Bacon Act.

1.2 If applicable, please provide the correct Wage Determination (WD) for this location.

1.3 If no labor standard applies, please confirm that no WD is required.

Answer: Davis-Bacon Act is N/A as the IRS has classified the requirement as IT/Telecommunications Services, not construction. SCLS is applicable and WD 2015-4857 has been added to the solicitation.

2. Classification of Work (Construction vs. IT Services)

2.1 The PWS includes demolition, conduit penetration, fire-stopping, carpentry, mounting hardware, and IT cabling.

Please confirm whether this requirement is classified as:

• Construction

• Service (IT/Telecommunications)

• Hybrid

2.2 If classified as construction, please confirm whether bonding requirements (bid, payment, performance) apply.

Answer: 2.1 Classified as IT/Telecommunications Services.

2.2 Bonds are not required as the estimated dollar value does not meet the threshold for bonds.

3. Hazardous Materials / Asbestos Information

3.1 The PWS requires Asbestos Awareness training but does not state whether asbestos-containing materials are present.

Please provide the building’s asbestos and hazardous materials survey or confirm whether none is available.

3.2 If asbestos is present, please identify affected areas and required work protocols.

Answer: 3.1 IRS will obtain asbestos confirmation from Building Delegation Manager.

3.2 Work will not begin until hazards removed; protocols will be issued.

4. Security Requirements and Background Checks

4.1 Please confirm the required background investigation level for contractor and subcontractor personnel (PIV, Tier 1/NACI, fingerprinting, BEARS enrollment, etc.).

4.2 Are subcontractors permitted to complete security vetting remotely, or must vetting occur onsite?

4.3 Is continuous escort required for unbadged personnel?

Answer: Tier 1/NACI, fingerprinting, BEARS; escort required until cleared.

5. Working Hours and Operational Restrictions

5.1 The PWS states working hours as 8AM–5PM. Are any portions of the work required to be completed after hours (e.g., cutovers, demolition, drilling, ladder use, or noisy work)?

5.2 Are installations permitted during normal business hours, or is after-hours/weekend work required?

5.3 Are there any noise, lift, or ladder restrictions during IRS operating hours?

5.4 Are there any IRS operational blackout dates, such as during tax season, that restrict physical work?

5.5 Are there noise, vibration, or disruption restrictions we should account for?

Answer: 8AM–5PM; noisy work may require after-hours; tax-season restrictions may apply.

6. Material Requirements and Brand Acceptance

6.1 Please confirm whether this procurement is brand-name required (Panduit and listed components) or brand-name-or-equal.

6.2 If “or equal” is acceptable, please confirm what supporting documents are required (e.g., cut sheets, compliance matrix, certification).

6.3 Please provide the IRS’s approved materials list, if one exists.

Answer: Brand‑name‑or‑equal; equivalency documentation required.

7. Manufacturer Certification for 25-Year Warranty

7.1 The PWS requires a 25-year manufacturer warranty for the structured cabling system.

Please confirm whether the prime and subcontractor must be:

• Manufacturer-certified installers, and

• Eligible to submit formal warranty registration.

7.2 Must certification documents be submitted with the proposal, or only after award?

Answer: Manufacturer certification required for 25-year warranty. Certifications shall be submitted with the proposal. Section L has been updated accordingly.

8. Missing IRS Cabling Templates and Standards

8.1 The PWS references IRS-specific templates for:

• Labeling conventions

• Patch panel nomenclature

• Rack elevation diagrams

• Pathway layout

• Cable routing

Will the IRS template package be provided post award or confirm where it can be accessed.

Answer: Provided post-award.

9. Documentation Format Requirements

9.1 Please confirm required formats for:

• Cable test results (PDF, FLW native file, Excel summary)

• As-built drawings (AutoCAD, PDF, or both)

• Labeling records (CSV, Excel, or IRS-specific format)

9.2 Please confirm whether digital redlines are acceptable or if full CAD updates are required.

Answer: Test results PDF + FLW; As‑builts PDF + CAD; labeling Excel/CSV

10. Storage, Staging, and Access

10.1 Will the contractor have access to onsite storage or staging areas?

10.2 Is there a loading dock or freight elevator available?

10.3 Are there restrictions on material delivery hours?

Answer: Limited storage; loading dock available; deliveries during business hours.

11. Site Visit

11.1 Please confirm whether a site visit is:

• Required

• Optional

• Not permitted

11.2 If a site visit is required, please provide the date, time, and sign-up process.

Answer: We will not be holding site visits. Coordinate with local telecom if Award is given.

12. Network Cutover and IRS Coordination

12.1 Will IRS IT personnel be required for cutover and activation activities?

12.2 Are there specific scheduling windows or blackout periods for network disruptions?

Answer: IRS IT personnel required; blackout windows may apply. Coordinate with local Telecom POC after award.

13. Removal of Existing Cable

13.1 Is the contractor required to remove abandoned cabling, or may existing cables remain in place?

13.2 If removal is required, must cable disposal follow any IRS-specific protocol?

13.3 The PWS requires removing abandoned cabling but does not specify whether removal must occur:

• To the nearest accessible point, or

• Completely back to the IDF/MDF as required by NFPA 70 (NEC 800.25).

Please clarify required removal depth.

Answer: Remove abandoned cabling; dispose per regulations; remove back to MDF/IDF unless obstructed

14. Phased Delivery and Long-Lead Items

14.1 Are phased deliveries permitted?

14.2 If long-lead materials (e.g., racks, pathways) exceed typical timelines, should the contractor assume alternative lead-time requirements?

Answer: Phased deliveries are permitted; use standard lead times.

15. Unforeseen Conditions and Equitable Adjustments

15.1 Please clarify the process for handling unforeseen conditions such as:

• Blocked conduits

• Damaged tray or pathways

• Asbestos discovery

• Structural obstructions

15.2 Will the IRS allow equitable adjustments under this RFQ if such conditions arise?

Answer: Report immediately; equitable adjustments per FAR 52.212-4(d).

16. Past Performance Requirements

16.1 Please confirm whether specific past performance documentation is required (examples, CPARS, past contract numbers, etc.).

16.2 If required, please state:

• Number of projects

• Required similarity (size, scope, complexity)

• Documentation format

Answer: The solicitation is clear on its face. Please refer to Section L.3.1.2 under Factor 3.

17. Safety Plans and Compliance

17.1 Please confirm whether safety plans must include:

• JHA/JSAs

• OSHA 10/30 certifications

• Site-specific safety plan

17.2 Please indicate whether additional IRS-specific safety standards apply.

Answer: Site‑specific plan; OSHA‑10/30; JHA/JSA; ladder & asbestos awareness

18. Insurance Requirements

18.1 Please confirm minimum required coverage for:

• General liability

• Auto

• Workers comp

• Professional liability (if required)

18.2 Is additional insured status required?

Answer: General Liability, Auto, Workers Comp; professional liability only if design services apply; additional insured if required. FAR 52.228-5 Insurance-Work on a Government

Installation has been added to the solicitation.

19. Cable Type and Specification

19.1 Please confirm whether the IRS requires Cat6 or Cat6A cabling for this project.

19.2 Are there IRS-specific cable performance requirements (plenum, manufacturer preferences, color coding)?

Answer: Cat6A required; plenum needed; IRS labeling applies.

20. Patch Panels, Racks, and MDF Requirements

20.1 Should the contractor furnish and install new patch panels, or terminate into existing panels in the MDF?

20.2 Is there sufficient rack/rail space available in the MDF, or should the contractor include new rack hardware?

20.3 Should patch panels be 48-port, 24-port, or a specific configuration?

Answer: Provide new patch panels; include new rack hardware; 48‑port panels unless directed otherwise.

21. Pathways and Ceiling Conditions

21.1 Can the IRS confirm whether existing pathways (J-hooks, tray, conduit) are present and may be used?

21.2 If supplemental pathways are required, should they be included in the quote or treated as an as-needed add?

21.3 Can the IRS confirm the ceiling type at the East Lansing facility (e.g., drop ceiling, hard lid, mixed)?

Answer: Existing pathways may be used; provide supplemental if needed; drop‑ceiling.

22. Q-Matic Drop Requirements

2.1 The floor plan indicates Q-Matic locations. Should these be treated as standard data drops, or do they require any specialty wiring or labeling?

Answer: Treat as standard data drop.

23. Access Point (AP) Drops

23.1 For the five future AP locations, should RJ-45 jacks be installed at ceiling level, or does the IRS require AP mounting brackets or hardware?

23.2 Should the contractor provide patch cords for AP ports (length/type)?

Answer: Ceiling termination; contractor provides patch cords.

24. Testing and Documentation

24.1 What testing standard is required — e.g., TIA-568, Fluke DSX certification, or IRS-specific documentation?

24.2 Should electronic PDF test reports be sufficient, or is a specific report format required?

Answer: TIA‑568; Fluke DSX; PDF reports.

25. Clarification on Drop Count

25.1 The floor plan shows 55 workstation drops + 5 AP drops, for a total of 60. Please confirm that this is the final and accurate count for the installation.

Answer: Total of 60 (55 workstation, 5 AP, 1 Q‑Matic).

Section B. SERVICE PRICE

B.1 TYPE OF CONTRACT

It is the intent of the Internal Revenue Service (IRS) to award one Firm Fixed Price (FFP) Purchase Order.

Award will be made after evaluation of quotes based on the criteria as stated in Section L and Section M of this RFQ.

B.2 CLIN STRUCTURE

CLIN DESCRIPTION TYPE QTY Unit Price TOTAL AMOUNT 0001 East Lansing -IRA Network

Modernization IRA Network Modernization Project for East Lansing MI

FFP 6 $ $

Total Task Order Value

B.3 CONTRACTOR’S QUOTE

Performance of this Order by the Contractor shall be conducted and performed in accordance with the detailed obligations to which the Contractor committed itself in the submitted Technical and Price Quote in response to the solicitation. All proposed rates and labor categories submitted in the Quote are bound by the award and shall not be deviated unless approved in writing by the Contracting Officer. All rates and labor categories performed by the Contractor shall be at the lowest achievable labor category as to not jeopardize quality of the services performed.

B.4. PERIOD OF PERFORMANCE

The period of performance is expected to be 4-8 weeks after date of award. Hard dates will be defined in the task order award.

Section C. PERFORMANCE WORK STATEMENT

BACKGROUND

The Michigan MI2101 modernization project is a critical initiative supporting the Internal Revenue Service’s (IRS) efforts to enhance telecommunications infrastructure at the Michigan MI2101 Post of Duty. This project aims to improve operational efficiency, scalability, and compliance with federal standards.

Work shall be completed during business hours of 8:00 AM to 5:00 PM, Monday – Friday, per the General Contractor’s construction schedule. Noisy work shall be done before or after standard business hours, after hour coordinate with local telecom. Will keep the area clean and clear of debris of each workday and ensure all excess materials and trash are removed.

SCOPE OF WORK

The contractor shall provide the following services:

1. Comprehensive cable plant planning and design review.

2. Selection and procurement of components.

3. Development of installation designs and specifications.

4. Accurate cost estimates for all project phases.

5. Phased project scheduling to ensure minimal disruption.

6. Installation of structured cabling systems, network racks, and fiber infrastructure.

7. Detailed testing and documentation of all installed systems.

8. Coordination with IRS local Telecom staff for all scheduling, access, escorting, cutovers, and operational impacts.

9.Compliance with all IRS security, safety, operational, and documentation requirements described in this

PWS.

Key Deliverables:

- 60 cable drops:

- 55 data drops.

- 5 future access points (APs).

- 1 Q-Matic drop.

- Termination of cables in the (Main Distribution Frame) MDF, and wall/furniture interface inserts (WSIs).

- Installation and labeling of all network racks and fiber infrastructure.

-As-built drawings (PDF + AutoCAD) -Fluke DSX test results (PDF + FLW native files) -Labeling records (Excel or CSV) -Manufacturer and workmanship warranties

MATERIALS Quantity

General Cat 6A 10,000 FT 10’ CAT6 PATCH CORD BLUE (Plenum) 64 CAT32+PCD1B J-Hooks 128 Mod Furniture Cover Plate 26

Furniture Data Conn 5

CAT 6A PATCH CORD 34

Vertical Cable Management 6” 3

VERT CENTER BRACKET KIT 1

PANDUIT WMPSE HORZ CABLE

MGMT1 10

Panduit Cat 6A Patch Panel ( 48 ) 2 CAT 6 Term 96 16’ 1 (4) Post Rack ALUM 1 Ground Bar 1 Anchors (not bolts) 24 Panduit mini-conn Jack 6A 51

Cable type must be Cat6A plenum (CMP) per NFPA 70 and IRS facility standards.

All materials brand-name or equal, with equivalency documentation required.

Lead times shall follow industry standards:

Termination hardware: 2–4 weeks Plenum cable: 2–6 weeks Racks/cable managers: 4–8 weeks Phased deliveries are permitted but must be coordinated with local Telecom.

Items

DESIGN/INSTALLATION PLAN

The contractor shall develop a detailed design and installation plan for Government approval. This plan must include:

- Floor plans for (Main Distribution Frame) MDF, (Independent Distribution Frame) IDF, and associated telecommunications areas.

- Cable labeling and testing schemes in accordance with ANSI/TIA/EIA-606-B standards.

- Structured rack layouts showing patch panels, switches, and power distribution units (PDUs).

- Local IRS Telecom must approve all cutover plans, scheduled outages, and sequence of work.

- Plan must identify existing pathways and required supplemental pathways.

-Contractor must confirm ceiling type (drop ceiling) and verify plenum classification.

Change Control:

- Any unforeseen conditions (blocked conduit, damaged pathway, asbestos discovery, structural conflict) must be reported IMMEDIATELY to the COR.

-No work may proceed until written COR direction is provided.

Any deviations from the approved design must be documented, estimated, and submitted for written approval by the Government. Verbal approvals for urgent changes must be followed by written confirmation.

SPECIFICATIONS

The installation must comply with the following standards and regulations:

- ANSI/TIA/EIA-568-C.2: Telecommunications Cabling Standard.

- ANSI/TIA-942: Data Center Infrastructure Standards.

- ANSI/TIA-607-C: Bonding and Grounding Requirements.

- ANSI/BICSI 002: Best Practices for Data Center Design.

IRS Compliance Requirements:

Clearance Standards:

Front Clearance: 36 inches.

Rear Clearance: 24 inches.

Side Clearance: 24 inches (if applicable).

Grounding: Use dedicated grounding bars compliant with ANSI/TIA-607-C.

Cable Management: Use J-hooks and secure cables with Velcro straps to prevent stress and maintain flexibility.

-All cabling must be plenum-rated unless written exemption is provided by property management.

Removal and installation must comply with NEC 800.25, IRM 2.7.1, and local fire code.

-Contractor shall adhere to IRS-approved labeling schemes.

Fire Safety: Implement fire-stopping measures with non-mechanical materials approved by local fire authorities.

Work hours are 8 AM – 5 PM unless after-hours approval is granted.

Noisy or disruptive work (drilling, demolition, ceiling penetration) may be restricted to after-hours.

IRS may impose operational blackout periods (e.g., filing season).

After-hours access must be coordinated with the COR and local Telecom.

NETWORK RACK MODERNIZATION

The vendor shall:

- Remove existing racks obstructed by HVAC systems or sprinklers.

- Install new network racks with the following configuration:

- Top Layer: Patch panels for structured cabling terminations.

- Middle Layer: Network switches (e.g., Cisco Catalyst).

- Bottom Layer: Power distribution units (PDUs).

- Deploy vertical and horizontal cable management systems for optimal routing.

- Utilize labeled, color-coded short patch cables (1-3 feet) to maintain a neat and professional appearance.

- Contractor shall install new 48-port patch panels.

- Implement IRS-approved labeling schemes for cables, ports, and rack units.

TESTING

Testing must adhere to EIA/TIA-568-C standards, including:

- Continuity and wire map validation.

- Near-End Crosstalk (NEXT) and attenuation measurements.

- Fiber testing for power loss and continuity in compliance with ANSI/TIA/EIA-526-14A.

A comprehensive test report shall document results, including any corrections for failed tests.

-All test results must be submitted in PDF and native FLW format.

-Failed tests must be corrected at no cost to the Government.

Quality Assurance Surveillance Plan (QASP) The Government will use this Quality Assurance Surveillance Plan (QASP) to evaluate the Contractor’s performance in removing and disposing of existing telecommunications and network cabling. The objective of this QASP is to ensure all work is performed in accordance with the Statement of Work (SOW), applicable codes, and environmental standards. The Contracting Officer’s Representative (COR) will conduct inspections during and after removal activities using random sampling and 100% inspection methods for safety and regulatory compliance. Key performance metrics include (1) complete removal of all designated cabling and components, (2) prevention of damage to active systems or building structures,

(3) compliance with safety and environmental disposal requirements, and (4) timely completion of work within the approved schedule. Any identified deficiencies will be documented in a Corrective Action Report (CAR) and monitored until resolved. Unsatisfactory performance may result in withholding of payment or other contractual remedies as determined by the Contracting Officer.

Remove and Dispose of Existing Cabling

The Contractor shall remove all existing telecommunications and network cabling, including associated conduit, raceways, and termination hardware, as identified in the project drawings or directed by the Government. All removal activities shall be performed in a manner that prevents damage to active infrastructure, building systems, and structural elements. The Contractor shall properly coil, label, and transport removed materials to an approved staging area for inspection by the Contracting Officer’s Representative (COR) prior to disposal. All waste material, including copper, fiber, and related components, shall be disposed of or recycled in compliance with applicable federal, state, and local environmental regulations. The work area shall be cleaned and restored to a safe and orderly condition upon completion.

-Cable removal must extend back to the MDF/IDF unless obstructed.

-Contractor must comply with NEC 800.25 and IRM 2.7.1.

-All removal scheduling must be coordinated with local Telecom staffing.

Delegated Buildings - Wall, Floor or Ceiling Permeation:

In IRS delegated buildings, the Building Delegation section must be contacted for approval prior to the start of the project to ensure there is no asbestos containing material present in the area prior to the start of work. The Building Delegation Manager will provide a written statement about status of asbestos containing or other hazardous materials at the designated work site. The project will not proceed until hazard(s) have been eliminated from the area. Contract personnel must have received Asbestos Awareness training by the employer prior to arriving on the worksite regardless of asbestos clearance. An email from the property manager is required to EHS Review Team with a statement that the project area(s) is/are free from any known hazards.

General Safety:

It is the contractor’s responsibility to know and understand which regulations and standards promulgated by the Occupational Health and Safety Administration applies to them and they’re sub-contractors, as well as any local or state health and safety regulations. Sub-contractors who have less than 10 employees are not exempt from OSHA regulations and standards while working on a federal contract.

-Provide site-specific Safety Plan, including JHA/JSA and OSHA 10/30 documentation.

Working at Heights (over 4 feet off ground) If ladders are to be used to reach ceilings to pull wires contractors and subcontractors shall be trained in ladder safety per 29 CFR 1910.23 and use the appropriate non-conductive ladders for any work involving electrical devices. The contractor shall not leave a ladder to climb onto any structures, in the ceiling spaces or anywhere else, that are not meant for human occupancy. The contractor shall ensure they provide the necessary equipment for their employees and subcontractors to work at heights safely and in compliance with 29 CFR 1910.28 and 1910 Subpart F.

Green Purchasing and Bio-Based Preferred When acquiring goods and services, the contractor shall acquire green products including bio-based, environmentally preferable, energy-efficient, water-efficient, and recycled-content products. The Contractor shall use paper of at least 30 percent post-consumer fiber content. When acquiring an electronic product to meet facility requirements, the contractor shall purchase Electronic Product Environmental Assessment Tool (EPEAT)-registered electronic products, unless there is no EPEAT standard for such product.

The contractor shall give preference to the purchase of:

• Recycled content products designated in EPA’s comprehensive procurement guidelines.

• Energy Star® products identified by DOE and EPA, as well as FEMP-designated energy-efficient products.

• Water-efficient products, including those meeting EPA’s Water Sense standards.

• Energy from renewable sources.

• Biobased products designated by the U.S. Department of Agriculture in the Bio Preferred program.

• Environmentally preferable products and services, including EPEAT-registered electronic products.

• Alternative fuel vehicles and alternative fuels required by EPAct.

• Products with low or no toxic or hazardous constituents’ non-ozone depleting substances, as identified in EPA’s Significant New Alternatives Program.

Biobased products are commercial or industrial products that are composed in whole, or in significant part, of biological products or renewable domestic agricultural materials or forestry materials. To the greatest extent feasible, the Contractor shall use “Green” products and services.

WARRANTY

The contractor must provide:

- A 1-year workmanship warranty, covering installation defects.

- A 25-year material warranty, covering all installed components and cabling.

DOCUMENTATION

The contractor shall submit the following within 30 days of project completion:

- As-built diagrams, including labeled rack and cable layouts.

- Comprehensive testing reports for all systems.

- Warranty documentation for materials and workmanship.

- As-builts must be delivered in PDF + AutoCAD.

-Cable test results must be delivered in PDF + FLW.

-Labeling must be provided in Excel or CSV.

-Final CAD drawings are required (digital redlines alone are not acceptable).

SECURITY REQUIREMENTS

-All personnel must complete Tier 1/NACI, fingerprinting, and BEARS enrollment.

-Unbadged personnel must remain under continuous escort by local Telecom staff.

-Remote vetting is permitted where allowed by IRS Security.

-Badges must always be visible.

STORAGE, STAGING, AND SITE ACCESS

-Limited onsite storage may be available and must be coordinated with local Telecom.

-Loading dock and freight elevator access available as approved.

-Deliveries must occur during business hours.

NETWORK CUTOVER COORDINATION

-IRS IT personnel must participate in all cutover and activation events.

-Cutovers must be scheduled in advance and may be subject to blackout periods.

Post-Award Monthly Workforce Report (Recurring Deliverable)

The contractor shall submit the workforce report using the template at Attachment 2 with each invoice submitted.

Monthly Prime Contractor Certification. Contractors shall include with each monthly workforce report a certification signed by an authorized company officer affirming that, based on current performance data, the small business prime and its similarly situated subcontractors collectively performed at least 51 percent of the total contract cost for personnel during the reporting period. This information shall be used by the CO to verify compliance throughout performance.

FISMA Cybersecurity Requirements Language

Incorporate FISMA Cybersecurity Requirements language in all solicitations and delivery/task order contracts (Section C or H) when procuring information technology systems, applications, or services.

Information Systems and Information Security Controls for Contracting Actions Subject to Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP)

In performance of this contract, the contractor agrees to comply with the following cybersecurity requirements and assumes responsibility for compliance by its personnel and subcontractors (and their personnel):

1. General. The contractor shall ensure IRS information and information systems are always protected. The contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security and privacy controls, requirements, and objectives described in applicable security and privacy control guidelines, and their respective contracts. Pursuant to the Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP), the contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with the Internal Revenue Manual (IRM) Part 10.8 series and the current version of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security Privacy Controls for Information Systems and Organizations.

2. Business Entitlement Access Request System (BEARS) /Entitlement - Role-based user permission groups. The contractor shall ensure all applications and platforms integrate with the IRS to establish least privilege BEARS entitlements for all roles that prevent any one role from authorizing a transaction from end to end.

3. Privileged User Management and Access System (PUMAS). The contractor shall ensure all applications and platforms integrate with the IRS’s PUMAS to secure, provision, manage, control, and monitor all activities associated with all types of privileged identities to include, but not limited to, privileged user accounts, service accounts, and secrets management for on-premises and cloud-based applications and infrastructure.

4. Log Management and Enterprise Security Audit Trails (ESAT). The contractor shall ensure systems provide audit trails in an approved automated format acceptable to the IRS for all user actions and activities when using or maintaining the system. In accordance with NIST 800-53 Audit and Accountability (AU) controls, applications and platforms shall integrate with ESAT for audit logging to support organization-wide analysis and correlation for situational awareness.

The contractor shall provide to the IRS to be used in accordance with OMB Memo 21-31, the system logs for both services implemented on servers within the authorization boundary and services deployed on Cloud Service Offerings. The contractor shall collect and maintain network and system logs on Federal Information Systems for both on-premises systems and connections hosted by third parties, and when it is necessary to address a cyber incident on Federal Civilian Executive Branch Information Systems.

5. Federated Authentication Services Technology (FAST)/Homeland Security Presidential Directive 12 (HSPD-12) Compliant Authentication. The contractor shall ensure the system enforces the use of phishing resistant, modern multifactor authentication (MFA) compliant with Treasury, Federal and HSPD-12 Policy/Guidance. Use of MFA shall be at the exclusion of all other authentication methods i.e., username and password.

The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified IRS Administrators that will allow IRS designated personnel the ability to perform management duties on the system. The contractor shall support MFA including phishing resistant MFA (e.g., Fast Identity Online/Web Authentication and public key infrastructure (PKI)) as required by Office of Management and Budget (OMB) Memo 22-09. The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified contractor administrators that will allow contractor designated personnel the ability to perform management duties on the system.

Use of federated MFA may be leveraged by adopting one or more of the following Treasury/IRS Enterprise Services:

i. Secure Access Digital Identity (SADI) for authenticating external users.

ii. IRS Active Directory Federation Services (ADFS) for internal IRS users

iii. Common Access Identity Assurance (CAIA)/Treasury Enterprise Authentication Service (TEAS) in support of all Treasury

6. Cryptography Key Establishment and Management (System and Communications Protection (SC-12)). The contractor shall establish and manage cryptographic keys for required cryptography employed within the information system in accordance with centralized management of key generation, distribution, storage, access, and destruction in accordance with NIST SP 800-57, Recommendation for Key Management.

7. Data-at-Rest and Data-in-Motion Encryption of all IRS Data. The contractor shall ensure all applications encrypt data at rest (per NIST 800-53, latest revision, SC-28) and data in transit (per NIST 800-53, latest revision, SC-9). SC-28 and SC-9 must pass all objective criteria stated in NIST 800-53. In addition, the encryption solution must meet or exceed all Federal Information Processing Standards (FIPS) 140 standards. All web traffic will enforce Hypertext Transfer Protocol (HTTPS) Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocols.

8. Data Jurisdiction. The contractor and subcontractors shall identify all data centers that the data at rest or data backup will reside. All data will be guaranteed to reside (and transit) within the United States (or U.S. territories).

9. Non-repudiation. The contractor shall ensure the sender of information is provided with proof of delivery, and the recipient is provided with proof of the sender’s identity. The IRS uses digital certificates to confirm the identity of Internet users sending x.509 standard encrypted information, to verify the integrity and origin of file contents. The contractor shall agree to install United States Treasury TLS site certificates for the purpose of authenticating traffic between the contractor application and the IRS. The use of SSL or TLS to facilitate arbitrary transmission control protocol (TCP) and user datagram protocol (UDP) or other protocols (effectively, anything other than HTTP) inside the encrypted TLS tunnel between an internal IRS client and an external server cannot be used.

Site-to-site virtual private network (VPN) or internet protocol security (IPsec) can be used as long as there are verifiable controls to ensure that the vendor end of that tunnel is an environment that is a closed environment. That is, the environment must be isolated at the network layer from other customers services by the offeror and does not provide for communications to other services (e.g., a gateway or routing service to endpoints outside of the control of the vendor submitting the proposal, etc.).

10. Media Transport. The contractor shall document activities associated with the transport of IRS agency information stored on digital and non-digital media and employ cryptographic mechanisms to protect the confidentiality and integrity of this information during transport outside of controlled areas. The contractor shall ensure all digital media, containing IRS information, that is transported outside of controlled areas must be encrypted using FIPS 140-2 level 2, FIPS 140-3 or National Security Agency (NSA) approved cryptography; nondigital media must be secured using the same policies and procedures as paper. The contractor shall ensure media, containing IRS information that is transported outside of controlled areas must ensure accountability. This can be accomplished through appropriate actions such as logging and a documented chain of custody form. IRS data that resides on mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards) must be encrypted. All IRS data residing on laptop computing devices must be protected with NIST-approved encryption software.

11. Boundary Protection. The contractor shall ensure that IRS information, other than unrestricted information, being transmitted from Federal government entities to external entities using cloud services is inspected by Trusted Internet Connections (TIC) processes, or the contractor shall route all external connections through a TIC in accordance with OMB Memo 19-26.

12. Security Alerts, Advisories, and Directives. The contractor, subcontractor or cloud service provider shall provide a list of personnel, identified by role, with system administration, monitoring, and/or security responsibilities who shall receive security alerts, advisories, and directives.

13. Developer Security Testing and Evaluation. The contractor shall provide the IRS with all test plans and test results developed under IRS IRM 10.8.24.3.15.9 (SA-11: Developer Security Testing and Evaluation) at least 30 days prior to the release of any new code, settings, enhancement(s) or deprecation of features.

14. Software Bill of Materials (SBOM)/Attestation. The contractor shall provide a software build/bill of materials, and attestation in accordance with OMB Memo 22-18 using CISA templates.

https://www.cisa.gov/sbom

15. RA-05 Vulnerability Mitigation. Per Binding Operational Directive (BOD) 22-01, the contractor shall ensure the application or system at the time of the Authority to Operation (ATO) must not contain any vulnerability listed in the Cybersecurity & Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog whose CISA remediation due date has been exceeded.

16. Vulnerability Monitoring and Scanning. Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. The contractor shall implement vulnerability scanning as defined by IRS IT Security Policy and NIST requirements to include NIST SP 800-70.

The contractor shall, monitor and scan for vulnerabilities in the system and hosted applications using vulnerability monitoring tools and techniques, and when new vulnerabilities potentially affecting the system are identified and reported, perform analysis and remediation activities.

The contractor will provide an environment that adheres to NIST SP 800-207 Zero Trust Architecture and CISA Binding Operational Directives. Non-compliant conditions are unacceptable for new technologies and cannot be remediated via a Risk Based Decision (RBD) or Risk Acceptance Form and Tool (RAFT). Non-compliance discovered in existing software (SW) or hardware (HW) will result in SW or HW being placed into quarantine until non-compliance issues are remediated to the satisfaction of the government.

https://www.cisa.gov/sbom https://www.cisa.gov/news-events/directives/binding-operational-directive-22-01 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog

If approved for existing SW or HW, the contractor shall create a plan of actions and milestones Plan of Actions and Milestones (POA&Ms) to identify and track remediation of the identified risks/vulnerabilities for any vulnerabilities identified that cannot be remediated within 30 days.

The contractor shall report POA&Ms progress to the government as requested and at minimum monthly. The affected SW and HW shall remain in quarantine until such time the government is satisfied the remediation action/s have raised the level of compliance to an acceptable level (defined by the government).

The contractor shall provide all compliance scan results in an IRS acceptable format (i.e., CSV, JSON, or XML).

17. Cybersecurity Supply Chain Risk Management (C-SCRM). In accordance with the request for proposal (RFP), statement of work (SOW) or performance work statement (PWS) requirements, the contractor agrees to take complete responsibility for all actions of its Subcontractors.

Subcontractors are expected to meet all requirements set forth in the RFP, SOW, or PWS agreed to by the prime contract holder. The contractor shall identify all subcontractors who will perform services, including their name, the nature of services to be performed, address, telephone, email, federal tax identification number (TIN), and anticipated dollar value of each subcontract before any work is performed by the subcontractor. The IRS reserves the right to reject subcontractors identified by the contractor that pose a significant risk to IRS and the IRS IT Infrastructure as defined by Federally mandated C-SCRM requirements and Publication 4812.

Any subcontractors not listed in the contractor’s proposal submission, who are engaged by the contractor, must be pre-approved, in writing, by the IRS.

The contractor shall manage the supply chain risk lifecycle of their products, services and subcontractor tiers using risk assessment methods and procedures identified by the current version of NIST SP 800-161. The assessment must consider documented processes, documented controls, all-source intelligence, public information, foreign ownership, control, or influence (FOCI), Country of Origin (COO), ownership and leadership personnel, comparisons against Federal Government restriction lists, and identification of product vulnerabilities through the CISA national known vulnerability databases.

The contractor shall comply with NIST Secure Software Development Framework (SSDF) SP 800- 218 for its products and services or map to the SSDF to demonstrate a framework for well- secured products. The contractor shall apply the SSDF to the entire product lifecycle including design, development, testing and operations. The contractor shall secure all code in a software versioning library located in a secured environment with access enabled for the government requirements, software review and oversight roles. This tool must facilitate task management, versioning, check-in/check-out/commits, reporting, testing, automation, deficiencies, and vulnerabilities, debugging, flagging and traceability as examples. Additionally, the vendor shall identify all instances of artificial intelligence (AI) used in information and communication technology (ICT) product development or supporting ICT product capabilities.

The contractor will provide an environment that adheres to NIST SP 800-207 Zero Trust Architecture and CISA Binding Operational Directive 23-02. Non-compliant conditions are unacceptable for new technologies and cannot be remediated via a Risk Based Decision (RBD) or Risk Acceptance Form and Tool (RAFT). Non-compliance discovered in existing software or hardware will result in software or hardware being placed into quarantine until non-compliance issues are remediated to the satisfaction of the government.

The federal government has the authority to conduct site reviews for compliance validation. Full cooperation by contractor and third-party providers is required for audits and forensics. The contractor must support IRS in its efforts to assess and monitor the contractor systems and infrastructure. The contractor must provide logical and physical access to the contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases upon request.

Within 14 business days of a request from IRS Cybersecurity, the contractor shall provide the following:

i. The vendor shall provide the completed CISA Common Form documenting their attestation to the OMB 23-16 mandated secure software development requirements. The contractor shall only use software provided by software producers who can attest to and demonstrate compliance with the Government- specified secure software development practices, Security and Privacy controls and Cybersecurity Supply Chain Risk Management Practices, as described in the NIST Guidance, including software renewals and major version changes upon or prior to award. For any practices from the NIST guidance that the software producer cannot attest, the contractor shall provide documented practices in place to mitigate those risks along with a POA&M to remediate in accordance with OMB Memorandum M- 22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (September 14, 2022) and M-23-16 Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (June 9, 2023).

ii. The contractor shall develop and provide an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services as it relates to the products and services delivered to the IRS.

iii. The contractor shall provide evidence of a C-SCRM Plan that identifies supply chain risk with their product or services, components, suppliers, and contractors. The contractor shall review and update the supply chain risk management plan annually.

iv. During all contract phases, including the request for proposal (RFP) and/or request for information (RFI), the contractor may be required to provide responses to the IRS Cybersecurity Supply Chain Risk Assessment Questionnaire that contains a list of questions based on the current version of NIST SP 800-53 Supply Chain Risk Management security controls and the current version of NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. The questionnaire will be provided to the vendor by IRS/Cybersecurity and is tailored for each procurement to assess the maturity of the contractor’s C-SCRM capabilities and any C-SCRM related risks relating to the contractor and its supplier supply chain components, subsystems, intellectual property, and other services relevant to the procurement.

18. Security Authorization/Certification and Accreditation Process. The IRS’ FIPS 199 baseline is a moderate. All solutions must, at a minimum, meet moderate NIST SP 800-53 security and privacy controls. However, after officially completing the FIPS 199 it may be determined that the solution is a FIPS 199 high or has additional control overlays above the standard baseline.

Cloud service providers and contractors developing vendor-built solutions must review NIST SP 800-63, use its decision trees to obtain an overview of all digital identity requirements, and read the applicable NIST SP 800-63 volumes to determine specific requirements that apply to their cloud offerings. A digital identity risk assessment (DIRA) will be completed to determine the appropriate authentication level; however, the IRS baseline is Identity Assurance Level 2 and the solution must integrate with the IRS authentication solution.

The cloud service provider/contractor systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), with a FIPS 199 security categorization) must ensure annual reviews and continued security certification and accreditation. Some of the key elements of this IT risk and impact assessment process are project security deliverables such as the System Security Plan (SSP), Information System Contingency Plan (ISCP), Business Impact Analysis (BIA) with documentation of inclusion of the 12-hour Maximum Tolerable Downtime (MTD) for IRS Mission Essential Functions (MEFs) and evidence of recovery capability within that 12-hour timeframe, Interconnection Security Agreement (ISA), Security Risk Assessment (SRAs), Data Impact Assessments (DIAs), Risk Analyses, Security Threat Analyses, Audit Plan, Source Code Review, Security Control Assessment (SCA), and/or Event-Driven Security Control Assessment (ED-SCA). All systems that complete this process will, at a minimum, meet FedRAMP, Federal Continuity Directives (FCDs) 1 & 2, Treasury and IRS requirements. All systems must follow the NIST risk management framework (RMF) and the IRS processes supporting the RMF.

19. Data Loss Prevention (DLP) Software. The cloud service provider/contractor shall implement DLP software to assure existing software will operate effectively in the cloud.

The cloud service provider/contractor shall be responsible for all patching and vulnerability management (PVM) of software and other systems’ components supporting services when doing business with the IRS to prevent proactively the exploitation of IT vulnerabilities that may exist within the cloud service provider/contractor operating environment.