ITSI Contractor Support Recompete - SOO Draft.docx

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

INFORMATION TECHNOLOGY – CYBERSECURITY

ARCHITECTURE & IMPLEMENTATION DIVISION

STATEMENT OF OBJECTIVES FOR

MODERNIZING IT CYBERSECURITY CORE INFRASTRUCTURE AND IMPLEMENTING ZERO TRUST CYBERSECURITY ARCHITECTURE CAPABILITIES

STATEMENT OF OBJECTIVES FOR

MODERNIZING IT CORE INFRASTRUCTURE & IMPLEMENTING ZERO TRUST CYBERSECURITY ARCHITECTURES & CAPABILITIES

INSTRUCTIONS

This Statement of Objectives (SOO) describes desired outcomes and required tasks for Modernizing IT Core Infrastructure and Implementing Zero Trust Cybersecurity Architectures and Capabilities including Cybersecurity Systems Support, Splunk Technical Support, and Program Management Support.

Offerors will leverage this document and applicable portions of the Request for Proposal (RFP) as the basis for preparing their proposal; ensuring each aspect is thoroughly addressed.

POINT OF CONTACT

Kristen Healy, Ph.D.

IRS Cybersecurity Architecture & Implementation Division, Cybersecurity Solutions Development Branch Email: kristen.r.healy@irs.gov

SECONDARY POINT OF CONTACT

Charles Bennett, Ph.D.

IRS Cybersecurity Architecture & Implementation Division, Cybersecurity Solutions Development Branch Email: charles.c.bennett@irs.gov

Contents

PROJECT TITLE

Modernizing IT Cybersecurity Core Infrastructure and Implementing Zero Trust Cybersecurity Architecture Capabilities

PURPOSE

The purpose of this solicitation is to secure expert information technology, cybersecurity, and project management support required to scope, design, implement, operationalize, and maintain a wide range of new security systems, processes, applications, and other technology solutions for the IRS Cybersecurity organization; and to assist in the overhaul, enhancement, interoperability, augmentation, expansion, integration, retirement/decommissioning, and/or migration of existing IT assets into a streamlined operational environment. Improving the Agency’s core infrastructure, technological architecture, and security capabilities is necessary to fulfill the Agency’s mission and protect the sensitive information of every American taxpayer

INTRODUCTION

The Internal Revenue Service (IRS) Information Technology (IT) Cybersecurity Organization has adopted an aggressive approach to overhauling major systems, platforms, applications, and networks in support of the Agency’s mission and to achieve compliance with emerging federal information system security standards. Novel multi-year funding for long-term modernization initiatives provided under the historic Inflation Reduction Act (IRA) has enabled several critically needed transformation efforts for mission-essential systems following decades of underinvestment and constraints of short-iteration budgetary funding cycles. Broader Agency-wide endeavors to improve the taxpayer experience are dependent upon the advancement and security of IRS core infrastructure, which currently lacks standardization[footnoteRef:1] and hosts some of the oldest in-service legacy systems within the federal government. All modernization efforts are data-driven and enable excellence in customer service, enhanced compliance enforcement efforts, and adaptive tax administration capabilities while maintaining the security and privacy of taxpayer and Agency information. A robust IRS Cybersecurity Program rooted in cutting-edge technology, data, and analytics will ensure the confidentiality, integrity, and availability of information systems, services, data, and assets across the enterprise in support of the Agency mission. [1: FY23-FY31 IRS IRA Strategic Operating Plan, Part II, Objective 4 (Page 80)]

AGENCY MISSION

The mission of the Internal Revenue Service is to “provide America’s taxpayers top-quality service by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness to all”. The Agency collects 96% of the revenue that funds the federal government[footnoteRef:2], supporting priorities from national security to infrastructure. Key to the IRS mission and delivery of information technology services that drive effective tax administration to ensure public confidence is maintaining the security, privacy, and protection of sensitive taxpayer data that is transmitted, collected, stored, managed, and analyzed on Agency owned and managed assets. This is achieved in part through the fulfillment of the Cybersecurity organization’s mission to “protect taxpayer information and the IRS’ electronic systems, services, and data from internal and external cybersecurity-related threats by enacting world-class security practices in planning, implementation, management, and operations while preserving the confidentiality, integrity, and availability of IRS assets.” [2: Internal Revenue Service Data Book, 2022]

The Cybersecurity organization fulfills its mission through the collaboration and support of other enterprise business units (BUs), Associate Chief Information Officer (ACIO) organizations, Agency governance bodies, independent external oversight entities, federal regulators and auditors, congressional stakeholders, leading industry security authorities, private sector consultants, supply chain partners, compliance enforcement teams, policy experts, and others.

Architecture and Implementation (A&I) is one of four IRS Cybersecurity Divisions. It provides essential leadership and guidance to Agency business units, information technology organizations, and end-users regarding security requirements and capabilities. The Cybersecurity Solutions Development (CSD) Branch within A&I is responsible for the management of this solicitation and resulting contract vehicle(s). CSD is a customer-focused organization that develops and implements cybersecurity and data protection solutions employed across the enterprise.

RELEVANT GOVERNMENT-RELATED CONSULTING EXPERIENCE

· Internal Revenue Service Information Technology

· Department of Homeland Security Cybersecurity Infrastructure Security Agency

· National Institute of Standards and Technology

· Defense Information Systems Agency

· IT / Cybersecurity Programs Within Civilian Federal Agencies of Comparable Size

CONTRACT BACKGROUND

This is a follow-on, comprehensive contract that is intended to support the IRS’ IT Cybersecurity organization effectively and efficiently strengthen it capabilities to thwart omnipresent, malicious, and continuously evolving internal and external cyber-attacks. Requirements will continue to evolve as the Cybersecurity organization commits itself to meeting taxpayers’ increasing digital expectations for secure data. All this must be accomplished in a complex, large, often siloed organization that regularly deploys new online and on-premise applications. IRS is in a state of aggressive procurement and transformation.

CURRENT OPERATIONAL ENVIRONMENT

In addition to combating cybersecurity threats in an increasingly hostile operational environment, IRS IT and Cybersecurity programs are in receipt of numerous federal mandates and Agency strategic objectives released in response to recent executive orders and emerging security trends in the last five years. As a result, the IRS Cybersecurity program’s major milestones, commitments, and deliverables have been further accelerated and expanded in scope to meet the demands of evolving legislative, oversight, and operational requirements. Additional support is needed to achieve success against an increasingly aggressive service and delivery schedule.

Cybersecurity Threat Landscape The IRS observes and mitigates more than 1.4 billion cyberattacks annually. This includes, denial-of-service attacks, intrusion attempts, probes or scans and other unauthorized connectivity attempts. IRS Cybersecurity’s Insider Threat program has identified Agency-specific threats and threat trends in the areas of information theft, data exfiltration, personal identifiable information (PII) exfiltration attempts, workplace violence, property theft, physical security compromises, and fraud.

According to recent comprehensive customer attitude survey reports, four of the top five IRS services most important to taxpayers are digital services. Related consumer expectations for digital accounts and communications reflect those currently provided by private sector financial institutions. Simultaneously, the IRS budget was cut by nearly 20% in real terms over the last decade, along with a 12% decrease in full-time equivalent employees, and a retirement rate that exceeds new hire onboarding by thousands each year.

Federal Mandates & Emerging Guidance Issuance of Executive Order #14028 Improving the Nation’s Cybersecurity (21MAY2021) and subsequent publication of federal mandates including the Office of Management and Budget (OMB) Directive M-22-09 Moving the United States Government Toward Zero Trust Security Principles (26JAN2022) have further accelerated Agency efforts initialized and funded under the IRS Integrated Business Modernization Plan, American Rescue Plan Act (ARPA), and the Taxpayer First Act (FTA). In addition to achieving compliance with emerging federal directives and minimum security standards, the IRS is committed to meeting or exceeding recommendations for civilian agencies proposed by federal information security authorities including the National Institute of Standards and Technology (NIST) Cybersecurity Framework[footnoteRef:3], Department of Homeland Security (DHS) Cybersecurity and Infrastructure Agency (CISA)’s Revised Zero Trust Maturity Model (ZTMM) and Continuous Diagnostics and Mitigation (CDM) Program. [3: NIST is expected to release CSF 2.0 in early 2024]

The IRS is fully leveraging long-awaited opportunities provided under the 2022 Inflation Reduction Act to make dramatic investments in core infrastructure, adopt an ambitious cloud-first approach to data standardization and centralized storage, and improve secure access to real-time operational and taxpayer account information. These initiatives are expanded and accelerated technology improvement efforts begun under the Agency’s 2019 Integrated Business Modernization Plan now encompassed in the FY23-FY31 IRS IRA Strategic Operating Plan. The American Rescue Plan Act (ARPA) provided the IRS with approximately $1.8 billion in additional funding for modernizing and securing IRS systems. The Information Technology organization was allocated approximately $1.2 billion of the $1.8 billion in additional funding. As of April 30, 2022, 26 percent of the $1 billion funds allocated have been obligated, expended, or disbursed.

The IRS is working in close partnership with external auditing entities such as the Treasury Inspector General for Tax Administration (TIGTA) and the Government Accountability Office (GAO) through multiple projected program audits in FY23.

Agency Strategy & Policy Within the last three years, the IRS has released multiple strategic plans and updates to Agency policy in response to evolving federal, strategic, and operational information technology and cybersecurity requirements. These include, but are not limited to, Updates to Internal Revenue Manual Series 10.8; the Agency Strategic Plan FY22-FY26 (20JUL2022); IRA Strategic Operating Plan FY23-FY31 (05APR23); IRS Zero Trust Architecture (ZTA) Strategic Implementation Plan (11MAR22); Taxpayer First Act Organizational Redesign Strategy; IRS IT Workforce Strategic Plan; IRS Human Capital Strategic Plan; IRS IT Cybersecurity Inflation Reduction Act (IRA) Roadmap; IRS IT Strategic Plan FY23-FY26 Objective: Bulletproof Cybersecurity; IRS Integrated Business Modernization Plan 2.0, Pillar 4: Cybersecurity and Data Protection Revised Baseline (2.0) Objectives; IRS IT CIO and Executive Commitments, and more. The Compliance Data Warehouse (CDW) Dome initiative has recently emerged as a priority of the newly inaugurated IRS Commissioner and IT Chief Information Office (CIO). Additionally The Department of the Treasury recently released a new memorandum expediting efforts to achieve bureau compliance with federal Multi-Factor Authentication (MFA) standards.

Updated strategic objectives support the Agency’s future-state vision of a “Bulletproof Cyber” program, reflect the IRS’ commitment to expeditious remediation of external audit findings, and are aligned to meet or exceed the requirements of emerging federal guidance.

SCOPE

Hybrid and vendor-built solutions will impact enterprise-wide IT/Cybersecurity operations and policies that apply to all IRS employees, partners, and stakeholders with access to Agency-owned or maintained information systems and information assets.

OBJECTIVES

Agency compliance with federal mandates, directives, audit response, and executive guidance are critically dependent upon the efficacy, efficiency, and reliability of contracted services procured in support of the below objectives.

Business Objectives

1.1. Employ Agile Best Practices to Manage All Key Projects & Initiatives

1.2. Produce Through, Clear, & Usable Documentation

1.3. Provide Organizational Readiness Support as Needed

1.4. Develop Standardized, Complete, & Useful Status Reports, Presentations, Product Evaluations, Data / Analytics Summaries, Executive References, Meeting Records, & Other Documentation as Needed

1.5. Support FISMA, OMB, TIGTA, and GAO Audit & Other Related Activities

1.6. Apply Automation & Standardization to Streamline Reporting, Audit Responses, Workflows

1.7. Provide Subject Matter Expertise to Inform Changes/Updates to Agency Security Policies

1.8. Enhance IT Service Delivery and Responsiveness; Continuous Operations w/ Minimal Downtime

1.9. Deliver Advanced Data Analytics & Visualization to Support Decision-Making & Resourcing

Technical Objectives

1.10. Support Implementation of Zero Trust Architecture & Authentication Security Components on the IRS Network

1.11. Support Development of Continuous Diagnostics & Mitigation Program Capabilities Including Integration & Implementation of Components & Assets

1.12. Support Significant Technology Procurement: Lifecycle Planning, Testing, Development

1.13. Execute Migration to Secure Future-State Enterprise Cloud Architecture

1.14. Apply Product-and-Platform Operating Model in Partnership with IT & Broader Enterprise

Security Objectives

1.15. Achieve Compliance with Existing & Emerging Directives & Standards for Federal Information Systems Security

1.16. Align Security Objectives & Operations to Agency Strategic Plans, Federal Requirements, Audit Remediation Objectives, & Executive Commitments

1.17. Improve Digital Identity Management: Authentication, Access, Role-Based Permissions, Controls

Program/Project Management Objectives

1.18. Perform All Vendor Contract Management & Oversight Duties in a Timely, Collaborative Manner

1.19. Develop and Implement Transition Management Plans as Necessary to Ensure Seamless Transfer to IRS Employees and/or Other Contractor Personnel

1.20. Provide Responsive & Knowledgeable Support, Facilitation, Coordination, Guidance, and Oversight

1.21. Enable Real-Time Visibility into Operations for Program Management & Process Improvement

1.22. Develop Standardized, Current, Project & Program Schedules IAW Industry Best Practices - Including Continuous Management of Implementation & Improvement

1.23. Establish & Maintain Regular, Organized Stakeholder Communications

1.24. Transfer Critical Knowledge & Skills to IRS Employees as Needed to Ensure Optimal Cybersecurity Readiness Posture & Reduce Risk of Disruption to Continuous and/or Critical Operations

1.25. Support Risk Management Framework, Governance Processes, Agile Workflows & Operations

1.26. Conduct Requirements Identification, Implementation Planning, Resourcing for Directives

1.27. Support Implementation of Inter-Agency Agreements (IAAs), Treasury Shared Services Program (TSSP), Treasury Franchise Fund (TFF) Enabled Services, and TEICAM

TASK 1: PROGRAM / PROJECT MANAGEMENT SUPPORT

Provide responsive and knowledgeable support, facilitation, coordination, guidance, and oversight in the following areas, as needed:

· Employ Agile best practices to manage all key projects and initiatives

· Develop standardized, current, project/program schedules in accordance with Agile best practices, and continuously manage and oversee their implementation and improvement

· Produce standardized, complete, and useful status reports, presentations, reports, product evaluations, meeting-related records, and other documentation as needed

· Perform all vendor contract management duties in a timely, collaborative manner

· Produce thorough, clear, concise, and usable documentation

· Establish and abide by regular, organized stakeholder communications

· FISMA, OMB, TIGTA and GAO Related Support Activities

· Provide organizational readiness support, as needed, to IRS Cybersecurity staff

· Develop and implement transition management plan, as necessary, to ensure seamless transition to follow-on contractors

· Transfer skills and knowledge to IRS staff, as needed, to ensure an optimal IRS cybersecurity posture

TASK 2: SPLUNK TECHNICAL SUPPORT

Provide expert technical support in all aspects of Splunk, Qmulos, Splunk Technical Add-Ons, and Splunk Premium Apps (e.g., Enterprise Services [ES], User Behavior Analytics [UBA], IT Service Intelligence [ITSI], Security Orchestration, Automation & Response [SOAR]). This includes expertise in enterprise-level development, architecture and design, deployment, security, data ingestion, maintenance and tuning, documentation, and other areas of as needed. Technical Splunk support objectives include (not listed in a specific, prioritized order):

· Design, document and implement systems integration, along with the technical architecture within which the systems integration will take place

· Execute all operations and maintenance (O&M) of in-scope IRS Splunk and related technology systems

· Conduct thorough, standardized data mapping, modelling, ingestion, ensuring all are continually updated to reflect the current state

· Develop dashboards in Splunk based on user requirements and provide responsive support in their use to improve Cybersecurity’s data analytics capabilities

· Conduct all system testing related to and required for maintenance, security and improvements in Cybersecurity’s Splunk environment Support all aspects of Splunk dashboarding including development, maintenance, continuous improvement, collaboration with stakeholders, data modeling and ingestion, troubleshooting, and other tasks as required.

TASK 3: CYBERSECURITY SYSTEMS & CAPABILITIES SUPPORT

Provide expert technical support in various aspects of IT security systems used and proposed for use within the IRS infrastructure. This expertise includes, but is not limited to, enterprise level development, architecture and design, deployment, data ingestion, maintenance and tuning, documentation, and other areas of expertise as needed.

· Technical documentation

· Technical/business requirements

· Programming languages of legacy master files

· Legacy databases replacement with modern, flexible systems

· Data processing systems and maximizing utility through comprehensive data platforms

· Systems integration, architecture and design

· Enhance digital identity management through expansion of Secure Access Digital Identity (SADI)

· Reciprocity / recognition of external user access and permissions on IRS Systems

· Enable ingestion and adjudication of mission-relevant data from external sources and jurisdictions

· Streamlining of system connections and privacy-preserving analytic methods

· Frontrunner Pilots for new functionality / refinement of operating models & playbooks

· Compliance and audit data management / visualization support

· Data accessibility, enterprise-wide data governance, proactive gap identification

· Continuous Diagnostics and Mitigation (CDM) mainframe

· Multi-Factor Authentication (MFA) for High Value Assets (HVA)

· Multi-Factor Authentication (MFA) capability expansion

· Identity and access management and privileged user account management

· Enterprise database scanning

· Next Generation Enterprise Security Audit Trails (ESAT) Program

· Data logging requirements

· DevOps Continuous Integration & Continuous Delivery (CI/CD)

· Enterprise Container Platform (ECP) support

· Dashboarding, benchmarking, metrics and measurements to support scaling and standardizing solutions

· Data discovery, mapping, modelling, ingestion

· Data analytics and dashboarding

· Common DevOps toolsets in the IRS Environment, such as:

· Jenkins

· RedHat OpenShift

· Kubernetes

· Ansible

· Applications that leverage JSON Web Tokens (JWT)

· Federated Identity (FID) solutions utilizing vendor best practices for cloud deployments on WC2-H platform as a service Virtual Private Cloud (VPC)

· Configuration Settings Management (CSM)

· Operations and Maintenance (O&M) of in-scope IRS Systems

· Operations and Maintenance (O&M) of in-scope Treasury WC2-H cloud environment assets

· Vulnerability management

· System testing

· IT System auditing

· Specific IT security system expertise

· Qualys

· SailPoint

· CyberArk

· Carbon Black

· ForeScout

· Guardium

· BigFix

· Splunk

· ServiceNow

· InfoConnect

· MicroFocus

· IBM Mainframe Z/OS applications and Z/VM, Z/TPF and Unisys Platforms

· SharePoint Online

HIGH LEVEL PERFORMANCE OBJECTIVES

· Objective 1 Sustainment of Continuous Operations

· Maintain uninterrupted, continuous business and technical operations at typical or better level of performance/activity while simultaneously designing, developing, architecting, implementing, maintaining, and sustaining information technology systems, hardware, software, networks, platforms, applications, repositories, dashboard, and other assets. Ensure mission-critical processes, procedures, and systems are operational, redundant, and recoverable throughout filing season.

· Objective 2 Timely Implementation of Optimal Solutions

· Responsively adapt to changing requirements, specifications, interoperability constraints, organizational priorities, operational demands, etc. with agility and flexibility to provide required manpower and expertise to meet mission.

· Objective 3 Adherence to Risk Mitigation Strategies

· Prevent data loss and other information security vulnerabilities while managing and migrating data, configuring systems, installing hardware, software, platforms, mainframes, applications, etc.

OPERATIONAL & PERFORMANCE CONSTRAINTS

All vendor-built solutions will comply with federal information systems standards and policies. Constraints include fulfillment of federal minimum security standards, compliance with Agency policy, and reporting requirements imposed under various Congressional regulations, directives, and guidance. Associated information assurance, accessibility, security, risk management, and governance processes and procedures apply. All contracted support personnel are subject to applicable security clearance and authorization requirements.

· Federal Information Security Management Act (FISMA) of 2012 Federal Information Security Modernization Act (FISMA) of 2014

· FITARA

· Executive Order #14028 Improving the Nation’s Cybersecurity 2021

OMB M-21-01

· OMB M-21-30

· OMB M-21-31 Improving Federal Government Investigative and Remediation Capabilities Related to Cyber Incidents (2021) OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

· OMB M-23-03

· NIST SP 800-27

· NIST SP 800-30

· NIST SP 800-37

· NIST SP 800-53 / 53A Rev. 5

· NIST SP 800-61

· NIST SP 800-63-3 Digital Identity Guidelines (2022)

· HSPD-12

· CISA BOD 23-01

· CISA Zero Trust Architecture Security Maturity Model & Implementation Guidance

· Department of the Treasury CIO Memoranda 13-05 & 14-02 Department of the Treasury Memorandum: Phishing Resistant Multi-Factor Authentication (MFA) Sprint

· Taxpayer First Act (TFA)

· TIGTA FISMA Annual Audit & Special Audit Reports

· IRS Inflation Reduction Act Strategic Operating Plan for FY23-FY31, Section 4 IRS Strategic Plan FY23-FY26

· IRS IT Strategic Plan FY24-FY27

· IRS Integrated Business Modernization Plan 2.0 IRS Zero Trust Architecture Implementation Strategic Plan IRS IT CIO Memorandum for Decommissioning of Legacy Assets

· IRM Series 10.8.1 IT Security Compliance & Organizational Common Controls USC Section 508 Compliance Regulations & Policies; Applicable EEOC Guidelines

PLACE OF PERFORMANCE

The contractor will work at contractor facilities, remote, and onsite at IRS locations, primarily in the greater Washington DC metropolitan area. Requests by the contractor to work remotely will be evaluated and approved by the IRS. Approval of such requests would be at no cost to the government. Site visits to IRS locations or other locations may be required to meet with contractors, system developers and administrators, operations personnel, and/or other IRS staff. The contractor must coordinate site visits to IRS facilities with the GTM and COR and must abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at these facilities. When working at a government facility, contractor employees are required to wear identification badges. Long distance travel outside of the Washington DC commuting area will be approved on an as-needed basis and coordinated with the GTM, COR and the IRS Contracting Officer, if necessary. The contractor must make every effort to obtain economic airfares and other forms of transportation. The Government will reimburse travel and per diem at actual cost in accordance with the limitations set forth in FAR 31.205-46 and the General Services Administration’s Federal Travel Regulations. Profit applied to travel costs is prohibited. Local travel (within 50-mile radius of Washington, DC or any IRS field offices) required for on-site meetings will not be reimbursed by the IRS. The contractor must provide the COR, GTM, and other IRS staff as appropriate with advanced notice to make necessary arrangements.

The Contractor shall provide a travel voucher statement for all local travel. The voucher will ensure verification of costs incurred for local travel under the contract is both allowable and reasonable and in accordance with FAR 31.205.46. The Contractor shall attach the voucher and receipts to the monthly invoice. For any trip to be authorized, the COR must approve such travel in advance and in writing. Failure to acquire pre-approval may result in non-local travel charges by the contractor being denied.

PERIOD OF PERFORMANCE

The period of period of performance will be as follows:

· Base Year: Date of award through one calendar year (12 Months)

· Option Year 1: 12 months

· Option Year 2: 12 months

· Option Year 3: 12 months

· Option Year 4: 12 months image1.png