The file's text, extracted by GovTribe without its formatting.
Vendor Questions in Response to IT SECURITY IMPLEMENTATION (ITSI) CONTRACTOR SUPPORT on Sam.gov 7.14.23
| # |
| Date |
| SOO Reference |
| Question(s) / Comment(s) |
| Response |
| 1 |
| 7/5/23 |
| 1 – Sources Sought |
| Incumbent Information |
| Maximus Federal Services Inc. |
Contract No. 47QTCK18D0044
| 2 |
| 7/5/23 |
| 1 – Sources Sought |
| Size of Incumbent Workforce |
| Please obtained information from a FOIA request. |
| 3 |
| 7/5/23 |
| 3 – Submission |
| Are small businesses allowed to include the capabilities of a committed large business partner as part of their response to this RFI given clear identification of the large partner’s material? |
| Yes |
| 4 |
| 7/5/23 |
| 3 – Submission |
| Is the IRS seeking to designate the ensuing ITSI procurement depending on its analysis of the responses received as one of either small business set-aside or full and open? Or possibly a BPA with both small and large business tracks? |
| A determination has not been made. |
| 5 |
| 7/5/23 |
| Technical Information |
| What are the requisite security clearances for contractor personnel on this procurement? |
| Level 4 /5 (High Risk) Depending on Applicable Systems Access / Risk Level |
| 6 |
| 7/5/23 |
| Technical Information |
| Is the government contemplating issuing a cost type contract from this solicitation? |
| To be determined by the contracting officer. |
| 7 |
| 7/5/23 |
| Technical Information |
| Please explain the applicability and estimated percent of the work scope to be spent on traditionally non-cybersecurity tasking mentioned under this cybersecurity contract. Examples are developing software documentation, systems administration manuals, and software code documentation, requirements documentation, data dictionaries, data models, business rules, configuration, customization, enhancement services, and Agile methodology in application development. |
| Percentage of non-technical work will fluctuate throughout PoP pending mission requirements; traditionally business process engineering, data analytics / data visualization, security control and configuration documentation, lean / agile / scrum, requirements identification, etc. tasks exist on each workstream. |
| 8 |
| 7/5/23 |
| SOO |
| Does the Government intend to continue a SOO approach for this procurement on the final solicitation, where each offeror typically is required to provide their own proposed Performance Work Statement (PWS) with Tasks to address the objectives? |
Or... are the TASK 1, TASK, 2, TASK 3 included in the draft SOO the structure of a Government PWS?
To be determined by the contracting officer.
| 9 |
| 7/5/23 |
| Task 1 – Page 8, 9 |
| The TASK 1 - Program/Project Management Support encompasses both CSD-wide project management support tasking and ITSI contract level tasking (e.g., transition)... could the task items which are specific to ITSI contract administration/management functions be segregated for clarity of scope? |
| Yes – Contract administration and management functions are typical (weekly project status updates, monthly program status updates, budget tracking, maintenance of personnel rosters, mandatory contractor training, itemized invoicing, milestone tracking, kick-off meeting, etc.) |
| 10 |
| 7/5/23 |
| Task 3 – Page 9, 10 |
| The "TASK 3 - Cybersecurity Systems & Capabilities Support" represent a wide range of objectives and tasking including technical advisory services, systems O&M, and documentation... could it be organized on Subtasks to better clarify the different scope areas in it... particularly for non-cybersecurity activities? |
| To be determined, please provide any recommendations. |
| 11 |
| 7/5/23 |
| Objectives |
| Is a part of the IRS SOO objectives for ITSI to achieve and maintain full compliance with U.S. Department of the Treasury applicable cybersecurity policies, directives, guidelines, enterprise tools, shared assets/resources usage, and reporting requirements for component agencies? |
| Yes |
| 12 |
| 7/5/23 |
| Task 2 & 3 – Page 9, 10 |
| There is overlap between the bullet points listed under TASK 3 and some of the objectives listed under TASK 2, such as data discovery, mapping, modeling, ingestion, analytics, and dashboarding. Is it the intent that some of these topics are in support of tools other than Splunk? |
| Yes |
| 13 |
| 7/5/23 |
| Task 3 – Page 10, 11 |
| Are the bullet points listed under TASK 3 intended to represent specific tasks in a future version of the solicitation? There are topics which are broad (unlike TAASK 1 and 2), and will need more details for offerors to be able to define their technical approach. |
| Task 3 bullet points represent tasks initiated and vendor support capabilities leveraged under current vehicle that will be carried over for continuation on new contract. Refined requirements will be enumerated in future task orders specific to each applicable system and / or program area. |
| 14 |
| 7/5/23 |
| Task 3 – Page 11 |
| To what extent will the personnel performing under TASK 3 be conducting operations, maintenance, and administration of the systems listed (such as Qualys, CyberArk, BigFix, etc.), compared to the personnel outside of the A&I Division, such as those in Cybersecurity Operations or Cyber Threat Response & Remediation? |
| Work conducted in A&I is significantly more technical than work completed in CTR&R; Select current contractor support personnel are 100% dedicated to technical systems engineering, maintenance, administration, etc. in accordance with their subject matter expertise or technical specialties. |
Can you please confirm if STANDARD FORM 1408 (REV. 1/2014) – is the determining factor for a company to comply as an approved DCAA accounting system?
To be determined by the CO during the solicitation phase.
If STANDARD FORM 1408 (REV. 1/2014) is not a determining factor, can you please provide guidance?
To be determined by the CO during the solicitation phase.
Are there any requirements regarding Teaming Partners and use of past performance?
To be determined by the CO.
| Can past performance be provided by the PRIME as well as the Teaming Partner(s)? |
| To be determined by the CO. |
| Can you please provide the annual cost of the current contractor? |
| Please obtained information from a FOIA request. |
| What is the anticipated FTE count per LCAT upon release of RFQ? |
| TBD |
| Will the incumbent be available to shadow during the transition period? |
| TBD |
| If travel is required, will this be included in the pricing or ODC? |
| To be determined by the CO. |
| What is the projected date for the RFQ? |
| To be determined by the CO. |
| Incumbent Information (Contract #) |
| Maximus Federal Services Inc. |
| 25 |
| 7/5/23 |
| Background PMO Support – Page 1 |
| Are the scope of the requirements expected to have separate PMO support teams aligned with each task area separately, or is a central PMO Support team that can cover all areas acceptable? |
| A vendor solution is expected to be propose in response to the solicitation. |
| 26 |
| 7/5/23 |
| Task 2 – Page 9 |
| Does the agency have all the essential Splunk tools, application/components that are required, or is the agency looking for support from vendor to implement additional aspects of Splunk? |
| This vehicle augments a large-scale Splunk BPA |
| 27 |
| 7/5/23 |
| Task 3 – Page 9 |
| Can the agency share a list of Legacy systems or databases already in use, and/or assume operations and maintenance of this tool? |
| Unable to disclose exhaustive list due to security concerns; most O&M for legacy systems is not conducted on this contract currently |
| 28 |
| 7/5/23 |
| Purpose – Page 3 |
| Can the agency clarify if the task areas under this SOO is currently being performed by one or more incumbents on an existing contract? |
Maximus Federal Services Inc. and subs.
| 29 |
| 7/5/23 |
| Purpose – Page 3 |
| Can the agency provide information on the acquisition strategy or vehicle to be used? GSA HACS, etc. |
| To be determined by the contracting officer. |
| 30 |
| 7/5/23 |
| Task 3 – Page 9 |
| Task 3 contains a lot of tools and technologies in support of the cyber mission and objectives. |
Does the agency anticipate the need to procure tools under the new contract?
This requirement is for contractor support services only; tools and technologies included in the SOO are either existing or already in procurement.
| 31 |
| 7/5/23 |
| Task 3 – Page 9 |
Is the agency open to a Managed Security Service Provider type of model to augment some of the service and technology stack needs under the new contract?
No
| 32 |
| 7/5/23 |
| Federal Mandates & Emerging Guidance – Page 5, 6 |
| Would the agency provide the broad-brush milestones that form the critical path(s) of the long-term modernization initiative? Or, should we rely upon publicly available documents such as the IRS Inflation Reduction Act Strategic Operating Plan (05APR2023) and other strategy and policy documents itemized. |
| Yes; Agency and Cyber Divisions have strategic-level and program/project-level milestones and objectives aligned to federal guidance that will be used to inform and guide the contractor’s efforts in support of Agency mission. |
| 33 |
| 7/5/23 |
| Placeholder for AI |
| Does the agency have a prohibition against the use of AI, or is it amenable for the contractor to incorporate the use of AI in a proposal response, where AI is included as a facet of comprehensive NetOps / SecOps support? |
| The Agency does employ AI; however, all technical proposals involving AI will be reviewed for suitability, security, and risk. |
| 34 |
| 7/5/23 |
| RFI Question Due Date – Page 3 |
| Outside of the required 10 page count, would the agency accept appendices/attachments to separately included? |
Yes
| 35 |
| 7/5/23 |
| IT & Cyber Certifications – Page 1, 9, 10, 11 |
| Will the agency seek specific certifications for consultants delivering services or, if not, will possessing certifications in key technologies (e.g., Splunk, Qmulos, CyberArk) be viewed as a positive in selection? |
| Yes; Certifications are a primary criteria for consideration |
| 36 |
| 7/5/23 |
| Arcsight – Page 11 |
| Does the listing of "Arcsight" refer to the Micro Focus (now opentext) ArcSight Enterprise Security Manager? |
| Yes |
| 37 |
| 7/5/23 |
| Business Objectives 1.5 – Page 7 |
| How may of these events per year? |
| TBD; The Agency does not determine the third-party audit and oversight review cycle. |
| 38 |
| 7/5/23 |
| Business Objectives 1.9 – Page 7 |
| Is there an existing solution that we build on or is the task to bring in a solution, deploy, and implement? |
| There is an existing framework and platform (Qmulos) for data visualization. See DHS CDM Dashboard for more information about metrics. |
| 39 |
| 7/5/23 |
| Technical Objectives 2.1 – Page 7 |
| How many endpoints, network size (firewalls, routers, switches), how many servers, etc. in scope and timeframe to complete? |
| TBD |
| 40 |
| 7/5/23 |
| Technical Objectives 2.3 – Page 7 |
| What is the estimated number of projects? |
| 15-20 |
| 41 |
| 7/5/23 |
| Technical Objectives 2.4 – Page 7 |
| Is this a multicloud strategy? – How many? Any cloud in play? |
| Yes; TBD |
| 42 |
| 7/5/23 |
| Security Objectives 3.1 – Page 8 |
| How many systems in scope? |
| TBD |
| 43 |
| 7/5/23 |
| Program / Project Management Objectives 4.1 – Page 8 |
| How many contracts in scope? |
| 4.1 Refers to contract management and oversight duties for this contract only, including any sub-contractor or teaming partner arrangements. |
| 44 |
| 7/5/23 |
| Program / Project Management Objectives 4.2 – Page 8 |
| How many systems/programs/projects in scope? |
| Transition plans will be required for handoff to government personnel for every project the contractor completes at the conclusion of the PoP |
| 45 |
| 7/5/23 |
| Program / Project Management Objectives 4.9 – Page 8 |
| How many systems/projects? |
| All systems impacted or affected by emerging federal guidance and/or information security standards |
| 46 |
| 7/5/23 |
| Task 1 – Page 9 |
| How much of each bullet above is expected? Do we want to be selective and pick a few? |
Each of the bullets under Task 1 will be required for some or all projects. These are general expectations for areas where the government requires administrative support (based on utilization of the incumbent).
| 47 |
| 7/5/23 |
| Task 1 – Page 9 |
| Who are the stakeholders? |
| Agency management, senior leadership, contracting officers and representatives, project and program managers |
| 48 |
| 7/5/23 |
| Task 1 – Page 9 |
| What tools/products/systems are used for this task? |
| Microsoft Office Suite products are used for administrative tasks and activity tracking |
| 49 |
| 7/5/23 |
| Task 1 – Page 9 |
| Please elaborate “contract management duties”; what does it entail? |
| Weekly project status updates, monthly program status updates, budget tracking, timely submission of clearance documentation, maintenance of personnel rosters, mandatory contractor training, itemized invoicing, milestone tracking, kick-off meeting, etc. |
| 50 |
| 7/5/23 |
| Task 2 – Page 9 |
| Is the contractor expected to create new search queries? If so, how many per year is estimated? |
How many indexers and search heads are in scope? How many endpoints are ingested for the system?
TBD
| 51 |
| 7/5/23 |
| Task 2 – Page 9 |
| How many Splunk SMEs do you anticipate for this task? |
TBD; There have been roughly 25-45 Splunk SMEs aligned over the course of the current contract PoP at any given time - as dictated by program requirements.
| 52 |
| 7/5/23 |
| Task 2 – Page 9 |
| How many systems does Splunk need to be integrated with? |
| TBD; Several |
| 53 |
| 7/5/23 |
| Task 3 – Page 9 |
| Does this task require supporting other IT personnel/teams or actually performing the listed services (i.e., the architecture, development, design, implementation, integration, database modernization, etc.)? If latter, how many FTEs are you anticipating? |
| Contractor support is sought by the government for performance of listed services. |
Please obtained information from a FOIA request.
| 54 |
| 7/5/23 |
| Technical Info |
| Can the Government please clarify the term “requisite security clearances”. Is this a Department of Defense (Dod) Top Secret (TS) clearance; an IRS MBI with tax check; something else? Are there different types of security clearances required, and if so, can the Government list them all? |
| IRS MBI 4 & 5 |
Select TS may be required for those working alongside DHS CDM contractors and other personnel aligned to various IAAs
| 55 |
| 7/5/23 |
| Objectives & Task 1 |
| Is IRS Cybersecurity looking at SAFe Agile as a source of best practices? Or is SAFe seen as too burdensome/costly? |
| The Agency does utilize SAFe Agile best practices – in particular for Enterprise Case Management. IRS IT and Cybersecurity BUs apply SAFe where feasible (e.g. CDM Mainframe Support) |
| 56 |
| 7/5/23 |
| Task 1: Program/Project Management Support |
| Can the Government characterize the work in support of FISMA, OMB, TIGTA and GAO activities? Are these supporting the provision of information to these audit/oversight agencies, responding to questions, tracking recommendations to implementation? Can the Government indicate a typical number of interactions/audits occurring in a year; or in the 1st year? |
| Contractor support for external audits typically includes provision of system and program information in response to oversight inquiries; in some cases, it also includes assisting the government in tracking remedial progress against findings, assessing and implementing recommendations / best practices, and providing business process and workflow recommendations to improve future audit response and / or data collection, metrics, etc. Contracted personnel do not respond directly to auditors. |
| 57 |
| 7/5/23 |
| Task 2: Splunk Technical Support |
| Is the integration of data from the older Security Audit and Analysis System (SAAS) fully integrated into SPLUNK now, or is there work remaining to consume and organize SAAS data, or functionality of the IDRS On-line Reporting System (IORS)? |
| Extent of remaining work by the time of contract award, onboarding, etc. is TBD. |
| 58 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government list the programming languages of the IMF and BMF that are required for this task and how those skills will be applied in Cybersecurity? |
| ALC; See Other Systems: CADE, CADE2, SCRIPS, CFOL and FTD IRS (.gov) and Modernizing Tax Systems IMF to CADE2 |
| 59 |
| 7/5/23 |
| Place Of Performance |
| Can the Government provide the reporting locations in the greater DC area that personnel will be required to report to? |
| 1111 Constitution Ave - DC |
5000 Ellin Rd - New Carrolton MD Kearneysville / Martinsburg WV
2. Technical Objectives
| Can the Government share documentation / diagrams of the “Secure Future State Enterprise Cloud Architecture”? |
| No |
3. Security Objectives
| Can the Government list the entities in scope under identity management (internal vs. external, individual vs. business users, etc.)? |
| Scoped for internal users and contracted users in support of fully federated identity services – see OMB M-22-09 IAM / PAM requirements |
| 62 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government clarify / list the in-scope legacy database platform (Oracle, SQL, DB2, etc), quantities, versions, and types? |
| See IRS IRA Strategy for a Unified Compliance Organization (UCO); IRWorks Solutions Architecture |
| 63 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government list the other / external user authentication / authorization systems that the IRS would need to recognize in reciprocity? |
| Data flow w/ Treasury CDM Dashboard, WC2-H, Treasury TIECAM & DHS/CISA CDM personnel |
Enable “Bulletproof Audit Trails” on 100% of FTI Applications and leveraging of the Data Telemetry Report for the SRM Authority to Operate (ATO) Process and closure of FISMA ATO Process Gaps. Additionally, the Agency is required under OMB-21-31 to achieve 100% EL3 Advanced Logging Requirements at all criticality levels - This requires support for expansion of on-premise and cloud environments related to Qmulos application performance. There are currently 8+ Cybersecurity Solutions Development (CSD) commitments for Agile Epics associated with this workstream. Additionally, contractor support for data visualization enables Qmulos Compliance (QC) for audit and compliance teams to view OMB controls and dashboards by IRS system.
| 64 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government list these external sources and jurisdictions and the kind of data and volume of data that need to be ingested and adjudicated? What does it mean to enable this capability? |
| Audit / Logging – Scope TBD (CDW) |
| 65 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government provide an estimate of the number of pilots they anticipate to be completed within an annual period, if unknown, can the Governments share the average number of pilots that were conducted over the last fiscal year? |
| There were 2-3 pilots conducted last FY for Cyber A&I programs relevant to the scope of this requirement |
| 66 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government specify more detail about the CDM Mainframe? |
| Identify, implement, and maintain tools, scripts and/or programs to assess security configurations on mainframe platforms operating within IRS; Review mainframe vulnerability scan results and advise on mitigation and/or remediation of findings; |
Maintain configuration checklists, script or programs to align with IRS policy requirements. VCM, REXX, zOS LPARs, RACF. zVM, zTPF, Unisys.
CDM Mainframe support enables accelerated implementation of the DHS CISA CDM Program’s Identity and Access Management (IAM) and Privileged Access Management (PAM) capabilities initiated under the American Rescue Plan (ARP). SME support provides critical input to the development and delivery of configuration compliance assessments for mainframe platforms, configuration checklists, scripts, and programs. FY23 mainframe-related deliverables dependent on contracted support include: employment of centralized identity management systems and their integration into common platform applications (IRS Cybersecurity Zero Trust Implementation Plan Delivery Suspense 09/30/2023); Personal Identity Verification (PIV) enablement for the deployment of all HVA systems (IT Modernization Plan due 09/30/2023); delivery of Homeland Security Presidential Directive (HSPD)-12 compliant multi-factor authentication (MFA) solution for PIV cards and fully implement phishing-resistant MFA at the application layer (IRS Zero Trust Implementation Objective), development of the implementation plan for the Privileged User Management and Access System (PUMAS) privileged account management (ARP Accelerated Modernization due 09/30/2023). Contracted subject matter experts (SMEs) are critical to achieving the 9/30/23 delivery suspense for comprehensive management of privileged user accounts required for the mitigation plan Cyber Risk IT-29 Uncontrolled Data Access. Also dependent on contracted resources is the full implementation and integration of PUMAS (CyberArk PAS), including automated Service Account (SA) management.
| 67 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government provide information about what MFA capabilities are in place and what other capabilities are being considered for expansion? |
| See 17MAY23 Treasury Memo via DACIO “Phishing-Resistant MFA Sprint”; HSPD-12 MFA PIV; FISMA Metric Reporting Dashboard; DARE/DITE, MFA for HVAs & Password Accessible Mainframes, Applications, Systems. In Progress: SADI, FIDO2 / U2F, PKI, etc. |
MFA for HVA is a CIO-mandated effort to address deficiencies in enterprise-wide multi-factor authentication and personal identification verification card use for end-users. IRS MFA HVA deficiencies were cited in TIGTA's FY21 and FY22 Annual FISMA Audit Reports. The IRS also has open recommendations to remediate authentication weaknesses in a 2018 Government Accountability Office (GAO) Audit Report. Contracted support for MFA HVA programs enable Agency compliance with HSPD-12 PIV card and phishing-resistant MFA requirements at the application layer as part of the Zero Trust architecture implementation initiatives enumerated in OMB M-22-09. This program area includes a commitment to deliver PIV-enablement for HVA systems deployment on all 7 IRS HVAs (FMS, RRACS, BDA, eServices, SCRIPS, ERCS, EFPPS) by 9/30/23 under the IT Modernization plan and the mitigation plan for Cyber Risk IT-29 Uncontrolled Data Access. Contracted support directly influences the Agency’s ability to meet 100% MFA authentication for all applicable systems in support of the President’s Executive Order on Improving the Nation’s Cybersecurity and IRS IRA Objective 3.2.11 Enhanced Multifactor Authentication. Enhanced security measures provided by robust, phishing-resistant MFA will protect critical software and data. Micro Focus is the Agency's commercial PIV/MFA solution of choice for mainframe applications (IMF, BMF, CADE2) and z/OS, z/TPF, z/VM and Unisys platforms across the enterprise. Micro Focus Dedicated Support Engineers (DSE) and OpenText support to the IRS CDM Program test and deploy the MFA solution across enterprise HVAs, mainframes, and platforms. Federal mandates for updating password policies under OMB M-22-09 are dependent upon implementation of MFA access to all systems; password requirements are applicable only when public key infrastructure (PKI) based authentication is not feasible. OMB M-23-03 Guidance on Federal Information Security & Privacy Management Requirements (08DEC21) defines new FISMA reporting metrics (including MFA compliance) reported quarterly by IT Cybersecurity via the Department of the Treasury to OMB. MFA Encryption reporting requirements under OMB M-23-03 track 19-point compliance for 155 FISMA systems including both internal and external end-users.
| 68 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Has the Government already identified all HVAs within the purview of this SOO? |
| Yes |
| 69 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government provide more detailed information about the Enterprise Container Platform? |
| The IRS Enterprise Container Platform (ECP) provides capabilities for running, operating, managing, and monitoring containerized, cloud-ready applications at scale; provides a means to modernize and de-couple applications into on-premise “micro-services”; and support migration to the cloud. Requires security analyst and engineering support for ECP vulnerability assessments, configuration settings, risk mitigation, and enterprise lifecycle management components. Application container security, operations, and management capabilities are required for Agency compliance with OMB Advanced (EL3) Event Log Management (OMB Event Log Maturity Model Classification) on 100% of systems by 08/27/2023 per OMB M-21-31 Improving Federal Government Investigative and Remediation Capabilities Related to Cyber Incidents (27AUG21). ECP program modernization is also necessary to achieve Agency strategic plan “Bulletproof Audit Trails” goals and federal Zero Trust Architecture Implementation benchmarks under EO #14028 and OMB-21-31. There are 11 Cybersecurity Solutions Development (CSD) organizational commitment Agile epics associated with Advanced Enterprise Logging Maturity (EL3), the majority of which are scheduled to run throughout Q3 of FY23. ECPs Red Hat OpenShift Container Platform (Red Hat Enterprise Linux (REHL) Host) is an enterprise-grade application environment that supports all aspects of the development and deployment process. Applications are deployed via continuous delivery (CD) tools and are run on containers built using continuous integration (CI) tools. ECP provides platform-level features including routing, configuration, load balancing, and more. IRS Cybersecurity is currently engaged in an active enrollment campaign to identify systems and applications on the network which require event logging. |
| 70 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government provide description or list of the in-scope IRS Systems and the in-scope Treasury WC2-H cloud environment assets? |
| Departmental Offices (DO) Amazon Web Services (AWS) Treasury Digital |
Services Workplace.gov Community Cloud High (WC2-H) Environment.
The Treasury CDM SailPoint, DataMart and IRS BEARS / SailPoint environments are housed in the Treasury FEDRAMP High enclave – WC2H. IRS Carbon Black (SWAM) Servers, Splunk Servers, Entrust HSP, PUMAS, etc. are hosted on WC2-H.
| 71 |
| 7/5/23 |
| Task 3: Cybersecurity Systems & Capabilities Support |
| Can the Government provide additional insight to the requirements for Vulnerability Management Task Item? |
| The IRS Enterprise Database Scanning (EDS) Program protects Filing Season (FS) critical applications, high value assets (HVAs), infrastructure general support systems (GSSs); informs Security Assessment and Authorization (SA&A), Annual Security Controls Assessment (ASCA), and Enterprise Lifecycle (ELCS) programs and processes. This enables expansion of enterprise security scanning capabilities necessary to identify vulnerabilities in database configuration and design for remediation. It also supports expanded scanning requirements for cloud environments and IBM mainframes in accordance with (IAW) revised EDS standard operating procedures (SOP), dated 03/15/2023. Database scanning and scan report analysis are key components to successful implementation of National Institute of Standards in Technology (NIST) Special Publication (SP) 800-53 Rev. 5 Security Control RA-5 Vulnerability Monitoring and Scanning (10DEC20). EDR capabilities facilitate Agency compliance with CISA Binding Operational Directive (BOD) 23-01 Improving Asset Visibility and Vulnerability Detection on Federal Networks (03OCT22), which requires scans are conducted every 14 days; IRM 10.8.1.3.16.4(1) which requires scans every 30 days and ad hoc; Federal Information Security Modernization Act (2014) requirements and security best practices. Subject Matter Experts (SMEs) provided support the EDR Tech Team, responsible for 100% of database vulnerability scan findings in accordance with the Defense Information Systems Agency (DISA) Security Technical Implementation Guides "(STIGs) Checklists". |
The EDR Program produces key reports, metrics, and summary findings which inform enterprise risk management processes and mitigation strategies. The Agency's failure to close scanning tool gaps necessary to perform checks for unauthorized hardware components / devices and to notify appropriate organizational officials is cited in TIGTA's FY22 FISMA Audit Report. The same report references existing unaddressed recommendations related to vulnerability scanning in prior year IRS FISMA Audit Reports and TIGTA Report No. 2022-20-006, Vulnerability Scanning and Remedial Processes Need Improvement - (Metric 21). Enterprise Database Scanning capabilities are a core component of securing IRS internet-accessible applications under federal Zero Trust Architecture (ZTA) implementation guidance enumerated in Office of Management and Budget (OMB) M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (26JAN22) in response to Executive Order (EO) #14028 Improving the Nation’s Cybersecurity 12MAY21).
| 72 |
| 6/30/23 |
| General |
| Considering the breadth and depth of potential support needs described in the SOO, it may be helpful for the Government to provide industry with a sense of the expected level of effort. For example, would the Government consider providing information such as the estimated hours by CLIN and labor category for the current ITSI support contract? |
| Please obtained information from a FOIA request. |
| 73 |
| 6/30/23 |
| General |
| Does the government anticipate releasing this as a firm fixed price, labor hour, or a hybrid requirement? |
| TBD by the contracting officer. |
| 74 |
| 6/30/23 |
| Task 1 – Page 8, 9 |
| In order to develop a solution that will meet the IRS’s needs, bidders will need more information on the scope and complexity of the work. Will the government provide additional detail – for example, what is the estimated number of programs? |
| TBD |
| 75 |
| 6/30/23 |
| Task 2 – Page 9 |
| For planning purposes, what is the required / desired level of small business participation? |
| Small Business participation is encouraged |
| 76 |
| 6/30/23 |
| Task 3 – Page 9 |
| Is the government wedded to an on-prem model, or would you be open to bidders proposing a managed service model to achieve cost savings? |
| On prem |
| 77 |
| 6/28/23 |
| General |
| After reviewing the opportunity, I'm unable to find any attachments referenced in this posting. Would you please provide a copy of the Draft SOO that is referenced? |
| Please go to SAM.gov |
| 78 |
| 6/26/23 |
| N/A – Submitted Capability Brief |
| 79 |
| 6/27/23 |
| General |
| Wants Connection to Small Business Representative in Procurement |
External: https://www.irs.gov/about-irs/procurement
| 80 |
| 6/27/23 |
| General |
| Was reviewing this solicitation but not able to download the SOO for some reason (says files have been deleted). Would love to review in more detail to see if our company may be of assistance. |
| Please go to SAM.gov |
| 81 |
| 6/26/23 |
| General |
| The Draft SOO lists this procurement as a “Recompete.” Please identify who the incumbent contractor is and what the current contract number is. |
Maximus Federal Services Inc.
| 82 |
| 6/27/23 |
| General – Submitted Capability Statement |
| Please let me know if there’s direct award opportunity under NAICS Code 541511, 541512, 541513 and 541519 wherein you can consider Agovx LLC. |
| Please keep checking the procurement opportunities to include GSA, Sam.gov, NASA-SEWP and others may have postings. |
| 83 |
| 6/23/23 |
| General Procurement |
| Is this a new requirement or contract renewal? If re-compete, what is the current contract number and who is the incumbent? |
| Maximus Federal Services Inc. |
| 84 |
| 6/23/23 |
| General Procurement |
| Will the Government consider using GSA Schedule (Our GSA Schedules 47QTCA19D00ER (STARS III); 47QTCB22D0051 (MAS)? |
| Yes |
| 85 |
| 6/23/23 |
| General Procurement |
| Will the Government be changing the Solicitation Number upon RFP release? |
| This is only market research, there is no solicitation number at this time. |
| 86 |
| 6/23/23 |
| General Procurement |
| Will the Government consider a set-aside for Total Small Business? |
| TBD by the CO and Market Research results. |
| 87 |
| 6/23/23 |
| General Procurement |
| When does the Government plan to release the RFP? |
| Conducting Market Research. No dates have been determined at this time. |
| 88 |
| 6/23/23 |
| General Procurement |
| Will the Government be making the award for this requirement in FY23? |
| No |
| 89 |
| 6/23/23 |
| NA – Submitted Capability Statement |
| 90 |
| 6/23/23 |
| NA – Submitted Capability Statement |
| 91 |
| 6/22/23 |
| General Procurement |
| Who is the incumbent contractor(s) currently supporting the requirements of the subject solicitation? |
| Maximus Federal Services Inc. |
| 92 |
| 6/22/23 |
| General Procurement |
| I would like to confirm if the project mentioned above are considered as new requirement or is there an incumbent contract? |
| Maximus Federal Services Inc. |
| 93 |
| 6/22/23 |
| General Procurement |
| If there are incumbent vendor(s), would you be able to provide the contract details (such as: Vendor Name, Contract Number, Award and end dates, total contract value |
| Maximus Federal Services Inc. |
| 94 |
| 6/22/23 |
| General Procurement |
| Is an estimated value available for this requirement? Is it estimated to be greater than $250,000? |
Maximus Federal Services Inc.
It is over the simplified acquisition threshold.
| 95 |
| 6/22/23 |
| General Procurement |
| Incumbent Information |
| Maximus Federal Services Inc. |
