24-021-OITA - IDT Innovation_PWS (001).docx

Performance Work Statement Identity Theft (IDT) Innovation

1.0 Introduction & Overview

The Internal Revenue Service (IRS) identified the importance of advancing data analytics, enforcing the tax code, securing operations, and collaborating with external partners to improve tax administration and IRS operations. The IRS recognizes improving outcomes as strategic goals to enhance mission performance.

The IRS, Office of Research, Applied Analytics & Statistics (RAAS) provides innovative approaches to address IRS challenges using public-private partnerships, collaboration with state tax agencies, the tax industry and other stakeholders that assists with combating identity theft.

To accomplish these strategic changes, RAAS supports the IRS Strategic Goals identified in the IRS Inflation Reduction Act Strategic Operating Plan addressed below covering FY2022 to FY2026:

· Dramatically improve services to help taxpayers meet their obligations and receive the tax incentives for which they are eligible.

· Quickly resolve taxpayer issues when they arise.

· Focus expanded enforcement on taxpayers with complex tax filings and high-dollar noncompliance to address the tax gap.

· Deliver cutting-edge technology, data, and analytics to operate more effectively.

· Attract, retain, and empower a highly skilled, diverse workforce and develop a culture that is better equipped to deliver results for taxpayers.

2.0 Background

Identity (ID) thieves are becoming more adept at hacking data sources, placing legitimate taxpayers at greater risk. In 2022, government accounts and benefits, including IRS, accounted for the top accounts compromised by identity misuse (Identity Theft Resource Center). Data breaches can reveal confidential information that allows ID thieves to look like legitimate taxpayers making detection more difficult. The increase in promotion of First Party Fraud (FPF) schemes complicate the landscape in discerning IDT from FPF, and the impact of both is pernicious though not parallel: IDT results in loss of private taxpayer data as well as refund dollars, and risks granting a thief access and legitimacy to commit further malicious acts.

Attempted tax refund IDT was roughly $15B in 2022, 50% more than the prior year amount, and it burdens taxpayers, creates challenges for revenue protection, diminishes confidence in the tax system and impacts IRS operations. RAAS partners with other organizations in the IRS to combat IDT, serving as an effective integrator of IDT work across the organization and helping business units collaborate to achieve IDT goals. RAAS delivers an unwavering commitment to precision and quality in the IRS by:

· Identifying and implementing proven frameworks to holistically guide IDT efforts and address risks.

· Producing in-depth analysis of IDT and IRS efforts to combat IDT, the results of which directly impact decision-making.

· Working to enhance defenses and putting forth innovative approaches and strategies to get ahead of ID thieves.

The IRS has had success combating IDT as the known unprotected dollar amount is steadily dropping and is currently estimated at under $250M. Still, the IRS has seen schemes become more sophisticated and include more legitimate taxpayer information. This creates challenges in separating legitimate taxpayers from fraudulent filers increasing the likelihood of unknown undetected IDT.

The IRS addresses challenges and responds to changes in the IDT environment by expanding and adapting the services delivered over time. RAAS delivers research and analysis to identify opportunities to improve IDT detection, mitigation, and associated effectiveness. The RAAS IDT portfolio focuses on these approaches and areas of responsibility:

· Monitoring – development of predictive fraud models and filters and IDT monitoring.

· Threat response – provide rapid response analytical capabilities to assess breaches and incidents and provide recommendations for threat mitigation and treatment.

· Partnerships – with state revenue departments, software Industry, and Information Sharing and Analysis Center.

· New Tools and Techniques – explore and test innovative approaches to IDT challenges.

· Deterrence – Identify the specific techniques and methods used by ID thieves to defeat IRS defenses and use this knowledge to develop and adjust policies and capabilities to dissuade future IDT attempts.

· Strategy – collaborate with IRS stakeholders to assess and develop strategies for IRS business areas and align program areas to key strategic outcomes.

· Portfolio management – support coordination of IDT programs.

The overall RAAS IDT Portfolio is organized into two program areas with teams that maintain systemic IDT models and filters, and this portfolio that focuses on IDT mitigation. The RAAS IDT Portfolio workstreams work closely in strategic partnership with other RAAS portfolios that treat intersecting issues (identity assurance, promoter issues). Collaboration and knowledge sharing across programs in the portfolio is essential to ensure response to a dynamic IDT environment. RAAS and its contractors must work in partnership to ensure alignment of approaches across programs and to integrate and coordinate responses that address portfolio needs.

3.0 Award Objectives

The objective of this Performance Work Statement (PWS) is to:

· Identify, develop, test, and deliver new approaches to detect and deter IDT and reduce false detections. This work will mitigate emerging and existing fraudulent release of refund dollars and taxpayer information, leveraging ad hoc approaches during filing season and strategic analysis of returns throughout the year.

· Perform strategic analysis to address IDT related threats and identify opportunities to close performance gaps, as well as identify factors driving successful IDT and opportunities for mitigation through recommended changes in policies, procedures, or taxpayer protection capabilities.

· Increase coordination and knowledge sharing among internal and external partners.

Contractors supporting IDT programs must engage in bi-directional feedback through ad hoc meetings and other program and portfolio activities that identify needs or emerging issues that may impact more than one contractor. RAAS and its contractors plan for and execute the integration of activities across a multi-contractor work environment and engage with IRS stakeholders to plan and execute programs and deliver continuous process improvement activities. RAAS contractors report program activities and progress up through their RAAS Initiative Managers and RAAS Initiative Directors who provide portfolio management, set strategic direction, define performance management objectives, goals, measures of success, and key milestones that are planned, monitored, and evaluated across programs in the IDT portfolio.

4.0 Scope of Work and Description of Tasks

This PWS is Performance Based Acquisition, hybrid Firm Fixed Price (FPP) / Labor Hour (LH) with mission oriented and event driven performance measures.

The scope of work encompasses contractor support to identify and deliver innovative approaches to detect IDT and reduce false detections, while identifying policies and procedures to deter the submission of IDT returns.

The approaches of IDT mitigation will require two passes: quick response to manage emergent threats (typically addressed ad hoc during the filing season), and strategic analysis to deter and reduce the impact of threats (throughout the year).

The quick response work involves the development new tools and techniques for detection and exclusion and a quick response approach to emerging threats.

The Contractor must deliver a quick response analytic capability throughout the year that may also lead to exploration and new approaches to combat IDT. This task involves ad-hoc response, threat monitoring, and exploratory analysis.

The strategic portion of the work is informed by the filing season analyses in addition to broader analysis of the IDT and filing environment. This work focuses on the data-driven strategic analysis, deterrence research, partnerships, and portfolio management focus areas listed above.

Contractor support requires: the analysis of datasets used to research IDT and legitimate taxpayer returns, identification of IDT tactics and schemes needed better prevent IDT, assessment how IDT impacts the IRS and taxpayers; as well as the recommendation of actionable strategies to address strategic capability gaps. In addition, the tasks within this work statement require knowledge sharing and coordination across the IDT portfolio and partners.

The tasks require understanding IRS systems, processes, and data. IRS IDT effort’s main goals are:

· Improving the individual and business taxpayer experience,

· Protecting from revenue loss, and

· Maintaining operational efficiencies.

These goals are: Advanced analytic approaches identify IDT risks, inform, and revise taxpayer protection strategies, and assist IRS taxpayers at risk from identity theft.

Contractor support will work alongside business stakeholders across the IRS that either a) manage programs to detect IDT b) apply additional protections and response to taxpayers, c) pursue law enforcement actions, or d) monitor and maintain supporting data and operational detection models. IRS has performed this mission for several years and mature, as well as evolving, processes in place to conduct the above action.

The IRS works with organizations in the federal tax preparation industry through partnerships and best practice sharing to address the identity theft threat.

4.1 TASK 1, Orientation Briefing (FFP)

Within two weeks of award, the contractor shall conduct an orientation briefing for the Government. The Government does not desire an elaborate orientation briefing, nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task award participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of award requirements and objectives.

The orientation briefing shall be held at the Government's facility and both parties shall mutually agree upon the date and time.

The completion of this briefing shall result in the following:

1. The contractor and Government personnel who will perform work under this award will be introduced.

2. The Government will show the applicable facilities to the contractor and determine if the contractor will be performing work on the Government’s site.

3. The Government may provide any GFP to the contractor at this time.

4. Any issues concerning the contractor clearances for contractor personnel will be discussed.

5. The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

The contractor shall provide the accounting period end dates to be used for the term of this award.

Desired Outcomes & Deliverables:

The contractor shall provide:

Deliverable 0002.1: Contractor delivers Orientation Briefing Minutes to COR within 5 business days after conducting the briefing. Contractor delivers Quality Control Plan (QCP) to the COR within 60 business days of award order.

4.2, Task 2, RAMP-UP KNOWLEDGE TRANSFER / TRANSITION-IN (LH) (OPTIONAL)

The Contractor shall conduct knowledge transfer and transition-in sessions as needed to ensure uninterrupted performance/service of IDT with the IRS stakeholders and the current support contractor.

4.2.1 Knowledge Transfer

Ramp-Up Knowledge Transfer is defined as the Contractor acquiring and understanding the necessary documentation, information, and processes related to any work in progress. This task includes meeting with the IRS Subject Matter Experts frequently to gather any tacit knowledge related to the Core Systems, Compliance Document Matching and Solutions Engineering/Enterprise Services tasks or programs in development. The government estimates this task will take approximately ninety (90) days to complete after award.

The contractor shall provide the following services:

The Contractor shall appoint a knowledge transfer manager to oversee the transfer of knowledge and ensure all areas are accounted for. If desired, this can be the Project Manager (PM) or Project Scheduler. Prior to the transfer of knowledge, the Contractor shall develop a draft Knowledge Transfer Plan (KTP) and present it to the Government within the first 15 business days after award, final due 1 week after meeting. The KTP shall identify the Contractor resources and roles involved in the transfer process, provide a list of risks and mitigation strategies for the transfer, and contain a detailed resource balanced project schedule developed with in a project management software, like Microsoft Project. The project schedule shall identify tasks, dependencies, deliverables and milestones. The project schedule shall be at a sufficient level of detail to track progress on a bi-weekly basis, (i.e., all tasks will be detailed to a level such that no task has duration of more than ten workdays).

The Government shall have 10 business days to review the draft KTP plan and provide comments to the Contractor. Government and Contractor representatives will then meet to discuss the comments after which the Contractor shall incorporate the agreed-upon changes and deliver a final KTP within 5 business days of the government’s feedback.

The contractor shall meet with the IRS bi-weekly (twice a month) to discuss the progress of the knowledge transfer. The Contractor shall show an updated MS Project Schedule and discuss any risks or concerns at this time.

Operating Constraints:

1. Work under this PWS requirement may require a transition support period for the previous Contractor to transfer knowledge to the new contractor and/or government staff that takes an average of 3 months.

2. The transition phase will start no later than sixty (60) days prior to the incumbent contract end date.

3. All new contractor personnel attend a system security orientation within the first 10 business days following initial assignment to any IRS contract/order, and additional IT security awareness training (commensurate with the individual’s duties and responsibilities) within 5 business days of being granted access to an IRS facility or system.

4. The IRS relies on multiple teams working together to deliver planned capabilities for one or more products and services. Teams involved in the transition could be primarily Contractor, IRS, or any combination (multiple contractor organizations).

5. All work and products become the property of the government, regardless of the ownership of the automation hardware or software used to create the products or services.

Desired Outcomes & Deliverables:

The contractor shall provide:

Deliverable 0002.1: Knowledge Transfer Plan:

The Contractor shall provide a Knowledge Transfer Plan that is accepted by the Government and successfully completes knowledge transfer in accordance with the plan and no later than three months after Government acceptance of the Knowledge Transfer plan.

4.2.2 Transition-In (LH)

The Transition-In Task permits for an effective transition from incumbent(s) Contractor to a new Contractor. The Government estimates this task will take approximately 90 calendar days to complete from the contract award date. Successful transition can be defined by its capacity to maintain full continuity of operations, high productivity, and exemplary service quality. To ensure a successful, low-risk transition, the Contractor shall follow the approved Transition-In Plan submitted as part of their proposal and keep the Government fully informed of status throughout the transition-in period. During the transition-in period, the incumbent(s) is responsible for performance. This Task would be worked concurrently with Task 2, Ramp-Up/ Knowledge Transfer.

In addition to the transition actions in the approved Transition Plan, the Contractor shall perform the following activities during the transition-in period:

1. Assign personnel and submit security papers promptly to get the background investigations done quickly and gain access to IRS’s network, including completing IRS Security and IT Awareness Training

2. Create a project schedule at a sufficient level of detail to track progress on a weekly basis.

3. Request access to tools and documentation

4. Review and understand all the technical and process documentation.

5. Review and understand the existing data and system security policies in place.

6. In support of this task, the Contractor shall be responsible for completing the following deliverables:

Transition-in Checklist The Transition-in Checklist provides a vehicle to verify completion of the necessary transition-in activities. The Transition-in Checklist shall be developed by the Contractor and shall include all necessary activities to ensure an effective transition from incumbent(s) Contractor to a new Contractor were performed.

The Transition-in Checklist shall be signed by both the Contractor and the COR after completion of the task.

Desired Outcomes & Deliverables:

The contractor shall provide:

Deliverable 0002.2: Transition-In Checklist:

The Transition-in Checklist provides a vehicle to verify completion of the necessary transition-in activities. The Transition-in Checklist shall be developed by the Contractor and shall include all necessary activities to ensure an effective transition from incumbent(s) Contractor to a new Contractor were performed. The Transition-in Checklist shall be signed by both the Contractor and the COR after completion of the task.

4.3 Task 3, Program Management (FFP)

The contractor shall provide the following services:

1. Initiate, plan, execute, and monitor the work of the Contractor team to achieve the objectives, address the requirements, and provide the deliverables as stated in the PWS.

1. Participate in weekly briefings about the work throughout the period of performance, including periodic quality reviews of in-process work. The contractor shall provide status update to RAAS management and other appropriate IRS staff, Contracting Officer Representative (COR), and IRS Initiative Manager/Director, highlighting key accomplishments/work activities, risks, and any general concerns with the completion and/or budget of this work. Ongoing meetings will be established to go over the progress on projects and deliverables.

1. Produce monthly status reports throughout the period of performance.

1. Create a final work summary report and conduct a close-out meeting to wrap up any items related to the Contractor’s final deliverables and any other necessary matters before Contractor exits the Award Order.

Operating Constraints:

1. Employ IRS processes and adhere to guidelines for data privacy and security risk management throughout the period of performance following IRS security and data protection protocols.

2. Coordinate with the COR to facilitate staff onboarding and offboarding, annual IT security training, and processing of new contractor personnel background investigations.

3. Perform knowledge management activities to ensure interim work product and final deliverable information is current; and, all data, analyses, and materials are saved on SharePoint, shared file locations, or on Compliance Data Warehouse (CDW) servers.

4. Transfer knowledge of technical skills and lessons learned to IRS staff upon completion of deliverables and work products.

Desired Outcomes & Deliverables:

The contractor shall provide materials at regular cadence, including summary reports on work status and work summary materials, and communicate project status, updates, and risks for IRS project leadership.

Deliverable 0003.1: Monthly Status Reports The Contractor shall produce a single monthly report in Word, PowerPoint, or any another agreed upon format, that contains the status report information that records the work delivered in the prior month to the COR and IRS Initiative Manager no later than 5 business days after the end of each calendar month. The monthly status report shall include:

1. Description of work performed in the past month, including a compendium of analytic products.

1. Work planned for the coming weeks.

1. Progress of critical upcoming tasks and activities.

1. Warnings to any problems or delays in project timeframes.

1. Attempted solutions of encountered problems, issues, and any risks identified with corresponding mitigation actions and escalation plans.

Deliverable 0003.2: Weekly and Ad Hoc Briefings

Deliverable 0003.3: Close-out Meeting and Activities (Final Work Summary Report (to include document inventory and identify any gaps)

4.4 TASK 4, Quick Response and Innovation (Labor Hours)

The IRS relies on a team of IDT subject matter experts to research requests to assess the initial impact of IDT incidents, as well as in-depth research which identifies scheme characteristics and offers recommendations to improve IRS systemic defenses.

Stakeholders pose ad hoc questions requiring quick and accurate responses. Depending on the nature of the request, response requirements range between brief research and analysis and a quick turnaround to a set of short sprints and rapid prototyping. Briefing out on the status and results of these requests, as well as ongoing analytic work related to IDT schemes uncovered and mitigated during filing season, is of paramount importance to facilitate a coordinated response across IRS stakeholders.

Work during the filing season is steady and driven by responses and stakeholder requests. Work may slow down post-filing season or shift toward exploration.

The Contractor shall:

1. Perform analytic work related to data breaches, IRS security incidents and emerging IDT refund fraud schemes as well as ad hoc analysis and research related to new IDT approaches.

2. Complete an initial assessment of IRS security incidents and emerging IDT schemes within 1 week of request receipt.

a. Evaluate each security incident, and segment at-risk taxpayers into impacted, potentially impacted, and protected categories.

b. Conduct in-depth research that extends beyond descriptive reporting by providing quantitative analysis on the scope and originations of the incident, as well as proposed recommendations for threat mitigation and treatment.

c. Where appropriate develop filters that allow for detection and treatment of additional returns associated with emerging schemes.

3. Respond to the short turn around ad hoc requests and explore new concepts/approaches in a timely manner. (Requests will come with a proposed turnaround time (e.g., by end of day for short turnaround, 2-4 business days for ad hoc requests), but there are opportunities to shift the timeframe depending on the priorities and feasibility of response time).

4. Propose approaches to detect IDT, deter IDT or reduce false detections.

5. For ideas approved by the government (for ex., identify specific form data availability; analyze/quantify populations with a risky filing behavior) , lead sprints to rapidly prototype and develop concepts around new IDT approaches. (The number of sprints and duration of sprints will vary).

6. Develop a tracking system to maintain awareness of the status of various tasks and projects.

7. Report out on emerging schemes and ad hoc analysis to supporting Subject Matter Experts (SMEs) and stakeholders to enhance awareness of schemes and communication/solutioning. Information-sharing during filing season is expected to be frequent (e.g., daily) to prioritize immediate information-sharing.

8. Generate potential modeling features which, if approved, will be implemented by the Models and Filters team. Suggestions for features should be completed by the end of February and delivered to the Models and Filters Team for implementation.

9. Appropriately document methodologies, work products, programming scripts and other foundational documents in Microsoft Word or other programs as appropriate.

Operating Constraints:

1. Research requests are received by the team from IRS Business Units on an ad-hoc basis, but the high-profile nature of these assignments shall require timely analysis, assessment, and recommendation to stakeholders.

2. Activities during the filing season are more focused on incident assessment and response. These incidents may occur after the filing season as well. After the filing season it will require analyzing data to identify schemes missed and explore opportunities to combat schemes in the next filing season.

3. It is not possible to estimate the timing, focus, and extent of the work required for threat response analysis requests since the demand for these services is uncertain and occurrence of threats cannot be predicted. The following historical workload attributes are provided for yearly support:

a. Most of the workload is driven by ad hoc requests that require short turnaround (from one day to a week).

b. Some analyses lead to deeper investigations of potential schemes, development of filters and presentations of findings.

c. When an incident arises, workload may shift to develop and understanding and response framework.

i. Timeframes range from days to weeks.

d. If there are no questions to answer or incidents to respond to opportunities to explore IDT data and identify potential schemes.

Desired Outcomes & Deliverables:

The contractor shall provide insights from scheme analysis to improve business processes and IDT detection effectiveness. They will propose new approaches to combat IDT:

1. Effectively communicate to IDT Threat Response team stakeholders in a timely manner the initial scope of a security incident or emerging IDT scheme.

2. Develop an understanding of the nature of incidents and, where possible, develop filters to prevent additional high-risk returns related to the examined incident or scheme from being submitted.

Deliverable 0004.1 – Quick Response and Innovation Work Products:

The contractor shall provide a work product for each request. The work products will be evaluated and approved by IRS personnel. The work products will vary depending on the nature of the request. Informal ad-hoc requests requiring straight forward information may result in an e-mail product, whereas more in depth analysis may require an Excel Output. For more substantive requests, Power Point and/or Word Documents may be needed to describe methodology along with the results. There may also be coding work products that can be used to replicate the analysis.

4.5 TASK 5, Segmentation and Network Analysis (Labor Hours)

The Segmentation and Network Approaches use advanced modeling methods to identify clusters of risky and safe groups of taxpayers. This approach builds on selections and false detections to identify non-selected associates and groups likely to be false detections. This allows for a reduction in false negatives and false positives. This work will build on existing segmentation and network approaches, currently tested and developed. The task will evaluate opportunities to develop new approaches/pilots, as well as expand and refine existing approaches.

Segmentation is a rigid clustering approach based on a set of criteria for inclusion in a segment.

Network analysis is a flexible clustering approach allowing for the exploration of multiple combinations of linking factors to create taxpayer segments. Using various linking factors can lead to improved selections and exclusions as all groups of IDT and false detections may not separate well using a rigid set of criteria.

The Contractor shall:

1. Develop an understanding of IDT operations across stakeholder business units to identify opportunities for improvement and ensure recommendations are in line with current operations.

2. Monitor exclusions/selections made by the Segmentation and Network approaches and provide selections and/or exclusions to stakeholders (Mid-January to Mid-November).

3. Present updates, analysis, findings, and recommendations within RAAS and to defined stakeholders (estimated five demonstrations to executives between February and November).

4. Perform an evaluation of selections/exclusions, identify meaningful criteria and potential explanatory factors that allow for decisions to be made for the next year that improve the selection/exclusion methodology based on results (May to August).

5. Perform ad-hoc analysis related to clusters to identify trends, schemes, and additional analytic insights for immediate action and future consideration.

6. Generate potential modeling features and model revisions to include new approaches which, if approved, will be implemented by the Models and Filters team (suggestions for features should be completed by the end of February).

7. Define, maintain, and report metrics such as the percentage of confirmed IDT cases, the percentage of false detections, the number of returns excluded, the percentage of exclusions determined to be confirmed IDT and false detections.

8. Appropriately document methodologies, work products, programming scripts and other foundational documents in Microsoft Word or other programs as appropriate.

9. Provide a timely response (acknowledgement of request within 1 day) to RAAS and business operating division (partner) requests for information about the Contractor’s plans and execution of task activities, proactive and effective resolution of issues, timely communications, and regular status updates that may include verbal and written briefings (estimated 10 presentations throughout the year).

Operating Constraints:

1. This task develops approaches to test out innovative ways to detect IDT returns. Once stakeholders require no changes, the development may end, and the project may be transitioned to be maintained by another group within the IRS. The transition process would occur between September and January of the following year. Exclusion approaches may be tested offline before deploying (i.e., exclusions can be tested by tracking proposed exclusions of actual selections and noting false positives versus confirmed IDT).

2. The network approach requires more computational resources and is currently being developed on a Kubernetes cluster, using MinIO for object storage. This development on these systems is not finalized and has required input from the Network Team, as well as extensive coordination with the RAAS Data Management Division that owns the servers.

Desired Outcomes & Deliverables:

The contractor shall provide:

Returns associated with IDT clusters or non-IDT clusters are selected or excluded (as appropriate) and delivered to stakeholders on a weekly basis to IRS stakeholders from late January to November.

1. A filing season analysis delivered by the end of August that allows IRS stakeholders to determine whether to continue approaches and whether changes need to be implemented for the next year.

2. Metrics are defined, data collection is maintained, and results are reported over time that inform IRS stakeholders about IDT detection outcomes resulting from the piloted approach. Key metrics include but are not limited to:

a. Number of returns selected as potential ID Theft (and the impact marginal to other filters)

i. Percent confirmed as ID Theft

ii. Percent determined to be False Detections

b. Total number of returns confirmed as IDT

c. Number of clusters identified through segmentation or network analysis

d. Summary statistics of all clusters showing selections, IDT, false positives, and other statistics of interest

Deliverable 0005.1 – Exclusion/Selection Analysis:

The contractor shall develop PowerPoint presentations including:

1. An executive summary

2. A discussion of the methodology, including data collection procedures, outcome measures and analytic techniques

3. A summary of selections/exclusions made by the approach including:

a. Outcomes of returns selected/excluded

b. Insights on drivers of good and bad selections/exclusions

4. Recommendations for improvements to the selection/exclusion process

These briefings shall be completed by May 31 and August 31.

Deliverable 0005.2 - AI Governance Reporting:

In accordance with recent executive orders and policy determinations, any machine learning model or similar advanced analytics tool, may have an annual review and reporting requirement. This will include presenting the use case to a technical evaluation committee, to evaluate the work and ensure it remains fair and unbiased, in a suitable presentation format, like PowerPoint. Also, the annual creation and/or update of a TEC model and data card.

4.6 Task 6, Strategic Threat Path and Anomaly Detection and Mitigation (FFP)

IDT threat mitigation efforts use data-based insights to inform business strategies to reduce IDT attempts. This work develops understanding of how IDT schemes bypass existing systemic checks to develop strategies to increase costs of theft attempts, decrease rewards from IDT attempts, and reduce attempts overall. Emergent threat paths are identified through a variety of methods; the IDT Portfolio currently uses a cohort-based model to detect anomalous segments of the filing population – this model evaluates the filing population to identify cohort-level anomalies, where pockets of anomalous returns may be an early warning signal of an emergent threat path. This model is expected to work as part of the identification process for finding new threat paths, to then develop further into a deeper analysis.

The anomaly detection model was developed in RAAS in 2023 and is in a pilot stage. It uses historical tax data sourced from RRP to identify suspicious behavior and emerging schemes. The model seeks anomalous year-over-year activity within taxpayer cohorts to detect emerging schemes and relies on interpretation to identify schemes among anomalies (as taxpayer filing behavior may change due to policy changes, for example). The model pipeline generates weekly reports that identify anomalous filing behavior. The next step with this work is to connect this anomaly detection model to the threat path detection work, to use the anomalous filings as seeds for additional analysis into them as threat paths.

In addition to detecting and developing strategies to deter unknown IDT threat paths, the IRS IDT Portfolio currently develops ad hoc and strategic analyses to mitigate emergent and egregious threat paths. An example of this is the IDT Portfolio work to identify and mitigate abuse through IRS phone lines using compromised preparer credentials. For these types of work, the analysis is expected to leverage relevant IRS data sources in both tactical efforts to shut down abuse (e.g., data breaches, accepted IDT and false returns), as well as develop holistic solutions to identify, recommend treatment, and assess impact of this threat path.

The Contractor shall provide:

IDT Threat Path Analysis

1. Identify specific threat paths among confirmed IDT returns and suspect IDT returns by applying analytic methods using IRS datasets, including but not limited to the Return Review Program (RRP), Dependent Database (DDb), Taxpayer Protection Program (TPP), and Compliance Data Warehouse (CDW).

2. Maintain the anomaly detection model and generate weekly reports on anomalous cohort behavior.

3. Use data to describe at least six, separate IDT threat paths taken by ID thieves (minimum IDT count per scheme: 150) that were not discovered by existing models and filters in the previous season.

4. Document the findings and develop recommendations for treatment. Documentation is not limited to but to include description of analytic approach, code, and description of data. Recommendations may include changes to policy, procedures, or a suggested filter/model, as well as estimated impact of the intervention.

5. Contractor shall validate the accuracy of data and provide validation results to the government.

Mitigating Existing Threat Path Abuse

1. Contractor shall develop datasets composed of relevant IRS data to scope emergent threat path, e.g., containing RRP, CDW, and other data sources.

2. Contractor shall develop and document algorithms and approaches using the dataset defined above to 1) quantify the IDT threat and 2) rapidly identify data breaches.

3. Contractor shall provide ongoing ad hoc monitoring to identify data breaches or other IDT-related data losses while continuing development of datasets and algorithms to holistically identify system abuse.

4. Contractor shall make recommendations for threat mitigation and treatment related to the IDT threat associated to the threat path.

Operating Constraints:

1. Contractor will be provided with capabilities available in any IRS approved software.

2. Contractor will be provided with existing anomaly detection model, datasets, code, and documentation. Model is an unsupervised anomaly detection model that is run on the IRS GPU server.

3. Separate IRS processes produce datasets indicating specific returns which are confirmed IDT. Contractors may produce their own logic to determine which additional returns are IDT. Government will provide access to separately produced data indicators for returns believed to be confirmed IDT by IRS processes.

4. New data sources and computed variables produced during the execution of this task may be used by government or other vendors supporting IRS mission areas.

Desired Outcomes & Deliverables:

The contractor shall:

1. Recommend actions to mitigate the threat path, increase the cost of using the path, or decrease the reward for attempting IDT through the threat path.

2. Indicate how actions would minimally impact legitimate taxpayers or provide an accompanying reasonable resolution for lessening the impact to legitimate taxpayers.

3. Demonstrate and quantify specific addressable IDT populations for recommended interventions.

4. Identify threat paths definitions that apply to confirmed IDT as well as threat path definitions that apply to previously undetected IDT.

5. Recommendations for abuse threat mitigation and treatment, including ad hoc treatment recommendations during the year alongside broader analytic effort.

Deliverable 0006.1: IDT Threat Path Results and Analytic Products:

The Contractor shall produce results and analysis for this task. Threat path analysis efforts begin in advance of the filing season (e.g., 09/30) and complete after the filing season (e.g., 4/30). For written MS Word or PowerPoint documents, interim drafts shall be provided monthly at least 5 months preceding the final deliverable due date.

This deliverable shall include:

1. IDT Threat Paths: Findings and Recommendations Documentation The contractor shall document the ID theft threat paths or schemes definitions and criteria, procedures to replicate analysis, and code to develop the analysis. Additionally, the contractor shall document potential actions to mitigate the threat paths and impact.

2. Underlying Threat Paths Dataset, New Variable Definitions, and Code The contractor shall produce the dataset that may use new data sources and computed variables with existing government-furnished data sourced from RRP, DDB, TPP, or CDW. The contractor shall document the procedures to extract, import, and integrate new data sources and calculate new computed variables. The contractor shall document the code used to produce this data.

Deliverable 0006.2: Anomaly Detection Model:

The Contractor shall maintain and develop historical datasets for anomaly detection, leverage sets to detect anomalous filings, analyze findings for schemes, and recommend potential schemes as possible threat paths or for further treatment.

This deliverable shall include:

1. Cohort Maintenance and Identification The contractor shall (1) Leverage and maintain historical data sets to create cohorts of taxpayers to monitor for suspicious activity; (2) Detect anomalous segments within the cohorts.

2. Cohort Monitoring and Treatment The contractor shall (1) Analyze findings for schemes; (2) Recommend potential schemes as possible threat paths or for further treatment.

Deliverable 0006.3: Abuse Mitigation, Modeling, and Analysis:

The Contractor shall produce datasets and analysis, in addition to ad hoc and systemic recommendations within this task. These efforts are expected to be completed by end of fiscal year (e.g., 8/30). Interim drafts shall be provided monthly at least four months preceding the final deliverable due date.

This deliverable shall include:

1. Dataset and Approaches The contractor shall (1) Develop a dataset that leverages relevant IRS data to the threat path being mitigated, to include but not limited to return-level filing data and metadata available in RRP and subject-relevant sources (for example Verint log data, the Centralized Authority File eFax System (CAF EFS), Transcript Delivery System (TDS), and Accounts Management (AM) text narratives for the CAF/SORID analysis); (2) Develop and document methods to leverage the developed dataset to quantify the data breach/loss threat and quantify potential impact.

2. Data Loss Mitigation Recommendations The contractor shall (1) Provide ongoing monitoring of the threat path and make tactical recommendations to mitigate data loss and related IDT impact; (2) Apply algorithmic solutions to systemically identify abuse and recommend selections for treatment.

Deliverable 0006.4 - AI Governance Reporting:

In accordance with recent executive orders and policy determinations, any machine learning model or similar advanced analytics tool, may have an annual review and reporting requirement. This will include presenting the use case to a technical evaluation committee, to evaluate the work and ensure it remains fair and unbiased, in a suitable presentation format, like PowerPoint. Also, the annual creation and/or update of a TEC model and data card.

4.7 TASK 7, Inventory/Workload Support (Labor Hour)

Increased inventory for related and downstream processes to IDT selection, to include but not limited to Taxpayer Protection Program (TPP) and Identity Theft Victim’s Assistance (IDTVA), create the need and opportunity for inventory support. Currently, the IDT Portfolio has developed an understanding of downstream/related process inventories through classification analysis, and there is additional opportunity to continue to identify opportunities for inventory analysis for increased efficiency. Additional understanding can facilitate (1) understanding of inventory load and reasons driving growth, (2) developing reasoning and making recommendations for inventory prioritization, as well as (3) making additional recommendations to enhance inventory efficiency.

The contractor shall:

1. Perform analysis of existing inventory in downstream and related processes to IDT identification and/or selection as requested by IRS: process, needs, factors impacting inventory volumes, including policy or environmental changes that may impact volumes.

2. Where appropriate, leverage IRS and external data sources to develop prioritization solutions that meet stakeholder business case requirements.

3. Sufficiently document methodologies, work products, code, and other required work products as appropriate.

4. Finalize and communicate the analytic approach in a report, not limited to but including assumptions, rational, data preparation, stakeholder feedback, repeatable code (where applicable), and the procedures to repeat the analysis.

Operating Constraints:

1. Certain inventories assisted by IDT Portfolio face significant backlog, where business processes may elongate the timeline to see the impact of efficiency recommendations.

Desired Outcomes & Deliverables:

The contractor shall provide:

1. Designated inventory or inventories are classified along a metric of significance to the business unit (for example, level of effort to work the case, confidence that the case is an IDT case, etc.).

2. Recommendations for inventory prioritization are documented, to include communication in plain language to stakeholders for handing off work products.

Deliverable 0007.1: Inventory Process, Classification, and Recommendations:

The Contractor shall analyze current inventory of a designated process downstream or related to IDT identification/selection, then provide classification and prioritization recommendations.

This deliverable shall include:

1. Inventory Process Mapping The contractor shall Develop understanding of designated inventory, which may include developing process maps, business unit process flows and needs.

2. Inventory Classification and Recommendations for Prioritization The contractor shall (1) Categorize inventory; (2) Develop and make recommendations for inventory prioritization based on above understanding of business unit needs.

Deliverable 0007.2 - AI Governance Reporting:

In accordance with recent executive orders and policy determinations, any machine learning model or similar advanced analytics tool, may have an annual review and reporting requirement. This will include presenting the use case to a technical evaluation committee, to evaluate the work and ensure it remains fair and unbiased, in a suitable presentation format, like PowerPoint. Also, the annual creation and/or update of a TEC model and data card.

4.8 Task 8, IDT Research Sprints (FFP)

Every year, there are emerging opportunities to develop further analysis out of the other tasks. Such work involves identifying Taxpayer Protection Program (TPP) release candidates using 3rd-party vendor data and applying a machine learning model to identify TPP release candidates. The IRS will require contractor support in performing research sprints to provide timely and accurate data-based insights to emergent IDT-related issues, approximately four (4) per year. This analysis may be developed from work scoped from other tasks, RAAS project management and leadership request, and from feedback from stakeholders, to provide robust analysis and solutions. These research sprints typically support objectives such as: improving the taxpayer experience, protecting IRS from revenue loss, protecting taxpayer accounts and information, and improving operational efficiency.

The Contractor shall:

1. Document the Planned Scope of the Research Sprint:

Documentation to be in PowerPoint or other acceptable format to describe estimated timeline, level of effort, and planned impact of research sprint. Impact statement to include a description of the current state (e.g., quantification of IDT threat and IRS capability to address threat) and effect of desired outcome.

2. Document Methods and Brief Out on Sprint Status:

Include description of methodology, data collected, analytic techniques, and outcome measures, as well as performance results, in regular meetings with project leadership and stakeholders, and in Portfolio update materials.

3. Summarize Sprint Outcome:

Documentation to be in PowerPoint or other acceptable format, to include sprint goal and impact, methodology including documentation of data sources and code.

Operating Constraints:

1. When this work is initiated by the IRS, the task effort will be executed with IRS stakeholders and will be scheduled for completion with a defined timeline, generally expected within 3 months from sprint kickoff, with option to extend as another research sprint.

2. Contractor will have opportunity to gather input and feedback from IRS executive leadership on a bi-weekly or monthly basis as agreed upon between the government and contractor.

3. Contractor will be furnished with at least two existing prior developed strategies as examples of the work.

Desired Outcomes & Deliverables:

The contractor shall:

1. Incorporate and document IRS stakeholder feedback on desired strategic outcomes.

2. IRS stakeholders receive data-based insights that indicate strategic gaps and provide clear rationale explaining the gap.

3. IRS stakeholder feedback on proposed solutions is incorporated and documented into the plan.

4. The analysis presents data-based insights that inform future government decisions regarding adoption of, further investment into, or retirement of IRS capabilities, programs, and activities.

Deliverable 0008.1 – Biannual Sprint Briefing:

The contractor shall develop two executive summaries annually in PowerPoint, or any other acceptable format, which should cover:

A summary of the IDT research sprints including:

A discussion of each sprint’s methodology, including data leveraged, outcome measures and analytic techniques.

Outcome of each sprint and implementation recommendation.

Initial performance results, to include quantifying along IDT metrics, for example IDT mitigated in returns and dollars.

Deliverable 0008.2 - AI Governance Reporting:

In accordance with recent executive orders and policy determinations, any machine learning model or similar advanced analytics tool, may have an annual review and reporting requirement. This will include presenting the use case to a technical evaluation committee, to evaluate the work and ensure it remains fair and unbiased, in a suitable presentation format, like PowerPoint. Also, the annual creation and/or update of a TEC model and data card.

4.9 Transition Out (Optional)

At the end of this award, the Contractor shall provide transition-out services (refer to Federal Acquisition Regulation (FAR) Clause 52.237-3 Continuity of Services). The Contractor shall facilitate the transition of contracted activities and services to the Identity Theft Program personnel and to a follow-on Contractor in accordance with the Government Approved Transition-Out Plan. The transition period shall not exceed sixty (60) calendar days.

The Contractor shall:

· Minimize transition impact to the stakeholders involved in receiving analytic products.

· Ensure no breaks in regular services performed.

· Maintain existing service quality and performance levels.

· Ensure a transparent and seamless transition.

· Maintain support and meet delivery milestones of ongoing projects.

In support of this task, the Contractor shall be responsible for completing the following deliverables: