24-IRA-023-OITA - CSP Continuous Monitoring Automation PWS.pdf

Performance Work Statement (PWS) Cloud Service Provider Continuous Monitoring Automation

IRS Continuous Authorization Services and Oversight Information System Security Officer (CASO ISSO)

Version 1 April 10, 2024

PWS for Cloud Continuous Monitoring Automation | ii

TABLE OF CONTENTS

1 Background

1.1 Purpose

1.2 Agency Mission

1.3 Cloud Service Provider Continuous Monitoring

1.4 Cloud Service Provider and Cloud Service Offerings and Monitoring

1.4.1 Cloud Computing Essential Characteristics:

1.4.2 Cloud Service Models:

1.4.3 Cloud Deployment Models:

2 Scope 3 Objective 4 Tasks

4.1 Task 1 – Program Management

4.1.1 Subtask 1.1 – Coordinate a Project Kick-Off Meeting

4.1.2 Subtask 1.2 – Progress Reports

4.1.3 Subtask 1.3 – Prepare and Update a Project Management Plan (PMP)

4.1.4 Subtask 1.4 – Provide Quality Management

4.1.5 Subtask 1.5 – Provide Knowledge Transfer

4.1.6 Subtask 1.6 – Provide Transition Out

4.2 Task 2 - Automated Cloud Security Continuous Monitoring Tool

4.2.1 Subtask 2.1 Vulnerability Management

4.2.2 Subtask 2.2 POA&M Management

4.2.3 Subtask 2.3 Deviation Request

4.2.4 Subtask 2.4 Compliance Analysis

4.2.5 Subtask 2.5 FedRAMP Compliance Analysis

4.3 Task 3 – Customized Dashboard Reporting

4.3.1 Subtask 3.1 – Develop Core Dashboard Reporting Templates

4.3.2 Subtask 3.2 – Provide Dashboard Reporting Capabilities

4.3.3 Subtask 3.3 – Dashboard Reporting Continuous Updates

4.4 Task 4 – FedRAMP PMO Support

5 Key-Personnel and Qualifications

5.1 Project Manager

5.2 FedRAMP SME

6 Deliverables Table

6.1 Submission of Deliverables

PWS for SPMO Training and Technical Services | iii

6.2 Documentation Requirements

6.3 Review of Deliverables

7 Place of Performance 8 Period of Performance 9 Contract Type 10 Performance Requirements, Standards, and Surveillance 11 Government-furnished Information (GFE)

PWS for Cloud Continuous Monitoring Automation | 1

1 BACKGROUND

The Internal Revenue Service (IRS) Cybersecurity program is responsible for safeguarding the confidentiality, integrity, and availability of the system data. Per the Federal Information Security Modernization Act of 2014 (FISMA), Federal Agencies are required to authorize and monitor the security posture of information systems. System Owners must have visibility into the security risk posture of an information system to continuously authorize the system, allowing their Federal Organization's use of that system. As IRS modernizes and delivers new services on an accelerated timeline to meet the demands of the Inflation Reduction Act Strategic Operating Plan (IRA SOP), it must harness adoption of secure cloud services without compromising security of taxpayer data. This accelerated adoption requires IRS to continuously monitor the security posture of its cloud services. IRS must also continuously interpret and implement new developments in Federal Risk and Authorization Management Program (FedRAMP) to best align its authorization and monitoring processes to meet the needs of the IRA SOP.

Federal Agencies are responsible for determining appropriate policies and procedures to meet FISMA and continuous monitoring requirements. IRS seeks to establish a cloud information security program aimed at effectively overseeing and monitoring the risk posture of their cloud service providers authorized through FedRAMP. The IRS recognizes the challenges associated with agency compliance needs, specifically around managing machine readable data, deriving insights, and making effective risk-based decisions. Agency Information System Security Managers (ISSMs)/ Information System Security Officers (ISSOs) are required to process monthly artifacts that include vulnerability scans, asset inventories, and Plan of Action and Milestones (POA&M); and review other artifacts that include significant changes, annual assessments, and security incident reports to ensure compliance with FedRAMP requirements and new Federal Executive Orders, Emergency Directives, and Binding Operational Directives. At the same time, they need to track vulnerabilities against a number of sources, including the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) Known Exploitable Vulnerability (KEV) database. Comprehensively monitoring cloud services requires parsing through gigabytes of vulnerability data, correlating that data against the POA&M and inventory to ensure the scans cover all inventory assets, vulnerabilities are accurately captured in the POA&M, and are remediated in accordance with internal policies and FedRAMP requirements.

The FedRAMP program continues to evolve. The FedRAMP Authorization Act of 2022 adopted the “Presumption of Adequacy” clause to address the gap that many agencies have in understanding FedRAMP and aligning internal processes to FedRAMP best practices. The Draft Office of Management and Budget (OMB) Policy Memorandum defines the FedRAMP program path as a replacement to the Joint Authorization Board (JAB) authorization path, which intends to define "core security expectations” associated with FedRAMP Authorized security packages.

Interpreting FedRAMP policy and program changes and developing effective and efficient

PWS for Cloud Continuous Monitoring Automation | 2 processing for authorization and monitoring will be key for the IRS in meeting its IRA cloud adoption needs.

The IRS continuous monitoring program is based on Internal Revenue Manual (IRM) 10.8.1, 10.8.24, and the continuous monitoring processes defined by FedRAMP.

1.1 PURPOSE

The IRS is looking for vendors who can provide a FedRAMP approved automation tool as Software as a Service (SaaS) that will manage our security posture, subject matter experts (SMEs) that can customize dashboard reporting from the automation tool and provide FEDRAMP Program Management Office (PMO) support.

1.2 AGENCY MISSION

The IRS mission is to provide America’s taxpayers top quality service by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all. To support the latter part of this mission, the IRS must ensure that its continuous monitoring, diagnostics and mitigation capabilities are designed to strengthen the security posture of IRS systems and networks at any given time as well as make it possible to identify, prioritize, and mitigate vulnerabilities.

1.3 CLOUD SERVICE PROVIDER CONTINUOUS MONITORING

The IRS CONTINUOUS AUTHORIZATION SERVICES AND OVERSIGHT (CASO) INFORMATION SYSTEM SECURITY OFFICER (ISSO) cloud continuous monitoring program supports ongoing IRS authorization activities. Security-related information collected during continuous monitoring is used to complete continuous monitoring summaries. The continuous monitoring activities are performed by the CASO ISSO.

Currently ISSOs conduct the Continuous Monitoring manually which is very labor intensive, more prone to errors and lacks the capability of any dashboard reporting.

1.4 CLOUD SERVICE PROVIDER AND CLOUD SERVICE OFFERINGS AND MONITORING

Cloud computing is defined in NIST Publication 800-145. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

PWS for Cloud Continuous Monitoring Automation | 3

1.4.1 Cloud Computing Essential Characteristics:

• On-demand self-service - A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

• Broad network access - Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource pooling - The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

• Rapid elasticity - Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

• Measured service - Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

1.4.2 Cloud Service Models:

• Software as a Service (SaaS) - The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible Deviation of limited user-specific application configuration settings.

• Platform as a Service (PaaS) - The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating

PWS for Cloud Continuous Monitoring Automation | 4 systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.

• Infrastructure as a Service (IaaS) - The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer can deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

1.4.3 Cloud Deployment Models:

• Private cloud - The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

• Community cloud - The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.

• Public cloud - The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.

• Hybrid cloud - The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

2 SCOPE

The Contractor shall provide program management for all activities under this contract, Subject Matter Experts (SMEs) as defined in the Tasks, along with the subscription base automation tool.

3 OBJECTIVE

To align its cloud transition strategy with the IRS SOP’s aggressive goals and meet the agency’s security needs, IRS must simultaneously inject automation into its cloud monitoring posture while developing new processes for continuous monitoring and improving cloud authorization and adoption. This requires tools and automated workflows tailored for monitoring cloud

PWS for Cloud Continuous Monitoring Automation | 5 services coupled with FISMA and FedRAMP subject matter expertise to optimize processes and operations. This combination of automated tools and expertise is a must for the IRS to both meet its challenges in cloud services monitoring and position IRS to efficiently adopt new cloud services at an accelerated pace with a sound security posture. Through this contract, the IRS will automate collection and analysis of security compliance artifacts across the enterprise cloud environments.

4 TASKS

4.1 TASK 1 – PROGRAM MANAGEMENT

The contractor shall provide program management support under this contract This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement

(PWS).

4.1.1 Subtask 1.1 – Coordinate a Project Kick-Off Meeting

Within five (5) business days of the Project Start (PS), or other mutually agreed upon date, the Contractor shall schedule, coordinate, and host a Project Kick-Off Meeting at the time and location approved by the Government (Section 5, Deliverable 2). The meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the PWS and to assure a common understanding of the project requirements and objectives. The meeting shall provide the opportunity to share and discuss scope, resources (including roles and responsibilities), key milestones and timeline, and technical, management, and security topics, as well as any travel authorization and reporting procedures. At a minimum, the attendees shall include the contractor’s Key Personnel, the Program Manager(s), other relevant Government personnel, the CO, and the COR.

At least three (3) business days prior to the Project Kick-Off Meeting, or on another mutually agreed timeline, the Contractor shall provide a Project Kick-Off Meeting Agenda (Section 5, Deliverable 1) for review and approval by the COR and the Government Program Manager (PM) prior to finalizing. The agenda shall include, at a minimum, the following topics/deliverables:

a) Points of Contact (POCs) for all parties

b) Project Scope

c) Project Personnel (i.e., roles and responsibilities and lines of communication between contractor and Government)

d) Project Staffing Plan and status

e) Present Project Management Plan (Section 5, Deliverable 7) – milestones, deliverables, and associated timelines

f) Financial reporting and invoicing requirements

PWS for Cloud Continuous Monitoring Automation | 6

g) Share baseline Quality Control Plan (QCP) (Section 5, Deliverable 8) The Contractor shall provide a Project Kick-Off Meeting Minutes Report, within five (5) days following the Kick-off Meeting (Section 5, Deliverable 3), documenting the Project Kick-Off Meeting discussion, capturing any action items and/or decisions.

4.1.2 Subtask 1.2 – Progress Reports

The Contractor shall provide an electronic weekly, monthly, and quarterly progress report, or on a schedule mutually agreed upon with the COR and SPMO representative.

At a minimum, the weekly report shall include the following for each PWS objective:

a) Activities during the reporting period (work planned and work accomplished to include ongoing activities, new activities, activities completed, and progress to date on all above-mentioned activities).

b) Key decisions.

c) Problems and corrective actions taken. Also, when appropriate, include issues or concerns and associated proposed resolutions.

d) Personnel gains, losses, and status (security clearance, etc.)

e) Government actions required.

f) Schedule to include status of major tasks, milestones, and deliverables with planned and actual start and completion dates for each.

The weekly report shall be due every Tuesday prior to 5:00 PM ET, or on the day and time as mutually agree upon with the SPMO representative (Section 5, Deliverable 4).

g) Personnel gains, losses, and status (security clearance, etc.).

h) Government actions required.

i) Schedule (show status of major tasks, milestones, and deliverables; planned and actual start and completion dates for each at the sub-task level).

At a minimum, the monthly progress report shall include the following for each PWS objective:

a) A succinct summary of activities for the reporting period to include project status, accomplishments, and upcoming milestones at the sub-task level.

b) Identified concerns with proposed mitigation, and provide/visualize analytics.

c) Accumulated invoiced amount for each CLIN, up to the previous month.

The monthly report shall be due on the last Friday of each month prior to 5:00 pm ET of the month. (Section 5, Deliverable 5).

At a minimum, the Quarterly progress report shall include the following for each PWS Objective:

a) A succinct summary of activities for the reporting period to include project status, and progress to date on completed and upcoming milestones and deliverables, PWS for Cloud Continuous Monitoring Automation | 7

b) Key decisions.

c) Identified issues with resolution.

d) Identified risks and proposed mitigations and provide/visualize analytics.

The quarterly report shall be due on the second Wednesday of the first week in each quarter.

(Section 5, Deliverable 6).

4.1.3 Subtask 1.3 – Prepare and Update a Project Management Plan (PMP) For each PWS Objective, the Contractor shall document all support requirements in a PMP and provide it to the Government (Section 5, Deliverable 7) on the same day as the Project Kick-off Meeting.

The PMP shall:

a) Describe the proposed management approach.

b) Include milestones, tasks, and subtasks required in this PWS.

c) Include the contractor’s QCP activities.

d) Provide for an overall Work Breakdown Structure (WBS) with a minimum of three levels and associated responsibilities and partnerships between Government organizations.

e) Describe in detail the contractor’s approach to risk management under this PWS.

f) Describe in detail the contractor’s approach to communications, including processes, procedures, format, and other rules of engagement between the Contractor and the Government.

The PMP is an evolutionary document that shall be updated as project changes occur or at a cadence mutually agreed upon with Government.

4.1.4 Subtask 1.4 – Provide Quality Management

The Contractor shall identify and implement its approach for providing and ensuring quality throughout its solution to meet the requirements of the PWS. The Contractor shall provide a Quality Management Plan (QMP) at Project Kick-off Meeting and maintain and update it as changes in the program processes are identified. The Contractor’s QMP shall describe the application of the appropriate methodology (i.e., quality control and/or quality assurance) for accomplishing PWS performance expectations and objectives. The QMP shall describe how the appropriate methodology integrates with the Government’s requirements.

The QMP shall contain a meeting cadence to discuss the development of each task area with the government. The contractor shall present all draft documents and next steps at each meeting for government approval.

PWS for Cloud Continuous Monitoring Automation | 8

4.1.5 Subtask 1.5 – Provide Knowledge Transfer

Knowledge Transfer is defined as the contractor acquiring and understanding, the necessary documentation, information, and processes related to any work in progress.

This task includes meeting with the IRS Subject Matter Experts frequently to gather any tacit knowledge related to the Cloud Systems, Compliance Document Matching and Solutions Engineering/Enterprise Services tasks or programs in development. The government estimates this task will take approximately four to six months to complete after the Task Order is awarded.

The contractor will appoint a knowledge transfer manager to oversee the transfer of knowledge and ensure all areas are accounted for. If desired, this can be the Project Manager (PM) or Project Scheduler. Prior to the transfer of knowledge, the contractor shall develop a draft Knowledge Transfer Plan (KTP) and present it to the government within the first 15 business days after award (See 6.x.x DELIVERABLES).

The KTP shall identify the contractor resources and roles involved in the transfer process, provide a list of risks and mitigation strategies for the transfer, and contain a detailed resource balanced project schedule developed with Microsoft Project. The project schedule (Integrated Master Schedule) shall identify tasks, dependencies, deliverables, and milestones. The project schedule shall be at a sufficient level of detail to track progress on a bi-weekly basis, (i.e., all tasks will be detailed to a level such that no task has duration of more than ten work days).

The government will have 10 business days to review the draft KTP plan and provide comments to the contractor. Government and contractor representatives will then meet to discuss the comments after which the contractor will incorporate the agreed-upon changes and deliver a final KTP within five working days of the government’s feedback.

The contractor will meet with the IRS bi-weekly (twice a month) to discuss the progress of the knowledge transfer. The contractor will present an updated MS Project Schedule and discuss any risks or concerns at this time.

4.1.6 Subtask 1.6 – Provide Transition Out

The Contractor shall provide transition-out support when requested by the Government. The contractor shall deliver a transition-out plan and shall facilitate the accomplishment of a seamless transition from the incumbent to incoming contractor/Government personnel at the expiration or termination of the contract. The Government will work with the contractor to finalize the plan and at a minimum, shall be reviewed and updated quarterly during the final contract option year. In the transition-out plan, the contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

a) Project management processes

b) Points of contact

PWS for Cloud Continuous Monitoring Automation | 9

c) Location of technical and project management documentation/deliverables

d) Status of ongoing initiatives

e) Appropriate vendor to vendor coordination to ensure a seamless transition

f) Schedules and milestones

g) Actions required of the Government

h) Coordination of related programs

The contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings or as often as necessary to ensure a seamless transition-out. Additionally, the contractor shall cooperate fully with the Government and the succeeding contractor to include:

a) Permitting employees to be interviewed for possible employment by a succeeding contractor(s).

b) Releasing any employee who chooses to be employed by a succeeding contractor.

c) Orienting assigned employees of the succeeding contractor during the last 90 calendar days of the period of this contract if directed by the CO.

4.2 TASK 2 - AUTOMATED CLOUD SECURITY CONTINUOUS MONITORING TOOL

The Contractor shall provide a comprehensive automated tool the IRS can use to manage the security posture of FedRAMP and Agency Authorized Cloud Service Providers. The contractor shall provide a tool capable of providing the full suite of monitoring functions on day one and be operationalized on an accelerated timeline to meet the cloud services demands of the IRS.

The capabilities of the tool shall include at a minimum:

• Ingest and processing of monthly compliance artifacts (vulnerability scans, asset inventory, POA&M) in a digital workflow empowering analyst to quickly correlate data against historical records for cloud assets.

• Automating and streamlining the analyst review and workload, and communications of findings, remediations, and evidence, artifacts, approvals, and timelines associated with all Plan of Action and Milestones.

• Providing full visibility and insights through dashboards and reports, informing agency’s accurate risk analysis, oversight, lessons learned, and future budgetary investment strategies, including:

− Providing a clear picture of the organization’s risk posture, for all systems, with prioritized remediation.

PWS for Cloud Continuous Monitoring Automation | 10

− Correlating and standardizing all security sources, including vulnerability scans, application scanners, configuration management tools, and other sensors.

− Enabling a drill down to individual issues and identify key remediation metrics and track overall compliance and residual risk.

− Identifying the presence of impactful or high priority vulnerabilities down to the discreet instance on an asset to focus remediation/mitigation efforts.

− Enabling IRS to quickly react to incidents and provide required reporting information to CISA and OMB.

4.2.1 Subtask 2.1 Vulnerability Management

The Contractor shall provide an automation tool with the following vulnerability management capabilities:

• Able to ingest many different scan output formats (both COTs and CSP created versions)

• Allows for tracking of vulnerabilities over time by their Weakness Source Identifier (Vulnerability ID) and all the way down to the asset level.

• Provides a detailed list of each unique finding that is searchable, sortable and can be filtered.

• Breaks down vulnerability counts by both the unique and raw vulnerability counts for Operating System and Network Scans, Containers Scans, Database Scans, and Web scans

• Ability to deep dive on any given aspect of any vulnerability found on the system (This includes Risk rating, Associated CVEs, CVSS scores, exploitability vectors, what assets they are currently found on, What assets have they been found on in the past, the scan names that they originated from, any asset they were found on that the CSP does not map to a current open POA&M, *depending on role of user the ability to see what other managed systems also have these same exact vulnerabilities)

• Automatically tracks and validates both the vulnerabilities and assets to associated CSP provided POA&M items.

• Dashboards that show trending metrics over time for unique and raw vulnerabilities.

• Vulnerability closure metric reports that show CSP’s closure rates on vulnerabilities in their environment over time.

• Tracks any vulnerability found on the scans that is not addressed with a POA&M by the CSP over time.

4.2.2 Subtask 2.2 POA&M Management

The Contractor shall provide an automation tool with the following POA&M management capabilities:

PWS for Cloud Continuous Monitoring Automation | 11

• Ingest and update POA&M items on the fly as they are delivered by the CSP.

• Track individual POA&Ms over time (month to month).

• Allow for easy access to and review of POA&Ms by putting data into easily readable, searchable, and consistent formats.

• Provide reporting on which items are open, closed, as well as pending or approved deviation requests.

• Ability to quickly search, sort, compare or filter all findings by what the organization has deemed to be the most important at any given time.

• Ability to drill down into the Individual risk (weakness source identifier) on any given

POA&M.

• Ability to view all associated assets for any POA&M item at any given time, with the ability to compare assets across POA&M items or across all items.

• Provide a list of action items that require attention from the user or stakeholder (examples:

approvals of submitted deviation requests or items that are past SLA that need to be addressed).

• Dashboards and reports that show metrics based on the trends over time of open POA&M items as well as any items that have past SLA and have become late.

• Alerts and warnings that inform the stakeholders that POA&M items have past SLA or will pass SLA within given time frames.

• Recording vulnerability remediation activities, which involves documenting evidence of the remediation process and maintaining audit logs detailing any changes made to the strategies employed for remediation.

4.2.3 Subtask 2.3 Deviation Request

The Contractor shall provide an automation tool with the following Deviation Request capabilities:

• Provide a secure interface where CSPs and the agency can streamline information delivery about the deviation securely.

• If a deviation request is accepted by the agency, the approved change is automatically reflected throughout the tool. Conversely, if a deviation request is rejected, the CSP is obligated to amend the POA&M to address the vulnerability.

• Deviation decisions must be memorialized over time and available for review.

PWS for Cloud Continuous Monitoring Automation | 12

4.2.4 Subtask 2.4 Compliance Analysis

The Contractor shall provide an automation tool with the following Compliance Analysis capabilities:

• Development and documentation of Standard Operating Processes (SOPs) for Cybersecurity to operationalize its continuous monitoring of cloud services.

• Analysis and interpretation of system vulnerabilities, impact on operations, and associated trends.

• Analysis of CSP’s security risk posture, and end-to-end risk assessment of security risks to IRS services.

• Identification of anomalies and non-compliance flags.

• Review and respond to deviation requests, and development of reports to share with stakeholders.

• Analysis of CSP’s security risk posture, and end-to-end risk assessment of security risks to IRS services.

4.2.5 Subtask 2.5 FedRAMP Compliance Analysis

The Contractor shall provide an automation tool with the following Compliance Analysis capabilities:

• Access to FedRAMP program and FISMA expertise to interpret evolving FedRAMP policy, guidelines, and processes.

• Comparison of FedRAMP “core security expectations” provided through the FedRAMP authorization process against IRS specific needs to identify security controls not currently addressed through the FedRAMP program that require focus during the IRS authorization process.

• Development of new authorization processes that optimize re-use of FedRAMP authorization package and previously authorized systems and system boundaries to minimize duplication in the security assessment process.

4.3 TASK 3 – CUSTOMIZED DASHBOARD REPORTING

The contractor shall provide dashboard reporting of the analysis of the Continuous Monitoring of the CSPs (POA&Ms, Vulnerabilities and other security monitoring analytics).

4.3.1 Subtask 3.1 – Develop Core Dashboard Reporting Templates The Contractor shall develop and deliver to the COR and IRS SPMO SME (Section 6, Deliverable 10), NLT twenty (20) business days prior to the xx date or as mutually agreed upon with the Government, the draft Core Dashboard Reporting templates. Contractor shall work with COR

PWS for Cloud Continuous Monitoring Automation | 13 and SPMO to identify IRS desired Dashboard Reporting Capabilities to develop a phased in implementation approach that will ensure the information collected meets IRS mission needs and all reporting requirements.

4.3.2 Subtask 3.2 – Provide Dashboard Reporting Capabilities

The Contractor shall deliver Dashboard Reporting in Phases:

a) Phase 1 – Essential (Initial) Dashboard Reporting Capability from each cloud environment.

Key elements shall be determined after contract award, review of the environments and must be approved by the COR and SPMO.

b) Phase 2 – Expanded Dashboard Reporting Capability – after implementation of Initial Dashboard Reporting Capabilities additional features identified either by the government or recommended by the contractor shall be added during Phase 2. COR and SPMO shall approve such capabilities.

4.3.3 Subtask 3.3 – Dashboard Reporting Continuous Updates

The Contractor shall continue to update dashboard reporting for compliance with FedRAMP, IRS policies, and all other governance directives relevant to security posture of the IRS enterprise cloud environments.

4.4 TASK 4 – FEDRAMP PMO SUPPORT

The Contractor shall provide SMEs to ensure connectivity with FedRAMP as the IRS moves forward with its Information Technology Modernization plans. The SMEs shall assist the IRS achieve government recognition for IRS compliance and security standards.

5 KEY-PERSONNEL AND QUALIFICATIONS

The government has identified certain roles in the below table as Key personnel. The contractor will submit the resumes (certified by their respective manger) of the contractor employee(s) that will fill the position(s) identified in the following table. Resumes shall demonstrate that proposed key personnel possess skill and experience as described at PWS Section 10, “Skill Requirements.”

Role Professional Services Schedule Labor Category

FedRAMP Senior SME Computer & Information Research Scientists (15-1111)

Project Manager Managers, All Other (11-9199)

PWS for Cloud Continuous Monitoring Automation | 14

Contractor employees identified as Key Personnel will be dedicated to this project. If any changes in proposed key personnel become necessary during actual performance, the contractor shall provide written notification 60 days in advance. In the event of a sudden change in key personnel (death, incapacitation, immediate termination, etc.), the contractor shall provide written notice to the CO within 3 calendar days of the event. For any substitution, the contractor will submit a justification with a proposed substitute whose qualifications are equal to or greater than the person being replaced, along with a 1 to 2-page introductory summary, in sufficient detail to permit evaluation within 10 calendar days of notification of a substitution.

5.1 PROJECT MANAGER

The Project Manager shall be prepared at all times to present and discuss the status of contract activities, requirements, and issues. The Project Manager must immediately inform the PM, CO, and COR of any performance issues, cost or financial concerns and potential problems that, if unresolved, will adversely affect the contractor’s performance, schedule, or costs.

The Project Manager shall, at a minimum, have:

• A bachelor’s degree from an accredited university or college and a minimum of six years of professional supervisory/management experience or a master’s degree from an accredited university or college and a minimum of four years professional supervisory/management experience as a program manager. The degree must be in a business field (e.g., Program Management, Business Management, Business Administration, Accounting, Finance, and Economics).

• Relevant experience must be in program management (e.g., trend and forecast analysis, earned value management, cost benefit analysis, balanced scorecard, activity-based costing, life cycle cost estimating, activity-based budgeting, and gap analysis), personnel management, and project management (e.g., communications plan development, risk management, project management frameworks such as Agile, resource planning and management, conflict management and resolution).

• Demonstrated ability/experience in successfully developing, implementing and Managing complex, high profile, multi-faceted projects.

• Demonstrated ability to communicate clearly, both orally and in writing.

• Demonstrated ability to organize and perform multiple tasks at the same time.

• Analytical, problem-solving, and decision-making capabilities.

• Project Management Professional Certification a plus.

5.2 FEDRAMP SME

The FedRAMP SME shall at a minimum have

• A post-graduate degree or current credentials in XXXXX

• Relevant professional experience must be in desired areas of XXXXX

PWS for Cloud Continuous Monitoring Automation | 15

• At least half of the experience must be from XXXXX

6 DELIVERABLES TABLE

# Milestone / Deliverable

PWS

Reference Date of Completion / Deliveryi

Gov’t Rights

Project Start (PS) At NLT five (5) business days post contract award

N/A

1 Project Kick-Off Meeting Agenda

4.1.1 At least five(5) days prior to the Project

Kick-Off Meeting

UR

2 Project Kick-Off Meeting 4.1.1 Within five (5) business days of Project Start (PS)

N/A

3 Project Kick-Off Meeting Minutes Report

4.1.1 NLT three (3) business days following

Project Kick-Off Meeting

UR

4 Weekly Status Report 4.1.2 Weekly on Tuesday prior to 5:00 pm ET. UR

5 Monthly Status Report 4.1.2 Monthly, on the last Friday of the month prior to 5:00 p.m. ET

UR

6 Quarterly Status Report 4.1.2 Quarterly, on the second Monday of the following Quarter prior to 5:00 p.m. ET

UR

7 Project Management Plan

(PMP)

4.1.3 Due at Project Kick-Off Meeting; updates

as project changes occur or a mutually agreed upon cadence.

UR

8 Knowledge Transfer Plan

(KTP)

4.1.4 Due at Project Kick-Off Meeting; updated

as changes in program processes are identified

UR

9 Quality Management Plan 4.1.5 Within fifteen (15) business days of Project Kick-Off Date

UR

10 Core Dashboard Reporting Templates

4.3.1 NLT twenty (20) business days prior to

the xx date as mutually agreed

UR

PWS for Cloud Continuous Monitoring Automation | 16

6.1 SUBMISSION OF DELIVERABLES

The contractor will deliver all products concurrently to the IRS Government Technical Monitor (GTM) and the Contracting Officer’s Representative (COR). The COR will notify the contractor whether the formal deliverable has been accepted or provide written comments within ten (10) government workdays of receipt. Contractor shall then resubmit the final deliverable within ten

(10) government workdays to the IRS GTM and the COR, if necessary. All documents will be provided in electronic format to the IRS using Microsoft Word 2010, Excel, PowerPoint and/or Visio.

Documents shall be submitted electronically whenever possible. Hardcopies shall be provided upon request. See Delivery Table Section 6.0 that outlines the report/delivery schedule.

6.2 DOCUMENTATION REQUIREMENTS

All deliverables will meet requirements as described under the tasks in clear, concise, well-written language, and in accordance with this Performance Work Statement. Accordingly, the quality measures (acceptance criteria) as set forth below will be applied to each work product or deliverable received from the contractor under this Performance Work Statement.

• Completeness - Initial requirements (as identified) are satisfied in all sections.

• Accuracy - Documents will be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity - Documents will be clear and concise; project management and terms shall be used, as appropriate. All diagrams shall be easy to understand and be relevant to the supporting narrative.

• Specification Validity - All deliverables must satisfy the requirements of the U.S.

government as specified herein.

• File Editing - All documents will be provided in electronic format to the IRS using Microsoft Word 2010, Excel, PowerPoint and/or Visio.

• Format - Documents shall be submitted electronically whenever possible. Hardcopies shall be provided upon request. The documents format may change from Subtask to Subtask.

• Timeliness - Deliverables shall be submitted on or before the due date specified in the Deliverables Table Section, 6.0 , of this PWS or submitted in accordance with a later scheduled date determined solely by the government.

6.3 REVIEW OF DELIVERABLES

The government will perform an initial review of deliverables detailed in section 6.0. If problems are encountered during the deliverable review, the contractor must correct them. If

PWS for Cloud Continuous Monitoring Automation | 17 necessary, a meeting may be convened to resolve any differences. The contractor will make all required changes to achieve an acceptable deliverable. The government will perform its review within approximately 15 calendar days from receipt of the deliverable or as otherwise specified.

When the review of a deliverable results in necessary modifications, the government will, in accordance with the approved task order schedule, provide the necessary documentation to correct the deliverable. It will then be the responsibility of the contractor to incorporate the comments properly and consistently in the final product.

7 PLACE OF PERFORMANCE

Performance will be conducted at the Contractor’s site.

8 PERIOD OF PERFORMANCE

The period of performance for this Task Order is 12 months from the effective date of the Task Order award with one (1) 12-month option period.

12-month base year period and one12-month option period:

• Base Year (12-months) September 30, 2024 – September 29, 2025

• Option Period 1 (12-months) September 30, 2025 – September 29, 2026

The dates listed above are for estimation to identify the length of time. The start date can be adjusted to fit the government’s transition need after discussion with the (apparent successful) contractor.

9 CONTRACT TYPE

This is a Firm Fixed Price (FFP) contract to fully meet the IRS requirements.

10 PERFORMANCE REQUIREMENTS, STANDARDS, AND

SURVEILLANCE

The government has determined there is value in incorporating Performance-Based Service Acquisition (PBSA) methodology with an outcomes-based focus for this work.

Section 4.1.3 defines the High-Level Project Schedule. Deliverables are listed in the tables under section 6.0. Exhibit 1 of the QASP defines the government’s Desired Performance Standards, PWS for Cloud Continuous Monitoring Automation | 18

Acceptable Quality Levels and Monitoring Methods for each sub-task and deliverable included in this Task Order.

11 GOVERNMENT-FURNISHED INFORMATION (GFE)

GFI (to include manuals, notes, memos, instruction materials and other information) may be provided in the performance of this task order. The following GFI will be provided to the contractor upon task order award.

INFORMATION ITEMS

Power Points that provide background knowledge on the development of the effort.

Wiki that outlines current 24x7 indicators

Dashboards that are used by 24x7 team to monitor data in near-real time

Access to the team SharePoint Site i All times include flexibility to change to a timeline mutually agreed upon by the Government and the Contractor.

4.4 Task 4 – FedRAMP PMO Support