24-IRA-023-OITA - CSP Continuous Monitoring Automation RFI.docx

Internal Revenue Service (IRS) Cloud Service Provider Continuous Monitoring Automation Request for Information (RFI) April 10, 2024

RFI for IRS Cloud Service Provider Continuous Monitoring Automation | ii Introduction SOURCES SOUGHT– THIS REQUEST FOR INFORMATION (RFI) IS RELEASED PURSUANT TO FEDERAL ACQUISITION REGULATION (FAR) PART 10, MARKET RESEARCH.

This RFI is only issued for information and planning purposes. It shall not be construed as either a solicitation of the obligation on the part of the Government. All information received from this RFI will be used for Market Research purposes only. The Department of Treasury solicits vendor responses to this RFI for market research purposes only. This RFI will not result in a contract award.

The Government does not intend to award a contract based on responses to this RFI nor otherwise reimburse vendors for the preparation of any information submitted or Government use of such information. There is no guarantee of a solicitation resulting from this RFI.

Acknowledgment of receipt of responses will not be made, nor will respondents be notified regarding the outcome of the information received. All data received in response to this Sources Sought synopsis marked or designated as corporate or proprietary information will be fully protected from release outside the Government.

The Government shall not be liable for or suffer consequential damages for proprietary information not properly identified. Proprietary information will be safeguarded in accordance with all applicable Government regulations. All documentation shall become the property of the Government and will not be returned.

Request for Information Number: 24-IRA-023-OITA Project Title / Short Description: Cloud Service Provider Continuous Monitoring Automation PSC or FSC Code: DA10 NAICS Codes: 518210 Release Date: April 10, 2024 Response Date: May 7, 2024 Primary Point of Contact and Contact Information:

Name: Sandra R. Anderson Title: Business Operations Specialist Email: sandra.r.anderson@irs.gov Phone number: 240-613-7462

Cloud Service Provider Continuous Monitoring Automation The IRS is seeking to procure Subscription Services for Cloud Service Provider Continuous Monitoring Automation.

Description of Services IRS requires a comprehensive tool to manage the security posture of FedRAMP and Agency Authorized Cloud Service Providers. This capability must provide the full suite of monitoring functions on day one and be operationalized on an accelerated timeline to meet the cloud services demands of the IRS, including, but not limited to:

· Ingest and processing of monthly compliance artifacts (vulnerability scans, asset inventory, POA&M, significant changes, deviations) in a digital workflow empowering analyst to quickly correlate data against historical records for cloud assets.

· Automating and streamlining the analyst review and workload, and communications of findings, remediations, and evidence, artifacts, approvals, and timelines associated with all Plan of Action and Milestones.

· Providing full visibility and insights through dashboards and reports, informing agency’s accurate risk analysis, oversight, lessons learned, and future budgetary investment strategies.

Vendor Inquiries and Questions Please email questions to both primary and secondary points of contact listed below with the following in the Subject Line: Questions to RFI - Cloud Service Provider Continuous Monitoring Automation. Responses to questions will be available to all vendors through Sam.gov and GSA e-buy for this RFI. The Government reserves the right to respond to some, all, or none of the questions submitted. Respondents may use the “Part III Question and Comments” tab located in the attached 24-IRA-023-OITA - CSP Continuous Monitoring Automation RFI Info. & Questions.xlsm to capture and submit questions and/or comments.

RFI Response Submittal Instructions Vendors are encouraged to be as specific as possible in addressing each section of the RFI. Feedback of a general or non-specific nature is less useful and may not be used in refining the acquisition strategy and impacting the content of a possible RFP/RFQ.

Vendors that meet the requirements described in this announcement are invited to submit their capability statements/RFI response. Vendors shall reference “Response to RFI - Cloud Service Provider Continuous Monitoring Automation“ in the subject line of their response, as well as in the subject line of any other e-mail correspondence referencing this notice.

Respondents shall fill and include the file 24-IRA-023-OITA - CSP Continuous Monitoring Automation RFI Info. & Questions.xlsm as an attachment to their response.

Respondents are strongly urged to adhere to this page limitation as defined in the designated sections as well as to limit marketing material in order to provide more substantive information in their response. Vendors may provide links to relevant websites, as appropriate.

Parties shall respond to this RFI in accordance with the instructions provided in the table below:

Primary Point of Contact Sandra R. Anderson e-mail: sandra.r.anderson@irs.gov Secondary Point of Contact Sudebi Roy e-mail: Sudebi.Roy@irs.gov

Proprietary Information See FAR Subsection 3.104-4 for how this information will be safeguarded if properly labeled. The Government reserves the right to publish any information provided by a respondent to the RFI if publishing such information is done without attribution (i.e., does not identify the party submitting the response materials), and would not reveal company trade secrets or other similar protected or proprietary information. For example, if a respondent were to ask when the RFP would be released, then such a question could be published without attribution and would not jeopardize any corporate or trade secrets of the respondent. Accordingly, the Government may publish such materials. On the other hand, if a respondent were to provide detailed product rollout plans for a new payroll system offering, then that material would not be published if properly marked.

The Government will not respond to phone calls regarding this RFI.

Thank you for your interest.

RFI for IRS Cloud Service Provider Continuous Monitoring Automation | 1 image1.png image2.png