IR Mod_IRIS_UI PWS_08.28.2024.pdf

PERFORMANCE WORK STATEMENT (PWS)

For

Information Returns Modernization (IR Mod)

IRIS/UI Application Development

PERFORMANCE WORK STATEMENT (PWS) for IR Mod IRIS/UI Application Development

06/24/2024

1. INTRODUCTION/OVERVIEW

The purpose of this task order is to acquire technical support services from a contractor team responsible for development and operations and maintenance of the Information Returns Intake System microservices (IRIS), and User Interface (UI). The contractor will work closely with the IR Mod Program Management Office (PMO) to update and deliver capabilities in alignment with the Strategic Product Roadmap to meet program objectives.

This effort aligns with recently published Internal Revenue Service Inflation Reduction Act Strategic Operating Plan objectives:

• Strategic Operating Plan Objective 1: Dramatically improve services to help taxpayers meet their obligations and receive the tax incentives for which they are eligible.

• Strategic Operating Plan Objective 4: Deliver cutting-edge technology, data, and analytics to operate more effectively.

2. BACKGROUND

The Internal Revenue Service (IRS) has modernized the Information Returns processing pipeline by leveraging and building on the opportunity presented by legislative mandates, such as the Taxpayer First Act (TFA), Provision 2102, American Rescue Plan (ARP) Modernization Portfolio, and the Inflation Reduction Act (IRA). The long-term IR modernization solution is scalable and compatible for information returns and other intake forms, such as tax returns and W2s. By using the IRS Enterprise Data Strategy and Cloud First vision, the end state enables improved data access and data integration and enhanced compliance processing, while providing high availability and resiliency.

IRIS/UI Release Strategy

In January 2023 the IRS completed Release 1 (R1) of the IR Mod strategy which addressed the 1099 family of information returns (IRs) in compliance with the TFA, Provision 2102 by introducing a new IR internet platform via which IR issuers and transmitters can prepare forms online and submit them electronically to the IRS. Appendix D provides a high-level view of the current IRIS. To support this new functionality, R1 delivered a modernized intake system that receives, and checks IRs submitted electronically and stores the returns as received. Validation, posting, and certification processes are performed prior to distributing IR data for downstream compliance and information sharing In FY24, IR

Mod Release 2.1 added 13 File Information Returns Electronically (FIRE) forms and 8809 Automatic

Extensions to enable taxpayers and businesses to file and distribute additional forms. In FY25, IR Mod

Release 3 will add account-to-account (A2A) and Service Center Recognition Image Processing System

(SCRIPS) Intake and Processing of Prioritized FIRE Forms. Correspondingly, incremental performance enhancements will be made to the Information Returns Intake System microservices (IRIS), and the

Taxpayer-facing and Employee-facing User Interface (UI) portal for IR Mod Releases 2 and 3. The IR Mod

Strategic Product Roadmap (see Appendix A) lays out the high-level plan for building out the IR Mod platform to completion. This roadmap provides guidance on prioritization of capabilities and will be reviewed and updated quarterly and as priorities are reassessed and new requirements emerge. While the Strategic Product Roadmap identifies development of capabilities through approximately FY2026, for purposes of this PWS, the program assumes additional requirements will be identified for continued

Development, Modernization, and Enhancement into FY2030.

IRIS/UI Complexity and Scope

Indicators of the current complexity and scope of IRIS/UI include the following:

• Intake and processing of nearly 100 different types of information returns

• Processing of approximately 7-10 billion information returns annually

• Application resides in AWS GovCloud hosted by a Managed Service Provider designated for IRS and must exchange data with applications in separate AWS GovCloud accounts, IRS systems residing on-prem, and with other state and federal government systems

• System is in operation 24x7 and requires fast response to triage and resolution of outages to ensure information return filing requirements can be met by third parties and other reporting entities

• Number of agile development teams: 5

• Delivery cadence for major/minor releases: 3-4 scheduled releases per year

3. SCOPE OF WORK AND DESCRIPTION OF TASKS

The PWS scope covers project management, development, and operations and maintenance (O&M) activities over multiple releases for IRIS/UI. The following are the tasks in this task order:

1. Project Management

2. Development, Modernization, and Enhancement (DME)

3. Operations & Maintenance (O&M)

4. Transition Services

Each task will be described in detail below including the cost type, description of work, and desired outcomes. Some tasks will be organized into subtasks with their own activities and desired outcomes.

Integration of AI Technology

For the work described in this PWS, the contractor is strongly encouraged to utilize Artificial Intelligence

(AI) enabled code development, testing, delivery, and deployment. The contractor should provide strategic leadership in determining how best to use and incorporate AI technology into IRIS/UI. The contractor will be expected to support any AI associated governance and assurance activities.

Operationally, the contractor shall use AI capabilities to improve business reporting and analysis. The contractor should promote the integration of AI-based tools in delivering current and future IRIS/UI services.

Constraints, Standards and Guidance

The contractor shall comply with the following constraints, standards, and guidance (which may be provided upon request) for all efforts under this PWS:

• IRS Internal Revenue Manual (IRM) o All current and future IRS Privacy Information Protection and Data Security standards

(currently referenced in IRM 10.8, IT Security) o Current and future guidance on Systems Development (currently documented in IRM 2.5) o Current and future guidance on Information Technology (IT) Operations (currently documented in IRM 2.7) o Current and future guidance on Security and Privacy (currently documented in IRM 2.12) o Current and future guidance on Enterprise Architecture (EA) (currently documented in

IRM 2.15)

o Current and future guidance on Enterprise Life Cycle (ELC) (currently documented in

IRM 2.16)

o Current and future guidance on Infrastructure Currency (currently documented in IRM 2.17) o Current and future guidance on Business Planning and Risk Management (currently documented in IRM 2.22) o Current and future guidance on Section 508 (currently documented in IRM 2.30) o Current and future guidance on Lifecycle Management (currently documented in IRM

2.31) o Current and future guidance on Integrated Process Management (currently documented in IRM 2.100) o Current and future guidance on Risk, Issue, and Action Item Management Practices

(currently documented in IRM 2.109) o Current and future guidance on Requirements Engineering (currently documented in IRM

2.110) o Current and future guidance on Engineering (currently documented in IRM 2.120) o Current and future guidance on Knowledge Management (currently documented in IRM

2.123) o Current and future guidance on Change Management (currently documented in IRM

2.125) o Current and future guidance on Enterprise Organizational Readiness (currently documented in IRM 2.126) o Current and future guidance on IT Testing Standards and Procedures (currently documented in IRM 2.127) o Current and future guidance on Service Catalog Management (currently documented in

IRM 2.142)

o Current and future guidance on Capacity Management (currently documented in IRM

2.144) o Current and future guidance on Availability Management (currently documented in IRM

2.145) o Current and future guidance on IT Support Services Management Incident Management

Process (currently documented in IRM 2.148) o Current and future guidance on IT Asset Management (currently documented in IRM

2.149) o Current and future guidance on Configuration Management (currently documented in IRM

2.150) o Current and future guidance on Enterprise Control Authority and Operations (currently documented in IRM 2.172) o Current and future guidance on IT Program Governance (currently documented in IRM

2.173) IRS Enterprise Software Configuration Management Transmittal Process

• Requirements Engineering Program Office (REPO) Guidelines

• IRS Knowledge Incident/Problem Service and Asset Management (KISAM) – Defect Reporting/Resolving/Closing

• Configuration Management (CM) and Change Request (CR) Procedures

• Project Management Body of Knowledge (PMBOK) Guide

• Project Management Life Cycle defined and published by the Project Management Institute (PMI)

• IRS Enterprise Services Solution Engineering (SE)

• IRS Enterprise Architecture (EA) o IRS Target Architecture o IRS Technology Roadmap

• IRS Enterprise Technology Blueprint

• Enterprise Life Cycle (ELC) and One System Development Lifecycle (OneSDLC)

• Tools to be used in the performance of the work under this Task Order must be on the approved Enterprise Standards Profile (ESP) Standard Products List. Tools not on the list cannot be used until they go through the ESP approval process and are added to the list.

• Software included in the IRS ESP must be updated to align with technology shifts; this initiative is referred to as N/N-1:

o (‘N’) – The latest major release of a product that is commercially available from the vendor o (‘N-1’) – The previous major release of a vendor product. This release is still within the product support period, but is not the most current released version of the product

• IRS Milestone process

• PMI Project Management Body of Knowledge (PMBOK) Guide version 7.0

• PMI Project Management Life Cycle

3.1 Task 1. Project Management

Cost Type: Firm Fixed Price (FFP)

To manage this scope of work the contractor shall employ program, project and contract management in accordance with industry best-practices (e.g. PMBOK, Scaled Agile Framework). The contractor shall deliver and maintain contract artifacts as required below.

3.1.1 Subtask 1.1. Project Management Support

The contractor shall provide project management support as follows:

1) Develop and maintain a detailed Project Management Plan and briefing summarizing the

PMP content for the government following award. The briefing may be conducted virtually.

The baseline PMP and all subsequent updates shall be coordinated with the government and approved by the COR.

2) Conduct a technical kickoff briefing within 10 days of award. Present for government review and approval the details of the intended approach, work plan, and schedule. Provide minutes of the meeting.

3) Develop and maintain an Integrated Master Schedule (IMS) and Work Breakdown structure

(WBS).

4) Collect and manage progress data against the IMS at both the activity and milestone level.

Evaluate and report on progress regularly so that PMO staff can proactively address variances.

5) Develop, coordinate, vet, and publish project management measures/metrics used to provide transparency into health of project delivery.

6) Identify and track project related risks and issues. Identifying mitigation strategies and impacts to the overall project schedule and manage the Project Risk Register.

7) Identify and manage project dependencies.

8) Create and maintain a Project Action Item Tracker

9) Create and maintain a Project Decision Tracker

10) Provide support to governance and change management entities by providing expert inputs on Artificial Intelligence (AI)-related topics as they pertain to 1) creation of the strategic roadmap, and 2) development, test, and operation of IRIS/UI

11) Develop and submit a monthly progress report for COR approval. The report should include contract and project status, and deliverables submitted

3.1.2 Subtask 1.2. Requirements and Design Support

The contractor shall provide requirements and design support as follows:

1) Plan, prepare, and conduct requirements gathering sessions to identify requirements to identify user stories and epics aligned to key capabilities (as identified in the Strategic

Planning Roadmap) planned for upcoming deployment.

2) Provide preparation support for any sessions related to deeper technical discussion into topics areas identified during requirements gathering sessions.

3) Ensure appropriate elicitation or development of Non- Functional Requirements (NFRs) related to planned capabilities.

4) Ensure all project requirements are stored in one central repository. The repository shall update progress regularly and reflect decomposition as well as the allocation of requirements and tasks. The contractor will use value/secrets management tools and will not store access credentials in the Git repository or other code repository.

5) Plan and conduct Planning Increment (PI) Sessions to identify the user stories that will be completed as a part of each Planning Increment (PI) and develop Roadmaps that depict what is to be accomplished in each PI. Conduct sprint and/or other planning and retrospective ceremonies as determined to be appropriate for project delivery.

6) Decompose requirements, user stories and backlog as an input to Planning Increment

Planning and Sprint Planning sessions.

7) Produce “build-to” requirements needed to inform and enable development efforts.

8) Identify and validate project integration points, associated requirements, and interdependencies.

9) Interpret crypto legislative environment to make recommendations to the program that ensure compliance with the law.

10) Review PMO-provided architecture documentation to assess impact on operational delivery.

11) Conduct technical analysis of architecture and design decisions/artifacts to identify technical gaps and report on identified gaps to the PMO. Monitor resolution of technical gaps by governance bodies.

Desired Outcomes:

1) Effective and efficient project management ensures all tasks are completed on schedule with accuracy and high quality.

2) IR Mod IRIS/UI requirements are complete and accurate

3) Ensure identification and resolution of architecture and design issues including those related to delivery of Information Reporting for Brokers and Digital Assets as mandated by IIJA.

3.2 Task 2. Development, Modernization & Enhancement (DME)

Cost Type: Hybrid (Labor Hours (LH) & FFP)

3.2.1 Subtask 2.1. Agile Development

The contractor shall perform agile development for the following components:

• Information Returns Intake System (IRIS) microservices

• IRIS User Interface (UI)

Appendix B lists all IR forms, and Appendix C provides an overview of the technology stack used for IR

Mod Releases. The contractor shall support new forms and associated requirements in accordance with the Strategic Roadmap. The list of IR forms may be updated as new legislation requires new IR forms.

Changes to the IR Mod IRIS/UI components shall be sequenced in alignment with the Strategic Product

Roadmap. The contractor shall create, update, and support application–level documentation (tailored by OneSDLC).

Development must include functionality identified by the PMO in the IR Mod IRIS/UI backlog for which the contractor will be given access by the government. The backlog will be managed using an IRS requirements repository suitable for Agile requirements. The contractor must use that repository for formal management, traceability, and reporting of progress.

The contractor shall ensure that the applications being developed are compliant with IRS Agile/Development, Security, and Operations (DevSecOps) methodologies. The contractor shall maximize use of DevSecOps tools and services, including those available within IRS environments.

In addition, the contractor shall:

• Collaborate with the Government to establish application access controls

• Determine and integrate the required common services for the application in accordance with

IRS Enterprise guidance

• Strongly encouraged to leverage AI-enabled code development techniques such as, for example, code generation, bug detection (including automated detection), code optimization, documentation creation, test case generation, automated testing, and automated code review

• Conduct unit testing

• Ensure DEBUG logging is used in multi-threaded code to help identify and prevent deadlocks.

• Drive and lead the effort to achieve a Path to ATO compliance with the Risk Management

Framework (RMF) process. Assist the Information System Security Engineer and/or the Information System Security Manager (ISSM) in conducting Assessment & Authorization (A&A) to demonstrate that the RMF requirements have been met.

• Migrate the application enhancements to the production environment(s) based on a government “go-live” decision.

• Develop SLAs which include at least the metrics, acceptable quality level, measurement method, and a sufficiently detailed description of the data utilized to allow for independent calculation of compliance.

• Collaborate with other development teams as required.

The contractor shall ensure that all new and existing applications, systems, or services deemed non-legacy shall expose their data and functionality through service interfaces (e.g., OpenAPI specification).

The contractor shall ensure that all service interfaces, without exception be designed to be consumable from external sources and must plan and design to be able to expose the interface to developers. The contractor will provide project README files to provide clear documentation that explains how code works and helps developers and O&M support teams make changes consistent with the application design. The contractor shall utilize IRS approved centralized source code repositories to store all government funded software development or customization of commercial-off-the-shelf (COTS) products.

Desired Outcome:

1) Working software that performs as specified by architecture and engineering artifacts is developed by the contractor.

3.2.2 Subtask 2.2. Business Analysis and Reporting

The contractor shall provide for a business analysis and reporting engine to support report and dashboard generation accessible for authorized users, including IRS users. The contractor shall expose their raw data to authorized users to support the generation of real-time reports. The contractor is strongly encouraged to leverage AI technologies and capabilities for the creation of the business analysis and reporting engine. These may include capabilities for data collection and integration, data cleaning and preparation, descriptive analytics (including data visualization), predictive analytics, natural language processing (NLP), and real-time analysis. The business analysis and reporting engine shall provide canned and ad hoc reports, pre-defined dashboards, and dashboards defined in conjunction with the government. The government will work with the contractor to define the desired reports and dashboards, as well as to identify the data required to create them.

3.2.3 Subtask 2.3. Testing Support

The contractor shall perform setup, testing, integration and validation for Application Development. The contractor shall ensure that all service specific setup, testing, integration and validation procedures are fully documented and complete. The contractor shall develop a Test Strategy, Test Plan(s) (including procedures, scenarios, scripts, and acceptance criteria), Test Data, and Final Post-Implementation Test

Report. The contractor will provide documentation to Government that describes the step-by-step build process and associated CI/CD pipeline tooling.

The contractor team shall have experience with the following support areas and tools:

• Selenium (front end automation) software

• SOAPUI (Back end) software

• JAVA programming language

• Rational Tool Suite (ETM), including Rational Functional Tester, Test Management Suites, and

Reporting Tools

• Loadrunner

• SQL Database experience, TOAD or SQL Server

• HTML Data creation (Eclipse, XML Spy)

• JSON/XML schema updates

• MongoDB

• Cloud

• Cypress Software (in the event that it is approved by IRS in September 2023)

• ETL (Extract Transfer and Load) and Informatica

• SecureFx

• SecureCRT

• Splunk (Integration)

The contractor will use versions of software, including Java and Spring Boot, as directed by IRS and/or as documented in the IRS Enterprise Standards Profile.

The contractor shall create and utilize development and test environments that will interconnect appropriately with Government prior to implementation into the Production environment. The contractor will use static code analysis tools as part of their deployment/build process and address exceptions identified by those tools to ensure high code quality. The contractor shall establish and test workflows, business rules, policy definitions, and permissions progressing from lower-level environments up through higher level environments mapped to the appropriate Government environments.

The contractor shall establish and test the Applications developed or modified, including functional, security, Section 508, integration and browser testing. Within five calendar days following successful external system integration testing, the contractor shall validate its solution has been completely executed and is production ready.

The contractor shall support integration activities and configuration changes with delivery partners.

The contractor will provide access to government staff and designated partners to all development, test, and production environments.

Use of AI to improve Software Testing

The contractor is strongly encouraged to leverage AI capabilities to improve software testing. Some areas of potential improvements include:

• Automatic test case generation

• Bug prediction and detection

• Test optimization

• Regression testing

• Test data generation

• Automated code review

• User interface testing

• Performance testing

The Test Strategy, Test Plan(s) (including procedures, scenarios, scripts, and acceptance criteria), Test

Data, and Final Post-Implementation Test Report(s) shall identify where and how AI-based techniques are leveraged to enhance testing.

Desired Outcomes:

1) Applications developed or modified are successfully tested and deployed.

3.3 Task 3. OPERATIONS & MAINTENANCE (O&M)

Cost Type: LH and FFP

The contractor shall provide O&M support. O&M support is the development and delivery of ongoing and repetitive IT products and services to sustain Production. The O&M support for new functionality releases begins approximately three months after the new functionality is successfully deployed to Production.

O&M activities include, but are not limited to:

• Complete and report production defect fixes

• Provide access to all application logging data to government staff and designated partners.

• Regularly analyze application logging data to identify and troubleshoot problems.

• Identify and mitigate cybersecurity vulnerabilities within the required time period(s).

• Identify and provide plans for Legislative changes.

• Provide Annual Filing Season delivery.

• Implement Infrastructure currency upgrades.

• Prepare materials for Defect Review Board and Integrated Project Team meetings to confirm defect resolutions, rules and model impacts, and consolidated stakeholder feedback.

• Perform software code testing, including creating test cases and scripts; share test scripts, as needed; work to increase the coverage, quality, and speed of existing tests.

• Perform integration and delivery activities to ensure the deployment process (transmittals, automatic builds, etc.) works effectively across all environments.

• Provide documentation updates (including technical and end user documents)

• Conduct detailed analysis of the system performance, identify the bottlenecks.

• Implement resolutions to identified issues as part of the release.

The contractor shall ensure that all software is appropriately licensed. The Government will furnish the tenant administrative credentials or the appropriate role / IAM government furnished equipment (GFE) to the contractor to manage. The contractor will not have access to Admin or Root Admin.

The contractor shall provide the government with 24x7 direct access to MongoDB employees in addition to any internal expertise, to troubleshoot and resolve issues during standard and non-standard business hours.

The contractor shall employ continuous integration and outreach to ensure customer satisfaction with changes and updates to the IR Mod IRIS/UI. The contractor shall propose an application Service Level Agreement (SLA). A proposed SLA shall at a minimum contain the metric to be measured, the systems to which it is applicable, the period over which the measurement is occurring, the method of measurement, the acceptable quality level or levels, and a sufficiently detailed description of the calculation to allow independent calculation of compliance if necessary.

The contractor shall provide a defined SLA end-to-end implementation approach to include SLA definitions, reporting, and remediation of SLA deficiencies. The contractor and government will mutually agree upon the final SLA. The contractor shall clearly identify where government dependencies exist.

The contractor shall also clearly identify where CSP dependencies exist. The contractor shall request government approval for any planned service interruptions.

Desired Outcomes:

1) IR Mod IRIS/UI performs in compliance with SLA specifications in production and problems are resolved in accordance with SLAs.

2) Customers are able to report problems and are informed of the status of service issues regularly until resolution.

3.4 Task 4. TRANSITION SERVICES

Cost Type: LH

The contractor shall provide transition-in, and transition-out services required to develop, operate, and manage the Application Development programs with minimal disruption to services, internal and external stakeholders, and delivery partners. The purpose of the transition is to transfer expert knowledge, data and artifacts that are used to support the programs from the incumbent contractor to the incoming contractor and/or the Government.

3.4.1 Subtask 4.1, Transition-In/Ramp-Up

contractor shall perform a one-time “start-up” period at the initial award of the Task Order for on-boarding resources and transitioning support and transfer of the knowledge from the incumbent contractor(s). The contractor is tasked with acquiring and understanding the necessary documentation, information, and processes related to any work in progress. This effort includes meeting with the IRS Subject Matter

Experts and/or incumbent contractor frequently to gather any tacit knowledge related to the systems, projects, etc. in support of this Task Order. The contractor shall bear full responsibility to successfully transition this work from the incumbent contractor(s).

In support of this task, the contractor shall be responsible for completing and delivering the Transition-In

Checklist. The Transition-in Checklist provides a vehicle to verify completion of the necessary transition-in activities. The Transition-in Checklist will be developed by the incoming contractor and will include all necessary activities to ensure an effective transition from incumbent(s) contractor to successor contractor are performed. The Transition-in Checklist will be signed by both the contractor, and the COR after completion of the task.

3.4.2 Subtask 4.2, Transition-Out/Knowledge Transfer

The contractor shall perform knowledge transfer which will be defined as, but not limited to, the transitioning of all task order activities to the successor service provider or government staff, as directed.

The contractor will work with the Government to transition all plans, designs, developmental and test activities. The contractor shall coordinate across IT delivery partners which will include Enterprise

Services (ES), Enterprise Operations (EOps), Cybersecurity, Enterprise System Testing (EST) and the

Business customer. All activities will be discussed with the successor contractor. The Government estimates this Transition-Out/ Knowledge Transfer shall take approximately four to six months and be completed 14 business days prior to the end of the Task Order period of performance. If the Government decides not to exercise an option year, the Transition Management Plan (TMP) and transition activities shall be delivered at the time the contractor receives notification from the Government.

The incoming contractor shall work with the incumbent contractor(s) and government personnel identified by the IRS to ensure a seamless transition with minimal disruption to services and support for internal and external stakeholders, and delivery partners. The contractor shall transfer data and artifacts that are used to support the systems and applications from the incumbent contractor to the incoming contractor and/or the Government efficiently.

The contractor shall ensure service readiness by conducting technical reviews (e.g., technology stack, code review, configuration review), conducting security vulnerability reviews, and conducting a performance review.

The contractor will develop, document, and provide a Transition-Out Checklist no later than one hundred eighty (180) calendar days after the date of award, or earlier if directed by the Contracting Officer, and will be updated annually. The contractor’s Transition-Out Checklist will facilitate the accomplishment of a seamless transition from the incumbent(s) to the incoming contractor and/or government personnel. The contractor will identify transition activities, schedules, and milestones for the turnover of work (e.g., operations, maintenance, engineering, training, asset management, and logistics functions) and identify how it will coordinate with the incoming contractor(s) and/or government personnel to transfer knowledge.

The Transition-Out Checklist will be signed by both the contractor and the COR after completion of the task.

Desired Outcomes:

1) Contractor readiness to assume the responsibilities in this PWS before any incumbent contractors reach the end of their period of performance.

2) Completion of Transition-out Checklist activities before the end of the contractor’s final period of performance.

3) Successor contractors or government staff are ready to assume the responsibilities assigned to them.

4. KEY PERSONNEL

Key Personnel assigned to this task order shall be identified by labor category, name, and resume qualifying certain skill levels and years of experience in order to perform the required tasks. Resumes shall demonstrate the individuals’ qualifications and capabilities to perform the required activities.

Complete Key Personnel chart.

The offeror shall identify certain positions or roles and associated labor categories considered to be Key

Positions. The contractor shall submit the name and resume of the contractor employee proposed in each

Key Position. No substitution or replacement of the key personnel shall be permitted without Government approval. Contractor employees identified as Key Personnel shall be dedicated to this task order. If any changes in the proposed key personnel become necessary during actual performance, the contractor shall provide written notification 30 days in advance. In the event of a sudden change in key personnel, the contractor shall provide written notice to the CO within 3 calendar days of the event. For any substitution, the contractor shall submit justification with a proposed substitute whose qualifications are equal to or greater than the person being replaced, along with a 1 to 2-page introductory summary, in sufficient detail to permit evaluation within 10 calendar days of notification of a substitution.

The name of key personnel and any alternates who shall act within specified key roles under this task order shall be designated in writing to the Contracting Officer and may, with the consent between the Contracting Officer, Contracting Officer Representative, and contractor be amended from time to time during the course of this award to either add or delete personnel as appropriate. The government reserves the right to disapprove the proposed substitutes and negotiate for an acceptable replacement.

Name Description of Role Labor Category

5. SPECIALIZED EXPERIENCE AND KNOWLEDGE

In the area of program management, the contractor shall have PMI certified Project Management Professionals (PMP) on their team. The contractor shall have experience with managing complex programs and shall also have demonstrated IRS experience.

The contractor shall have expertise with cryptocurrency, block chain, and related technologies to consult and support IT enterprise architects to identify a strategy aligned with end state design. The contractor shall have comprehensive and demonstrable familiarity with IRS current state systems, and target state architectures, especially with regard to information returns processing.

The contractor shall have subject matter expertise in Agile methodologies and frameworks and be able to articulate their usage within Agile software development. The contractor shall have broad experience in AI technologies and capabilities.

The contractor team must have expertise and certifications relevant to the technologies listed in Appendix C, Current Information Technology / Network Environment.

6. ACCESS TO AWS INNOVATION CREDITS

The contractor shall be an AWS partner. If the contractor earns AWS innovation credits during the performance of this contract, those credits shall be made available up to the earned level of credit. The contractor shall be prepared to partner with the government to use those credits to bring new, innovative solutions to market faster, and is strongly encouraged to actively identify and suggest such opportunities to the government during the life of this contract.

7. PLACE OF PERFORMANCE

Work shall be primarily done at the contractor’s site. Under this task order telework is permissible, the contractor must ensure compliance with all applicable security related clauses regardless of where the work is performed. contractor employees will be expected to use the government spaces provided for this task order when/if needed for onsite support. Contractor personnel shall be prepared to report on-site/government facility, as requested within two hours ‘of notice for mandatory meetings.

8. PERIOD OF PERFORMANCE

The period of performance of this task order shall be a base period of twelve (12) months from date of award, plus four (4) 12-month option periods.

9. DELIVERABLES/DELIVERY SCHEDULE

Precisely describe the items to be delivered, both during the period of performance and at completion of the task order. Deliverables should be referenced back to their requirement in the Specific Tasks section.

Describe the schedule either in terms of calendar days from the date of Task Order award or in calendar days when other projects or program elements are dependent on the delivery (e.g., 10 calendar days after draft plan is approved). All documentation tied to planning increments and releases is to be updated when a planning increment or release occurs. The table below provides an example list of deliverables.

SECTION

or TASK #

DELIVERABLE or WORK

PRODUCT

FORMAT DUE DATE OR FREQUENCY

1.1 Project Management Plan MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Draft – 15-calendar days after award

Final - 30 calendar days after acceptance of draft

1.1 Technical Kickoff Briefing MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

10 calendar days after award

1.1 Technical Kickoff Briefing

Minutes

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Within 10 calendar days of the

Technical Kickoff Meeting

1.1 Integrated Master

Schedule (IMS)

MS Project or another compatible format designated by the COR or

CO

Draft – 30-calendar days after award

Final - 45 calendar days after acceptance of draft

Updated continually and reported in Monthly Status

Report

1.1 Work Breakdown

Structure (WBS)

MS Project or another compatible format designated by the COR or

CO

Draft – 30-calendar days after award

Final - 45 calendar days after acceptance of draft

Updated quarterly and reported in Monthly Status

Report

1.1 Project Management

Measures

MS Project or another compatible format designated by the COR or

CO

To be included in Project

Management Plan

1.1 Program Risk Register MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Draft – 15-calendar days after award

Final - 30 calendar days after acceptance of draft

Updated continually and reported in Monthly Status

Report

1.1 Dependency Tracker MS Word, PowerPoint, Excel or another

compatible format designated by the COR or

CO

90 calendar days after award and monthly thereafter

1.1 Action Item Tracker MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Draft – 30-calendar days after contract start

Updated weekly

1.1 Key Decision Tracker MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Draft – 15-calendar days after award

Final - 30 calendar days after acceptance of draft

Updated continually and reported in Monthly Status

Report

1.1 Monthly Status Report MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

NLT the 15th of the following month

1.3 Requirements Gathering

Materials

MS Word, PowerPoint, Excel or another compatible format

1 week prior to each requirements gathering designated by the COR or

CO

session for which contractor is designated facilitator

1.3 Requirements Gathering

Meeting Minutes

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Within one business day of all requirements gathering meetings for which contractor is designated facilitator

1.3 Planning Increment (PI)

Materials

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

1 week prior to each RRE session for which contractor is designated facilitator

1.3 Planning Increment

Roadmaps

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

1 week following each

Planning Increment Planning session

2.1 IRIS/UI documentation MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

As designated in IMS for any documentation for which contractor is identified as primary author

2.1 Unit Test results MS Word, PowerPoint, Excel or another

compatible format designated by the COR or

CO

Test results to be delivered as designated by IMS

2.1 README Files MS Word, PowerPoint, Excel or another

compatible format designated by the COR or

CO

Draft – 15-calendar days after each release

Final - 30 calendar days after acceptance of draft

2.1 SLAs MS Word, PowerPoint, Excel or another

compatible format designated by the COR or

CO

SLAs to be delivered as designated by IMS

2.2 Test Strategy, Test Plan

(including procedures, scenarios, scripts, and acceptance criteria), Test

Data, MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Test results to be delivered as designated by IMS

2.2 Post Implementation Test

Results

MS Word, PowerPoint, Excel or another compatible format

Test results to be delivered as designated by IMS

10. REVIEW OF DELIVERABLES

a) The Government will perform an initial review of deliverables, and if problems are encountered during the review, the contractor must correct them. If necessary, a meeting may be convened to resolve any differences. The contractor shall make all required changes to achieve an acceptable deliverable. The

Government will perform its review within approximately 10 business days from receipt of the deliverable.

b) When the review of a deliverable results in necessary modifications, the Government will, in accordance with the approved task order schedule, provide the necessary documentation to correct the deliverable. It will then be the responsibility of the contractor to properly and consistently incorporate the comments in the final product.

11. OTHER DIRECT COST/TRAVEL

Travel and per diem will be reimbursed at actual cost in accordance with the limitations set forth in FAR

31.205-46 and the General Services Administration’s Federal Travel Regulations. Profit shall not be applied to the travel costs. Local travel may be required for on-site meetings, etc.

designated by the COR or

CO

2.2 Build Process MS Word, PowerPoint, Excel or another

compatible format designated by the COR or

CO

To be delivered 15 calendar days after first release and updated quarterly

3 Monthly O&M report MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

Monthly - by end of month

4.1 Ramp-Up Knowledge

Transfer/Transition In Plan with Checklist (optional)

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

3 calendar days after orientation briefing

4.2 Transition Management

Plan

MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

NLT 30 calendar days after notification of requirement to transition out

4.2 Transition Out Checklist MS Word, PowerPoint, Excel or another compatible format designated by the COR or

CO

NLT 30 calendar days after notification of requirement to transition out

The contractor shall provide a travel voucher statement for all travel. The voucher shall ensure verification of costs incurred for local travel under the contract is allowable, allocable, reasonable, and in accordance with regulation FAR 31.205.46. The contractor shall attach the voucher and receipts to the monthly invoice.

12. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The Government shall evaluate the contractor’s performance under this contract in accordance with the

Government’s Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on how the

Government will ensure that the contractor has performed in accordance with the performance standards.

The Quality Assurance Surveillance Matrix (QASM) is contained within the QASP and defines how the performance standards will be applied, the frequency of surveillance, the rating standard, and the person(s) responsible for surveillance. The Quality Assurance Surveillance Form is also contained in the

QASP and will be used by the Government to record the results of the surveillance.

The quality of services performed under this task order shall conform to the highest standards in the industry. The contractor shall immediately notify the COR of problems or situations that could negatively impact compliance with the provisions of the task order and the plan the contractor shall implement to resolve problems. The designated COR/ACORs will participate in the administration of this task order by evaluating contractor performance, inspecting and accepting services for the Government, and providing a report of inspection as well as contractor performance assessments to the CO.

13. INFORMATION SYSTEMS AND INFORMATION SECURITY CONTROLS FOR

CONTRACTING ACTIONS SUBJECT TO FEDERAL INFORMATION SECURITY

MODERNIZATION ACT (FISMA) AND FEDERAL RISK AND AUTHORIZATION

MANAGEMENT PROGRAM (FedRAMP)

In performance of this contract, the contractor agrees to comply with the following cybersecurity requirements and assumes responsibility for compliance by its personnel and subcontractors (and their personnel):

1. General. The contractor shall ensure IRS information and information systems are always protected. The contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security and privacy controls, requirements, and objectives described in applicable security and privacy control guidelines, and their respective contracts. Pursuant to the Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP), the contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with the Internal Revenue Manual (IRM) Part 10.8 series and the current version of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security Privacy Controls for Information Systems and Organizations.

2. Business Entitlement Access Request System (BEARS) /Entitlement - Role-based user permission groups. The contractor shall ensure all applications and platforms integrate with the IRS to establish least privilege BEARS entitlements for all roles that prevent any one role from authorizing a transaction from end to end.

3. Privileged User Management and Access System (PUMAS). The contractor shall ensure all applications and platforms integrate with the IRS’s PUMAS to secure, provision, manage, control, and monitor all activities associated with all types of privileged identities to include, but not limited to, privileged user accounts, service accounts, and secrets management for on-premises and cloud-based applications and infrastructure.

4. Log Management and Enterprise Security Audit Trails (ESAT). The contractor shall ensure systems provide audit trails in an approved automated format acceptable to the IRS for all user actions and activities when using or maintaining the system. In accordance with NIST 800-53 Audit and Accountability (AU) controls, applications and platforms shall integrate with ESAT for audit logging to support organization-wide analysis and correlation for situational awareness.

The contractor shall provide to the IRS to be used in accordance with OMB Memo 21-31, the system logs for both services implemented on servers within the authorization boundary and services deployed on Cloud Service Offerings. The contractor shall collect and maintain network and system logs on Federal Information Systems for both on-premises systems and connections hosted by third parties, and when it is necessary to address a cyber incident on Federal Civilian Executive Branch Information Systems.

5. Federated Authentication Services Technology (FAST)/Homeland Security Presidential Directive 12 (HSPD-12) Compliant Authentication. The contractor shall ensure the system enforces the use of phishing resistant, modern multifactor authentication (MFA) compliant with Treasury, Federal and HSPD-12 Policy/Guidance. Use of MFA shall be at the exclusion of all other authentication methods i.e., username and password.

The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified IRS Administrators that will allow IRS designated personnel the ability to perform management duties on the system. The contractor shall support MFA including phishing resistant MFA (e.g., Fast Identity Online/Web Authentication and public key infrastructure (PKI)) as required by Office of Management and Budget (OMB) Memo 22-09. The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified contractor administrators that will allow contractor designated personnel the ability to perform management duties on the system.

Use of federated MFA may be leveraged by adopting one or more of the following Treasury/IRS Enterprise Services:

i. Secure Access Digital Identity (SADI) for authenticating external users.

ii. IRS Active Directory Federation Services (ADFS) for internal IRS users

iii. Common Access Identity Assurance (CAIA)/Treasury Enterprise Authentication Service (TEAS) in support of all Treasury

6. Cryptography Key Establishment and Management (System and Communications

Protection (SC-12)). The contractor shall establish and manage cryptographic keys for required cryptography employed within the information system in accordance with centralized management of key generation, distribution, storage, access, and destruction in accordance with NIST SP 800-57, Recommendation for Key Management.

7. Data-at-Rest and Data-in-Motion Encryption of all IRS Data. The contractor shall ensure all applications encrypt data at rest (per NIST 800-53, latest revision, SC-28) and data in transit (per NIST 800-53, latest revision, SC-9). SC-28 and SC-9 must pass all objective criteria stated in NIST 800-53. In addition, the encryption solution must meet or exceed all Federal Information Processing Standards (FIPS) 140 standards. All web traffic will enforce Hypertext Transfer Protocol (HTTPS) Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocols.

8. Data Jurisdiction. The contractor and subcontractors shall identify all data centers that the data at rest or data backup will reside. All data will be guaranteed to reside (and transit) within the United States (or U.S. territories).

9. Non-repudiation. The contractor shall ensure the sender of information is provided with proof of delivery, and the recipient is provided with proof of the sender’s identity. The IRS uses digital certificates to confirm the identity of Internet users sending x.509 standard encrypted information, to verify the integrity and origin of file contents. The contractor shall agree to install United States Treasury TLS site certificates for the purpose of authenticating traffic between the contractor application and the IRS. The use of SSL or TLS to facilitate arbitrary transmission control protocol (TCP) and user datagram protocol (UDP) or other protocols (effectively, anything other than HTTP) inside the encrypted TLS tunnel between an internal IRS client and an external server cannot be used. Site-to-site virtual private network (VPN) or internet protocol security (IPsec) can be used as long as there are verifiable controls to ensure that the vendor end of that tunnel is an environment that is a closed environment. That is, the environment must be isolated at the network layer from other customers services by the offeror and does not provide for communications to other services (e.g., a gateway or routing service to endpoints outside of the control of the vendor submitting the proposal, etc.).

10.