24-IRA-023-OITA - CSP Continuous Monitoring Automation RFI QandAs.pdf

QUESTIONS AND ANSWERS

FOR

REQUEST FOR INFORMATION (RFI) for

Cloud Service Provider Con�nuous Monitoring Automa�on posted April 10, 2024 (SAM.gov) and April 16, 2024 (GSA e-buy)

Ques�ons that were submited by vendors, in response to the above referenced RFI are answered below:

Number

Vendor Ques�ons

IRS Answers

1 Approximately how many IRS users are expected to need access to the provided subscription base automation tool?

~40

2 Will the tool be required to perform automated validation of packages and deliverables to ensure consistency and completeness?

Yes

3 Will tool need to provide APIs facilitating system to system integration with FedRAMP PMO tools?

YES

4 Who are the key IRS stakeholders that need to be engaged throughout the project, and what are their communica�on preferences?

Multiple Security Risk Management Unit representatives, via email

5 What specific metrics and KPIs does IRS currently track for its cloud security program, and are there any new ones that need to be incorporated?

Security Control Risks associated within purview of NIST 800-53 Rev5

6 Are there any exis�ng IT service management (ITSM) processes that the contractor needs to adhere to for incident, problem, and change management?

These processes are governed by FedRAMP and IRS policy.

7 What are IRS's expecta�ons for knowledge transfer during transi�on periods, both at the beginning and end of the contract?

IRS expects that any knowledge collected during the period be transferred completely to the IRS at both stages (Beginning and end)

8 What compliance frameworks and security standards do IRS CSPs need to adhere to beyond FedRAMP (e.g., IRS-specific policies, etc.)?

All NIST Guidance (i.e., NIST 800-53 Rev5)

9 Can IRS provide an es�mate of the number of CSPs that will need to be monitored? What cloud pla�orms do they use (AWS, Azure, etc.)?

Cannot approximate total at this point but looking at least 40 or more. Use numerous platforms to include AWS, Azure, Google, ServiceNow, and more

10 Are there exis�ng processes the IRS uses for vulnerability management and POA&M management that the IRS would like to con�nue to leverage? Are there any exis�ng security tools or data sources that IRS would like to integrate with the proposed con�nuous monitoring solu�on?

Yes, Potentially, there are tools/sources the IRS would like to integrate into the proposed solution at some point.

11 Who are the primary consumers of the security dashboards and what are their repor�ng needs?

Information System Security Officers and management

12 Will the dashboards need to integrate data from any systems beyond the con�nuous monitoring tool (e.g., GRC pla�orm, ITSM tool, etc.)?

Yes, potentially (at some point we look to integrate other data/sources)

13 What are IRS's requirements around data reten�on and auditability for the dashboard metrics?

Requirement are based on NARA requirements

14 How many cloud services does IRS an�cipate authorizing through FedRAMP in the next 1-2 years?

Potentially several but can not estimate at this time

15 What internal stakeholders (e.g., mission owners, sys admins, etc.) will the FedRAMP SMEs need to collaborate with during the authoriza�on process?

Internal Information Security Specialist, Assessment, Auditing , and Identity management teams.

NOTE: The Cloud Service Provider Con�nuous Monitoring Automa�on RFI posted on both SAM.gov and GSA e-buy, response due date of 5/7/2024, consist of the same RFI informa�on; nothing is different between the two pos�ngs. Therefore, firms can choose to respond to either pos�ng without being excluded from the opportunity to demonstrate their company’s capability.