5000171652 NOLA-SOW.docx

Physical Security System Scope of Work

(Prepared by/Date:)

Stephen Strausbaugh 4/24/2023

Facility Location:

600 S. Maestri Place, New Orleans, LA 70130

I. STATEMENT OF WORK

1.0 OVERVIEW

1.1 Description: The Internal Revenue Service requires the purchase and installation of a complete physical security equipment (Electronic Access Control System, Video Surveillance System & Intrusion Detection System) as specified in Section 3.6.

1.2 Background: The IRS is required to procure physical security equipment, inclusive of relative construction services and testing for the following project: This project is to Install a Video Surveillance System (VSS), remove and replace the current Intrusion detection System, (IDS) on the 9th and 10th Floors. The IDS is inadequate and requires an upgrade. The project also includes installation of a duress on the 9th Floor. (see diagram for specific locations).

Note: This is not considered a construction requirement even though minor construction work may be required for installation of the physical security system.

2.0 RELATED DOCUMENTS

2.1 This scope shall be used in conjunction with documents such as mark-up plans, drawings and specifications for the project, when applicable. At a minimum, contractor must comply with manufacturer’s specifications found in Section 3.6 below.

FLOOR PLANS AND/OR DRAWINGS INDICATING THE APPROXIMATE DEVICE LOCATIONS FOR ITEMS IN SECTION 3.6.

2.2 LIST OF ACRONYMS

The acronyms listed below will be used when referring to the corresponding terms:

2.3 REFERENCES

Services to be performed by the Contractor under this scope of work shall conform to all applicable requirements and criteria indicated in the following handbooks and publications and the latest issues and changes thereto:

a) General Services Administration Facilities Standards for the Public Buildings Service PBS/PQ-100.1.

b) Internal Revenue Service Facilities Design Criteria and Physical Security Standards for IRS Facilities.

c) Federal Information Processing Standards Publication FIPS-Pub; 174-1 and 175

d) National Fire Protection Association (NFPA) Codes and handbooks

i. NFPA72,

ii. NFPA101 Life Safety Codes

iii. NFPA70E

iv. National Electric Code NFPA 70.

e) Electronic Industries Association (EIA/TIA Standard 568-A, related bulletins and 569)

f) All applicable Federal, State and local codes and regulations

g) Interagency Security Committee (ISC) Standards

h) Homeland Security Presidential Directive HSPD-12

i) Occupational Safety and Health Standards.

j) Federal Information System Management Act (FISMA)

k) Federal Information Processing Standard Publication (FIPS 201-1)

l) National Institute of Standards and Technology SP 800-73

m) National Institute of Standards and Technology Standard (draft) SP-800-116

n) Americans with Disabilities Act.

o) Underwriters Laboratories (UL)

a. UL 1076 (1995; Reprint Sep 2010), Proprietary Burglar Alarm Units and Systems.

b. UL 634 (2007; Reprint Mar 2013), Connectors and Switches for Use with Burglar-Alarm Systems.

c. UL 639 (2007; Reprint May 2012), Standard for Intrusion Detection Units.

d. UL 609 (1996; Reprint Sep 2010) Local Burglar Alarm Units and Systems

e. UL 1610 (1998; Reprint Sep 2010), Standard for Central-Station Burglar-Alarm Units

f. UL 681 (2014), Installation and Classification of Burglar and Holdup Alarm Systems.

The above items are a standard listing of handbooks and publications. The contractor will utilize only those sections that are applicable to develop and complete the Scope of Work. Where conflicts occur, the more stringent requirement shall take precedence.

3.0 PROJECT/WORK IDENTIFICATION

3.1 INSTALLATION:

Installation includes all work and materials necessary for a full and complete system. Installation may include, but not be limited to the following:

a) Electrical power to all devices.

b) All wiring, conductor, conduits, and connections.

c) VSS, Access Control, IDS (intrusion detection system), duress and any other physical security system tie-ins.

d) Floor prep, flooring, walls and ceiling finish work.

3.2 – 3.4 NOT USED

3.5 GENERAL REQUIREMENTS:

A. Upon award of contract, the Contractor shall contact the Contracting Officer’s Representatives (COR) and/or POC: Stephen Strausbaugh for commencement and coordination of performance.

B. Prepare a project schedule of dates and times when installation will occur, including anticipated completion dates. This information shall be updated, and the revised schedules forwarded on a weekly basis to the Contracting Officer’s Representatives (COR) and IRS POC through email notification: Stephen.j.strausbaugh@irs.gov

C. Upon commencement of performance, the IRS POC will review with the Contractor of the proposed location for each device (i.e., alarm keypads, duress buttons, access keypads, motion, cameras, etc.) as shown on the drawing. Major changes will only be approved by the Contracting Officer.

D. The Contracting Officer (CO) is the person with the authority to enter into, administer, and/or terminate contracts, make related determinations and findings, make constructive changes, and bind the Government in contractual matters. The IRS POC monitors contract performance and provides technical direction within the terms and conditions of the contract. This individual does not have the authority to make constructive contract changes or bind the Government in contractual matters. The Contractor shall document all proposed changes in writing and address them to the CO with copy to the IRS POC. The CO is the only government official who can modify and approve changes to the original scope of work.

E. Warranty: The contractor shall ensure all components and systems have a minimum one-year warranty, including parts and labor. The IRS shall not provide additional funding for service during the one-year warranty period due to any alarm system malfunction. The one-year warranty period shall commence at the time of government acceptance.

F. The Contractor shall provide a list of all proposed security equipment and devices to be used in this Contract. This list shall contain and clearly identify the make, model, and technical specifications of proposed security equipment and devices. The security equipment and devices proposed shall be approved by IRS POC.

G. The Contractor shall not substitute equipment/parts for any reason without the prior written approval of the IRS POC. Some items in this scope are part of an enterprise system and substitution is not allowed. Substitutions of any equipment/parts without the written Government approval shall be corrected at the Contractor own expense and delay.

H. The Government (IRS) requires an experienced Contractor to install the Security equipment as required and contained in this specification/statement of work. This is defined as a contractor who has been installing electronic physical security equipment for at least five years and has an association with and/or follows the installation standards presented by the National Burglar Fire Alarm Association (NBFAA), and the state chapters. The Contractor shall install the alarm system according to applicable agency certification and Underwriters Laboratories (UL) guidelines (installation methods, wire supports, etc).

I. Install all necessary electrical outlets, including hardwiring of circuits by a licensed electrician to ensure that all devices function as designed [Coordinate with General Contractor (GC) Electrician, if applicable; in some projects the GC electrician will provide power]. All electrical work necessary to make the entire physical security system and equipment function properly is the Security Contractor’s responsibility and may require ‘collaboration’ with local building manager/contractor. Power circuits can be shared to 80% capacity amount security equipment (ACS; VSS and IDS); but must be dedicated to security devices and in a separate conduit and circuit breaker. All power connections shall be labeled at the breaker panel and at the load device identifying the breaker Number and location.

J. The Contractor shall furnish and install and test all equipment, cable, wire, connectors, labor and any electrical requirements that are necessary for the successful installation of the physical security systems as described in this Statement of Work.

K. Fasten all wires in the ceiling to overhead wire supports in order to prevent damage that may occur from existing or future wire runs in the ceilings. Wires shall not be supported solely by suspended ceiling. Periodic labels (no more than 20ft) shall be placed on expose wire(s) or conduits to indicate type of wire (i.e., alarm, access, video and device connected). All wiring shall be concealed and of a gauge no less than 18 with 4 conductors and copper stranded in composition, unless otherwise noted. Mechanical pulling of wires is prohibited.

L. Each wire/cable/etc. shall be properly labeled as it enters its termination location on the head end. This is needed for long term troubleshooting purposes. Wire numbers shall be used with a wire legend posted on panels on site with a full description of each device detailing where it is going and where it terminates. The labels shall be printed on letter size label sheets that are self- laminated vinyl that can be printed from a computer data base or spread sheet. The labels shall be 9-1/2 in Length, 8 in Width, White, Polyester, For Use With: Dot Matrix Printer or equal.

M. Every detector, sensor, button, junction box, control panel, transformer, phone jack, etc. shall be labeled in order to show the device, security system (i.e. ACS, IDS or VSS) and/or zone number on the front cover of the specific device. Each label shall be large enough to be seen from a standing position 12 in. distant without the use of a ladder.

N. Conceal all wires that are in the agency-protected space by “fishing” wire in the walls, ceilings, and doorframes to ensure tamper resistance. At various locations in which walls cannot be fished or channeled place wire in EMT. Wires are not allowed to be exposed or visible. Wire-mold is not permitted. The Contractor shall first attempt to fish wire in walls prior to using EMT in the agency-protected space.

O. Conceal all wires that are outside the agency-protected space by placing wiring in conduit, EMT, metallic tubing, etc. The size of the conduit, EMT, metallic tubing, etc. shall be large enough (i.e., 50% larger than needed) to permit additional wire pulls.

P. Homerun a wire from each device, keypad, receiver, etc. to the alarm control panel, enclosure, spare cabinets, or auxiliary power supply. Splices, t-taps, etc. are not permitted, except inside the control panel, spare enclosure, cabinets, or auxiliary power supply. All wire(s) shall be installed in accordance with UL Standards for alarm, access, and/or VSS.

Q. Contractor shall provide any devices, appliance, material or work not shown on Drawings but mentioned in this Specifications, or vice versa, and any incidental accessories necessary to make the work complete and perfect in all respects and ready for operation, even if not particularly specified, shall be provided without additional expense. The Drawings and Specifications are intended to supplement each other so that any details or equipment shown on either shall be executed the same as if mentioned in both. Note that not all devices required in the specification can be shown in drawings as it is mainly to show location.

R. The Contractor assumes responsibility for all necessary patching, repairing, painting, etc. as a result of installation or removal of items in the scope of this project, or in the event of an accident (i.e., drilling through drywall by mistake). The Government (IRS) shall not incur any additional costs for patching, repairing, painting, etc.

S. Contractor shall perform a pre-installation and final walk-through of all physical security system with the IRS POC and U.S. Department of Homeland Security/FPS representative to ensure system is complete and acceptable before final invoice and payment. The IRS POC shall coordinate the pre-installation and final walk-through.

T. Contractor shall demonstrate and train the IRS POC on the full operation of all security systems installed to government personnel. The Contractor shall ensure that required government employees selected by IRS POC, can operate the systems in a competent manner. Contractor shall provide the Government (IRS) with manufacturers technical and/or maintenance booklets of installed physical security equipment.

U. All installed equipment shall remain the property of the United States Government. The Contractor shall retain no liens, titles, etc. against any installed or uninstalled equipment once payment is received from the government.

V. Remove all old non-operative security equipment, power supplies and wiring from interior of current IDF/MDF/Security room location. No security equipment, wiring, or pathways shall be abandoned in place. Conduit can be abandoned if label property as abandoned and location of the other end at both ends and sealed.

W. Compliance with Manufacturer’s Specifications: The Contractor shall obtain all necessary equipment manufacturer’s installation specifications and drawings to complete all installation and contract work. The Government will not furnish any manufacturer’s information except that which is included in the contract documents. It is the Contractor’s responsibility to see that the equipment is installed to manufacturer’s specifications.

3.6 SPECIFIC REQUIREMENTS: The Contractor will perform the following tasks.

3.6.1 - Access Control System (ACS)

1. N/A - EXISTING

3.6.2 - FIRE-RATED PLYWOOD FOR DOOR CONTROL & BURGLAR PANEL

3.6.3 - Intrusion Detection System (IDS)

Install (1) Intrusion Detection System (IDS) Control Panel [equal to Radionics (Bosch) B8512G (or B9512G for more than 99 devices) w/ phone card OR Ademco Vista V128BPT]. Approximate location is shown on drawings and must be field verified and approved by security specialist.

Contractor must supply and install all accessories pertaining to each panel. Items must be mounted securely and resist tampering. Control panels and accessories shall be tested during inspection.

Install 9, (4 on the 9th floor and 5 on the 10th floor) alarm keypads [Honeywell Model 6160; or Bosch B942 touch screen keypads] as shown on layout (coordinate locations with Security Specialist). [Note to Contractor: One alarm keypad is included with Vista Kit]. Mount the keypad device(s) at the approximate 54 in. height.

NOTE: Keypads will ONLY alarm and/or trouble conditions in plain English and activate an audible alarm so that IRS employees can recognize trouble/alarm and location. The device/location descriptions must be conveyed to the designated FPS Mega Center.

Specific (additional) tasks are as follows:

· Contractor shall install all (new) burglar equipment according to manufacturer’s specifications. Suggested alarm devices/line modules shall be Belden 8761, 22- gauge (for lengths up to 700 feet) or Belden 8760, 18 gauge for lengths up to 2,000 feet respectively.

· Hardwire the panel OEM supplied transformer box outside and below the control panel with EMT in accordance with the NEC, and UL standards.

· Hardwire surge protector ahead of the panel OEM power supply [Ditek DTK-120HW or equal 50,000A surge rating, 10kA SCCR/In, 700V L-G/L-N; 1500V N-G;].

· Install the OEM included control panel tamper switch on the control panel to a hardwired panel zone. Program as ’24-hour auxiliary’ alarm (i.e., to Mega Center).

· Install the dual battery harness included with the Burglar panel. Also provide cam lock and key [Medeco Cam Locks or UL434 Listed equal].

· Install two 12-volt, 17 or 18 amp-hour batteries into the Burglar control panel [the 7-amp hour rated units is NOT acceptable].

· Install two Ademco 620 cords, and two Ademco 621 RJ31X jacks inside the Burglar control panel.

· Install two surge protectors [Ditek MRJ31XSCP-WP or equal: RJ45 SCP: 150mA self-resetting fuse] ahead of the analog telephone lines for the alarm system (i.e., to be eventually linked to the FPS Mega Center).

· Install Auxiliary Power Supply [Altronix AL400ULM or approved equal: 5 PTC Class 2 Outputs (auto-resettable), 12/24VDC @ 4A, FAI, 115VAC] (UL Listed Commercial) w/ tamper switch and program for 24-hour auxiliary alarm. Install auxiliary power supply below the control panel connected by EMT. If hardwired to the AC, install a surge protector ahead of the Auxiliary Power Supply line voltage. Use this for detection device and keypad power on non-polling loop powered devices. All wires that come into or out of all panels/enclosures must be in EMT or fished in the wall into the back of the enclosures. No exposed and/or visible wires are permitted.

· Install one 12-volt, 17-amp hour battery into the Auxiliary Power Supply. Connect Auxiliary Power Supply to the control panel’s hardwired panel zones for detection and notification.

· Install at least one UL365 listed spare enclosure below the Auxiliary Power Supply connected by EMT or fish the wires in the wall and into the back of the panel. Install a tamper switch on the panel (programmed as 24-hour auxiliary). Provide cam lock(s) and key(s) [Medeco Cam Locks or UL434 Listed equal] for zone expanders and terminal strips.

· Install OEM zone expanders as required (one minimum) for the number of devices in this scope; inside the spare enclosure mentioned above. A zone per each device is required for every device. Each expander will provide 8 zones via zone expanders. Each individual device must annunciate locally with its specific location and communicate this identification back to the designated FPS Mega Center.

In general, install cam locks w/key [Medeco Cam Locks or UL434 Listed equal] & IDS panel OEM tamper switches on all control panels, enclosures, power supplies, etc. Note: all tamper switches must be linked to Mega Center for monitoring

IDS Requirements:

a. The Contractor shall complete all configuration paperwork and testing coordination and communication for monitoring of the Intrusion alarm with the US Department of Homeland Security, Federal Protective Service Mega Center in [Denver, CO] upon installation completion but prior to final contract completion and final payment. Each point of the system must be individually identified at the keypad and in the Mega Center. All zones must be tested to the Mega Center. Provide a detailed inventory (with manufacturer name and model number) of all equipment installed. The Mega Center selected above will monitor the burglar alarm system. The Contractor shall contact a “Remote Programmer” for this information at the Mega Center. The applicable “Remote Programmer” contact information can be acquired by the method of email communication through the IRS POC or at www.dhs.gov.

b. Prior to contract completion, the Contractor shall ensure that the alarm system has been uploaded by the FPS Mega Center using Honeywell/Ademco Compass Software or similar type software. Additionally, the Contractor shall ensure that all zones are fully tested and communicated before installation is deemed “complete.

c. Connect IDS panel to Video Surveillance to tag video for closest camera of any IDS alarm.

d. Upon contract completion, but prior to final, the Contractor shall complete all required documentation and forms (Example: IRS/GSA/DHS(FPS)), depicting the location of each specific device for any and all alarm, access, VSS, etc. systems to include wiring paths, junction boxes, control panels, etc. Mega Center diagram plans/paperwork shall be prepared in AutoCAD and delivered both on paper and in electronic format.

Install (1) Hard-wired silent duress/panic buttons [Honeywell Ademco 269 series; or Amseco HUSK-20]. Contractor must securely install panic buttons under each table or desk, and homerun (hardwire) back to the NEW Burglar Panel. Contractor must verify location with IRS POC. The wires shall be run in conduit through the walls and secure with wire clips under the desk.

Program each button to be identified individually (floor/room/cubicle #) on site through keypad and communicated exact location to the corresponding Mega Center.

Install a total of 21 (7 ON THE 9TH FLOOR AND 14 ON THE 10TH FLOOR) ceiling mounted motion detector [Bosch DS9370 ceiling mounted motion detector or Tri-Tech motion approved equal].

· NOTE: Contractor must verify location with IRS POC and refer to drawing marker.

Each 360-degree motion detector shall be home run (wired) to Burglar panel. Motion detector must be adjusted as necessary to avoid false alarms that are associated with environmental issues such as air vents. Wire motion detector to the control panel (located in Security Closet) on its own homerun wire with zone/point identification. As with every detector in this system, the proper Mega Center will be notified if an event occurs.

N/A

Note: door contacts shall be home run (wired) as a separate zone on the burglar control panel and report to the designated FPS Mega Center. Doors that enter/exit business units require contacts for the burglar alarm and/or access card reader portions of the project. No exposed wiring will be permitted. Ensure that the door contacts are installed in such a way that doorframe(s) and imperfections do not affect the contacts and break them.

3.6.4 - VIDEO SURVEILLANCE SYSTEM (VSS)

Install (8) ceiling or wall mounted mini-dome IP cameras w/ 5 megapixel minimum. Contractor must verify location with IRS personnel and refer to plan drawing.

Install (4) ceiling mounted dome DUO IP cameras; w/ 4 megapixel minimum and multi-lens (no fisheye). Contractor must verify location with IRS personnel and refer to plan drawing.

Cameras must meet these minimum requirements:

· IP cameras - IPv4, IPv6, HTTP, HTTPS, FTP, DNS, DynDNS, NTP, TCP. Enable IP filter to limit communication to Switch and Server/NVR IP only.

· Wide Dynamic Range (WDR) and True Day/Night

· Infra-Red (IR) illumination (outdoor)

· Zipstream compression or equivalent Dual Encoder H.264/265/MJPEG.

· IP66 rated enclosure, IK10 Vandal Resistance

· Autofocus, auto-iris

· ONVIF Profile S, T, and G Compliant

· Hardwired (no wireless communication)

· NDAA Compliant

Approved Products Are:

· AXIS M, P & Q Series

· Bosch FLEXIDOME IP Series.

· Hanwha / Wisenet

The locations of cameras as shown on drawings are approximate. The final location shall be field verified to get a clear, sharp, distortion free picture and roll-free vertical interval switching. A camera view plan should be created by camera vendor to ensure proper area coverage.

Contractor shall post Video Surveillance Signs.

POE Switches must be Managed and have POE+ of 60 watts minimum and IEEE802.3-compliant.

Approved manufacturers are:

· Cisco

Agency (IRS) network and switches are not allowed to be used for video camera. Video Switches shall be installed in a separate video rack or lock box. (May be on desk or floor) Under no circumstances the Video switch or equipment can be install on IRS IT racks. Video equipment must be clearly label that is it for Video Surveillance. Install (1) separate switch that may be used as a test and setup switch for cameras.

When multiple monitors are required, remote to NVR display(s) will be for (DISPLAY ONLY). For remote display only use a Video Decoder similar to WISENET SPD150/151 or approved equal.

Supply wall mount for all monitors.

See drawing for location or coordinate with Security Specialist. For wall locations provide Full-motion TV wall mount and coordinate height with IRS POC. All Monitors will show activity of cameras as indicated by local POC.

Also, install a 550VA Uninterruptible Power Supply (UPS) for each color monitor [Tripp-Lite INTERNET550U; or APC BE550G or 120V, 550VA, approved equal] to keep the monitor powered during a power outage and to condition the voltage. Hardwire all accessories. Note that UPS can be located on wall behind Monitor.

In addition, the equipment listed below are the only equipment allow to be installed at the IRS and substitution is not allowed.

IRS NVR APPROVED PRODUCT FOR UP TO 32 CAMERAS:

· Bosch DIVAR IP All-in-One (AIO) Series

· Hanwha / Wisenet WRN or WRT Series

Provide and install a separate lockable rack for VSS equipment (NVR, monitor, UPS and switch). Coordinate exact location with IRS POC.

Also, install a 1500VA Uninterruptible Power Supply (UPS) [APC SMT1500C; or Tripp-Lite SMART1500; or 208/120V, 1500VA equal] on shelf in security room to power the NVR, Switches and Cameras. Contractor shall hardwire all accessories

For a single camera exceeding 328ft (100 meters) install an AXIS-T8134 POE injector and AXIS-T8139 POE Extender every 328ft.

For locations with multiple cameras at remote locations exceeding 300ft separate POE+ switches shall be installed close to cameras location.

All cabling, jacks, patch cables, and patch panels must be tested and certified to the most current ANSI/TIA/EIA-568 cabling standard for the proper category of cabling. The cabling must be compliant with ANSI/TIA-1152-A accuracy.

All test results must be provided in written and electronic formats.

CAT 6e horizontal cable shall be tested to 250 MHz as defined by TIA/EIA-568-C.2. Measurements shall be of the "Permanent Link" including cabling, and modular jacks at the information outlet and modular patch panel. Parameters to be tested must include:

a) Wire Map

b) Length

c) NEXT Loss (Pair-to-Pair)

d) NEXT (Power Sum)

e) ELFEXT (Pair-to-Pair)

f) ELFEXT (Power Sum)

g) Return Loss

h) Attenuation

i) Propagation Delay

j) Delay Skew

3.6.5 - MISCELLANEOUS

1. 20

The Government estimates that the Contractor will need to supply and install manufacturer’s equipment. It is the Contractor’s responsibility to double check and be certain that all materials/equipment and/or labor are accounted for prior to quote submission. “HOMERUN” each device on its own stranded plenum rated wire or plenum coax with copper core and copper braid to the panel with no splices, “T” taps, no surface wire, etc:

3.7 OTHER INFORMATION

3.7.1 Government Furnished Equipment:

· Analog telephone line for burglar panel.

· Provide the room location for the electronic equipment to be wall mounted in a secure location under lock and key.

· IP address for each door control panel and data drop for each panel by IT

3.7.2 Related Work: Contract documents indicate the work of contract, and related requirements and conditions that have an impact on the project. Related requirements and conditions that are indicated on the contract documents include but are not necessarily limited to the following: (1) Existing site conditions and restrictions; (2) Alterations and coordination with existing work; (3) Other work to be performed concurrently by the Government; and (4) Other work to be performed concurrently by separate contractors.

3.7.3 Working Hours: Work shall be performed Monday through Friday (excluding holidays and weekends) from 7 AM – 6 PM. Any afterhours work will require prior written approval.

3.7.4 Trash Disposal: Contractor shall provide garbage/waste receptacles for disposal of trash (such as wrapping paper, boxes, etc.) and be removed by Contractor upon completion of work.

3.8 CONTRACTOR RESPONSIBILITIES

3.8.1 Contractor shall furnish all labor, materials, and equipment necessary to perform the job.

3.8.2 Contractor is required to (i) be licensed; (ii) maintain insurance coverage that is common within the industry and for the nature of work.

3.8.3 All Contractor personnel shall be required to wear proper identification, which may include company attire with logo, badge, etc. when working in the government facility. [Identification card or badge (if needed) is to be displayed on contractor employees at all times.]

3.8.4 Contractor shall provide personnel who are professional, reliable, trained, and experienced in performing the job requirements.

3.8.5 Contractor must ensure that all personnel working on this requirement be: (I) a U.S. citizen or have lawful permanent resident status, and (ii) fluent in the English language. Contractor shall not employ any person to perform work under this requirement with any of the following background history: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrest for continuing offenses, or failure to file or pay federal income tax.

3.8.6 Contractor shall provide timely and professional customer service (i.e., address concerns, issues, and other administrative functions). For purposes of this contract timely means no later than by the close of business next business day.

3.8.7 Contractor personnel shall maintain a neat, clean, and hazard-free working environment to the extent practicable. All work shall be done using the highest standards of the trade and in compliance with all federal, state, and local codes. Contractor personnel shall take all necessary precautions to avoid scarring, marring or damaging government’s property. Contractor(s) shall incur any cost to repair or restore to its original condition Government property damaged during the performance of this work. Upon completion, all packing materials, debris, dust, etc. shall be removed from the premises and discarded in accordance with local and state regulations. The work area shall be left in “ready to occupy” conditions.

3.8.8 The work shall be carried out in such a manner so that there will be little no interference with the proper execution of Government business. All persons employed in contract work shall, while on the premises, comply with all building regulations.

3.9 IRS RESPONSIBILITIES

3.9.1 IRS POC shall provide access to the respective work area(s).

3.9.2 IRS POC shall assist in making the appropriate decisions with regards to specific location/placement, procedures, and programming. The IRS POC shall be readily available during the contract term and shall make decisions without delay. All required and applicable changes shall be executed through contract modification. Contract modifications shall be executed by the Contracting Officer.

II. INFORMATION SYSTEM SECURITY REQUIREMENTS FISMA SECURITY CONTRACT LANGUAGE (MAJOR IT SYSTEMS / APPLICATIONS or SERVICES)

1. CONTRACTOR SECURITY TRAINING

IR1052.224-9001 Mandatory IRS Security Training for Information Systems, Information Protection and Facilities Physical Access (JUN 2021) The Federal Information Security Modernization Act of 2014 (FISMA) requires each federal agency to provide periodic information security awareness training to all contractors/subcontractors involved in the management, use, or operation of Federal information and information systems. In addition, contractor/subcontractor personnel are subject to the Taxpayer Browsing Protection Act of 1997, which prohibits willful unauthorized inspection of returns and return information and details that any violation of the Act could result in civil and criminal penalties. Contractor/subcontractor personnel are subject to the Privacy Act of 1974 (5 U.S.C. 552a; Pub. L. No. 93-579), December 1974.

Contractor/subcontractor personnel are bound by the Records Management by 93 Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

a. The contractor must ensure all new contractor/subcontractor personnel complete all assigned briefings which are based on the responses provided on the Risk Assessment Checklist Form 14606. These responses pertaining to access to any IRS system, including basic LAN, email and internet; access to any Sensitive but Unclassified (SBU) data; and access to any IRS facility. Since new contractor/subcontractor personnel will not have access to the IRS training system, the COR shall provide softcopy versions of each briefing.

i. Exception: Contractor personnel (including subcontractors) performing under IRS contracts with Nonprofit Agencies Employing People Who Are Blind or Severely Disabled (as described in FAR Subpart 8.7) are exempted from the aforementioned briefing requirements, unless the contractor requests access to the training, or there is a compelling justification for requiring the training that is approved by the Contracting Officer (CO). An example of this would be in an instance where visually impaired personnel is assigned to perform systems development and has potential staff-like access to IRS information.

ii. Contractor/subcontractor personnel working with IRS information at contractor-controlled facilities with no access to the IRS network will be subject to all mandatory briefing excepting the Facilities Management Physical Security briefing as outlined in Publication 4812.

iii. Service Personnel: Inadvertent Sensitive Information Access Training Contractor personnel performing: (i) janitorial and cleaning services (daylight operations), (ii) building maintenance, or (iii) other maintenance and repair and need staff-like access to IRS facilities are required to complete Inadvertent Access to Sensitive Information (SBU) Access training.

iv. Service Personnel Security Awareness Training: Contractor personnel providing services in the following categories are required to complete FMSS Physical Security Training:

1. Medical;

2. Cafeteria;

3. Landscaping;

4. Janitorial and cleaning (daylight operations);

5. Building maintenance; or

6. Other maintenance and repair

b. In combination these mandatory briefings are known as IRS Security Awareness Training (SAT). The topics covered are: Cybersecurity Awareness, Privacy Information Protection and Disclosure, Unauthorized Access to Taxpayer Data, Records Management, Inadvertent Sensitive Information Access, Insider Threat and/or Facilities Physical Security. The completion of the assigned mandatory briefings constitutes the completion of the Security Orientation.

c. The SAT must be completed by contractor/subcontractor personnel within 5 business days of successful resolution of the suitability and eligibility for staff-like access as outlined in IR1052.204- 9000 Submission of Security Forms and Related Materials and before being granted access to SBU data. The date listed on the memo provided by IRS Personnel Security shall be used as the commencement date.

d. Training completion process:

The contractor must submit confirmation of completed SAT mandatory briefings for each contractor/subcontractor personnel by either:

i. Using Form 14616 signed and dated by the individual and authorized contractor management entity and returned to the COR. This option is used for new contractor/subcontractor personnel and any that do not have an IRS network account.

ii. Using the IRS training system which is available to all contractors with IRS network accounts

e. Annual Training. For contracts/orders/agreement exceeding one year in length, either on a multiyear or multiple year basis, the contractor must ensure that personnel complete assigned SAT mandatory briefings annually no later than October 31st of the current calendar year. The contractor must submit confirmation of completed annual SAT on all personnel unable to complete the briefings in the IRS training systems by submitting completed Form 14616 assigned to this contract/order/agreement, via email, to the COR, upon completion.

f. Contractor’s failure to comply with IRS privacy and security policy (to include completion and certification of SAT requirements within the timeframe specified) may be subject to suspension, revocation or termination (temporarily or permanently) of staff-like access to IRS IT systems and facilities.

g. Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local privacy and security or safeguard clauses or provisions for protecting SBUSystem Review / Site Visit

2. SAFEGUARDING / PROTECTING SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION (PII)

Sensitive PII is defined as any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, legal permanent resident, or employee or contractor to the Department. Sensitive PII is Personally Identifiable Information, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Information Systems can be either electronic or manual. IRM 10.8.1 requires IRS sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearance required; receive security awareness and specialized IT security training required for contractor activities or facilities; and any facility physical security requirements.

IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information (PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

a. The CSP/Contractor shall ensure that individuals accessing an information system processing, storing or transmitting information requiring special protection satisfy the personnel screening criteria.

Note: This requirement is defined by FedRAMP.

b. The organization shall:

Screen individuals prior to authorizing access to the information system; and Rescreen individuals according to FedRAMP Assignments: for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low-risk positions.

The CSP/Contractor shall ensure that data is used, only as identified, in the IRS contract and that the data will be used for nothing else to ensure the privacy of the individual.

The CSP/Contractor is responsible for maintaining an inventory of all PII provided to the contractor, generated by the contractor, or used by the contractor sufficient to enable notification to taxpayers, if disclosed. The inventory of PII must be updated semi-annually with a final inventory notification provided to the COR.

Most IRS information is categorized as Sensitive But Unclassified (SBU). This includes:

i. Federal Tax Information (FTI)

ii. Personally Identifiable Information (PII)

iii. Protected Health Information (PHI)

iv. Certain procurement information

v. System vulnerabilities

vi. Case selection methodologies

vii. Systems information

viii. Enforcement procedures

ix. Investigation information

x. Proprietary processes or algorithms used in investigative work or tax processing

Note: Live data, which is defined as production data in use (production, testing, development), often contains SBU.

IRM 10.8.2, Information Technology (IT) Security, Security Roles and Responsibilities, defines IRS-wide roles and responsibilities related to IRS information and computer security.

a. The IRS shall designate an Authorizing Official for the Cloud Computing Service per IRM 10.8.2.

b. Each Business Unit shall assign at least one (1) Information System Security Officer (ISSO) or Security Program Management Officer (SPMO) to the Cloud authorization process.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Modernization Act (FISMA), the EGovernment Act of 2014, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information.

IRM 10.8.24.2, Internal Revenue Manual (IRM) 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy, CSP roles and responsibilities related to IRS information and computer security.

Unless specifically identified, the scope of the CSP’s responsibility for the protection of IRS assets depends on the service delivery model being used (SaaS, PaaS, IaaS) and their contractual agreement. The IRS personnel with technical responsibilities for the use, implementation, and acquisition of cloud service shall ensure the CSP is made aware of and adheres to, as part of their contract, all applicable CSP responsibilities according to their Cloud Service Offering (CSO).

3. HANDLING INFORMATION SECURITY INCIDENTS

The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

Contractors and their employees must be aware of their responsibilities under the law to safeguard PII and sensitive information, the procedures to follow when data is lost or compromised and the penalties for unauthorized disclosure of PII and sensitive information. Contractors should refer to Data Breach Information for IRS Contractors on irs.gov https://portal.ds.irsnet.gov/sites/vl003/RelatedResources/Doc13347-2020-01- Data%20Breach%20Response%20Playbook.pdf#search=contractors%20data%20breach Pub 4465-A; Protecting Federal Tax Information for Contractors, and Pub 4812, Contractor Security Controls, for information about a contractor’s responsibilities to protect Federal Tax Information (FTI) and incident/data breach response and reporting procedures.

It is critical to report an incident/data breach as soon as actionable information is available so a response/reaction can be initiated. Incident/data breach updates and any additional notifications to Treasury Inspector General for Tax Administration (TIGTA) and/or Local Law Enforcement can be completed after the initial report to the Office of Taxpayer Correspondence (OTC), Privacy, Governmental Liaison and Disclosure/Incident Management Office (PGLD/IM), or the Computer Security Incident Response Center (CSIRC) is submitted.

All physical security incidents and/or threats should be reported to the SAMC within 30 minutes of incident discovery. SAMC operates 365 days a year, 24 hours a day, seven days a week. Incidents may be reported to the SAMC through any of the following methods:

Primary Method of Reporting: Website incident reporting link, https://tscc.enterprise.irs.gov/irc/

Alternate Reporting Methods:

Telephone: 202-317- 6124 or 1-866-216-4809 (toll free hotline) Fax: 202-317-6129 Email: samc@irs.gov

The CSP/Contractor shall report security incident information according to U.S. Computer Emergency Response, Department of Treasury, IRS, and the FedRAMP Incident Communications procedures.

All incidents related to IRS processing, information or information systems shall be reported within one (1) hour to the CO, COR, and CSIRC. Contact the CSIRC through any of the following methods:

CSIRC Contacts: Telephone: 240.613.3606 E-mail to csirc@irs.gov

The CSP/Contractor shall be…