DRAFT CTO-IT-Research SW License Subscription SOW - 5000206381.pdf

STATEMENT OF WORK

For

IT Software License Subscription - Research Library

1.0 INTRODUCTION AND BACKGROUND

The Internal Revenue Service (IRS) is committed to making improvements that enhance customer service, bolster enforcement, and secure taxpayer information. The passing of the Inflation Reduction Act (IRA) lays a path for IRS IT to innovate the ways in which the IRS engages with taxpayers, business customers, and internal IT personnel. By leveraging the FY2019 IRS Modernization strategy and the IRS IRA Strategic Operating Plan (SOP) FY2023-2031, there is an opportunity to transform IRS operations and ways of working, upskill the IT workforce to meet the demands of the ever-evolving tech landscape, and lay the foundation for a modern, customer-centric IT. The IRS faces increasing demands of efficiency, accuracy, and security, while the growth of digital technologies creates new opportunities and challenges. IRS is taking on critical challenges in a dynamic environment to successfully accelerate the transformation of IRS.

The IRS Chief Technology Officer (CTO) is at the forefront of these initiatives, leading the charge towards a modernized approach to strategy, delivering dramatic improvements to the IT infrastructure through coordinated strategic collaboration with Associate Chief Information Officers (ACIOs) responsible for engineering, architecture and design activities, infrastructure, applications development, networks, enterprise information security and compliance with security standards and computer operations and support.

This Statement of Work (SOW) outlines the requirements for subscription-based licenses that provide comprehensive IT research to support the IRS CTO in achieving the strategic objectives of the IRA’s SOP. The service provider shall offer access to a wide range of research materials, including but not limited to, market analysis reports, technology forecasts, best practice guides, and industry benchmarks. Additionally, the subscription shall provide direct access to expert analysts for personalized consultations, webinars, and workshops tailored to IRS CTO business needs. The provider shall ensure timely updates and continuous access to the latest research findings and insights. The subscription should be scalable to accommodate varying numbers of users and adaptable to evolving organizational requirements, with a focus on delivering actionable intelligence that aligns with IRS IT and business objectives, including enhancing decision-making and improving performance across IT and business domains.

2.0 OBJECTIVES

The scope of work for this requirement is set forth in the below task area and its sub-tasks necessary to successfully support IRS CTO. The task area supporting this scope of work is as follows:

The primary objectives of this engagement are to:

1. Enhance the CTO’s understanding of IT industry trends and best practices.

2. Support strategic planning and IT executive-level decision-making processes.

3. Improve operational efficiency and effectiveness through expert guidance.

4. Foster innovation and competitive advantage.

5. Improve stakeholder engagement and communication to ensure alignment and support across the CTO.

3.0 SCOPE OF WORK

Subscription-based licenses that shall include but not be limited to:

• Two end-user licenses for subscription-based Information Technology (IT) research library services.

• Product-based, on-demand, internet-accessible research and documents on IT benchmarking, forecasting, technology trends, and strategic roadmaps that are objective, unbiased, and independent.

• Subject matter expertise analysts available on demand to provide access to information regarding technology strategy, software/cloud contract negotiation, cost optimization, benchmarking, budgeting, and functional maturity assessment research/tools.

• Market analysis and intelligence, vendor and product ratings, maturity assessments, cloud analysis & analytics tool(s), Artificial Intelligence (AI)-focused risks, and opportunities.

• Research library with access to analysts for deep dives, best practices, document reviews, business case analysis, tools, templates, and case studies.

• Resources and diagnostic tools specific to the roles and responsibilities of an office of the Chief Technology Officer.

• Access to conferences and learning events, team inquiries, workshops, peer networking forums, and webinars.

3.1 TASKS AND PERFROMANCE MEASURES

By establishing these tasks, the IRS can ensure that the Research Subscription engagement effectively supports the CTO in achieving the strategic objectives of the IRA’s Strategic Operating Plan. Regular reviews and adjustments to these measures will help maintain alignment with evolving goals and priorities.

3.1.1 Subscription-Based Licenses

The contractor shall enable access to Comprehensive Research and Analysis by providing a quantity of two (2) research and advisory subscription licenses for one Senior Manager and one Manager. The provided license subscriptions shall allow the following capabilities:

• Subscription-based, on-demand access to IT research products, including benchmarking, forecasting, and technology trends.

• Delivery of market analysis and intelligence, including vendor and product ratings, maturity assessments, and AI-focused risks and opportunities.

• Objective and Unbiased Insight (No Sponsored Research, No Commissioned White Papers or Outsourced Analysis).

• Proprietary Vendor and Technology Evaluation Research Methodologies.

• Strategic Content for Technology/IT Leaders.

• Executive Leadership Research Content.

• IT Benchmarking Data and Budgeting Tool.

• Functional Maturity Assessment Tools.

• Unlimited number of 30-minute Inquiry Discussions and/or Document Reviews with

Technology Strategy Research Experts.

• Unlimited participation in webinars designed for the technology professional.

• Full Access to an Interactive Online Peer Networking Platform.

• Ticket to attend a Multi-Day, In-Person Conference Event focused on a Specific IT

Role/Domain.

• Solution Delivery from a Research License Product Expert.

• Access to Research Tools and Research Capabilities, such as:

o Subject-matter expertise with analyst access for executive-level engagements.

o Deep-dive analyses into best practices, document reviews, and business case analysis.

o Tools and templates for IT benchmarking, budgeting, and functional maturity assessments.

o Custom research projects as requested by the IRS CTO.

o Conferences, learning events, workshops, peer networking forums, and webinars.

o Resources and tools specific to the roles and responsibilities of the CTO office.

o Monthly and quarterly research reports relevant to the IRS CTO and strategic focus.

o Event participation and post-event summary reports.

4.0 Task Order Kickoff Meeting

Within five (5) business days of task order award, the contractor shall meet with Government representatives at a mutually agreed upon location or via teleconference. The intent of this meeting is to initiate the communication process between the IRS and the contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The completion of this briefing shall result in the following:

• The contractor and Government personnel who will perform work under this task order will be introduced.

• The Government may provide any GFP to the contractor at this time.

• Any issues concerning the contractor employee security clearances will be discussed.

• The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this Statement of Work.

• The contractor shall provide the accounting period end dates to be used for the term of this task order.

• The contractor shall provide meeting notes, inclusive of any follow-up actions, to the Government within five (5) business days after the meeting.

5.0 Deliverables

The contractor shall provide the deliverables as described in Table 1 below during the performance of this Task Order. All contractor deliverables or work products shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government. The deliverables and work products shall be provided in electronic format to the COR and shall comply with all applicable standards of Section 508 of the Rehabilitation Act.

The final format and content requirements, if not stated in the Statement of Work, may be mutually developed and agreed upon among the IRS Program Manager (PM), the contractor and the contracting officer’s technical representative (COR).

Table 1: Schedule of Deliverables

Task 3.1. 1 Subscription-Based Licenses Deliverable No.

Deliverable Due Date/Frequency

1 Task licenses As Requested by CTO / NLT than specified due date

Research Tools and work products:

• Monthly and quarterly research reports relevant to IRS CTO and strategic focus.

• Scheduled advisory sessions with designated analysts.

• Subscription-based access to proprietary tools and databases.

• Event participation and post-event summary reports.

• Custom research projects as requested by

IRS CTO.

• Case studies from other organizations that have undergone similar transformations.

As Requested by CTO / NLT than specified due date

5.1 Submission of Deliverables

Any deliverable that does not comply with the acceptance criteria outlined in this SOW shall be considered rejected. Unless otherwise agreed upon by the contractor and the COR or otherwise specified herein, the COR shall provide written feedback on deliverables within ten (10) business days. Unless otherwise specified herein, all deliverables/ work products shall be provided no later than 4:00 p.m. EST on the applicable due date(s).

The contractor shall provide revisions within five (5) business days of receipt of the COR’s feedback. The number of days allotted to the contactor for re-submission of deliverables may be adjusted if agreed upon by both parties. If the contractor has not been notified of any discrepancies within ten (10) business days after submission of the deliverable or successful completion of a task, the deliverable or task shall be considered accepted.

5.2 Documentation Requirements

The contactor shall provide all documentation in Section 508 compliant electronic format and, upon request by the Government, in hard copy format. The Government will have the right to request suppression of hard copy deliverables in cases where security and privacy concerns are a factor, or to reduce paperwork burden. All deliverables resulting from work executed under this contact shall convey to the Government. In addition to the requirements set forth in the QASP, all documentation shall be provided in accordance with the criteria set forth below:

• Completeness – The document demonstrates sufficient level of detail to show understanding of the requirements, technology and design, customers and operating environment.

• Feasibility - The document defines information, which is formatted properly, contains valid information in support of this task order and provides a deliverable within time constraints.

• Understandability - The document is to be clean, clearly written, all printed words are legible, and the outline is easy to follow. All diagrams are easy to understand and relevant to the supporting narrative.

• Accuracy – The document is accurate in presentation exhibiting clear and concise information, technical content, and adherence to accepted elements of style, operational content, and consistent within itself and with other documents.

• Practicality - The document provides information and guidance that is practical for implementation within the IRS environment and appropriate given the subject organization’s level of maturity.

6.0 PERIOD OF PERFORMANCE

One base year plus one option year. The anticipated period of performance is April 1, 2025, to March 31, 2027.

7.0 GOVERNMENT FURNISHED PROPERTY (GFP) AND INFORMATION (GFI)

No government-furnished property or government-furnished information will be provided.

8.0 TRAVEL

There is no travel requirement.

9.0 SECURITY REQUIREMENTS

FEDERAL INFORMATION SECURITY MODERNIZATION ACT (FISMA)

Pursuant to the Federal Information Security Modernization Act (FISMA), Title III of the E-Government Act of 2014 (Pub. L. 113–283), the contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. The contractor shall provide a risk-based process for selecting the security controls necessary to satisfy the minimum-security requirements in accordance with Federal Information Processing Standard (FIPS) 199. The term information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor or subcontractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data. IRS information or information system with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

The potential impact values for confidentiality, integrity, and availability may not always be the same for a particular information system; the high-water mark concept must be used to determine the overall impact level of the information system. Thus, a low-impact system is an information system in which all three of the security objectives are low. A moderate-impact system is an information system in which at least one of the security objectives is moderate and no security objective is greater than moderate. And finally, a high-impact system is an information system in which at least one security objective is high. The determination of information system impact levels must be accomplished prior to the consideration of minimum-security requirements and the selection of appropriate security controls for those information systems.

Federal Risk and Authorization Management Program (FedRAMP) security requirements shall be applied to all IRS cloud services and products and shall be implemented and complied with as part of a competed FedRAMP authorization.

The enforcement of FedRAMP requirements shall be done through Service Level Agreements (SLA)/Contracts. IRS shall utilize aggregated and individual security categorization information when assessing interagency and Cloud Service Provider (CSP) connections with different FIPS 199 Category Impact levels.(e.g., High Impact system connecting to Moderate Impact system etc.)

THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) GUIDANCE

FOR INFORMATION SECURITY

The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum-security controls identified in NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations for FISMA compliance. The contractor shall follow the best practices and guidance established by NIST Special Publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

The contractor shall implement protections for personally identifiable information being accessed remotely or transported outside of the agency’s secured, physical perimeter, and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information.

TREASURY / IRS POLICIES FOR INFORMATION TECHNOLOGY (IT) SECURITY

The contractor shall comply with FedRAMP Framework, Department of Treasury Directive TD P 85-01, Internal Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security Policy and Guidance and Internal Revenue Manual (IRM) 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy. The contractor shall comply with IRS IRMs when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

The contractor/contractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

FEDERAL INFORMATION PROCESSING STANDARD (FIPS)-201-2

Homeland Security Presidential Directive-12 [HSPD-12], August 27, 2004, established the requirements for a common identification standard for identity credentials issued by Federal departments and agencies to Federal employees and contractors (including contractor employees) for gaining physical access to federally controlled facilities and logical access to federally controlled information systems. HSPD-12 directs the Department of Commerce to develop a FIPS publication to define such a common identity credential. In accordance with HSPD-12, this Standard defines the technical requirements for the identity credential that:

a) is issued based on sound criteria for verifying an individual employee’s identity.

b) is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.

c) can be rapidly authenticated electronically; and

d) is issued only by providers whose reliability has been established by an official accreditation process.

The standard for a Personal Identity Verification (PIV) system is based on secure and reliable forms of identity credentials issued by the Federal government to its contractors.

These credentials are intended to authenticate individuals who require access to federally controlled facilities, information systems, and applications. A PIV Card must be personalized with identity information for the individual to whom the card is issued, to perform identity verification both by humans and automated systems. Humans can use the physical card for visual comparisons, whereas automated systems can use the electronically stored data on the card to conduct automated identity verification.

IRS will determine the level of security and authentication mechanisms appropriate for their applications and will employ only information technology products on the FIPS 201-approved products list for PIV capability implementation within organization information systems.

CSPs must review SP 800-63-3, use its decision trees to obtain an overview of all digital identity requirements, and read the applicable 800-63 volumes to determine specific requirements that apply to their cloud offerings.

SECURITY AUTHORIZATION / CERTIFICATION AND ACCREDITATION PROCESS

CSP/Contractor systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), with a FIPS

199 security categorization) must ensure annual reviews and continued security certification and accreditation. Some of the key elements of this IT risk and impact assessment process are project security deliverables such as the System Security Plan (SSP), Information System Contingency Plan (ISCP), Interconnection Security Agreement (ISA), Security Risk Assessment (SRAs), Data Impact Assessments (DIAs), Risk Analyses, Security Threat Analyses, Audit Plan, Source Code Review, Security Control Assessment (SCA), and/or Event-Driven Security Control Assessment (ED-SCA). All systems that complete this process will, at a minimum, meet FedRAMP, Treasury and IRS requirements.

INFORMATION SYSTEMS AND INFORMATION SECURITY CONTROLS FOR

CONTRACTING ACTIONS SUBJECT TO IRS PUBLICATION 4812 REVISION 10-201

(Note: Publication 4812 is a layperson's guide to NIST SP 800-53, Rev. 5 when access to IRS information or information systems under contracts for services on behalf of the IRS is outside of IRS controlled facilities or the direct control of the Service as opposed to Internal Revenue Manual 10.8.1 - Information Technology (IT) Security, Policy and Guidance, which applies when contractors are accessing IRS information and information systems at Government controlled facilities.) In performance of this contract, the contractor agrees to comply with the following requirements and assumes responsibility for compliance by its employees and subcontractors (and their employees):

a) General. The contractor shall ensure IRS information and information systems (those of the IRS and/or the contractor, as appropriate) are always protected. In order to do so, the contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security controls, requirements, and objectives described in applicable security control guidelines, and their respective contracts.

b) The contractor shall be required to input data into a system, to be defined by the IRS, to describe the security controls being used to protect information.

c) Publication (PUB) 4812 Applicability. This contracting action is subject to

Publication 4812 – Contractor Security & Privacy Controls. PUB 4812 is available at: https://www.irs.gov/pub/irs-pdf/p4812.pdf

CONTRACTOR (AND SUBCONTRACTOR) SITE AND INFORMATION TECHNOLOGY

(SOFTWARE, HARDWARE AND DATA) LOCATION

The CSP/Contractor headquarters, infrastructure, servers (including back-up servers) and data must be physically located in the United States (or U.S. territories).

The infrastructure associated with services outsourced by the CSP/Contractor must located in the United States (or U.S. territories).

The current version and all subsequent versions of the software implemented by the CSP/Contractor must be escrowed in the United States (or U.S. territories) at the CSP’s expense to protect the code in the event the CSP declares bankruptcy.

Data stored outside the United States cannot be protected under the Privacy Act of 1974 or safe harbor framework and may allow for certain local or foreign law enforcement authorities to search IRS data pursuant to a court order, subpoena, or informal request outside the control of the IRS.

The Clarifying Lawful Overseas Use of Data ("CLOUD") Act enacted into law on March 23, 2018 provides that U.S. law-enforcement orders issued under the Stored Communications Act (SCA) may reach certain data located in other countries.

Recognizing the limits of existing law enforcement tools and privacy laws to govern requests for electronic evidence in the age of cloud computing, the CLOUD Act establishes processes and procedures for law enforcement requests for data in other countries.

Although the Act expands the geographic scope of the SCA, it does not change who is subject to SCA orders or what type of data is subject to U.S. law-enforcement requests under the SCA.

The CLOUD Act lays out the circumstances under which a "provider of electronic communication service or remote computing service" must comply with a U.S.

law-enforcement order to disclose data within its "possession, custody, or control," even when that data is "located … outside the United States."

ALTERNATE STORAGE

The CSP/Contractor shall establish an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information.

The alternate storage site shall be geographically separated within the United States (or U.S. territories) from the contractor site to enable recovery of operations. The alternate storage site is separated from the primary storage site so as not to be susceptible to the same hazards and identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. All backup data that contains SBU information shall be encrypted.

The alternate storage site shall provide information security safeguards equivalent to that of the primary site.

BACKUPS

Backups must be provided as part of the CSP service offering.

All backup data that contains SBU information shall be encrypted.

(1) The IRS or CSP/Contractor shall conduct backups for information contained in the information system at the following frequency:

• User-level: daily incremental; weekly full

• System-level: daily incremental; weekly full

• Information system configuration; daily incremental; weekly full

Not: The defined backup frequencies are above IRM 10.8.1 baseline and assigned by FedRAMP.

(2) The CSP/Contractor shall maintain:

• At least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of information system documentation including security.

information (at least one of which is available online) or provides an equivalent alternative.

Note: This requirement is defined by FedRAMP.

(3) The IRS or CSP/Contractor shall determine what elements of the cloud environment require the Information System Backup control.

Note: This requirement is defined by FedRAMP.

(4) The CSP/Contractor shall determine how Information System Backup is going to be verified and the appropriate periodicity of the check.

Note: This requirement is defined by FedRAMP.

(5) Backup copies of the operating system (i.e., deployed operating system with agency defined configurations and controls) and other critical information system software, as well as copies of the information system inventory (including hardware, software, and firmware components) shall be stored in a separate facility or in a fire-rated container that is not collocated with the operational system.

Note: This requirement is assigned to Moderate and High impact systems by FedRAMP.

DATA LOSS PREVENTION (DLP) SOFTWARE

The CSP/Contractor shall implement data loss prevention (DLP) software to assure existing software will operate effectively in the cloud.

The CSP/Contractor shall be responsible for all patching and vulnerability management (PVM) of software and other systems’ components supporting services provided under this agreement so as to prevent proactively the exploitation of IT vulnerabilities that may exist within the CSP/Contractor operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of NIST SP 800-40, as amended, with special emphasis on assuring that the vendor’s PVM systems and programs apply standardized configurations with automated continuous monitoring of the same to assess and mitigate risks associated with known and unknown IT vulnerabilities in the CSP/Contractor operating environment.

Furthermore, the CSP/Contractor shall apply standardized and automated acceptable versioning control systems that use a centralized model to capture, store, and authorize all software development control functions on a shared device that is accessible to all developers authorized to revise software supporting the services provided under this agreement. Such versioning control systems shall be configured and maintained to make sure all software products deployed in the CSP/Contractor operating environment and serving the IRS are compatible with existing systems and architecture of the IRS.

CONTINUOUS MONITORING BASELINE CONTRACT DELIVERABLES

Cloud Continuous Monitoring baseline contract deliverables are needed as applicable, such as, but not limited to:

• Weekly Security Status Report

• Monthly Security Status Report

• Continuous Monitoring Plan

• Security Configuration and Change Management Plan

• Security Patch Management Plan

• Security Incident Handling, Monitoring and Response Plan

• Information System Contingency Plan (ISCP)

• Security Concept of Operations (Security CONOPS)

• Access Management Plan (AMP)

• System Security Plan (SSP)

• Authorization Boundary Memorandum

• Interconnection Security Agreements (ISA)

• Security Control Assessment (SCA) Test Plan

• Security Assessment Report (SAR) Mitigation Plan

• Privacy/Civil Liberties Impact Assessment (PCLIA)

• State of Security (SoS) Package

• FISMA Compliance Reports including, but not limited to, inventory, inventory change log, security configuration compliance reports, personal security, and POA&Ms.

• Information Security Status Package

• Alternate Site Processing Environment (ASPE) Plan

• Executive Summary of Analytical Results and Recommendations

• Key Management Practices Statement

• Contractor Security Assessments (CSA) Test Plan

• Configuration Compliance Summary Report

• Security Incident Report

• Mitigation Report

• FSTAR Mitigation Plan

• Incident Response Test Report

USE OF OUTSOURCED / CONTRACTOR FACILITIES TO PROCESS IRS SBU DATA

The infrastructure associated with services outsourced by the CSP/contractor must located in the United States (or U.S. territories).

If IRS products/applications/data/services/solutions are hosted and/or managed by a CSP (outside the IRS network boundaries/facilities (e.g., outsourced)) then all such products/applications/data/services/solutions shall go through (and maintain) the Federal Risk and Authorization Management Program (FedRAMP) certification, and meet all of the IRS unique business/legal requirements (including applicable PUB 4812 requirements, etc.).

(Note: FedRAMP is mandatory for all IRS cloud deployments and cloud service models at the Federal Information Processing Standards (FIPS) 199 Low, Moderate and High impact levels. FedRAMP does not apply for internal housed IRS systems that are operated for IRS use only. This service model would be considered an On-Site-Private Cloud.)

Special contract language shall be included in all types of Cloud Service Provider (CSP) contracts/non-disclosure agreements/Service Level agreements to address all potential CSP risks (e.g., Data Governance, Data Protection, Data Location, Data Availability, Data Confidentiality, Data Integrity, Data Access, Data Backup, Data Encryption, Data Breach Notification, Contract

Exit Conditions, Contract Termination Conditions, Data Disposal, Data Retention, User/Device/Service AAA services (e.g., Authentication, Authorization, Audit Logging, Background Checks etc.). The Vendor shall pay special attention to the logical and physical separation of IRS data, applications, and communications to maintain security. Vendors are encouraged to manage any cloud environments containing IRS data with only other Federal or State and local Government customers operating at the same security level. The IRS shall control and maintain the centralized/authoritative control (in-house) of ALL the IRS authorized Users/Devices/Services Authentication, Authorization, and Auditing (AAA) functions, even if a particular IRS application/data/service/solution is hosted in a third-party cloud environment.

Outsourced operations shall report monthly for FISMA and Treasury submission. This includes all systems in the following environments: production, disaster recovery, training, development, and testing.

ENCRYPTION

(1) The IRS or CSP shall ensure that the information system implements FIPS-validated or National Security Agency (NSA)-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Note: This requirement is defined by FedRAMP. IRS sensitive data (e.g., Sensitive But

Unclassified (SBU), Personally Identifiable Information (PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation. The vendor shall provide a system that implements (encryption standard) that provides for origin authentication, data integrity, and signer non-repudiation.

Consider AU-11 audit Records retention.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

The CSP/Contractor shall ensure all SBU information is protected at rest, in transit, and in exchanges (i.e., internal and external communications). Limit access to SBU information to authorized personnel (those favorably adjudicated and trained) with a need to know and ensure internal and external exchanges are conducted only through secure or encrypted channels. The CSP/Contractor shall employ encryption concepts and approved standards to ensure the confidentiality, integrity, and availability of the SBU information, consistent with the security controls under Publication 4812 and any security requirements specified elsewhere in the contract.

Contractual liability to the government only exists with the prime contractor.

The CSP/contractor shall retain operational configuration and control of data repository systems used to process and store government data to include any or remote work. The CSP/contractor shall not subcontract the operational configuration and control of any government data.

IRS retains exclusive ownership over all its data; the CSP/Contractor acquires no rights or licenses through the agreement, including intellectual property rights or licenses, to use the IRS data for its own purposes; and that the CSP/Contractor does not acquire and may not claim any interest in the data due to security. If CSP/Contractor moves data, the IRS will not lose rights and access to conduct audits.

Intellectual property, including original works created using the cloud infrastructure, may be stored. IRS must ensure that the cloud provider contract respects the IRS’ right to any intellectual property or original works as far as possible without compromising the quality of service offered (e.g., backups may be a necessary part of offering a good service level).

CONTRACTOR SYSTEM REVIEW / SITE VISIT

In conjunction with the use of outsourced / Contractor facilities, the contractor shall be subject to at the option / discretion of the IRS, to periodically test and inspection (annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls, as indicated by the security plan, of every information system that maintain, collect, operate or use federal information on behalf of the agency.

The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

CONTRACTOR SYSTEM OVERSIGHT/COMPLIANCE

a) The Contractor, service providers, and third-party vendors must complete the IRS

Security – Assessments (IT Security Product Questionnaire) and submit the assessments to the Contracting Officer and Cybersecurity for review and evaluation.

This is a supplemental requirement and does not replace contract requirements under FISMA. The federal government has the authority to conduct site reviews for compliance validation. Full cooperation by Contractor and third-party providers is required for audits and forensics.

b) The Contractor must support IRS in its efforts to assess and monitor the Contractor systems and infrastructure. The Contractor must provide logical and physical access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases upon request. The Contractor shall be expected to perform automated scans and continuous monitoring activities which may include, but will not be limited to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases and provide the results of the scans to the IRS Cybersecurity, or designate, or allow IRS (or its designate) to run the scans directly.

c) All Contractor systems must participate in Information Security Continuous Monitoring (ISCM) and Reporting as defined in the IRS IT Policy.

d) All Contractor systems must perform vulnerability scanning as defined by IRS IT Security Policy and provide scanning reports to the IRS Cybersecurity, or designate, on a monthly basis.

e) All Contractor systems must participate in the implementation of automated security controls testing mechanisms and provide automated test results in Security Compliant Automation Protocol (SCAP) compliant data to the IRS Cybersecurity, or designate, on a monthly basis.

SAFEGUARDING / PROTECTING SENSITIVE PERSONALLY IDENTIFIABLE

INFORMATION (PII)

Sensitive PII is defined as any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, legal permanent resident, or employee or contractor to the Department. Sensitive PII is Personally Identifiable Information, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Information Systems can be either electronic or manual. IRM 10.8.1 requires IRS sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearance required; receive security awareness and specialized IT security training required for contractor activities or facilities; and any facility physical security requirements.

IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information

(PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

(1) The CSP/Contractor shall ensure that individuals accessing an information system processing, storing or transmitting information requiring special protection satisfy the personnel screening criteria.

Note: This requirement is defined by FedRAMP.

(2) The organization shall:

Screen individuals prior to authorizing access to the information system; and Rescreen individuals according to FedRAMP Assignments: for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low-risk positions.

The CSP/Contractor shall ensure that data is used, only as identified, in the IRS contract and that the data will be used for nothing else to ensure the privacy of the individual.

The CSP/Contractor is responsible for maintaining an inventory of all PII provided to the contractor, generated by the contractor, or used by the contractor sufficient to enable notification to taxpayers, if disclosed. The inventory of PII must be updated semi-annually with a final inventory notification provided to the COR.

Most IRS information is categorized as Sensitive But Unclassified (SBU). This includes:

(a) Federal Tax Information (FTI)

(b) Personally Identifiable Information (PII)

(c) Protected Health Information (PHI)

(d) Certain procurement information

(e) System vulnerabilities

(f) Case selection methodologies

(g) Systems information

(h) Enforcement procedures

(i) Investigation information

(j) Proprietary processes or algorithms used in investigative work or tax processing http://csrc.nist.gov/groups/STM/cmvp/validation.html

Note: Live data, which is defined as production data in use (production, testing, development), often contains SBU.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Modernization Act (FISMA), the EGovernment Act of 2014, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information.

CONTRACTOR RIGHTS TO ACCESS DATA

Access Control requirements shall be implemented as defined within Internal Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security, Policy and Guidance and Publication 4812.

1) The CSP/Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order issued hereunder. If authorized by the terms of this contract or a task order issued hereunder, any access to, or use, or disclosure of Government data shall only be for purposes specified in this contract or task order. CSP/Contractor shall ensure that each of its employees and representatives, and any others (e.g., subcontractor employees) performing duties hereunder, shall, prior to obtaining access to any Government data, sign a contract or task order specific nondisclosure agreement.

2) The CSP/Contractor shall use Government-related data only to manage the operational environment that supports the government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

CSP/Contractor shall:

a. Be subject to background investigations at the risk level appropriate to the sensitivity of the position and sensitivity/classification of the data.

b. Not access sensitive IT systems until they have at least a favorably adjudicated National Agency Check (a component of the full background investigation).

c. Be responsible for protecting any Personally Identifiable Information (PII) that they have in their possession, whether it is paper-based or in electronic form.

d. Understand the provisions and applicable criminal penalties under Public Law 105- 35, Taxpayer Browsing Protection Act, shall also apply to all contractors and contractor employees.

e. Comply with all executive, legislative and Department of Treasury and IRS security policies.

f. Minimize the threat of viruses by write-protecting removable media, routinely scanning files, systems, and media for viruses and never circumventing anti-virus safeguards.

A breach of the obligations or restrictions may subject the CSP/Contractor to criminal, civil, administrative, and contractual actions in law and equity for penalties, damages, and any other appropriate remedies by any party adversely affected by the breach.

HANDLING INFORMATION SECURITY INCIDENTS

The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

Contractors and their employees must be aware of their responsibilities under the law to safeguard PII and sensitive information, the procedures to follow when data is lost or compromised and the penalties for unauthorized disclosure of PII and sensitive information.

Contractors should refer to Data Breach Information for IRS Contractors on irs.gov https://portal.ds.irsnet.gov/sites/vl003/RelatedResources/Doc13347-2020-01- Data%20Breach%20Response%20Playbook.pdf#search=contractors%20data%20breach Pub 4465-A, Protecting Federal Tax Information for Contractors, and Pub 4812, Contractor Security Controls, for information about a contractor’s responsibilities to protect Federal Tax Information (FTI) and incident/data breach response and reporting procedures.

It is critical to report an incident/data breach as soon as actionable information is available so a response/reaction can be initiated. Incident/data breach updates and any additional notifications to Treasury Inspector General for Tax Administration (TIGTA) and/or Local Law Enforcement can be completed after the initial report to the Office of Taxpayer Correspondence (OTC), Privacy, Governmental Liaison and Disclosure/Incident Management Office (PGLD/IM), or the Computer Security Incident Response Center (CSIRC) is submitted. All physical security incidents and/or threats should be reported to the SAMC within 30 minutes of incident discovery. SAMC operates 365 days a year, 24 hours a day, seven days a week. Incidents may be reported to the SAMC through any of the following methods:

Primary Method of Reporting: Website incident reporting link, https://tscc.enterprise.irs.gov/irc/

Alternate Reporting Methods:

Telephone: 202-317- 6124 or 1-866-216-4809 (toll free hotline) Fax: 202-317-6129 Email: samc@irs.gov

The CSP/Contractor shall report security incident information according to U.S. Computer https://tscc.enterprise.irs.gov/irc/ mailto:samc@irs.gov

Emergency Response, Department of Treasury, IRS, and the FedRAMP Incident Communications procedures.

All incidents related to IRS processing, information or information systems shall be reported within one (1) hour to the CO, COR, and CSIRC. Contact the CSIRC through any of the following methods:

CSIRC Contacts: Telephone: 240.613.3606 E-mail to csirc@irs.gov.

The CSP/Contractor shall be accountable for incident responsiveness, including providing specific time frames for restoration of secure services in the event of an incident.

The CSP/Contractor shall provide and maintain insurance, to include cybersecurity insurance, throughout the performance of this contract, as specified in the Schedule or elsewhere in the contract.

Before commencing performance under this contract, the CSP/Contractor shall provide proof of insurance to the Agency. The CSP/Contractor shall resubmit the proof of insurance within 30 days of notification of any material change that occurs during the performance of the contract.

The CSP/Contractor shall insert the substance of this clause, including this paragraph (c), in subcontracts under this contract that require work with or in support of storage and retrieval of electronic/digital government data and shall require subcontractors to provide and maintain the insurance required in the Schedule or elsewhere in the contract. The CSP shall maintain a copy of all subcontractors’ proofs of required insurance and shall make copies available to the Contracting Officer upon request.

CONTRACTOR BOUNDARY PROTECTION

The CSP/Contractor shall ensure IRS data is not comingled with the data from other organizations.

The CSP/Contractor shall implement boundary protection mechanisms at servers, workstations, and mobile devices.

The CSP/Contractor shall isolate the information system from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

The CSP/Contractor shall define key information security tools, mechanisms, and support components associated with system and security administration and isolate those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnetworks.

Note: These requirements are above the IRM 10.8.1 baseline and are assigned to Moderate-impact systems by FedRAMP mailto:csirc@irs.gov

CLOUD SERVICE PROVIDER’S INFORMATION OUTPUT HANDLING AND RETENTION

The CSP/Contractor…