Performance Work Statement PWS 4-21-26-0001.pdf

PERFORMANCE WORK STATEMENT (PWS)

SAFEGUARDS IT COMPUTER SECURITY SUPPORT

1.0 OVERVIEW

1.1 INTRODUCTION AND BACKGROUND

The Office of Safeguards (Safeguards) within Governmental Liaison, Disclosure and Safeguards (GLDS) function of Privacy, Governmental Liaison and Disclosure (PGLD) is responsible for ensuring that Federal Tax Information (FTI) provided outside of the IRS is secured and used appropriately. Safeguards assess approximately 300 federal, state and local agencies, as well as their authorized contractors receiving FTI under various sub-sections of Internal Revenue Code (IRC) §6103 and other IRC provisions. Agencies must implement appropriate safeguards to protect confidentiality and prevent unauthorized access or use of FTI. Safeguards works in partnership with the recipient agencies to identify and mitigate risks to FTI. The specific safeguard requirements are outlined in IRC §6103(p)(4) and detailed in Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies.

Publication 1075 is primarily based upon National Institute of Standards & Technology (NIST) Special Publication (SP) 800-53, Assessing Security and Privacy Controls for Information Systems and Organizations for moderate risk systems, IRC §6103 statutory requirements and IRS policy and procedure. All automated information systems and networks which receive, process, store, transmit, or protect FTI must meet these information protection requirements.

Current Contract Number 2032H5-23-F-00312 Incumbent: Sky Solutions, LLC.

Approximate contract value: $15,864,000.00

2.0 OBJECTIVE

The objective of this requirement is to increase security of FTI and to ensure consistent application of information security standards across all partner agency information systems.

3.0 REQUIREMENT TASKS

The mission of Safeguards is to promote taxpayer confidence in the integrity of the tax system by ensuring the confidentiality of IRS information provided to federal, state, and local agencies.

Safeguards verifies compliance with IRC §6103(p)(4) safeguard requirements through the identification and mitigation of any risk of loss, breach, or misuse of FTI held by external government agencies.

The Contractor shall provide cybersecurity and information technology (IT) expertise. The Contractor shall optimize its processes, to reduce costs and minimize risk to FTI in possession of agency partners, while continuing to meet all regulatory and agency documented standards and guidance; and obtain information technology expertise and ancillary support to enable Safeguards to meet on-going and new regulatory objectives having an impact on the Safeguards Program.

The Contractor shall collaborate with IRS leadership, staff, and other contractors in support of agency computer security reviews. Support shall include the following: conducting preparatory agency outreach; conducting pre-review research and analysis to determine scope and potential areas of concern; executing automated and manual computer security compliance scans of partner agency systems during the review; preparing reports, documenting scan results and other https://irc.bloombergtax.com/public/uscode/doc/irc/section_6103 https://irc.bloombergtax.com/public/uscode/doc/irc/section_6103 https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.irs.gov/pub/irs-pdf/p1075.pdf https://csrc.nist.gov/pubs/sp/800/53/a/r5/final https://csrc.nist.gov/pubs/sp/800/53/a/r5/final computer security findings; and analyzing and responding to various partner agency computer security information submissions. Other computer security review-related support includes stakeholder outreach, risk-based modeling for agency review selection, computer security review methodology updates, and general IT expertise. The Contractor shall provide ad hoc support for the assessment of other projects, pilots, and new legislation that include provisions falling within the purview of Safeguards.

In accordance with Executive Order (EO) 14179, the contractor is permitted to use Artificial Intelligence (AI) to assist in this task.

The Contractor shall adhere to IRS Publication 1075 (Tax Information Security Guidelines for Federal, State, and Local Agencies), Federal Security Modernization Act (FISMA), Privacy Act of 1974, Internal Revenue Code §6103, NIST Risk Management Framework and IRS Safeguards Program requirements when utilizing artificial intelligence tools to enhance technical support capabilities assisting in the management and updates of Safeguards Computer Security Evaluation Matrices (SCSEM’s) and associated automated evaluation files.

Contractors shall not process, store, or have access to FTI, PII, SSI, Classified or controlled unclassified information and any agency specific confidential data.

The Contractor shall utilize only publicly available information from approved sources including IRS Publication 1075, NIST Special Publications and Standards, IRS Safeguard Program public website materials, Federal regulations and guidance documents and publicly available industry best practice standards to include Center for Internet Security (CIS) Benchmarks and Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIG). All queries submitted must contain no FTI or PII; referenced only publicly available information, comply with informational handling classifications and be reviewed for compliance prior to submission.

3.1 TASK 1- ORIENTATION BRIEFING

The contractor shall facilitate an orientation briefing via a video conference call (Microsoft (MS) Teams, Zoom, etc.) with its representatives, ensuring all parties have a common understanding of the task order tasks and requirements. The contractor shall bring, at a minimum, its key personnel to this meeting.

3.2 TASK 2, RAMP-UP KNOWLEDGE TRANSFER/TRANSITION-IN

3.2.1 RAMP-UP KNOWLEDGE

Ramp-Up Knowledge Transfer is defined as the contractor acquiring and understanding the necessary documentation, information, and processes related to any work in progress. The Government anticipates this task will be performed in conjunction with the Transition-In activities after the award of this task order.

The contractor shall appoint a knowledge transfer manager serving as key personnel to oversee all areas of information that are accounted for and all knowledge of information is transferred from the current incumbent. This can be the Project Manager (PM) or other approved key personnel.

https://csrc.nist.gov/pubs/sp/800/37/r2/final https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/nessus-audit-files https://www.irs.gov/privacy-disclosure/safeguards-program https://www.irs.gov/privacy-disclosure/safeguards-program https://www.cyber.mil/stigs

Prior to the transfer of knowledge, the contractor shall develop a final Knowledge Transfer Plan (KTP). The final KTP shall identify the contractor resources and roles involved in the transfer process, provide a list of risks and mitigation strategies for the transfer, and contain a detailed resource balanced project schedule developed with Microsoft Project or compatible equivalent.

The project schedule shall identify tasks, dependencies, deliverables, and milestones. The project schedule shall be at a sufficient level of detail to track progress on a bi-weekly basis.

The contractor shall meet with the IRS bi-weekly (twice a month) to discuss the progress of the knowledge transfer. The contractor shall show an updated MS Project Schedule or compatible equivalent and discuss any risks or concerns at this time.

In addition to the Ramp-Up activities in the approved KTP, the contractor shall perform the following activities during the Ramp Up:

• Assign personnel and submit security background packages within 10 calendar days to ensure background investigations are completed efficiently and gain access to IRS’s network.

• Create a project schedule at a sufficient level of detail to track progress on a weekly basis.

• Request access within 2 business days to tools and documentation (based on successful adjudication of background clearance of contractor personnel)

• Review and understand all the technical and process documentation.

• Review and understand the case management system.

• Knowledge Transfer/Transition-In Status Reports, for the duration of the transition-in period only, shall detail status of activities identified in the final KTP.

Note: Completed background requests shall be sent to IRS COR/Alternate COR via encrypted electronic file. Any incomplete packages will be rejected for re-submission within 2 workdays.

The contractor shall provide a KTP and a MS project or compatible equivalent schedule that is accepted by the Government and successfully completes knowledge transfer in accordance with the plan with a total transition-in project schedule not to exceed one hundred twenty (120) calendar days after Government acceptance of the KTP. In addition, the Contractor shall provide complete and accurate status reports for the KTP.

3.2.2 TRANSITION- IN

The Transition-In task permits an effective transition from the incumbent Contractor to the new Contractor. The Government estimates this task will take approximately 120 calendar days to complete from date of award of the task order. Successful transition can be defined by its capacity to maintain full continuity of operations. To ensure a successful, low-risk transition, the contractor shall follow the approved Transition-In Plan and keep the government fully informed of status throughout the transition-in period. During the transition-in period, the incumbent is responsible for performance. This Task would be worked concurrently with Task 2, Ramp-Up Knowledge Transfer.

In addition to the transition activities in the approved KTP, the contractor shall ensure the following activities have been successfully completed within 75 days of the transition-in period to ensure timely commencement of services after the 120-Day Transition-In period:

1. Obtain final access to tools and documentation

2. Comprehend and successfully perform all the technical and process documentation.

3. Comprehend and successfully apply the existing data and system security policies in place.

The Transition-in Checklist provides a vehicle to verify completion of the necessary transition-in activities. The Transition-in Checklist shall be developed by the Contractor and shall include all necessary activities to ensure an effective transition from the incumbent Contractor to a new Contractor that were performed. The Transition-in Checklist shall be signed by both, the Contractor and the COR after completion of the task.

3.3 TASK 3, TASK MANAGEMENT

3.3.1 General Requirements

The Contractor shall provide personnel, including an equivalent contractor Subject Matter Expert (SME), to perform the requirements set forth herein.

3.3.2 Monthly Status Report (MSR) Call

The Contractor shall facilitate a Monthly Status Report (MSR) Call that includes presentation materials, such as a slide deck and supporting documentation, outlining expenditures, billings, progress, status, and any problems or issues encountered during task performance. The MSR shall include financial projections and an overview of support provided during the previous invoice period, including a list of all deliverables accepted and those in progress. All MSR materials and activities are subject to review and acceptance by the Contracting Officer’s Representative (COR) and the Technical Point of Contact (TPOC).

3.3.3 Task Order Program Management Plan (PMP)

The Contractor shall develop, implement, and maintain a Task Order Program Management Plan (PMP), subject to Government review and approval, manage, track, and evaluate performance throughout the period of performance. The PMP shall include control policies and procedures consistent with standard industry practices for project administration, execution, and tracking.

The PMP may consist of multiple components, including, a project plan and performance status dashboards. The PMP shall include a consolidated roll-up of performance data for all active subtasks and shall be structured to support reuse for MSR Calls and other reporting requirements.

The Contractor shall maintain the PMP in accordance with agreed-upon project management best practices. The PMP is subject to review and acceptance by the COR and TPOC.

3.3.4 Administrative Touchpoint

The Contractor shall attend and facilitate a weekly Administrative Touchpoint meeting, not to exceed one (1) hour in duration, as scheduled by the COR. The purpose of this meeting shall be to address onboarding activities, Government Furnished Equipment (GFE), and other administrative matters. The Contractor shall prepare, update, and present a performance status dashboard that identifies completed deliverables, timeliness of performance, and any deliverables returned due to deficient quality. These meetings and associated materials are subject to review by the COR and

TPOC.

3.3.5 Annual Planning Meeting

The Contractor shall schedule, coordinate, and facilitate an Annual Planning Meeting with the COR, and the TPOC to discuss planned activities for the upcoming option year. The Contractor shall prepare and submit meeting materials to the COR for review and approval in advance of the meeting.

3.4 TASK 4, COMPUTER SECURITY REVIEWS

The Contractor shall work with external partner agency stakeholders to execute system configuration checks, interview system users (e.g., administrators), and to examine system artifacts (including policies and procedures) against management, operational and technical requirements, Center for Internet Security (CIS )Benchmarks, NIST requirements, and current IRS standards (e.g., IRS Publication 1075, IRC §6103). The scope of the assessment (“review”) will include all hardware and software associated with the processing, storing, or exchange of FTI including mainframes, operating system, telecom devices, applications, multi-function devices, firewalls, servers, cloud infrastructure, and databases. The contractor shall use the Safeguards Computer Security Evaluation Matrices (SCSEMs) and automated evaluation files as a guide to perform Computer Security Reviews on local, state or federal agencies, and their authorized contractors, that receive FTI under IRC §6103.

Completion of computer security reviews resulted in the Safeguard review report (SRR) being issued to the external partner agency. The SRR consists of Sections A through H. Sections A through G are completed by the IRS staff and Section H dealing with information technology is completed by the contractor. The SRR serves to identify an agency’s compliance with their statutory obligations under IRC 6103(p)(4) and provide guidance to the agency to improve their security posture and meet the safeguarding standards described in Publication 1075. Please refer to the Computer Security Safeguards Review Report Standard Operating Procedure (see attachment 4) for additional information for required services.

The government shall provide an annual review schedule to cover each period of performance that lists the reviews contractor shall support (see Attachment 4-1 for a sample annual review schedule). Reviews are conducted in a remote or hybrid format. During these types of review formats the IT portion of the review are conducted remotely via Microsoft Teams or other approved tools during the first week of the review period and the physical portion of the review is conducted by the government the following week at the agency’s site(s) where FTI is received, processed, stored, transmitted, disposed of, and protected. During hybrid or remote assessments, conference calls and IRS-provided collaboration tools for screen sharing will be used to conduct the review. Additionally, in limited instances and at the government’s discretion a full on-site review (both IT and physical portions) at the agency’s site(s) may be utilized in lieu of hybrid or https://www.cisecurity.org/cis-benchmarks https://csrc.nist.gov/publications/sp https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/nessus-audit-files remote review model. The IRS will provide notification lat least 30 days in advance to the contractor of any reviews to be conducted on-site at the partner agency’s location.

Note: In addition to regularly scheduled reviews, at least one agency per quarter will be selected for an out of cycle review that may require contractor support.

The contractor shall provide the following support services:

3.4.1 Pre-review outreach email: Email or otherwise transmit the Preliminary Security Evaluation (PSE) Template and supporting documentation to each agency to notify them of the upcoming review and gather initial data.

3.4.2 PSE Document Upload: Upload the agency-completed PSE documentation—including the completed PSE form, electronic data flow diagram, and any supporting materials such as FTI system listings and addendums.

3.4.3 PSE Call Scheduling: Schedule a pre-review conference call with each agency to validate reported information in the PSE Template that defines FTI scope.

3.4.4 PSE Call: Conduct the pre-review conference call to validate agency-reported information and confirm FTI scope; upload all resulting data flow documentation (notes, updated diagrams, etc.) to the Safeguards case management system.

3.4.5 Post-PSE Email: Provide the Scope Table, SCSEMs, Nessus information, and preparation materials to each agency.

3.4.6 Mini-PSE Calls: Conduct follow-up calls as needed to address additional issues identified during the PSE call.

3.4.7 Nessus/IT Schedule Prep Call: Schedule and complete calls with the agency to review the IT review schedule and walk through the Nessus package and any configuration adjustments.

3.4.8 Scope Memo: Document all in-scope technologies—including versions, support status, shared systems, responsible entities, applicable checklists, estimated effort, and a narrative of the FTI system interactions

3.4.9 Final Review Schedule: Provide recommended IT staffing and a finalized schedule covering all technologies in the Scope Memo while minimizing conflicts.

3.4.10 Agency Prep Document: Provide agency characteristics, identified issues or concerns, and the IT scope of the agency’s FTI environment.

3.4.11 Final Prep Call: Participate in a conference call with Safeguards personnel to finalize review preparations.

3.4.12 Touchbase Meeting: Report on the status of the IT review at the conclusion of the review week, including concerns and logistics.

3.4.13 Opening Conference: Attend the opening conference with agency personnel, present the data flow, and review the Scope Memo.

3.4.14 Conduct Review: Provide IT system testing support in accordance with the Scope Memo or as directed by the Review Chief.

3.4.15 Status Updates: Provide daily written summary updates for each agency—including assessment status, completed and outstanding work, personnel assignments, potential critical findings, scope changes, and concerns.

3.4.16 SCSEMs and Nessus Scan Results: Document and upload results of system configuration checks, interviews, and artifact reviews against applicable standards (CIS, NIST, IRS Publication 1075, IRC §6103), including both automated and manual testing, in accordance with the approved final review schedule.

3.4.17 Preliminary Findings Report (PFR): Prepare and deliver a summary of computer security findings covering all technologies in scope to the Disclosure Enforcement Specialist

(DES).

3.4.18 Closing Conference: Present computer security findings during the closing conference while the DES presents physical security findings.

3.4.19 Technology Matrix: Submit a matrix identifying all reviewed technologies, associated CAP/SRR numbers, and recommended remediation timelines, covering all scoped technologies.

3.4.20 After Action Report (AAR): Develop and deliver a report summarizing review insights, lessons learned, and recommendations for process improvement to IRS stakeholders.

3.4.21 Safeguard Review Reports (SRR): Prepare and upload the complete Section H package—including all required documents such as SRR narratives, corrective action plans (CAP)/ Plans of Action and Milestones (POA&M), SCSEMs, scan results, updated Scope Memo, and supporting materials. Please see Task 5, Evaluate Agency Submissions for more information on the CAP and the POA&M.

3.5 TASK 5, EVALUATE AGENCY SUBMISSIONS

Safeguards require periodic self-reporting information submissions and information requests from partner agencies. These agency submissions include CAPs, Safeguard security reports (SSR), notifications (N), and technical inquiries (TI).

CAPs are utilized by external partner agencies to respond to the Safeguard Review Report (SRR) findings. CAPs should detail the actions taken or planned to be taken with a planned or actual implementation date, which addresses each finding. An agency must submit a CAP update semi-annually based on Publication 1075 specified due dates until all findings are accepted and closed by the Office of Safeguards

SSRs describe the procedures established and used by the agency for ensuring the confidentiality of the information received from the Internal Revenue Service. They are filed by external partner https://www.irs.gov/irm/part11/irm_11-003-036#idm139858495505184 agencies at least 90 days prior to the agency’s planned date for receipt of FTI. The agency must update and submit the SSR annually to encompass any changes that impact the protection of FTI.

TIs are used by external partner agencies to request assistance in interpretations of Publication 1075 and other routine Safeguards matters. TIs received by Office of Safeguards staff are responded to via email or conference call depending on complexity of the inquiry.

Notifications are required from external partner agencies to provide advanced notification (45 days) prior to implementing certain operations or capabilities that require additional uses of the FTI. These implementations include cloud computing, contractor access, re-disclosure by contractor to sub-contractor, tax modeling and test environment.

To evaluate and respond to agency submissions the Contractor shall utilize only publicly available information from approved sources including IRS Publication 1075, NIST Special Publications and Standards, IRS Safeguard Program public website materials, Federal regulations and guidance documents and publicly available industry best practice standards. All queries submitted must contain no FTI or Personal Identifiable Information (PII); referenced only publicly available information, comply with informational handling classifications and be reviewed for compliance prior to submission.

Contractors shall not process, store, or have access to FTI, PII, Sensitive Security Information (SSI), Classified or controlled unclassified information and any agency specific confidential data.

3.5.1 Corrective Action Plan (CAP) Response

The Contractor shall review the computer security portions of up to 450 Corrective Action Plans (CAPs), also referred to as Plans of Action and Milestones (POA&Ms), annually and provide a written response. The review shall include evaluation of supporting evidence, such as screenshots, audit logs, and policy documents, for findings identified as significant or critical risk.

The Contractor’s response shall clearly identify whether each finding is open or closed and shall include recommended follow-on actions necessary to achieve closure, as well as address any questions or statements provided in agency responses. The Contractor may utilize automated tools, including Microsoft Office macros (Visual Basic for Applications (VBA)), to support the review process.

3.5.2 Technical Inquiry (TI) Response

The Contractor shall provide information technology (IT) and cybersecurity guidance for up to 350 agency-submitted Technical Inquiries (TIs) annually. Responses shall be provided in written format and may include follow-up conference calls with agency representatives, as needed, in accordance with Government-provided Standard Operating Procedures. Examples of TIs include, clarification of agency methodologies for complying with Publication 1075 cybersecurity requirements, multifactor authentication (MFA) implementation, and configuration requirements for cloud-based information systems.

3.5.3 Safeguards Security Report (SSR) Review

The Contractor shall review the physical and computer security components of Safeguards Security Reports (SSRs), also referred to as system security plans, for up to 300 agencies annually. The review shall include assessment of agency responses against applicable security controls (e.g., NIST controls) and clear identification of compliance status, along with articulation of applicable IRS requirements. The Contractor may conduct conference calls with agencies, as necessary, to resolve issues and obtain clarification or additional documentation. Agencies shall be provided a minimum of three (3) business days to respond to requests for additional information. All correspondence and documentation shall be uploaded into the Safeguards case management system. The Contractor may utilize automated tools, including Microsoft Office VBA macros, to support the review process.

3.5.4 Notification Response

The Contractor shall provide IT and cybersecurity guidance in response to up to 125 agency-submitted Notifications annually, in accordance with Publication 1075 requirements. Responses shall be provided in written format and may include follow-up conference calls with agency representatives, as needed. All correspondence and documentation shall be uploaded into the Safeguards case management system prior to submission for Government review.

3.6 TASK 6, DEVELOP AND UPDATE SAFEGUARDS METHODOLOGY

The Methodology Plan will drive the identification, definition, level of effort and deadlines of all other deliverables under this task.

The Contractor shall develop, maintain, and update a Methodology Plan that defines all deliverables under this subtask, including associated timelines and levels of effort. The Methodology Plan shall identify sources of security information (e.g., Secure Technical Implementation Guides (STIGs), Center for Internet Security (CIS) Benchmarks, and vendor configuration guides) and required updates to align with applicable Federal guidelines, directives, and standards, including but not limited to OMB Circular A-130, NIST Special Publications (e.g., SP 800-53, 800-30, 800-63), IRS Publication 1075, and the Internal Revenue Manual.

The Methodology Plan shall include, at a minimum: identification of new Safeguards Computer Security Evaluation Matrices (SCSEMs) to be developed and justification; rationale for updates;

planned delivery dates; actual acceptance dates; re-baselined dates; prioritization of SCSEMs based on technology prevalence and risk; identification of technologies approaching end of support; and recommendations for retirement of SCSEMs. The Plan shall also identify Contractor and Government points of contact for each initiative and demonstrate how the Contractor will ensure recommendations reflect current, state-of-the-art practices.

The Methodology Plan shall support change management and include artifacts such as a risk register, dependency tracking, mitigation strategies, a change control log, and stakeholder identification. A summary of information relevant to contract surveillance and performance management shall be incorporated into the Program Management Plan (PMP).

The Contractor shall support the efficient management of Safeguards methodology updates planning to allow for timely roll-out of updates and effective change control and risk management, while identifying opportunities to decrease costs, increase stakeholder customer service, and protect FTI. In accordance with Executive Order (EO) 14179, the contractor is permitted to use Artificial Intelligence (AI) to assist in this task.

https://csrc.nist.gov/publications/sp800

The Contractor shall adhere to IRS Publication 1075 (Tax Information Security Guidelines for Federal, State, and Local Agencies), Federal Security Modernization Act (FISMA), Privacy Act of 1974, Internal Revenue Code §6103, NIST Risk Management Framework and IRS Safeguards Program requirements when utilizing artificial intelligence tools to enhance technical support capabilities assisting in the management and updates of Safeguards Computer Security Evaluation Matrices (SCSEM’s) and associated automated evaluation files.

Contractors shall not process, store, or have access to FTI, PII, SSI, Classified or controlled unclassified information and any agency specific confidential data.

The Contractor shall utilize only publicly available information from approved sources including IRS Publication 1075, NIST Special Publications and Standards, IRS Safeguard Program public website materials, Federal regulations and guidance documents and publicly available industry best practice standards to include Center for Internet Security (CIS) Benchmarks and Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIG). All queries submitted must contain no FTI or PII; referenced only publicly available information, comply with informational handling classifications and be reviewed for compliance prior to submission.

The Contractor shall support effective implementation of Safeguards methodology updates per the Methodology Plan. The contractor shall provide the following support:

3.6.1 Methodology Quarterly Meeting Solicitation E-mail

The Contractor shall distribute a solicitation email to all Methodology Quarterly Meeting attendees to request methodology improvement topics for discussion.

3.6.2 Methodology Quarterly Meeting Dashboards

The Contractor shall develop and maintain dashboard(s) for presentation during the Methodology Quarterly Meeting. The dashboard(s) shall incorporate information from the Methodology Plan and highlight current and ongoing work under this subtask. At a minimum, the dashboard(s) shall include planned deliverable dates, actual acceptance dates, re-baselined dates (as applicable), and the status of each methodology file (e.g., Contractor updating, Government reviewing, published). The Government may require the use of an IRS-designated SharePoint or case management system for dashboard development and maintenance.

3.6.3 Methodology Quarterly Meeting Agenda

The Contractor shall develop and submit an initial draft agenda for each Quarterly Methodology Meeting. The draft agenda shall include Government-provided topics, recommendations obtained through the solicitation process, and Contractor-recommended methodology improvements.

3.6.4 Quarterly Methodology Meeting

The Contractor shall schedule, coordinate, and facilitate Quarterly Methodology Meetings in accordance with the approved Methodology Plan.

3.6.6 Methodology Change Implementation

The Contractor shall support implementation of the Government-approved Methodology Plan.

Implementation activities may include, updating SCSEMs and associated publications, developing and delivering training materials, establishing and maintaining document repositories, https://csrc.nist.gov/pubs/sp/800/37/r2/final https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/nessus-audit-files https://www.irs.gov/privacy-disclosure/safeguards-program https://www.irs.gov/privacy-disclosure/safeguards-program and creating templates. Implementation shall be performed in accordance with priorities and direction established in the approved Methodology Plan.

3.6.7 Safeguards Computer Security Evaluation Matrices (SCSEMs) and Automated Evaluation Files

The Contractor shall develop, update, and deliver SCSEMs and associated automated evaluation files (e.g., Nessus audit files or SCAP files) as complete, standalone packages on a semiannual basis (no later than March 31 and September 30). Each delivery shall include all current SCSEMs and associated files, regardless of whether updates were made.

All SCSEMs shall conform to Government-provided templates and be delivered in Microsoft Excel (.xlsx) format, including required data fields and embedded formulas to track completion status and compliance scoring. The Contractor shall ensure proper alignment with IRS Publication 1075, accurate mapping to NIST controls, correct issue code assignment, and traceability of test case changes.

Automated evaluation files shall be delivered in.nessus audit or SCAP (.xml XCCDF) format and include configuration instructions. The Contractor shall ensure alignment between SCSEMs and automated files, including mapping to applicable benchmarks or control identifiers. The Contractor shall validate that automated checks accurately reflect required configurations and properly evaluate both binary and non-binary conditions.

The Contractor shall update and maintain all associated documentation and configuration instructions and perform corrective actions as necessary to address identified issues. Ad hoc updates may be required if critical issues are identified, including logic errors in automated evaluation files. Portions of this process may be automated to improve efficiency.

3.7 TASK 7, SUPPORT RISK-BASED REVIEW SELECTION PROCESS

The Contractor shall build enhancements and provide risk model maintenance support to optimize Safeguards risk-based review selection process by providing expertise to recognize areas of risk model improvement and to plan and implement risk model maintenance and developments.

The contractor shall provide the following support:

3.7.1 Quarterly Risk Team Meeting

The Contractor shall schedule, coordinate, and facilitate a Quarterly Risk Team Meeting to review and update the Risk Support Work Plan. Meetings shall occur in the last month of each quarter—September, December, March, and June—for planning activities for the succeeding quarter. The Contractor shall ensure meeting materials are prepared and distributed in advance to all participants, and shall document meeting discussions, decisions, and action items.

3.7.2 Risk Support Work Plan

The Contractor shall develop, maintain, and update the Risk Support Work Plan. The purpose of this document is to identify, define, and provide deliverable deadlines for all tasks under the Support Risk-Based Selection Process Task. The Risk Support Work Plan shall be a living document and shall be adjusted based on discussions and decisions made during the Quarterly Risk Team Meetings.

3.7.3 Data Field Maintenance

The Contractor shall maintain and operate data fields, code, or scripts used to analyze Review Finding data and its relationship to Risk Model outputs and Health Score calculations. The contractor shall ensure the accuracy and integrity of the data used for risk analysis.

3.7.4 Macro Updates

The Contractor shall revise and maintain formulas and macros that provide weighted evaluations of various risk factors, as indicated by subsets of data fields. These updates shall ensure proper calculation and functionality to support the Risk Model and Health Score outputs.

3.7.5 Data Aggregation and Evaluation

The Contractor shall perform data aggregation to identify the most “at risk” agency partners. This task shall include manual validation of automated data to ensure accuracy of the “at risk” ranking.

3.7.6 Risk Dashboard

The Contractor shall develop and maintain a Risk Dashboard to identify, track, and communicate agency findings, risk levels, rankings, remediation status, and overall historical trends. The Risk Dashboard shall provide clear visualizations and summaries to support decision-making by the Risk Team.

Note: Personnel assigned to this workstream may be required to work with scripts in VBA, Python 3, R Suite, and Tableau.

3.8 TASK 8, TRANSITION OUT

At the end of this order, the contractor shall provide transition-out services. The Contractor shall facilitate the transition of contracted activities and services to the Cybersecurity Program personnel and to a follow-on Contractor in accordance with the Government Approved Transition-Out Plan. The transition period shall not exceed ninety (90) calendar days.

The Contractor shall:

1. Minimize transition impact to the user community.

2. Ensure no breaks in service availability.

3. Maintain existing service quality and performance levels.

4. Ensure a transparent and seamless transition.

5. Maintain support and meet delivery milestones of ongoing projects.

6. Ensure that the IT security posture during transition is maintained at current levels without creating gaps and/or vulnerabilities.

In support of this task, the Contractor shall be responsible for completing the following deliverables:

3.8.1 Transition-Out Plan

The Contractor shall develop, document, and provide a Transition-Out Plan. The Transition-Out Plan shall be updated annually throughout the period of performance.

The purpose of the Transition-Out Plan is to facilitate a seamless transfer of work from the incumbent Contractor(s) to the incoming Contractor(s) and Cybersecurity personnel. The Plan shall identify all transition activities, schedules, and milestones for turnover of work, including operations, maintenance, engineering, training, asset management, and logistics functions. The Contractor shall also detail coordination processes with the incoming Contractor(s) and Cybersecurity personnel to ensure effective knowledge transfer and continuity of operations.

The Transition-Out Plan shall be submitted for review and acceptance by the Contracting Officer’s Representative (COR) and the Technical Point of Contact (TPOC).

3.9 TASK 9, SURGE SUPPORT (OPTION CLIN)

The Government may require surge support during the base or any option period, on an “as needed” basis, when applicable. Surge Support services will be issued in writing via modification and will be within scope of the Task Order. It will provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed $150,000/year, Computer Security Reviews.

3.10 SKILL REQUIREMENTS

The contractor shall possess the knowledge and expertise in the following:

-Knowledge to address the Confidentiality and Integrity of information systems based on a Federal Information Processing Standard (FIPS) level of Moderate and High;

- Assessment or operation of mainframe technology such as (IBM Resource Access Control Facility (RACF), Access Control Facility 2 (ACF2), -Assessment or operation of workstation and server operating systems such as Windows, Linux, UNIX, Sun Solaris, MacOS;

- Assessment or operation virtual operating systems such as VMWare, Hyper V, Docker, OpenShift, and Kubernetes;- Cloud computing technologies and service offerings in the FedRAMP marketplace to include: Amazon AWS, Microsoft Azure and 365, Salesforce, Google, and other Cloud Service Provider (CSP) platforms.

-Cloud Service Models (CSM) including Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Anything as a Service (XaaS);

- Assessment or operation of telecommunication and networking devices, such as firewalls, routers, switches virtual private networks (VPN), wireless, voice over Internet protocol (VoIP), and network storage (e.g.,Storage Area Network (SAN), Network- Attached Storage (NAS));

-Encryption technology implementation and standards including, but not limited to Virtual Private Network, Transport Layer Security, Secure Sockets Layer (SSL) and FIPS encryption requirements.

The contractor shall have the required skills to:

- Apply guidelines of Presidential Executive Orders, OMB Circular A-130, Treasury Directive Policy 85-01, National Institute of Standards & Technology (NIST) Special Publication (SP) 800-53 Security and Privacy Controls for Information Systems and Organizations and NIST SP 800-30 Guide for Conducting Risk Assessments, Federal https://csrc.nist.gov/publications/fips

Information Processing Standards (FIPS), Center for Internet Security (CIS) Benchmarks and/or DISA’s Security Technical Implementation Guidelines (STIG).

-Provide expertise in customer education and outreach regarding cybersecurity requirements and incident response.

-Provide expertise in assessing, identifying, and addressing technical cybersecurity risk using the NIST Risk Management Framework.

-Utilize Microsoft Office products to develop reports, VBA macros, and ensure the integrity of templates.

4.0 QUALITY ASSURANCE SURVEILANCE PLAN (QASP)

Please see Attachment 3 for further information

5.0 GOVERNMENT-FURNISHED PROPERTY (GFP)

GFP (to include material and equipment) may be provided in the performance of this Task Order.

The following estimated GFP will be provided to the contractor:

ITEMS

Contractor Identification Badge Laptop Computer with Local Area Network Access Office Space (Desk, Chair, Standard Office Equipment) Laptop Computer for Nessus scans

6.0 GOVERNMENT-FURNISHED INFORMATION (GFI)

GFI (to include manuals, notes, memos, instruction materials and other information) may be provided in the performance of this task order. The following GFI will be provided to the contractor upon Task Order award:

Description of Government

Furnished Information

Safeguards Standard Operating Procedures Reporting Templates eCase Case Management System IRM (Official Use Only) SharePoint Manuals, notes, memos, instruction materials

The Contractor shall return all Government information, property, equipment and data used in conjunction with the performance of the order to the COR. The GFI/GFP, whether furnished by the Government to the Contractor or acquired by the Contractor with Government funding, shall be delivered/transmitted within 30 days of completion of this task order.

7.0 TRAVEL & OTHER DIRECT COSTS (ODC)

Travel and ODCs may be required under this task order for reviews and local travel may be required for on-site meetings. Travel and materials will be reimbursed at cost. Inclusion of indirect burden amounts or fee/profit on material costs, including travel expenses, is not allowable. For any trip to be authorized, the Contractor shall submit the dates of travel, location, and breakdown of costs associated with travel for approval to include airfare, lodging, rental car, taxi/mileage and any other costs or actions, in writing, to the COR/Alternate COR which must be approved prior to commencement of any travel.

The number of trips and types of personnel traveling shall be limited to the minimum required to accomplish work requirements. The Contractor shall provide a travel voucher statement for all travel. The voucher will ensure verification of costs incurred for travel under the task order is both allowable and reasonable. The Contractor shall attach the voucher and receipts to the monthly invoice.

Below you will find the not to exceed amounts for this order

8.0 ACCESS TO GOVERNMENT PROPERTY AND FACILITIES

The Contractor is allowed limited access to the government's facilities, as specified below:

(Specific IRS offices and complete addresses will be provided at time of award/during Orientation Briefing)

• Access to IRS facilities, located in, and including the DC commuting area;

• Access to printer, copy machine, fax machine and scanner;

• Access to external federal, state, and local government facilities in conjunction with the required reviews.

9.0 INSPECTION AND ACCEPTANCE

Unless otherwise stated in the Deliverable Table (Attachment 2), the government has 15 workdays to review deliverables, Contractor has 10 workdays to perform

Base Period Opt Yr 01 Opt Yr 02 Opt Yr 03 Opt Yr 04

$100,000.00 $50,000.00 $50,000.00 $50,000.00 $50,000.00 revisions, government has 10 workdays to approve the final version. Deliverables will be invoiced upon completion once agreed by the COR and TPOC. After acknowledgement and acceptance of deliverable(s) the Contractor’s invoice can be submitted to IPP.

The Contractor shall ensure that all deliverables are clearly marked with the task order number and visible on all shipping/service documents, containers, and invoices.

Inspection will be at the same place as performance and delivery, unless otherwise specified. The Contractor shall provide the deliverables and receive acceptance/approval from the Government prior to invoicing for services performed.

10.0 DELIVERIES OR PERFORMANCE

10.1 TASK ORDER PERIOD OF PERFORMANCE

The estimated period of performance for this Task Order shall be from the date of the Task Order award to the acceptance of the last Deliverable within the dates below:

Base Period: 10/01/2026-09/30/2027 Option Year 1: 10/01/2027-09/30/2028 Option Year 2: 10/01/2028-09/30/2029 Option Year 3: 10/01/2029-09/30/2030 Option Year 4: 10/01/2030-09/30/2031

10.2 PLACE OF PERFORMANCE

This requirement will be primarily worked at the Contractors facilities.

10.3 DELIVERABLES

Unless otherwise requested in writing by the COR, work products shall be produced using Microsoft Office 2016 or later Professional products and delivered in accordance with the deliverable schedule at Attachment 2. If it is required that deliverable(s) be submitted in media storage form all devices must be scanned and certified as virus free.

10.4 DELIVERY SCHEDULE

The work products and schedules required for this Task Order are listed in Attachment 2.

11.0 TASK ORDER ADMINISTRATION DATA

COR: To be Provided at Award TPOC: To be Provided at Award

12.0 SPECIAL TASK ORDER REQUIREMENTS

12.1 KEY PERSONNEL

Key Personnel (MAY 2018) The key personnel cited below are considered essential to the work being performed under this contract. If these individuals leave the Contractor's employ or are reassigned to other programs, the Contractor shall notify the Contracting Officer reasonably in advance and shall submit justification (including proposed substitutions) in enough detail to permit evaluation of the impact on the program. No diversion or replacement shall be made by the Contractor without the written consent of the Contracting Officer.

Key Personnel Title

Information Technology Project Manager (Senior Level) Labor ID #283

Computer & Information Systems Manager (SME Level) Labor ID #124

Computer & Information Systems Manager (Senior Level) Labor ID #123

The Contractor shall provide individuals to fill the key personnel positions identified below:

Senior Information Technology Project Manager STARS III LCAT#3/level 283 (Senior) Minimum Education: Bachelor level degree or higher in an Information Technology related discipline from an accredited college or university. Master level degree preferred.

Core Experience: Demonstrated experience with IT management related to, either, managing IT projects or managing IT related security assessments across multiple platforms.

IT Certification(s)/Licenses: A minimum of one of the following; Certified Authorization Professional (lCAP) ,Certified Network Defender ( CND), CompTIA Cloud+ (Cloud+), GIAC Security Leadership Certification (GSLC), CompTIA Security+ Continuing Education (Security+ CE), HealthCare Information Security and Privacy Practitioner (HCISPP), CompTIA Advanced Security Practitioner Continuing Education (CASP+ CE), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP (or Associate)), Certified Chief Information Security Officer (CCISO),Project Management Professional (PMP)

Senior Program Manager STARS III LCAT ID #3/Level 124 (SME) Minimum Education: Bachelors level degree or higher in any technical, business, or management discipline from an accredited college or university.

Core Experience: Demonstrated experience in a supervisory or management capacity with responsibilities for management of subordinates and personnel issues and direction, in addition to relevant experience with responsibility for financial management, tracking and fiscal oversight of program funding. Demonstrated experience in program management related to cybersecurity government work. Working knowledge of the IRS organizations, including their infrastructure, responsibilities, programs, and initiatives is preferred.

IT Certification(s)/License(s): A minimum of one of the following; CAP, CND, Cloud+, GSLC, Security+ CE, HCISPP, CASP+ CE, CISM, CISSP (or Associate), CCISO

Computer & Information Systems Manager (Information Systems Manager equivalency) STARS III LCAT ID #3/Level 123 (SENIOR) Minimum Education: High School Diploma or higher.

Core Experience: Demonstrated experience with federal government cybersecurity audits and assessments including implementing security controls, configuration changes, software/hardware updates, and vulnerability management. Demonstrated experience in IT/cybersecurity project and personnel management.

IT Certification(s)/License(s): A minimum of one of the following; CASP+ CE, Cisco Certified Network Security (CCNP Security), Certified Information System Auditor (CISA)), CISSP (or Associate), GIAC Certified Enterprise Defender (GCED), GIAC Certified Incident Handler (GCIH), Certified Cloud Security Professional (CCSP), CISM, GSLC, CCISO, HCISPP ,Certified Ethical Hacker (CEH), CompTIA Cybersecurity Analyst (CySA+/CSA+), GIAC Systems and Network Auditor (GSNA), CyberSec First Responder (CFR), CompTIA PenTest+ (PenTest+). In lieu of a certification, graduation from minimum of a 2 year IT/Cybersecurity program at an accredited college or university may be substituted.

All proposed Key Personnel shall submit a resume and a Letter of Commitment for this requirement.

Non-Key Personnel Labor Categories

The following labor categories are non-key personnel but are anticipated to be utilized during performance of this…