Synthetic Businesses Pilot (QA)_Final.pdf

Synthetic Businesses Pilot Q&A Question: Answer:

Is there any incumbent/recompete or this is a brand-new project?

If yes, could you please provide us with their award number or even if the customer bought similar services in the past.

This is a brand-new project for the IRS.

We would like to know if this is a brand new contract OR if there is (was) an incumbent performing these services.

If not brand new, could you please provide the current / previous contract number?

This is a brand-new requirement to the IRS.

The SOW states that BPL will provide the contractor with business and personal data on potentially fabricated entities, including EIN, name, address, bank account information, SSN, and DOB. Please confirm whether this Government-furnished data constitutes Federal Tax Information (FTI) subject to IRS Publication 1075 safeguarding, or Sensitive But Unclassified (SBU)/PII under other requirements, so offerors can accurately scope the applicable security, handling, and facility controls.

Yes, Government-furnished data constitutes Federal Tax Information (FTI) subject to IRS Publication 1075 safeguarding, or Sensitive But Unclassified (SBU)/PII under other requirements.

Please confirm the NIST SP 800-53 Moderate baseline and Authority to Operate (ATO) requirements. (a) Is a completed ATO required prior to award, prior to performance start, or achievable during a defined post-award onboarding period? (b) May the contractor's solution be hosted in a FedRAMP Moderate– authorized cloud environment, or is an IRS-hosted or on-premises solution required? (c) What is the anticipated assessment-and-authorization timeline and level of Government support?

a) No, a completed ATO is not required.

b) Yes, the Contractor’s solution can be hosted in a FedRAMP Moderate-authorized cloud environment. It is not the Government’s expectation that the contractor’s solution be hosted on an IRS-hosted solution.

c)There is anticipated timeline

Given this total small-business set-aside, please confirm that a small-business prime may obtain the commercial enrichment datasets from a data-provider subcontractor, and how the Government applies the limitation on subcontracting (FAR 52.219-

14) — specifically, whether commercially licensed data is treated as materials/other direct costs (excluded from the services self-performance calculation) versus a subcontracted service.

A small-business prime may use subcontractors or data providers, but the prime remains responsible for performance and compliance with FAR 52.219-14.

The SOW references verification/scoring for "up to 500,000 entities annually," plus a surge CLIN for an additional 500,000.

Please confirm whether the base 500,000 is a guaranteed minimum or an estimated ceiling, how the firm-fixed price should accommodate actual volumes below or above the estimate, and the definition of a single billable "search"/"entity."

Yes, the base period is guaranteed to be 500,000. The program will work closely with the vendor to track the entity information provided. If there is a potential of exceeding the 500,000, the program shall work with Procurement exercise the surge CLIN option before the vendor provides any data beyond the 500,000 level.

The SOW requires secure multi-factor remote access for IRS administrators to manage the system. Please confirm the expected delivery/integration model — e.g., a contractor-hosted platform with IRS administrator access, API integration to IRS systems, and/or batch dataset delivery — and the expected return-data format and cadence for Sub-tasks 4.1 (Datasets) and 4.2 (Verification, Scoring and Analytics).

IRS administrators will not be accessing the vendor’s system.

The expected delivery/integration model would involve the contractor providing a batch dataset via a secure data transfer.

This requirement is posted on SAM.gov as a Combined Synopsis/Solicitation, is set aside 100 percent for small business under FAR 19.5, and states that the Government anticipates awarding a Firm Fixed Price Purchase Order using the procedures at FAR 12.6. The solicitation does not reference the GSA Multiple Award Schedule, a Special Item Number, or any other contract vehicle. Please confirm that this is an open-market acquisition, Confirmed. This is an open-market small business set-aside;

a GSA MAS contract or SIN is not required.

and that quotes are neither required to be submitted through, nor required to be supported by, a GSA MAS contract or any particular

SIN.

The assigned NAICS code is 561450, Credit Bureaus, with a $41.0M size standard. The Statement of Work describes the provision of third-party datasets, verification, fraud scoring, and trend analytics for business entity fabrication. Will the Government consider adding a secondary NAICS code that more closely reflects the data and analytics character of the requirement, for example 541519, Other Computer Related Services? If the Government does not add a secondary code, please confirm that an offeror that qualifies as small under the 561450 size standard remains eligible for award where 561450 is not currently listed among the NAICS codes in its SAM entity registration.

The Government has determined that NAICS 561450 is the appropriate NAICS code for this acquisition and does not intend to add a secondary NAICS code. Offerors are responsible for ensuring their SAM registration is current and accurately reflects their business information prior to award.

FAR 52.219-14 is incorporated by reference, and Attachment 2 requires an authorized company officer to certify monthly that the small business prime and its similarly situated subcontractors collectively performed at least 51 percent of the total contract cost for personnel. The requirement as described is principally the delivery of licensed third-party datasets and a proprietary fraud scoring product rather than labor, and the data provider may not qualify as a similarly situated entity under NAICS 561450. Please confirm (a) how the Government will apply the 51 percent limitation to this requirement, (b) whether the cost of a data subscription or data license is treated as a cost for personnel for purposes of the certification, and (c) whether the Government will consider the acquisition to be for supplies rather than services for purposes of FAR 52.219-14, given that the Schedule prices a Research Product by the each

The Government is not looking for data licenses. It is the expectation that the vendor will perform analysis and provide the datasets. Government personnel would not be accessing a fraud scoring product. The vendor will also be meeting with the Government to refine the data. This is not a stand-alone data license or subscription. It is a services/data-analysis requirement, and FAR 52.219-14 applies as stated in the solicitation.

The Information System and Information Security Control Standards and Guidelines Applicability provision requires the offeror to assert by signing its offer which security control guideline applies - IRM 10.8.1, Publication 4812, or both - and, where Publication 4812 applies, whether the Software Application Development or Maintenance (SOFT) or Networked Information Technology Infrastructure (NET) control level is most suitable. For a contractor that receives Government-provided data at its own facility, processes it entirely within its own commercial environment, and returns datasets and reports to the Government, with no access to the IRS network and no IRS-hosted application, please state the Government's expectation as to the applicable guideline and, if Publication 4812, the applicable control level.

Offerors should assume both IRM 10.8.1 and Publication 4812 may apply. NET is the expected Publication 4812 control level, subject to IRS Cybersecurity review.

The FISMA Cybersecurity Requirements language at pages 23 through 30 includes requirements that appear to presume a contractor-operated system integrated with IRS infrastructure, including integration with BEARS for entitlements, PUMAS for privileged access, ESAT for audit logging, and the IRS authentication solution at Identity Assurance Level 2, together with FedRAMP, an Authority to Operate, and a full security authorization package including a System Security Plan, Information System Contingency Plan, Business Impact Analysis evidencing a 12-hour Maximum Tolerable Downtime, Interconnection Security Agreement, Security Risk Assessment, Data Impact Assessment, Audit Plan, Source Code Review and Security Control Assessment. Please confirm which of these requirements apply to a contractor performing entirely within its

While FedRAMP authorization and Authority to Operate are not conditions of award, there is an expectation that a roadmap be created to get these established during pilot.

own environment with no IRS system interconnection, and whether a FedRAMP authorization or an Authority to Operate is a condition of award or a post-award milestone.

Factor D states that past performance will be evaluated based upon past performance information contained in CPARS. Please confirm whether offerors may submit past performance references for the Government's consideration, including references for contracts that do not have a CPARS record, and whether the past performance of a proposed subcontractor or data provider will be evaluated where that entity performs the substantive data and analytics work.

Yes. Offerors may submit relevant past performance references, including work not in CPARS; relevant subcontractor past performance may be considered.

Attachment 1, Initial Staffing Plan, is identified as a proposal deliverable and requires a completed and certified table for the base period and each option period, listing for each line the employer company, labor category, labor type, employee last and first name, employee unique identifier, estimated level of effort in hours or FTEs, work location, work email address, work phone number and complete work address with zip code. Where the solution is delivered as a data and analytics subscription rather than as staffed labor, please confirm how offerors should complete Attachment 1, and whether a description of the subscription delivery model in place of named personnel is acceptable.

Yes. Attachment 1 remains required and should be completed to the extent known with proposed roles/personnel and updated as needed.

The solicitation does not state a required proposal format, volume structure, page limit, font, type size or line spacing. Please confirm whether the Government has a preferred format or page limit for the response to Factors A through E, and whether a price submission separate from the technical response is required.

The Government is amending the solicitation to establish a maximum 20-page limit for the technical proposal response.

The 20-page limit applies to the offeror’s narrative response addressing the non-price evaluation factors. Price information, completed solicitation provisions/clauses, representations and certifications, required attachments, EULAs, and other administrative documents are excluded from the 20-page limit unless otherwise stated in the amendment. Offerors are responsible for submitting a clear and complete response that addresses all solicitation requirements and evaluation factors.

CLIN 5001, Surge, is priced for the period 9/30/2026 through 9/29/2031 at a quantity of 1 EA for 500,000 estimated entity searches, while Factor E states that the evaluated total price is the 12-month base period and the four 12-month option periods.

Please confirm (a) whether the surge CLIN is included in the total evaluated price, (b) whether the 500,000 surge searches are a total across the full five-year span or an annual quantity available in each period, and (c) whether the Government expects the surge searches to be priced at the same unit rate as the base and option period CLINs.

CLIN 5001 is one surge pool of up to 500,000 additional searches for the full period of performance and requires Contracting Officer authorization before use.

Example: If 100,000 additional above 500,000 is needed during option period one, the rate for option period one shall be used. And there will only be 400,000 remaining to be used for the remainder of the task order.

The Schedule prices each period as quantity 1 EA for 500,000 estimated searches. Please confirm whether the Government intends a firm fixed price for the annual capacity regardless of the number of searches actually performed, or a per-search unit price invoiced against actual usage, and in either case how the Government will treat annual volumes materially below the 500,000 estimate.

The annual CLIN is firm fixed price for capacity up to 500,000 entities. Payment is fixed when lower volume results from the Government providing fewer entities.

Example: the total base or option year ceiling will be paid even if only 450,000 searches are performed as long as the shortage is the result of the Government sending less than 500,000 for the period.

Sub-task 4.1 states that BPL will provide the contractor with business data including Employer Identification Number, business name, address and bank account information, and personal data including Social Security Number, address, date of birth and bank

File format, submission cadence, and volume per submission will be determined after award through discussion between the vendor and the Government. A secure data transfer can be used to exchange the data.

account information. Please describe the anticipated file format, the transmission method, the submission cadence, and the volume per submission, and confirm the mechanism the Government will approve for transmitting this data to the contractor.

the SOW identifies datasets, an entity fabrication verification report including scoring and backup information, and analytics as deliverables, but states no required turnaround time and provides no deliverable schedule. Factor A evaluates whether the approach accomplishes the work 'within the timeline specified by either performance periods or documented in a deliverable schedule.' Please provide the required response times for each deliverable, or confirm that offerors are to propose them and will be evaluated on what they propose.

Offerors should propose deliverable schedules and turnaround times; the Government will evaluate the proposed approach.

Sub-task 4.2 states that the contractor's verification process 'shall run in parallel to the provision of data sets by the contractor as described in sub-task 4.2.1,' and refers to 'the analysis and identification described in sub-task 4.2.1.' The Statement of Work contains no sub-task 4.2.1; the provision of datasets is described in Sub-task 4.1. Please confirm that both references should read Sub-task 4.1

Confirmed. The reference to Sub-task 4.2.1 was an error and should refer to Sub-task 4.1.

Is any portion of this requirement performed by an incumbent contractor today? If so, please identify the incumbent and the current contract number. If the requirement is new, please confirm that no transition-in period is contemplated and that full performance is expected to begin on 9/30/2026.

This is a new requirement. No incumbent transition period is contemplated.

The Section 508 Accessibility of Information and Communication Technology provision applies Chapter 5 Software, Chapter 7 Referenced Standards and the Chapter 3 Functional Performance Criteria at 100 percent compliance. Please confirm whether the Government requires an Accessibility Conformance Report for a contractor-hosted analytics interface, and whether deliverables furnished as data files and written reports, rather than through a user interface, fall within the scope of the Chapter 5 software standards.

No response.

SF 1449 Block 14 is marked Request for Proposal. The General Information section describes the document as a Request for Proposal, the Special Instructions refer to quotes and to the RFP, the Combined Synopsis invites a response to the RFQ, and the Government states it will award a Purchase Order under FAR

12.6. Please confirm whether offerors are submitting quotations under FAR Part 13 procedures or proposals constituting offers under FAR Part 15, and whether the Government intends the submission to be an offer capable of acceptance without further action by the offeror.

The Government confirms this is a commercial services RFQ conducted under FAR Part 12 in conjunction with FAR Part 13 simplified acquisition procedures, not a FAR Part 15 negotiated procurement. Vendors are submitting quotations, not proposals constituting binding offers under FAR Part 15.

Any references to “RFP,” “proposal,” or “offeror” are administrative and do not change the intended procurement method.

The Combined Synopsis states that responses are due no later than 4:00 PM EST on August 31, 2026, while SAM.gov states 4:00 PM EDT and the RFP states 4PM ET. August 31, 2026 falls within Eastern Daylight Time. Please confirm that the deadline is 4:00 PM Eastern Daylight Time

The deadline has been extended to 4:00 PM Eastern Time on September 1, 2026, That date falls during Eastern Daylight Time.

Please confirm whether data provided to the contractor under this contract, or produced by the contractor from it, constitutes Federal Tax Information subject to Internal Revenue Code section 6103 and IRS Publication 1075, in addition to the Publication 4812 requirements stated in the solicitation.

It will be subject to IRC section 6103 and IRS Publication

Nonmanufacturer rule. None No Response Is an Accessibility Conformance Report (ACR/VPAT) required to be submitted with the proposal for any information and communication technology furnished under this contract, or may it be provided after award?

After award.

Will the Government provide a data dictionary of the fields BPL will supply, and a sample or synthetic referral file, so that offerors can accurately size entity resolution and matching effort? C.4 indicates BPL may provide business data (EIN, business name, address, bank account information) and personal data (SSN, address, DOB, bank account information) but does not indicate which fields are consistently populated.

No

The solicitation identifies estimates for 500,000 entities, but the IRS will also be sending personal information. Is there an estimate for the total number of personnel for whom the IRS will be sending data, or is there an average number of personnel per entity?

This is not known yet. It will be discussed/negotiated with the vendor after award.

Subtask 4.1 states "Below is a list of the possible data sets the contractor shall provide". To clarify any ambiguity between "possible" and "shall", is the government stating that datasets shall be provided, and in the below list are examples but not explicitly required datasets (i.e. possible data sets)?

The following datasets are crucial elements. We recognize that it will be difficult for any one firm to have access to all of these, let alone both this and the other set below, however the first list below is the most important. Vendors should indicate in their proposal which datasets they have access to and alternatives when that is necessary.

• Ownership data: Data on who owns or is associated with the business.

• Business Address data: Any changes to the business address throughout its history.

• Business Profile data: Name, address, phone number, email or IP address. Any changes to the previously mentioned profile characteristics.

• Bank History information: Bank account associated with the business. The name individual or individuals on that bank account. Determination of active bank account activity.

Identification of abnormalities.

• Employment History and Documentation: W2 data or any information return related information such as 1099 series forms. This part would be Individual and Business data.

• Individual data: Relevant information on individuals associated with the business. Criminal history.

For following datasets we are willing to consider alternative information options, but the vendor must be able to demonstrate how those alternatives will be of equal or greater value as means of determining whether a firm is potentially fabricated.

• Historical data: When a business was formed. How long it has been in operation. Any gaps in operation history.

• Secretary of State data: If they are registered with the Secretary of State. Which state. Articles of incorporation or organization for the business and are they still active with them.

• State tax information: State tax filing and payment status.

Workforce data to verify employees. State benefits claims.

• Any other business filing information that could be helpful, possibly the SEC or court documents.

• Federal Loan information: The existence and status of FEMA and/or SBA loans.

• Online Presence information: Business website and other forms of online presence.

• Recruitment information: Recruitment efforts information such as business post actions or intent to hire employees on any recruiting sites.

For the dataset deliverables in 4.1, is the government asking for data on the 500,000 entities supplied by the government or for a broader dataset of all businesses?

Data on the 500,000 entities supplied by the Government.

For the deliverables in 4.2, is it also a requirement or preference to score the identities associated with the business for their risk of being synthetic or fabricated since the IRS is sending personal information as well?

This can be done but it is not required, however the provision of this additional verification will be looked upon favorably.

Sub-task 4.2. Verification, Scoring and Analytics: Are there any specific requirements around analytics related data format etc?

This will be determined after award through dialogue between the vendor and Government.

How many IRS RICS users will need access to the vendor solution?

The Government does not expect its staff to access the vendor’s solution. This is not a requirement for a subscription service. It is the Government’s expectation that the vendor will provide the Government with the datasets and reports.

How will the vendor solution be triggered to perform a lookup?

Does the Government require the lookup to be automated, embedded into a pre-existing batch process (e.g. return processing program)? Or is it envisioned as a standalone system which can be triggered by employees themselves (either one at a time or in bulk upload)?

The Government will provide data which will trigger the lookup. The cadence of this delivery and the timeline for the vendor’s provision of the datasets and analytics shall be agreed upon between the vendor and the Government.

Batch sizes: What is the anticipated size and frequency of the entity information batches BPL will transmit to the contractor (e.g., number of entities per batch, and how often batches will be sent)?

This will be determined through dialogue after award between the Government and the contractor.

Turnaround time / SLA: Once BPL provides the initial entity information, what turnaround time is expected for the contractor to return the enriched datasets, verification determination, and risk score for each batch or entity? Is there a required service level agreement (e.g., number of business days) that offerors should design their technical approach and pricing around?

This will be determined through dialogue after award between the Government and the contractor.

How will RICS leverage the output entity fabrication verification reports? Will the outcomes be manually input into another Government system, or will the vendor be required to build an automated interface to another system?

The Government will manually input the data into another Government system. The vendor will not be required to build an automated interface.

Delivery mechanism / output format: SOW Sub-task 4.2 identifies the entity fabrication verification report (including scoring and backup information) and Analytics as deliverables, but does not specify the format or delivery mechanism for these outputs. Does the Government expect these deliverables to be provided as structured data via an API or system-to-system integration, as static reports/files (e.g., PDF, CSV) delivered through a secure file transfer, or some combination of both? Additionally, is there an existing IRS system or repository into which these outputs are expected to be ingested, or will BPL personnel review and act on them independently of any other system?

The Government expects this data to be provided via secure data transfer.

CLIN 0001 (and the option CLINs) are structured as a single firm-fixed-price lot for an “estimated” 500,000 entity searches. Can the Government confirm whether payment will be the fixed lot price regardless of actual search volume performed, and separately, Yes, the payment will be a fixed lot price regardless of actual search volume as long as the reason the search volume is below 500,000 because the Government has provided data whether IRS anticipates utilization at or near 500,000 searches annually, or a materially lower volume (e.g., 100, 1,000, 10,000)?

on less than 500,000 entities for any give period (base or option).

Throughput: Beyond the stated annual volume of up to 500,000 entities (with a Surge CLIN for up to an additional 500,000), can the Government indicate the expected rate at which entities will be provided to the contractor (e.g., evenly distributed across the year, delivered in periodic batches, or provided as a single annual volume)?

The Government will provide data periodically

Are any page limits, font size restrictions, or specific volume structures (e.g., separating Technical, Past Performance, and Price volumes) required for the proposal submission?

The Government is amending the solicitation to establish a maximum 20-page limit for the technical proposal response.

The 20-page limit applies to the offeror’s narrative response addressing the non-price evaluation factors. Price information, completed solicitation provisions/clauses, representations and certifications, required attachments, EULAs, and other administrative documents are excluded from the 20-page limit unless otherwise stated in the amendment. Offerors are responsible for submitting a clear and complete response that addresses all solicitation requirements and evaluation factors.

Are there any restrictions on using non-U.S. citizens (e.g., green card holders or visa workers) on the project?

This contract will require contract personnel to have at least a moderate risk security clearance level.

• Contractor personnel designated as high risk must be a US citizen.

• Contractor personnel designated as moderate risk must be a US citizen or Lawful Permanent Resident (LPR), with a minimum of three years of US residency as an LPR, and no break of US residency of a year or more.

Would the IRS be willing to accept proposals and quotes under small business NAICS 541519

No. The assigned NAICS remains 561450.

Processing Method: Does IRS anticipate that entity searches and analyses will be submitted and returned through batch processing, real-time API transactions, or both? If batch processing is anticipated, please provide the expected submission frequency and required turnaround time.

Searches and analysis will be submitted and returned through a batch process. The frequency and turnaround shall be negotiated with the Government after award.

Will every business entity submitted have a single corresponding individual associated with the entity or can there be multiple individuals? How will these individuals be related to the business (Owner, Representative, etc)

This may vary depending on the information available to the Government. These individuals will likely be owners.

What is the IRS/BPL existing scoring scale, risk-tier definitions, or threshold values (e.g., 0-100, low/medium/high) that the contractor's analysis must align to, or may the contractor propose its own scoring methodology in the technical proposal?

The contractor can propose its own scoring methodology in their technical proposal.

What is the expected or required turnaround time (SLA) between BPL's submission of potential entity fabrication information and the contractor's return of the verification/scoring determination, and does this vary for the base 500,000-entity volume versus surge volume?

This will be determined through dialogue between the Government and the awardee. The volume of entity information that the Government provides to the contractor may vary throughout a given year.

The reporting expected annually or will there be additional adhoc reporting on the results for the ~500K entities?

Reporting shall be performed as a part of the verification process. If the vendor identifies significant trends, the Government would like to be made aware as soon as possible.

Does the Government anticipate requiring real-time adjudication of entities, batch processing, or a combination of both?

The Government does not expect instant batch processing.

The Government expects the time needed for adjudication and batch processing to be reduced as the project evolves.

Can the Government provide an expected format for the "Entity Fabrication Verification Report" deliverable and associated analytics outputs?

This is not available currently. No response.

Will the Government provide labeled historical cases or outcomes to support calibration and validation of fraud-scoring methodologies?

This can be discussed post-award.

Can the Government provide an estimated distribution of annual volumes versus potential surge volumes and any expected processing timelines?

This information is not available at this time. It will be worked out after award.

What service-level expectations, if any, apply to the completion of entity verification, scoring, and analytics activities?

No Response.

Will entity submissions be provided individually, in bulk files, or through another transmission method?

In bulk

Under Factor C (Third-Party/Proprietary Data Sources), is the Government primarily evaluating breadth of data coverage, uniqueness of data sources, analytical methodology, or the combined effectiveness of those elements?

Combined effectiveness of those elements.

Regarding the requirement to identify all data centers in which the data resides: Can the Government clarify its data residency and jurisdiction requirements, including whether all contractor and subcontractor data storage, processing, and matching activities— including any activity performed by teaming partners—must occur within the continental United States, and what standards or conditions would apply to that data throughout the period of performance?

Yes, all contractor and subcontractor data storage, processing, and matching activities—including any activity performed by teaming partners—must occur within the continental United States

Does the IRS have a budget requested or approved? Yes What is the budgeted value of this contract? No Response The solicitation includes multiple security and infrastructure requirements. Can the Government provide additional guidance regarding which requirements are mandatory for all proposed solutions and which apply only when contractor-hosted systems, cloud environments, or Government data processing environments are utilized under this effort?

IRC 6103 and IRS Publication 4812

The solicitation references an anticipated volume of approximately 500,000 searches, with the potential for an additional 500,000.

Can the Government clarify the expected distribution of these searches between domestic (U.S.-based) entities and international ("rest of world") entities? Specifically, will the searches be limited to domestic entities, or should offerors anticipate that a portion of the total search volume will involve non-U.S. entities—and if so, can the Government provide an approximate proportion or count to inform data provisioning and pricing?

Searches will be limited to domestic entities.

Will the IRS grant a quote deadline extension to September 9, 2026? We would like to ensure our quote is in alignment with the additional information provided during the Q&A period and this additional time will be beneficial in facilitating this.

The deadline has been extended to 4:00 PM Eastern Time on September 1, 2026, That date falls during Eastern Daylight Time.

The current RFQ is issued as a Total Small Business Set-Aside under NAICS 561450 and requires the small business to deliver

The Government does not intend to reissue this requirement through NASA SEWP at this time.

51% of the work. Given the highly specialized nature of the data requirements, would the Government consider adjusting its small business approach from project delivery and reporting to procuring this requirement through the NASA SEWP contract vehicle as a Small Business Set-Aside? Doing so may help the Government save on labor/delivery costs, while maintaining the Government's small business participation objectives and providing access to mature commercial solutions that support the requirements of this pilot effort Please confirm whether the instructions for Attachment 2 – Monthly Workforce Report of the RFQ Solicitation document (page

22) indicate that the small business and/or any other small business as a subcontractor must perform 51% of the work. If so, would the IRS consider expanding to small businesses that have analytics NAICS codes of 541512, 518210, 541990, or others?

Attachment 2 requires monthly workforce reporting/certification. The Government does not intend to expand the acquisition to other NAICS codes at this time.

Please clarify the Government’s intended operating model for this requirement. Should offerors propose a contractor-hosted analytics/service model, the deployment of a contractor platform within an IRS environment, or another model?

This shall involve a contractor-hosted analytics/service model. The vendor shall ingest Federal information and perform analysis within their own system.

What is the expected cadence and turnaround time for processing up to 500,000 entities annually? Should offerors assume a batch processing workflow?

The cadence shall be worked out between the Government and the contractor after award.

Our understanding of the SOW is that the IRS expects the offeror to perform verification, fraud scoring, analysis of potential synthetic businesses, and the identification of fraud. Does the IRS prefer this labor be on-site, remote, or hybrid?

The IRS would prefer for the vendor to perform these services at the vendor’s facility. The contractor’s staff shall not work at a Government location. If their staff work remotely, there will need to be the necessary controls in place to safeguard government data when working remotely.

There will also need to be telework agreements in place.

Is there a page limit to the response, or other formatting guidelines?

The Government is amending the solicitation to establish a maximum 20-page limit for the technical proposal response.

The 20-page limit applies to the offeror’s narrative response addressing the non-price evaluation factors. Price information, completed solicitation provisions/clauses, representations and certifications, required attachments, EULAs, and other administrative documents are excluded from the 20-page limit unless otherwise stated in the amendment. Offerors are responsible for submitting a clear and complete response that addresses all solicitation requirements and evaluation factors.

Is there an incumbent contractor currently performing these services, or is this a new requirement for the IRS? If an incumbent exists, could the government please provide the contract/order number and incumbent vendor name?

This is a new requirement.

Approximately how many analysts will be accessing the application? In what offices do they work?

This requirement does not involve Federal staff accessing a contractor’s application. The vendor shall intake the data provided by the Government and perform their analysis.

The Government is not procuring licenses to a fraud scoring tool for its staff to access.

Which does the Government expect: (a) a contractor-hosted application accessed by IRS users; (b) bulk data delivered into an IRS environment, or (c) contractor-performed analysis with report delivery?

The Government expects contractor-performed analysis with report/dataset delivery.

Sub-task 4.1 states "Below is a list of the possible data sets the contractor shall provide." Are all thirteen categories mandatory, or is the list illustrative with a required minimum subset?

No response

State revenue and unemployment-insurance wage data is generally not commercially licensable. What source does the Government contemplate for state tax filing and payment status, workforce data to verify employees, and state benefits claims?

Would state UI or new-hire data obtained under an interstate data-sharing agreement satisfy it?

The Government does not prescribe specific sources.

Offerors must propose lawful, available, and reliable sources or alternatives.

Commercial providers generally cannot access bank account-level activity absent a Gramm-Leach-Bliley permissible purpose or account-holder consent. What legal basis does the Government contemplate, and would account-validation or account-ownership verification satisfy the requirement in place of transaction-level activity?

Transaction-level bank activity is not required where not lawfully available. Account validation or account-ownership verification may satisfy the need.

Is FedRAMP authorization required at time of award, or is an ATO the expected path? At what impact level, what is the expected award-to-ATO timeline, and may performance begin before ATO for work performed wholly at contractor facilities?

Not FedRAMP authorization is not required at time of award.

What is the number systems or data sources that need to be integrated?

No IRS system integration is required. The contractor is responsible for using proposed data sources and returning deliverables.

How many times per year do you need updates on the ~500,000 that need to be screened each year? Is it a 1-time screen or will you need periodic updates on those companies?

Generally, an entity will be screened once. If this entity is being abused for fraud, there may be follow-up screening requested, however this will be rare.

Factor D: Past Performance, RFQ Page 19 - Will the government review past performance summaries that are relevant to the scope of the solicitation as supplementary to information available in

CPARS?

Yes

If an offeror's proposed solution delivers entity verification, fraud scoring, and analysis, is Attachment 1 - Initial Staffing Plan still a required deliverable of the proposal?

Yes

Are there any specific IRS contractual documents offerors need to review aside from the referenced FARS?

The contractor should review the IRS 4812.

When and how would the IRS like us to submit possible redlines to any IRS provided contractual documents or should this be submitted along with any EULAs the offeror may have?

Submit any redlines, exceptions, EULAs, or contractor terms with the proposal/quote for Government review.

In lieu of a formal FedRAMP Authorization listed on the FedRAMP Marketplace, will the IRS accept either a FedRAMP Moderate Equivalency (e.g., a Body of Evidence assessed by an accredited 3PAO demonstrating 100% alignment with NIST SP 800-53 Moderate controls) for Cloud Service Providers (CSPs) or a Soc 2 Type 2 report supporting this contract? FedRAMP is currently undergoing significant changes.

The FedRAMP does not have to be completed at award.

That process can start after award.

Does enforcing U.S. Persons-only access within the United States for both end-user data viewing and backend administrative/support operations fulfill IRS Publication 4812 personnel location and security clearance guidelines? Alternatively, is the IRS open to contractually agreeing to an off-shore location or two outside the United States from which ad-hoc technology or account support services may be performed by respondent employees if a ‘follow the sun’ model is utilized?

No. Offshore locations are not permitted for work involving Government data.

Will the IRS consider expanding the North American Industry Classification System Codes (NAICS) for this acquisition to include 541519?

No. The Government does not intend to add NAICS 541519;

NAICS 561450 remains.

To ensure we provide a quality response, we are requesting an extension due date no earlier than September 3, 2026.

The deadline has been extended to 4:00 PM Eastern Time on September 1, 2026, That date falls during Eastern Daylight Time.

For surge pricing, is the estimated number of searches 500,000 above what is already quoted in the base and/or option years?

Yes. The surge CLIN is up to 500,000 searches above the base/option capacity and requires CO authorization.

How would you like past performance to be referred/ represented in the response? Understanding past performance information should be contained in CPARS, should this be documented in the response?

Document past performance in the proposal with contract/order details, scope, period, value, relevance, and customer contact information when available.