Attachment 1. SOO.docx

Statement of Objectives (SOO) Low-Code/No-Code Platform Delivery and Business Process Support

1. Introduction This Statement of Objectives (SOO) for a multiple award Blanket Purchase Agreement (BPA) outlines the broad objectives of the Internal Revenue Service (IRS) to improve business workflows through utilizing “Low-Code/No-Code” Platforms to enhance the delivery of modernized applications. As it relates to this requirement, Low-Code/No-Code Platforms are a software development environment that allows users to create applications without having to write code. This can be done by using a graphical user interface (GUI) to drag and drop components, or by using a visual programming language. This definition is Platform agnostic. Some historical examples of Low-Code/No-Code Platforms utilized to provide capability to the IRS are Palantir, Pega Systems, Power Apps, Salesforce, ServiceNow, UIPath, etc. These solutions are business-led with Contractor and IRS Information Technology (IT) support providing resources assisting on integration and implementation. Through this requirement, individual IRS business units will be able to rapidly access Contractors who can plan, design, and implement as well as provide Operations and Maintenance (O&M) support services. The initial priority for this requirement is to support Enterprise Case Management (ECM) use cases with other digitalization workflow use cases quickly following. The Contractor shall support the development and implementation of low-code Enterprise Platform Integrations to customize, adapt, and automate enterprise workflows. The platforms’ digital process automation will help to streamline business processes, automate repetitive tasks, and improve customer experiences. The low/no-code model will allow for faster application development and deployment, mapping and reusing multiple data sources in the workflow, as well as refining timely decision-making. By leveraging the integrated platforms’ capabilities, IRS can achieve greater efficiency, agility, and innovation.

2. Background The IRS has recently moved towards a new Business Focused Delivery (BFD) model for both ECM and the broader digitalization efforts, which has the potential to improve case management and operational practices in nearly every major IRS operating division.

In August 2022, the Inflation Reduction Act (IRA) was signed into law, giving the IRS a historic opportunity to transform tax administration and services it provides to the taxpayers and tax professionals. To deliver on the IRA, the IRS developed a strategic operating plan (SOP) and identified transformational objectives. Objective 1 centers around dramatic improvement of services to help taxpayers meet their obligations and receive tax incentives for which they are eligible. Under this objective, the IRS prioritizes expansion of digital services and digitalization, and one of the key results focuses on workflows to replace current paper and legacy digital processes. Digitalizing workflows is automating manual processes resulting in more efficient and productive processes that supports optimizing taxpayer experience. Example processes include but are not limited to submission processing, workload identification/case selection, internal business processes, implementation, and O&M services.

3. Scope This requirement shall include all technical, management, and quality control processes required to enable the IRS to plan, design, configure, implement, deliver, operate, and enhance Low-Code/No-Code Workflows utilizing a business-led delivery methodology. This capability shall enhance employee experience, optimize the taxpayer experience, and streamline the efficiency, effectiveness, and timeliness of internally provided requirements. The scope of the requirement encompasses the major objective areas listed below. For related background, see the Attachments to the SOO.

4. Objectives:

Outlined below are the strategic and operational objectives that shall be accomplished under the Low-Code/No-Code Platform Delivery and Business Process Support services.

Strategic Objectives:

1) Streamline, modernize and digitalize business workflow processes across the IRS by leveraging user centric design processers and modern Low-Code/No-Code Platforms that will provide IRS employees with new capabilities and tools to improve both the efficiency and effectiveness of interactions with taxpayers and tax professionals.

2) Empower IRS employees to rapidly resolve cases, provide top-quality service to taxpayers, and continuously uphold the fair administration of tax law.

3) Revolutionize IRS case management and business processes by leveraging modern technology and iterative methodologies.

4) Deliver, support, implement, and deploy efficient and cost-effective solutions that maximize re-use. Where applicable, leverage existing capabilities already built in the selected Low-Code/No-Code Platform and consider future re-use when designing new functionalities and framework/application components.

5) Modernize or replace outdated legacy case management systems and find synergies to reduce the overall number of case management systems used within the IRS.

Operational Objectives:

4.1 Objective 1: Technical Objectives

· Provide IRS employees with enhanced capabilities and tools to improve efficiency and effectiveness in taxpayer interaction.

· Support business-focused delivery, solution, configuration, and implementation, leveraging expertise in Agile methodologies, Low-Code/No-Code Platforms, and BFD Methodology.

· Provide technical advice, conducting fit-gap analyses, and supporting the design and implementation of modernized Low-Code/No-Code Workflow functionalities.

· Leverage Contractor expertise and experience in training, implementing, testing, and deploying solutions in large, complex organizations.

· Provide agile planning, design, and development analysis and recommendations to achieve the IRS objectives related to successful business adoption and efficient business configuration of Low-Code/No-Code Platform solutions.

· Work with IRS IT team to support the Release Management functions ensuring the configured Low-Code/No-Code Workflow is released to production timely and successfully.

· Coordinate with IRS IT team to identify and elaborate technical enablers needed in support of providing data, services, and functionality for the Low-Code/No-Code Workflow (See section 4.5).

· Configure and test solutions on the Low-Code/No-Code Platforms.

4.2 Objective 2: Technical Integration

Provide technical integration services to implement a Platform, with continuous monitoring, management, and response to anticipate and mitigate associated impacts to successful delivery. Contractor is expected to coordinate with stakeholders and other vendors to conduct technical integration and deliver a comprehensive advanced Platform integrating all intended functionalities. Technical Integration shall include the following:

· Deliver an integration implementation plan and project plan and schedule:

· Develop, record, and align with stakeholders for the implementation and integration implementation plan to include scope, level of effort, success criteria, and high-level timeline.

· Update, record, and align the project plan or schedule.

· Identify, integrate, and manage dependencies and constraints arising from the intersection of functional and non-functional requirements where non-functional requirements are those that specify solution quality and assurance attributes including security, privacy, availability, reliability, and performance.

· Conduct research and analysis, assessment, and Independent Verification and Validation (IV&V) efforts to establish or confirm accuracy, completeness, sufficiency, appropriateness, and/or effectiveness of IRS-selected elements of the Platform programs including program solutions, designs, products, technologies, data, frameworks, processes, practices, and documentation.

· Provide support to analyze and resolve issues impacting the quality of data needed for the program to achieve its objectives.

· Provide functional, regression, performance, security test plans, test cases and test reports.

· Perform functional tests, performance tests, security scans, and regression tests.

· Work to close out any defects from the tests.

· Provide system technology, architecture, and engineering subject matter expertise.

· Provide Performance Engineering subject matter expert (SME) to develop and execute performance impact analysis report, Performance Engineering Model (PEM), Performance Test Plan, Test Report, and Standard Operating Procedures.

· Define procedures for maintaining and updating the reference architecture and design patterns after their initial publication in the repository to ensure ongoing relevance and adaptability.

· Outline the processes and procedures for managing the systems throughout their lifecycle to include planning, development, design, automation, deployment, and maintenance.

· Conduct a comprehensive design and review of program processes and tools, architecture, and solutions.

· Provide analysis, recommendations, and documentation for an initial capability of databases within the non-production environments.

· Provide a repository of relevant information about design patterns directly aligned with the MVP.

· Evaluate and assess the technology solutions for an initial capability of each application hosted in an on-prem hybrid infrastructure and external cloud provider within an IRS dev and test environment.

· Assist IRS to identify systems requiring the integration. Create implementation plans and execution schedules.

· Coordinate with program stakeholders to support the development and implementation of the Platform.

· Successfully complete the Platform design, development, implementation, automation, and integration.

· Complete above listed activities and be available to support any ad-hoc activities as directed by the COR or Program/Project Manager.

4.3 Objective 3: Program/Project Objectives

· Deliver digitalized and modernized workflows to replace current and legacy processes which may be automated, manual or both. This includes case management and non-case management use cases across various divisions and business units within IRS.

· Provide program and project management support for Low-Code/No-Code workflows delivery.

· Transition legacy business processes and applications to the modernized Low-Code/No-Code Platforms.

· Support the development of execution plans and delivery approach plans that enable project stakeholders to achieve their goals and objectives.

· Coordinate, as needed, with other IRS projects, program management offices, and internal/external stakeholders to successfully deliver on the Low-Code/No-Code Workflow.

4.4 Objective 4: Business Focused Delivery

· Transition legacy business processes to the Low-Code/No-Code Platform, using an Agile iterative delivery.

· Provide organizational readiness and training.

· Develop, document, and refine business requirements, perform solution design activities, and prepare the business users for any organizational changes needed resulting from the adoption of the Low-Code/No-Code Workflow Platform.

· Create a more cohesive and strategic approach to business-focused project management and implementation delivery, that directly contributes to the success and growth of modernized solutions that ultimately benefit the IRS and business users.

· Support, refine business user stories in collaboration with product owners and business stakeholders.

· Provide Low-Code/No-Code Workflow solution orientation and support to ensure that business stakeholders understand the selected Low-Code/No-Code Platform’s suite of capabilities, features, and limitations.

· Provide product SME support to all stakeholders working with the selected Low-Code/No-Code Platform leveraging the BFD Methodology.

· Deliver compliant draft and final documentation based on input and approval from the IRS.

4.5 Objective 5: Maintenance & Support

· Provide sustainability and continuous improvement of the Low-Code/No-Code Workflow solutions.

· Provide ongoing support for solution orientation, Agile requirements elicitation, and organizational readiness.

· Develop and support any training materials, virtual learning sessions and provide coaching support as directed by the IRS.

· Provide ad hoc support for Low-Code/No-Code Workflow requirements, special studies, and surge support as directed by the Government.

· Transition business users to the modernized Low-Code/No-Code Workflow.

4.6 Objective 6: Ancillary IT Support

Because of their significant impact on taxpayer experiences, the scalable and flexible architectures associated with Enterprise Integration Platform Support have been identified to help IRS improve customer service through personalizing engagement, automating processes, and streamlining operations. The Enterprise Platform Integration Support consists of several cloud-hosted platforms for business process management providing a real-time, continuous, and seamless hand-off between business and IT throughout the entire application development process. The Enterprise Platform Integration Support scales analytics enterprise wide yet allows direct integration to IRS datastores for populating user interfaces. In addition, it helps managing complex, mission-critical, and customer-facing applications, and sharing workflows and decisions across the IRS.

· Collaborate and integrate with IRS IT to offer support on Low-Code/No-Code Infrastructure, Platform, Compliance, and Documentation.

· Infrastructure enablers – provide volume and performance information in support of infrastructure impact assessments for applications, adherence to environmental security processes, identify scalability opportunities and concerns where applicable.

· Platform enablers – provide User Interface/User Experience (UI/UX) configuration, code promotion, application architecture and design, integration of common services/APIs, support Platform version upgrades (e.g., regression testing applications, enabling new Platform capabilities, etc.), security compliance.

· Compliance enablers – respond to IT data calls related to the application, address security risks as applicable to the application, adhere to IRS IT configuration guidelines and access procedures, develop compliance and audit plans, perform business process integration with IRS systems, develop test automation plans and scripts, and perform Section 508 testing and remediation.

· Documentation – document workflow processes, provide streamlining/optimization/standardization, conduct organizational “Go Live” readiness, approvals, and execution, One Solution Delivery Life Cycle (OneSDLC) Agile ELC requirements, internal Service Level Agreement/Memorandum of Understanding (SLA/MOU) development.

· Monitor IRS IT alignment through positive rapport during all stages of Platform integration to meet internal policies and procedures.

· Provide business-led professional support to IRS Application Division (AD) and DevOps in the realms of application role development, data engineering, solution architecture and design.

· Enable the organization to customize workflows for user interactions and gather critical data for IRS systems effectively and efficiently.

· Supply annual term software licenses for use by the IRS to support integration services.

5. Surge Support The BPA structure will include Contract Line-Item Numbers (CLINs) for task areas. CLINs/Task areas that may require Surge Support will have a corresponding (but separate) CLIN designated for Surge Support. The ceiling or not-to-exceed amount for each Surge Support CLIN will be 20% of the respective CLIN. This Surge Support structure applies to each BPA period (the Base Period and each Option Period). Surge Support may be in one of these three categories:

1. Incremental - a near-term activity that requires a relatively low level of resources and time to pursue, and generally works within existing constructs and tools with little adjustment or change

2. Adjacent - a mid-term activity that likely requires moderate levels of time/resources and expands the use of or slightly modifies existing policies, business processes, or technology

3. Transformative - frequently a long-term activity that requires significant levels of time/resources and represents a fundamentally disparate approach to solving a problem

Surge Support may be funded at the time of call order award but will not be performed until the Contractor receives official authorization via e-mail from the COR. This Surge Support email will authorize the Contractor to perform and bill for ad hoc tasks and additional teams specified in the call order. The Surge Support shall not alter or modify the scope or terms of the order or the BPA. If the Contractor believes that Surge Support request has been issued that will alter, modify, or amend the scope or terms of the order they shall promptly notify the COR as required by FAR 52.243-7 notification of changes.

· A Surge Support email may be modified, canceled, or superseded anytime by issuance of a new Surge Support email.

· In case of extreme urgency, the COR may instruct the Contractor by telephone or in teams, but this shall be followed by a Surge Support email.

Surge Support emails are not intended to replace informal direct communication or nondirective information between the Contractor, the Contractor's team members/sub-Contractors, and Government personnel. Surge Support requests may be issued to provide technical direction that may more closely reflect new information or changed priorities within the IRS.

Surge Support email will include:

· Date of request

· Applicable section(s) of the BPA and call order

· Description of the effort to be performed

· Expected level and skill sets needed for the work authorized for performance

· A ceiling for the “not to exceed” estimated amount, the number of manhours, and travel

· Performance milestones and metrics (if applicable)

· Deliverables (if applicable) within those specified in the BPA and call order

· Other direction may be required to successfully achieve the objectives within the parameters established by the BPA and call order

· Name and contact information of the COR who issued the respective call order

· The applicable BPA CLIN and call order item number

6. Knowledge and Skills Required The Contractor will provide the required expertise to support the BPA throughout the period of performance, to include requisite abilities, knowledge, and skills such as those listed below. Requirements (for example, certification requirements and years of experience) will be further described and defined at the call order level:

Essential:

· Certification and demonstrated expertise configuring, deploying, testing, supporting, and maintaining solutions in support of one or more of the Low-Code/No-Code Platforms

· Experience in applying iterative processes including Agile and SCRUM methodologies

· Ability to proactively identify problems, recommend solutions and provide insights based on expert knowledge of the selected Low-Code/No-Code Platform for the modernized workflow

· Ability to effectively communicate with stakeholders, partners, and business units at all levels. This communication may be from technical to strategic and provided orally or in written documents (reports, presentations, etc.)

· Ability to collaborate and participate as part of a team composed of a mix of Government employees and Contractors

· Knowledge of and experience with systems thinking, as well as user centered and empathetic design thinking principles

· Demonstrated experience in organizational readiness, transition, and training

· Ability to interactively configure the selected Low-Code/No-Code Platform to capture the described business flows and work with business SME to recommend workflow refinement and/or restructuring or increased effectiveness and efficiency

· Demonstrated ability to maximize re-use both in leveraging existing capabilities and building new capabilities with re-use in mind

· Demonstrated ability in quantitative risk analysis, management, and solution.

· Ability to define use cases, test cases, and acceptance criteria

· Assist with all Low-Code/No-Code Workflow deployment and testing activities, including validating Continuous Integration/Continuous Deployment (CI/CD) pipeline

· Assist in the System Integration Testing (SIT), System Acceptance Testing (SAT), and User Acceptance Testing (UAT) during the iterative development lifecycle and resolve any defects

· Enable and partner with IT resources during environment deployment phases, ensure final deployment is successfully implemented into production

· Provide post “Go-Live” production support

· Develop and maintain transition plan and associated activities for the next Sprint iteration. Schedule and create necessary Epics, Features, User Stories, as needed to meet Business Requirements

· Experience working with low code solutions hosted in the cloud by a FedRAMP High Level provider and experience in ensuring all critical cloud components should be compliant with FedRAMP High. Critical components include, but are not limited to cloud storage, data analytics, identity & access management, data loss prevention, and audit logging

· Ability to ensure that all integrations are monitored and maintained for optimal performance and prevent any issues or downtime

· Experience in ensuring all integrations are properly documented and tested to ensure compatibility with the low code platform and other third-party applications to promote security, scalability, observability, and maintainability of the solution

· Experience in Employing a real-time scalable architecture, allowing for the efficient scaling of resources to accommodate growing data volumes and user demands

· Ability to support the monitoring and auditing of low code platform activity to identify and investigate suspicious activity and ensure compliance with security policies and procedures

· Experience with ensuring system adheres to cybersecurity requirements to obtain and maintain Authority to Operate (ATO) for the Platform and onboarded use cases in compliance with the Agency and Government wide policies Preferred, but not required:

· Direct experience with the IRS ATO that One SLDC, Cybersecurity approvals (System Security Packages creations, change requests, meeting security controls etc.), 508, Privacy, Network Connectivity, Enterprise Security Audit Trails, Identity and Access Management and others.

· Ability to implement robust security measures in the within agency security policies and regulations, integrate with existing agency security infrastructure as well as conduct regular security assessments and penetration testing to identify and mitigate potential vulnerabilities.

· Ability to prepare the necessary documentation and evidence to obtain ATO approval.

7. Contractor Performance Management Acceptance Standards Attachment D - Service Level Agreements (SLAs) includes SLAs that:

· apply at the BPA level

· apply to all call orders

· the Government may include at the call order level

The Government may also include SLAs at the call order level that are not included in Attachment D. Such SLAs may reflect increased efficiency, increased processing time and associated cost savings for either or both.

Notwithstanding the above, all work products will be delivered to the appropriate Government point of contact. Generally, all work performed under this call order shall comply with the rules below. Exceptions may be made on a case-by-case basis.

1. Completeness – Initial requirements (as identified) are satisfied in all sections.

2. Accuracy – Documents shall be accurate in presentation, technical content, and adherence to accepted elements of style, spelling, and grammar.

3. Clarity—Documents shall be clear and concise. All diagrams shall be easy to understand and be relevant to the supporting narrative.

4. File Editing—All text and diagrammatic files shall be provided in a compatible Microsoft Office Version (Word, Excel, PowerPoint, Visio, Project, etc.), so that they can be edited using current IRS software versions.

5. Timeliness—Deliverables shall be submitted on or before the due date specified in the Schedule of Deliverables Section of this SOO or the Technical Order. Work products will be delivered as agreed upon by the Contractor and the Government upon assignment.

The COR will notify the Contractor if a deliverable is Not acceptable and provide comments by email within ten (10) Government workdays of receipt of a deliverable. Within five (5) Government workdays of receipt of the email comments, the Contractor shall resubmit the deliverable to the COR, if necessary. The Contractor shall establish and maintain a complete Quality Control Plan (QCP). This links the Government and Contractor’s quality assurance efforts into an integrated package with shared objectives.

8. Period of Performance

9. Place of Performance Contractor resources will primarily work virtually or off-site within reasonable commuting distance (within 50 miles) to the main IRS Building located at 1111 Constitution Avenue, NW, Washington, DC 20224. As approved by the COR or their designated representative, the Contractor may participate in conferences and meetings where relevant project issues are being discussed. Site visits to IRS locations or other locations may be requested by the PM and verified and approved by the COR.

10. Government-Furnished Property Government furnished property (materials, equipment, badges, and/or information) will be provided in conjunction with required performance under this BPA and resultant call orders. In addition to the below requirements, at the written request from the COR, the Contractor shall immediately return any property provided by the IRS for the Contractor’s use.

10.1 Government-Furnished Information (GFI)

Contractor personnel shall not release or otherwise distribute GFI unless the COR provides the Contractor advance written approval to do so. All GFI shall remain the property of the Government and shall be returned to the IRS at the end of the BPA ordering period. Call orders may require GFI to be returned at the end of the call order period of performance, versus the end of the BPA ordering period.

10.2 Government-Furnished Equipment (GFE)

Contractor resources, depending upon tasks assigned, will be required to utilize IRS email for email communication, have ready access to IRS Teams and potentially access to Government systems or collaboration sites. The IRS will provide Government-issued laptops as GFE to the Contractor staff. Notwithstanding the Government issuing the Contractor laptops, the Contractor is responsible for providing their own laptops as necessary to perform services under this BPA. (For example, for security purposes, the Government-issued laptops will not permit the Contractor to send emails to recipients outside of specified IRS organizations.)

The Contractor is also responsible for providing office space, meeting space, network connectivity, equipment including computer equipment, and office supplies for Contractor staff.

11. Travel Travel, if required, shall be authorized, and funded at the call order level. Unless specifically authorized at the call order level, any travel within 50 miles of the IRS District of Columbia Headquarters, 1111 Constitution Avenue, NW, Washington, DC 20224 shall be considered local travel and shall not be reimbursed.

Travel, if authorized and funded at the task order level, shall follow the general guidelines below:

· For any trip to be authorized, the Contractor must provide a written estimate. The COR must approve the written estimate in advance of travel. The estimate will ensure that the costs incurred for travel under the call order are both allowable and reasonable and in accordance with the FAR 31.205.46 regulation and the GSA Federal Travel Regulations. Any actual travel costs which will exceed the written estimate by greater than 10%, requires purpose for the travel from the Program Manager and authorization from the COR. If preauthorization is not obtained, reimbursement will be limited to amount provided in the written estimate. Upon completion of travel, the Contractor shall forward a voucher including receipts to the COR with the monthly invoice.

12. Ramp-up-period Any ramp-up/transition-in activities will be defined at the call order level.

13. Security The provisions listed below apply to the Prime Contractor and any of its sub-Contractors (or Teaming Arrangement/Agreement) employed during this Contract.

This Contract is categorized as unclassified at the Moderate Public Trust. Contractors are required to comply with the Treasury Directive P 15-71, Treasury Security Manual in the handling, protection, and safeguarding of Government information in their possession. The Treasury Directive (TD) P 15-71 will be followed as it specifies Treasury-specific personnel, physical, industrial and information security policy, processes and requirements that apply to this Contract. Personnel security investigations conducted for access to Sensitive But Unclassified (SBU) or sensitive information will be initiated by Personnel Security, Office of Security Programs (OSP). The Contract employees must have and maintain favorable background investigations at the appropriate level throughout the life of the contract.

13.1 General

IRS retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this Contract, clearly conflict with the interest of the Government. Lack of the ability to obtain or maintain the required investigation level is included in the reasons IRS may remove a Contractor employee. The reason for removal shall be documented in writing by the COR. Additionally, the Contractor must notify the COR terminations/resignations within 7 days of occurrence. When and if such removal occurs, the Contractor is responsible for assigning qualified replacement personnel in a timely manner or ensuring that performance of the Contract is not adversely affected.

The Contractor shall return all IRS issued identification cards, building passes, keys, and any other Government issued material of those terminated employees to the COR. If Government issued material is not available to be returned, a report must be submitted to the COR referencing the number, name of individual to whom it was issued, the last known location, and disposition of the items. Failure to return Government materials may result in remedial actions against the Contractor. Contractor personnel shall visibly wear IRS issued identification badges when working in Government facilities.

If any current or prospective employee is found to be ineligible for access to Government facilities or information by IRS, the COR will notify the Contractor that the employee shall not continue to work or to be assigned to work under the Contract. The IRS may require drug screening for probable cause at any time. The Contractor must also ensure that, prior to the end of the contract, all IRS information, systems, and equipment unless moved to another IRS contract, is returned to the appropriate IRS personnel.

The Contractor must limit the number of individuals requested to undergo any level of investigation/adjudication to those required to ensure performance of the scope for this Contract (“pools” of investigated employees are not permitted).

Any employee assigned to support the IRS shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal Identity Verification Standards for Federal Employees and Contractors,” dated January 2022. For T4/High Risk contracts, the contract employee must be a U.S. Citizen. Contractor personnel will have access to IRS facilities, information and equipment limited to that which is needed to perform Contract scope.

The Contractor shall provide the COR the name of all entities to be used as sub-Contractors for each type of work to be performed prior to performing any work under this Contract in the quotation submission in accordance with the FAR. The Government reserves the right to accept or reject any sub-Contractors proposed.

The Contractor is responsible for obtaining the approval of the COR prior to release of any information received or generated under the Contract. The COR should complete this item as required by internal agency directives to direct the prime Contractor to the appropriate office that has public release authority. Prime Contractors should serve as focal point for their sub-Contractors’ public release requests and refer them to the COR. SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71). For Official Use Only must be protected in accordance with the providing Agency’s directives. Data contained within all IRS computer systems are governed by Agency Security Regulations as well as the Federal Privacy Act of 1974. Contractor personnel assigned to this project will be held accountable for adherence to these regulations.

Contractors and their subs must perform all initial, annual, contemporaneous, specialized and termination training required per 32 CFR 2004 and IRS guidance as appropriate for their position.

The Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this Contract, to include loss or suspension of clearance. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the Contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information.

Work on this Contract may require personnel to have access to private information covered by the Privacy Act, Title 5 of the U.S. Code, Section 552a (in addition to other types of non-public information). All Contractor personnel shall adhere to the requirements of the Privacy Act as well as any applicable Department or Federal rule/regulation regarding private information or other types of non-public information.

As a condition for access to Government Owned Systems and Data, all Contractor personnel must pass background investigations in accordance with OMB Circular A-130 which requires screening of all individuals involved with sensitive applications or data in Federal automated information systems.

13.2 Clearances

All Contractor employees assigned to this BPA shall be required to possess and maintain a Minimum Background Investigation (MBI), which shall be conducted on Contractor employees which the Contractor informs the IRS will be assigned to the call order by the IRS or its designee, granting Staff-like Access in the performance of the call order.

13.3 Personnel Security Clearances

Acquired services shall comply with the following regulations and requirements: Homeland Security Presidential Directive-12 requires that all federal entities ensure that all Contractors have current and approved security background investigations that are equivalent to investigations performed on federal employees.

The Contractor is expected to:

Provide personnel security screening standards. The Contractor shall ensure that all its employees and affiliate and Contractor personnel who have access to nonpublic information have appropriate personnel security background checks.

The Contractor shall provide Treasury a listing of all such background investigative requirements (e.g., FBI fingerprint check, police check, credit check, verification of lawful permanent resident status, etc.). Treasury may request additional personnel security checks.

All Contractor employees and affiliates and Contractor personnel who have access to nonpublic information must be United States citizens performing their work in the United States, unless specifically authorized by Treasury in writing.

14. Multi-Contractor Services provided under the Low-Code/No-Code Platform Delivery and Business Process BPA may be complementary to or interdependent upon services supported by other IRS Contractors. This will require Contractors to foster a collaborative multi-Contractor and multi-stakeholder environment. The Contractor must work cooperatively to the maximum extent possible to ensure seamless, high-quality services that holistically support the IRS.

The Contractor shall attend all Government-required (virtual and/or onsite) meetings in conjunction with other Contractors and entities as described herein. All materials and communications used to accomplish the work under this BPA shall be non-proprietary and able to be used collaboratively by IRS’s Contractors, with an emphasis on those supporting the IRS.

As such, the Contractor shall ensure activities in support of this BPA are effectively coordinated with IRS stakeholders and other Contractors. Where multiple Contractors (under separate contracting vehicles) are involved in a task, the Contractor shall not communicate with other Contractors or participate in meetings without informing the CO, COR, and IRS PM. Protocols will be established by the CO, COR, and IRS PM regarding communication rules of engagement that the Contractor shall follow. For example, some communication with other Contractors may require advance IRS approval, and IRS may require the COR or designee to be present at multiple Contractor meetings.

Activities and areas requiring Contractor coordination and cooperation shall include, but are not limited to, the following:

· Comprehensive cross-area support and consistent messaging; this includes areas where functional area processes overlap with other Program area processes, common data re-use requirements, and data and report submission standards; this interaction and coordination will be ongoing and applies broadly to all aspects of this BPA (e.g., common workflows, Quality Assurance (QA) monitoring and reporting).

· Hand off functions/capabilities between the Contractor, IRS, and other Program Contractors, ensuring coordination and collaboration to provide holistic strategies, solutions, and reporting, for example:

· Participation in workflow implementation or testing before go-live events to assess performance and capture any lessons learned

· Developing or revising procedures, scripts, and use cases to ensure successful execution of services and transfer of activities

· Knowledge management and sharing

· Adherence to IRS-approved communications, governance, and quality assurance processes

· Coordination among Program Contractors on all tasks and subtasks to minimize duplication of effort and streamline communications

· Sharing all deliverables, systems, data, and tools created from this BPA to appropriate parties, at the request of the COR

· Working cooperatively to identify service improvements and other efficiency projects relevant to the Program processes and, if any gaps are identified during order performance, the Contractor shall assign a reasonable number of staff support to develop process solutions that could be implemented

· Facilitating effective and collaborative decision-making through an IRS-approved governance process that recognizes Government-to-Government relationships within the federal Government

· Collaborating and maintaining a balance of interests, transparency, open, honest, frequent, and comprehensive communication to build and maintain relationships of trust and respect

· Cooperating with the IRS and its Contractors during timeframes when other Contractors are in transition phases such as transition-in and out

· Facilitating the transfer of responsibilities for task activity(s) described in this SOO to other party(s), if applicable, at the logical conclusion of any task or task activity(s)

· Cooperating fully in facilitating the transfer of responsibilities for task activities from other party(s) when at the logical beginning of any task or task activity(s) under this SOO

· Entering into Data Use Agreements (DUA) as necessary for the use of data necessary to develop and implement services under this SOO and to allow for smooth hand-offs and transition of services between the Contractor, IRS, and other Program Contractors; DUAs could be between the Contractor and the Government or between the Contractor and other Contractors

· Entering into Government-provided Non-disclosure Agreements as determined necessary by IRS for the performance of the services under this SOO and to allow for smooth hand-offs and transition of services between the Contractor, IRS, and other Program Contractors

15. Constraints Guardrails (definition): The IRS is using the term guardrails to broadly cover technical limitations that may be placed on the Contractor in the development of a solution. A guardrail could be the requirement to only use pre-approved software. It could also be limitations in what data is available. As part of the efforts, the Contractor will be required to work with the IRS Enterprise Architecture (EA) team to understand the initial set of guardrails. As the project matures, confirmation that the final proposed solution fits inside of the guardrails will be required prior to any technical implementation.

All end solutions provided under this requirement shall be, where applicable, Section 508 compliant.

Product must contain security measures necessary to protect the confidentiality of taxpayers’ returns and return information, as provided under Internal Revenue Code Section 6103.

Contractors must provide a product that meets current National Institute of Standards and Technology (NIST)/Federal Information Processing Standards (FIPS) security requirements.

Contractors must be able to provide personnel who can obtain secure access to Controlled Unclassified Information including Federal Taxpayer Information without posing a security risk as vetted by IRS security and onboarding procedures.

16. Accessibility Requirements for accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) are determined to be relevant. Information about the Section 508 Electronic and Information Technology (EIT) Accessibility Standards may be obtained via the Web at the following URL:

The Contractor shall adhere to Section 508 of the Rehabilitation Act of 1973, which requires access to the federal Government electronic and information technology.

The law applies to all federal agencies when they develop, procure, maintain, or use electronic and information technology. Federal agencies must ensure that this technology is accessible to employees and members of the public with disabilities.

Each electronic and information technology product or service furnished under this contract shall comply with the Electronic and Information Technology (EIT) Accessibility Standards (29 U.S.C. *&794(d)) this includes all task/delivery orders and product support services furnished in the performance of this contract.

For every EIT product or service accepted under this contract by the federal Government that does not comply with (29 U.S.C. §794(d)), the Contractor shall at the discretion of the federal Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either the planned refresh cycle of the product or service, or on the order renewal date, whichever shall occur first.

17. Rights in Data The IRS shall have unlimited rights in all data and products produced in the performance of this Contract, and in all products and data delivered under this Contract (except for restricted purchased products or SaaS solutions), including software, technical data, manuals, or instructional and training material for installation, operation, or routine maintenance and repair of items, components, or processes delivered or furnished for use. "Software," as used in this provision, means computer programs, computer databases, and documentation thereof. The term also includes data identifying its source, functional characteristics, and performance characteristics, and specifically includes the source code, algorithm, processes, formula, and flow charts of the software. The Contractor agrees that all intellectual and data rights in the software shall become the exclusive property of the Internal Revenue Service. With respect to manuals concerning pre-existing Contractor products, the IRS shall have an unlimited license to use copies of these manuals. If the Contractor creates for the IRS any software ("Developed Software") as specified in the Contract or any task order issued hereunder, all the Contractor's services shall be considered work for hire and the IRS shall have all rights of ownership in the Developed Software. The IRS shall have a non-exclusive right to use any software received from the Contractor to the extent embedded in the Developed Software.

The Contractor shall ensure that any commercial software used in the performance of this BPA does not restrict the government’s rights to access and use such data and products generated. The Contractor shall provide the Government with access to all such data and products in a format that is human readable, usable and accessible, regardless of the commercial software used.

17.1 Restricted Rights Software

Contractor's commercial software and commercial computer software documentation are provided to the IRS in accordance with the terms of the Contractor's written software license that is provided with the Contractor's or third-party equipment purchased by Contractor for the IRS under this Contract. The Contractor represents and warrants that commercial software or computer documentation was developed at private expense and contain confidential information or trade secrets of the Contractor or its suppliers and licensors.

18. Organizational Conflict of Interest (OCI) The Contractor shall be responsible for immediately notifying the Government of any apparent or actual Organizational Conflict of Interest (OCI). A written OCI Mitigation Plan shall be reviewed and approved by the Contracting Officer prior to the commencement of any work.

19. FISMA Cybersecurity Requirements Information Systems and Information Security Controls for Contracting Actions Subject to Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP)

In performance of this contract, the Contractor agrees to comply with the following cybersecurity requirements and assumes responsibility for compliance by its personnel and subcontractors (and their personnel):

General. The Contractor shall ensure IRS information and information systems are always protected. The Contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security and privacy controls, requirements, and objectives described in applicable security and privacy control guidelines, and their respective contracts. Pursuant to the Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP), the Contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with the Internal Revenue Manual (IRM) Part 10.8 series and the current version of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security Privacy Controls for Information Systems and Organizations.

Business Entitlement Access Request System (BEARS) /Entitlement - Role-based user permission groups. The Contractor shall ensure all applications and platforms integrate with the IRS to establish least privilege BEARS entitlements for all roles that prevent any one role from authorizing a transaction from end to end.

Privileged User Management and Access System (PUMAS). The Contractor shall ensure all applications and platforms integrate with the IRS’s PUMAS to secure, provision, manage, control, and monitor all activities associated with all types of privileged identities to include, but not limited to, privileged user accounts, service accounts, and secrets management for on-premises and cloud-based applications and infrastructure.

Log Management and Enterprise Security Audit Trails (ESAT). The Contractor shall ensure systems provide audit trails in an approved automated format acceptable to the IRS for all user actions and activities when using or maintaining the system. In accordance with NIST 800-53 Audit and Accountability (AU) controls, applications and platforms shall integrate with ESAT for audit logging to support organization-wide analysis and correlation for situational awareness.

The Contractor shall provide to the IRS to be used in accordance with OMB Memo 21-31, the system logs for both services implemented on servers within the authorization boundary and services deployed on Cloud Service Offerings. The Contractor shall collect and maintain network and system logs on Federal Information Systems for both on-premises systems and connections hosted by third parties, and when it is necessary to address a cyber incident on Federal Civilian Executive Branch Information Systems.

Federated Authentication Services Technology…