Attachment 1_EANS_SOW.pdf

Statement of Work (SOW) Emergency Alert Notification System (EANS)

Senior Commissioner’s Representative and Continuity of Operations

(SCR-CO)

Version 2 August 30, 2024

SOW for EANS SCR-CO Recompete | ii

Table of Contents

1.0 Background

2.0 Purpose / Objective

3.0 Deliverables / Requirements

3.1 Functional Requirements

3.1.1 Secure, Cloud-Based System

3.1.2 Notifications

3.1.3 Accountability and Acknowledgement

3.1.4 Detailed Reporting

3.2 Operational Requirements

3.2.1 System Requirements

3.2.2 Secure Communications

3.2.3 Alert Notifications

3.2.4 Security

3.2.5 Reliability and Availability

3.2.6 Upgrade/Maintenance

3.2.7 Tracking and Reporting

3.3 Management Portal

4.0 Place of Performance

5.0 Period of Performance

6.0 Contract Type

7.0 Contract Administration Data

8.0 Government Furnished Property

9.0 Government Furnished Information

10.0 Security Requirements

SOW for EANS SCR-CO Recompete | 1

1.0 Background

The Internal Revenue Service (IRS) initially implemented a software tool in July of 2009 called extWARN. In 2012, the IRS converted from IPv4 to a new IPv6 format. The change to IPv6 rendered our emergency alert software (extWARN) obsolete and a solution in the IRS software portfolio (Informacast) was identified which satisfied replacing extWARN requirements (Phase I) and provided the IRS with additional tools to notify staff in the event of an emergency (Phases II and III). Informacast, a software application providing emergency notification through the Convergence phone conversion project, was purchased with an enterprise-wide license on March 28, 2013. The Informacast support contract expired March 26, 2018 and a follow-on contract was not awarded. As a result, the implementation was postponed leaving 313 sites without an emergency alert system.

SCR-CO created a team to explore additional options and identify a recommended solution. The team began working with Information Technology (IT) to reconsider the Informacast Mobile solution that was paused in 2015. After collaboration with IT, the Vendor, Privacy Governmental Liaison and Disclosure (PGLD), and Cybersecurity it was determined (February 2017) that the Informacast Mobile solution was not viable because the cloud-based solution was not FedRAMP certified, and the solution was not hosted on a private/semi-private cloud.

Most recently, after collaborating with many federal agencies, vendor demonstrations were conducted during January and February 2017 for a FedRAMP certified solution. As a result, AtHoc was chosen as the Emergency Alert Notification System (EANS).

2.0 Purpose / Objective

The IRS has approximately 100,000 employees at 500 locations nation-wide. The IRS communicates critical weather, safety, and security messages to employees via an existing cloud-based application. The IRS is looking for vendors who can deliver an Emergency Alert Notification System (EANS) solution that provides mass notifications to all IRS employees. The Contractor shall also deliver an EANS solution that provides accountabilities for all employees.

3.0 Deliverables / Requirements

Due to mission criticality of personnel notification and accountability, the Contractor shall provide an implemented solution that contains the requirements shown in this PWS. The Contractor shall deliver an Emergency Alert Notification System (EANS) solution that provides mass notifications to all IRS employees. The Contractor shall also deliver an EANS solution that provides accountabilities for all employees.

3.1 Functional Requirements

The Contractor’s EANS solution shall provide the following functionality:

3.1.1 Secure, Cloud-Based System

1. High FedRAMP authorized solution required

2. Provides notifications to mobile devices

SOW for EANS SCR-CO Recompete | 2

3. Centralized management solution

4. Maintenance-free environment

5. Compliance with 508

6. Ability to integrate with overhead paging system

3.1.2 Notifications

1. Call to mobile devices

2. Text/SMS to mobile devices

3. Email

4. Customizable audio or silent alerts to desktops, laptops, and mobile devices

5. Text alerts to desktops/laptops

6. Desktop and Mobile App

3.1.3 Accountability and Acknowledgement

1. A single user to respond multiple times to report changes in status ("My power is back on").

System needs to update showing latest status of respondents

2. Identify, create, and send follow-up message to employees (that do not acknowledge request for response

3. Users receive alerts without required action from the employee

3.1.4 Detailed Reporting

1. Allow for accountability (if applicable in the incident)

2. The system shall allow IRS to account for employees in multiple post of duties. The system shall allow employees to respond to accountability alert. Accountability data shall be available via a drill-down dashboard, alert reports, and exported to Microsoft Excel

3. Provide accountability statistics

3.2 Operational Requirements

The Contractor shall provide a secure EANS solution that meets the requirements in this section.

3.2.1 System Requirements

The Contractor shall provide an EANS solution that:

1. Is cloud-based

2. Is 100% SaaS Solution

3. Has an active High FedRAMP authorization

4. Is IPV6 compliant

5. Supports a Single Sign-On feature, providing integration with an agency Identity Provider

SOW for EANS SCR-CO Recompete | 3

6. Integrates with HR Connect Data (adds new users, updates current users’ information, and removes non-users)

7. Full compliance with US Federal security and privacy regulations

8. Flexible deployment options that don’t compromise security needs

9. Integration with on-premises emergency communication services and systems (option)

10. Certification per NIST SP 800-53 Rev 4 (at a moderate FIPS 199 classification), complying with government and DOD security mandates

11. NIST SP 800-53 and FedRAMP certifications go beyond the typical SAS 70 Type II / SSAE 16 SOC 2 certification to include actual assessment of service security provisions:

12. Continuous monitoring (per latest federal mandates)

13. Security scans and hardening compliant with DISA (Defense Information System Agency) STIGs (Security Technology Implementation Guides)

14. Facility and system inspections

15. Contingency / Failover testing

16. History log

17. Controlled and compartmentalized user access

18. Reports for each process

19. Reports for each type of user

3.2.2 Secure Communications

The Contractor’s EAN solution shall provide the following:

1. Single Sign-on populated with Derived Credentials

2. Safeguards to protect data against accidental loss/corruption by users (e.g., control levels of user access)

3.2.3 Alert Notifications

The Contractor’s EANS solution shall provide the following notifications:

1. Call to mobile devices

2. Text/SMS to mobile devices

3. Email

4. Customizable audio or silent alerts to desktops, laptops, and mobile devices

5. Text alerts to desktops/laptops

6. Desktop/Mobile App

SOW for EANS SCR-CO Recompete | 4

The Contractor’s EANS solution shall provide the following supports:

1. Targeting of recipients by distribution lists and groups, as dynamic lists (based on user data), or as static lists of users that can be indefinitely nested

2. Delivery to multiple notification devices, including mobile

3. “On-the-fly” targeting of individual users, able to add or remove them from targeted recipient lists

4. Targeting of users by organizational hierarchy

5. “On-the-fly” targeting by dynamic queries based on a combination of user data fields, such as role, medical training level, location, etc.

6. The defining of custom attributes for targeting users by either pre-designating a custom attribute as targetable (i.e., “Target by Role”) and by utilizing logical constructs (AND/OR) for the purpose of selecting recipients for alert targeting, distribution lists, etc.

7. Targeting of personal (i.e., telephone and email) enabling the selection of buildings to be notified

8. A user that is a member of multiple targeting criteria that is notified only once per alert

9. Sending SMS alerts to different mobile devices, such as Apple, Android & BlackBerry

10. The blocking of alert deliveries to designated individual recipient and groups of recipients by any of the targeting methods

11. A mix and match of any of the targeting methods in one alert

12. Ability to allow users to subscribe to receive alerts from any IRS location

13. Ability to link to other IRS systems

14. Ability to disable separated users from daily interface

15. The sending of multiple messages over the course of time (e.g., Day 1: Are you safe? Day 2:

Do you have power? Day 3: Do you need anything, e.g., medications)? Tool needs to distinguish people who have already responded from people who have not, and then capture responses and non-responses in a central report

16. Supports personnel accountability using geo-location and reporting capabilities

17. Product needs to accommodate messaging capabilities and situational awareness reporting

18. Ability to create customized reports

19. Alert notifications to work and personal phones, work and personal mobile devices, SMS text, desktop, and mobile app

20. Live Information, on demand, and customizable reports must be easy-to-use so that occasional users with minimal training are able to employ it effectively when identifying, executing, and monitoring tasks necessary for the efficient recovery of business operations following a disruption

21. Identify locations by building

SOW for EANS SCR-CO Recompete | 5

22. Create alert templates

23. Creation of incident templates

24. Multiple senders, the application must support multiple messages sent

25. Obtain employee/location information

26. Send alerts form mobile device

27. Provide accountability statistics

28. Provide Realtime alerts

29. Identify, create, and send follow-up message to employees (that did not acknowledge request for response)

30. Creation of audio announcement without the publisher having to record

31. Ability to integrate with overhead paging system

32. Ability to create notification templates

33. Ability for SCR or AO to select devices to receive alerts

34. Support test, training, and exercise tracking

35. Mobile capabilities (have a mobile app)

36. Mobile phone combability

37. Locked workstation, with the ability to play an alert when the station has been locked

38. Screen splash, the application will not disrupt current work in progress

39. Capability to quickly and efficiently integrate and aggregate data housed in other government systems (IRS’ official employee database (HRConnect)

40. Capability to quickly add/delete users through data feed (extrapolation)

3.2.4 Security

1. The Contractor shall work with the agency to ensure that access to the EANS cloud server for system management is handled through a secure connection with an encrypted key

2. The Contractor shall work with the agency to ensure that user profile information pushed to the EANS cloud server is accomplished and maintained through a secure connection

3. Define user roles

4. Password/SSO Entry and ERAP

5. Ability to notify users using the services designated email account groups

6. Compartmentalized users and can control level of access

3.2.5 Reliability and Availability

1. The Contractor shall provide a system that is in service 24x7x365 (24 hours per day, 7 days per week, 365 days per year)

SOW for EANS SCR-CO Recompete | 6

2. The Contractor shall provide the appropriate redundancy based on the EANS application as well as the datacenters that house the application

3. The Contractor shall provide details of the application and datacenters and how they provide 24x7x365 (24 hours per day, 7 days per week, 365 days per year) reliability

4. Disaster Recovery, the application must be able to recover within five (5) days

5. The Contractor shall provide 24x7x365 (24 hours per day, 7 days per week, 365 days per year) support in the case of any request or issue

6. The Contractor shall appoint a dedicated account manager to the IRS

7. Section 508 of the Rehabilitation Act Compliance: The Contractor shall demonstrate that visual alerts delivered to end users via their computer desktop/laptop workstations can be accessed using assistive technology, such as Job Access with Speech (JAWS) software

8. Automated Data input

9. Data Storage

10. History maintained

3.2.6 Upgrade/Maintenance

1. The Contractor shall be responsible for all hardware and software upgrade and maintenance in the EANS datacenters

2. The Contractor shall not charge additional or separate costs associated to any software or hardware upgrade/maintenance

3. The Contractor shall ensure that only US citizens with appropriate security clearances will be allowed to access the servers hosted in the EANS cloud

4. The Contractor shall obtain written permission from the agency prior to EANS server and all other cloud-related maintenance that could affect the agency EANS

5. The Contractor shall make the agency aware of desktop application version upgrades and their added security or feature updates within 15 business days of release. The Contractor shall also provide desktop software packages to the agency when requested. The agency will be responsible to obtain necessary approvals and to push upgrades to end-user workstations

3.2.7 Tracking and Reporting

1. The Contractor shall provide an EANS solution that provides one or more response options presented to recipients for selection and acknowledgement tracking and reporting of alert delivery and responses for each alert, recipient and device, and timestamps for each recipient and device

2. The Contractor shall provide an EANS solution that delivers real-time, aggregated alert summaries with graphical views (bar, graph, or pie charts) of total personnel targeted, alerts sent, acknowledgements received, and responses by count and/or percentage. The Contractor shall permit the IRS to customize these alert summaries and graphical views. The Contractor shall ensure that reports include breakdowns of response tracking and delivery status per device and user

SOW for EANS SCR-CO Recompete | 7

3. The Contractor shall provide an EANS solution that produces organizational hierarchy summaries with detailed, real-time graphical table analysis for total notification messages sent and received, including acknowledgements and specific response options. The Contractor shall ensure that organizational chart reports can be viewed within each level of the hierarchy and filter down to the member level as well as individuals within each grouping

4. The Contractor shall provide an EANS solution that enables real-time tracking and consolidated reporting over all notification devices

5. The Contractor shall provide an EANS solution that produces distribution lists with detailed, real-time graphical table analysis for total notification messages sent and received, including acknowledgements and specific response options. The Contractor shall ensure that each distribution list can be converted into a list of individual members by a specific response option

6. The Contractor shall provide an EANS solution that produces summary reports of alerts sent over time. The Contractor shall ensure that reports are automatically archived for an operator-defined timeframe or per a defined rule

7. The Contractor shall provide an EANS solution that produces response tracking reports

8. The Contractor shall ensure that these reports allow formatting for printing, or to be exported to multiple Microsoft Office products i.e. (Excel, Word, PowerPoint, .PDF)

9. Consolidate responses into a single report

10. Generate ad hoc published alert reporting must have the ability to have canned and/or customizable reporting capabilities

11. Personal accountability must have the ability to account for personnel and have real time, ability to update status, and provide historical reporting

12. Collaboration reports must have the ability to invite additional operators for collaboration during an event

3.3 Management Portal

1. The Contractor shall provide preliminary configurations of the management portal based on

IRS requirements. The Contractor shall also create or modify existing configurations during the testing phase as a part of professional services

2. The Contractor shall ensure that the EANS solution management portal provides Single Viewing recipients, has options to create new recipients, can edit recipient details, can manage distribution lists (groups), and can import and export recipient data through daily extrapolation

3. The Contractor will provide training sessions on how to use the EANS system, as needed, up to two training sessions per year

4. The Contractor will develop training materials, as required, in cooperation with the Program Office. New training materials will be delivered within 30 days before new system updates, enhancements, and features

SOW for EANS SCR-CO Recompete | 8

5. The Contractor shall provide an EANS management portal that allows for multiple delivery devices (i.e., phone numbers, email addresses, mobile phone numbers, etc.) per recipient, which can be imported from enterprise personnel repositories (i.e., the IRS employee directory), CSV files or via the Extensible Markup Language (XML) based Application Programming Interfaces (APIs)

6. The Contractor shall provide an EANS management portal that allows for mandating and assigning default values for each custom attribute/field (i.e., role, title, office, medical training, etc.)

7. The Contractor shall provide an EANS management portal that designates a source and permitted method of update (i.e., synch with external Directory, Import, Operator and/or End- User) per custom attribute/field

8. The Contractor shall provide an EANS management portal that manages organizational structure/hierarchies, including targeting, reporting, and grouping based on Hierarchy

9. The Contractor shall provide an EANS management portal that provides the ability to import contact information from an existing database through a regularly scheduled upload process.

The Contractor shall ensure that this process is provided through a web services API or other delineated text type file developed by IRS ENS contractor in coordination with the IRS for compatibility with IRS systems. Information exchange should be a “push” to IRS EANS rather than a query to IRS data base system

4.0 Place of Performance

Primary place of performance shall be at the contractor’s site, or other alternate location as mutually agreed upon.

5.0 Period of Performance

The estimated period of performance for one twelve-month base period and four twelve-month option periods.

6.0 Contract Type

This contract/order will be Firm Fixed Price (FFP).

7.0 Contract Administration Data

The Contracting Officer for this requirement is:

Name: Carol Mays Email: carol.g.mays@irs.gov

The Contract Specialist for this requirement is:

Name: Ricardo Carter Address: 1111 Constitution Ave NW - Washington DC 20224-0002

SOW for EANS SCR-CO Recompete | 9

Phone: 240-613-7470 Email: ricardo.d.carter@irs.gov

The POC for this order is listed below:

Name:

Phone:

Email:

8.0 Government Furnished Property

N/A

9.0 Government Furnished Information

N/A

10.0 Security Requirements

TBD

3.3 Management Portal