CCEISS PWS-RFI DRAFT.pdf

Contact Center Enterprise Infrastructure Software and Solutions

Procurement Sensitive – Reference FAR 3.104

Contact Center Enterprise Infrastructure Software and Solutions

(CCEISS)

Performance Work Statement

05/21/25

Version 1.9

Table of Contents PERFORMANCE WORK STATEMENT ............................................................................................................ 1-1 1 INTRODUCTION .......................................................................................................................................... 1-1

1.1 PURPOSE.................................................................................................................................................. 1-1

1.2 BACKGROUND ......................................................................................................................................... 1-1

1.3 CCEISS OBJECTIVES/SCOPE ................................................................................................................... 1-1

1.4 OPTIONAL PRODUCTS/SERVICES ............................................................................................................. 1-2

2 CONTACT CENTER ENVIRONMENT .................................................................................................... 2-3

2.1 CALL MANAGEMENT TECHNICAL ARCHITECTURE .................................................................................. 2-3

2.2 CONTACT CENTER FUNCTIONAL COMPONENTS OVERVIEW .................................................................... 2-4

3 OPERATIONS SUPPORT SERVICES ....................................................................................................... 3-6

3.1 TROUBLE TICKETS RESOLUTION ............................................................................................................. 3-7

3.2 CHANGE MANAGEMENT .......................................................................................................................... 3-7

3.3 CONFIGURATION MANAGEMENT ............................................................................................................. 3-8

3.4 UPGRADES/PATCH MANAGEMENT .......................................................................................................... 3-8

3.5 OPERATIONS SUPPORT REPORTING ......................................................................................................... 3-8

3.6 DISASTER RECOVERY/CONTINUITY OF OPERATIONS ............................................................................... 3-9

3.7 SECURITY MANAGEMENT........................................................................................................................ 3-9

4 HARDWARE/SOFTWARE ........................................................................................................................ 4-10

4.1 HARDWARE ........................................................................................................................................... 4-10

4.2 SOFTWARE LICENSES (OPTIONAL) ........................................................................................................ 4-10

4.3 HW/SW MAINTENANCE AND SUPPORT ................................................................................................. 4-11

4.3.1 Maintenance/Support Model ............................................................................................................ 4-11

4.3.2 Hardware Maintenance ................................................................................................................... 4-12

4.3.3 Software Maintenance ..................................................................................................................... 4-13

4.3.4 IPV6 Compliance ............................................................................................................................. 4-13

5 TECHNICAL REQUIREMENTS .............................................................................................................. 5-13

5.1 SYSTEM PROTOCOLS ............................................................................................................................. 5-13

5.2 SECURITY .............................................................................................................................................. 5-14

5.3 SECTION 508 ACCESSIBILITY ................................................................................................................ 5-19

6 TRAINING (OPTIONAL) ......................................................................................................................... 6-20 7 PROFESSIONAL SERVICES .................................................................................................................... 7-21

7.1 LIVE ASSISTANCE SUPPORT .................................................................................................................. 7-21

7.1.1 Agent Desktop Sustainment Support ................................................................................................ 7-22

7.1.2 Voice Services Support .................................................................................................................... 7-23

7.1.3 Requirements Analysis/Requirements Management Support .......................................................... 7-24

7.1.4 Data Reporting Support ................................................................................................................... 7-25

7.1.5 Project Management Support .......................................................................................................... 7-25

7.1.6 Live Assistant Support Reporting ..................................................................................................... 7-26

7.1.7 Live Assistant Deliverables .............................................................................................................. 7-26

7.2 ENGINEERING/DEPLOYMENT SUPPORT (OPTIONAL) .............................................................................. 7-27

7.2.1 Engineering Support Services .......................................................................................................... 7-27

7.2.2 Implementation/Deployment Support Services ................................................................................ 7-28

7.2.3 Integration Support Services............................................................................................................ 7-28

7.3 GENERAL DEPLOYMENT/IMPLEMENTATION REQUIREMENTS ................................................................ 7-29

7.3.1 Documentation ................................................................................................................................. 7-29

7.3.2 Equipment/Cables Labeling ............................................................................................................. 7-31

7.3.3 Testing and Acceptance ................................................................................................................... 7-31

7.3.4 Blackout Periods .............................................................................................................................. 7-34 8 PROGRAM MANAGEMENT.................................................................................................................... 8-34

8.1 KICK-OFF MEETING .............................................................................................................................. 8-34

8.2 MANAGEMENT AND REPORTING ........................................................................................................... 8-34

8.3 GOVERNMENT FURNISHED PROPERTY ................................................................................................... 8-35

8.4 INVOICING ............................................................................................................................................. 8-36

9 TRANSITION .............................................................................................................................................. 9-36

9.1 TRANSITION IN ...................................................................................................................................... 9-36

9.2 TRANSITION OUT .................................................................................................................................. 9-37

10 SERVICE LEVEL AGREEMENTS ........................................................................................................ 10-37

10.1 SLA PERFORMANCE OBJECTIVES AND CREDITS ................................................................................. 10-37

10.1.1 Trouble Tickets Resolution Time SLA ....................................................................................... 10-39

10.1.2 Priority Tickets Resolution Time SLA ....................................................................................... 10-40

10.1.3 Timely Deployment/Implementation SLA .................................................................................. 10-41

10.1.4 Training SLA ............................................................................................................................. 10-42

10.1.5 Documentation SLA .................................................................................................................. 10-43

10.2 SERVICE LEVEL AGREEMENT CLAIMS ................................................................................................. 10-43

10.3 SERVICE LEVEL AGREEMENT CREDITS ............................................................................................... 10-44

11 PERSONNEL/KEY ROLES ..................................................................................................................... 11-44

11.1 PROGRAM MANAGER .......................................................................................................................... 11-44

11.2 FINESSE LEAD DEVELOPER ................................................................................................................. 11-45

11.3 PERSONNEL SECURITY CLEARANCE .................................................................................................... 11-45

12 TRAVEL ..................................................................................................................................................... 12-46 13 PLACE OF PERFORMANCE ................................................................................................................. 13-46 14 DELIVERABLES ...................................................................................................................................... 14-46 15 PWS ATTACHMENTS ............................................................................................................................. 15-47

1-1

Performance work statement

1 INTRODUCTION

1.1 Purpose

The purpose of the Internal Revenue Service (IRS) Contact Center Enterprise Infrastructure Software and Solutions (CCEISS) Contract is to acquire hardware, software licenses, hardware/software maintenance, engineering, development, deployment, and operations support, to support the ongoing management, maintenance, upgrades, and operations of the Internal Revenue Service (IRS), Contact Center Information Technology Infrastructure (CCITI).

1.2 Background

The IRS operates one of the largest contact centers in the world to assist taxpayers with tax-related problems and questions. The IRS Contact Center consists of over 30,000 agents operating out of 33 Contact Center sites and 17 Small Remote Centers (SRCs) located throughout the continental United States and Puerto Rico. The Contact Center Support Division (CCSD) manages and operates the CCITI that supports these IRS Contact Centers sites and SRCs.

The IRS has a large and complex contact center Information Technology (IT) infrastructure in which all calls are centrally managed and routed using a Cisco-based solution deployed at IRS data centers in Martinsburg, West Virginia (WV), Memphis, Tennessee (TN), and Ogden, Utah (UT). This infrastructure is jointly managed and operated by the CCSD and various support contractors. This IRS CCEISS Contract seeks to maintain continuity of support services.

1.3 CCEISS Objectives/Scope

The IRS key objectives for the CCEISS acquisition are:

• To support, manage, operate, and maintain the IRS CCITI.

• To be responsive to business and legal mandates which may impact the services, components, or capacity of the CCITI.

• To respond to technological changes which may impact the CCITI.

• To support changes to the CCITI as the CCE environment transitions to planned future states.

• Maintain and improve the quality of services provided to IRS end-users and taxpayers.

• Maintain and improve the performance and functionality of contact center services.

• Ensure contact center agents, supervisors, and other end-users are well trained in the use of any technology upgrades or enhancements deployed within the scope of this acquisition.

1-2

• Ensure that IRS system administration and operational staff are adequately trained to manage, operate, administer, and support any CCITI component deployed under the scope of this acquisition.

• Ensure complete and accurate documentation is maintained that reflects the “as built” implementation of any CCITI changes, upgrades, and functionality deployed.

• Achieve a smooth transition, from the current service provider to the new service provider, that maintains continuity and quality of services, and system security is not compromised.

The scope of the CCEISS Contract includes the acquisition of:

• Operations support services to assist CCSD Operations to operate, administer, and manage the CCITI.

• Maintenance for the CCITI non-Cisco hardware.

• Maintenance and support for CCITI software applications and operations support software tools.

• Software and Software as a Service (SaaS) licensing, and software upgrades to replace or expand capacity and functionality of the CCITI.

• Hardware products to replace CCITI components as they age and/or become out of Original Equipment Manufacturer (OEM) support.

• Hardware products/parts to expand the capacity of the CCITI to keep up with growth demands.

• Engineering, development, and deployment support services to upgrade the CCITI components, enhance functionality, or effect changes resulting from the evolution of the IRS contact center architecture.

• Engineering and deployment support services to support integration with upgrades to external systems or services that interface with the CCITI, and integration with any components that may be deployed that would need to interface with the CCITI.

• Training for products and solutions supplied within the scope of this acquisition.

1.4 Optional Products/Services

Optional products/services are identified throughout this Performance Work Statement (PWS) and may be required to support the operations and maintenance of CCITI during the contract period of performance. The timing, quantity, and scope of these optional items may vary depending on the available funding and evolving operational needs. The IRS is under no obligation or commitment to purchase these optional products/services. However, the Contractor shall provide pricing and delivered these optional products/services if requested.

2-3

2 CONTACT CENTER ENVIRONMENT

This section describes the IRS Contact Center Environment (CCE) to provide context for understanding the contract requirements and the functional/technical environment for which hardware and software maintenance, as well as professional services support are required.

2.1 Call Management Technical Architecture

The IRS Contact Center has a complex IT infrastructure that receives, manages, and routes approximately 140 million taxpayer calls/year to about 30,000 agents distributed over 33+ contact centers, SRCs, and mobile and remote agents at other locations throughout the United States and Puerto Rico. In addition, the contact center infrastructure supports, and routes calls for the IRS Customer Service Support (CSS) and Enterprise Resource Center (ERC) Help Desks that serve IRS personnel.

The IRS Contact Center uses a centralized high availability Cisco Unified Contact Center Environment (UCCE)-based architecture to manage all contact center call routing, skill group assignments, and agent targeting logic. The Intelligent Contact Management (ICM) instances in this architecture operate in duplex mode with each instance deployed respectively at the IRS Martinsburg and Memphis data centers. The figure below depicts the IRS contact center architecture.

Figure 2-1: Contact Center Call Management Architecture

There are three (3) Cisco Unified Communications Manager (CUCM) clusters, each cluster having a Publisher, eight (8) Subscribers, manage voice gateways and phones. CUCM servers are grouped into clusters to provide scalability, fault tolerance, and high availability. Critical

2-4 services in the cluster are configured on multiple CUCM servers to provide fault tolerance.

Approximately 14,000 concurrent agents are supported by this environment, and there are currently 14,000 Customer Voice Portal (CVP) ports.

The CUCM component are hosted in a virtual environment using the Cisco Unified Computing System (UCS) C240 M5/M6 Rack servers and VMware vSphere ESXi.

Cisco CVPs are deployed at Martinsburg, Memphis, and Ogden. The CVPs provide call prompting and queuing at the three IRS data centers for Enterprise routed calls. CVPs play prompts, queues calls, and provides ICM with the necessary information to route calls.

Concentrix/Convergys Interactive Voice Response (IVR) platforms are deployed at Martinsburg, Memphis, and Ogden to provide self-service to taxpayers. This is also known as the Contact Center Voice response Unit (CCVRU). The CCVRU provides call prompting and automated self-service applications for taxpayers. Two (2) CCVRU nodes are deployed at Martinsburg, and one (1) respectively in Memphis and Ogden.

The IRS contact center architecture also integrates with Mindful - Medallia Callback, eGain Chat/Messaging, and Nuance Voicebots cloud-based capabilities to provide a multi-channel and intelligent interactive voice and chat service experience to taxpayers.

2.2 Contact Center Functional Components Overview

This section provides an overview of the major functional components within the IRS Contact Center Environment (CCE) that are relevant to the requirements of this contract. The table below summarizes the major CCITI functional components and their function. Integration with these components may be required as part of the Professional Services support scope under this contract (See Section 7 Professional Services).

Table 2.2-1: CCITI Functional Components

Functional Component Vendor/Product High Level Description

Unified Contact Center

Environment

Cisco UCCE

Cisco UCCE is a suite of products that provide the core central routing platform for the contact center.

It provides state management, agent selection, call routing, queue control, and other functions associate with the routing and delivery of calls to appropriate call center Agents. In addition, it includes the Finesse Agent Desktop application and Cisco reporting Live Data and CUIC reporting applications that are integrated with the Agent Desktop.

Customer Voice Portal

Cisco Customer Voice

Portal

Customer Voice Portal provides call prompting and queuing at the three IRS data centers for Enterprise routed calls. As dictated by the product line, CVP

2-5

Functional Component Vendor/Product High Level Description plays prompts, queues calls, and provides ICM with the necessary information to route calls.

Customer Self-Service

Portal

Concentrix/ Convergys

Interactive Voice Response

The CCVRU provides call prompting and automated self-service applications for callers at the three IRS data centers.

Call Manager Cisco Unified

Communications Manager

The Cisco CUCM controls voice gateways and IP phones.

Contact Center Reporting

Five9 Vault

The Five9 Vault storage and reporting platform is the primary repository of contact center information within the CCITI.

Predictive Dialer

Cisco Outbound

Option

The Cisco Outbound Option is used to make outbound calls. It generates outbound calls from a selected campaign list and connects an available agent with a completed call.

Contact Recording Verint Quality

Management

The Verint Contact Recording platform captures both the audio and screen interactions associated with the agent for quality monitoring and coaching purposes.

Contact Analytics Verint Speech Analytics

The Verint Speech Analytics provides for the capabilities to analyze call center recordings.

Workforce Forecasting and

Scheduling

Alvaria Workforce

Management

Alvaria WFM is the contact center workforce management tool used for projecting staffing needs based on incoming call volume, and for monitoring agents’ adherence to schedules.

Hearing Impaired Support

NexTalk SimpliciTTY

NexTalk applications are used to support Teletype (TTY) communication with hearing-impaired taxpayers.

Voice Recognition/

Text-to-Speech

Nuance Recognizer, Vocalizer

These Nuance applications provide voice recognition and text-to-speech capabilities

Mindful – Medallia Callback

Services Verizon

Verizon provides the Mindful - Medallia Callback voice services that allows taxpayers to schedule a callback.

Conversational Voice Services Nuance/Verizon

Nuance Azure cloud-based natural language conversational voicebots provide voiced-based self-services to taxpayers.

Chat/Messaging Services eGain eGain Azure cloud-based secured messaging provides communication with taxpayers via non-voice communication channels including eMail, secure messaging, File Transfer, Chat, and Chatbots.

3-6

3 OPERATIONS SUPPORT SERVICES

The IRS requires ongoing support to administer and operate key components of the IRS Contact Center Infrastructure. The Contractor shall provide Operations Support in the following areas:

• Cisco UCM and Cisco Unity Configuration, Diagnostic and Support

• Cisco ICM & CVP Configuration, Diagnostics and Support (mix of Windows servers and vendor appliances)

• Cisco UCCE Configuration, Diagnostics and Support

• VMWare Configuration, Diagnostics and Support (including associated devices, i.e., SAN’s, network switches, etc.)

• Security compliance, patching and application updates

• Dial plan administration

• Operating System and SQL Server Administration

• Knowledge transfer and training for IRS team members

• Escalation of issues to OEMs as required

• Federal Information Security Management Act (FISMA) audit, certification, and resolution of Plan of Action Milestones (POAMs) and findings support

• Disaster recovery readiness and support

• Other support activities as may be required to administer and operate these key components of the IRS Contact Center infrastructure

The Contractor shall provide Operations Support during the CCSD Core Period of Operations (CPO), Monday-Friday, 6:30 AM - 10:30 PM EST year-round (16x5x52). In addition, the Contractor shall provide ad hoc Operations Support during the CCSD Maintenance Period Monday-Friday, 1:00 AM - 5:00 AM EST, and weekends, 6:30 AM - 10:30 PM EST, as necessary to deploy critical system patches, regularly scheduled monthly operating system patches, software and hardware upgrades, and support of quarterly ICM releases which cannot be deployed during the CPO.

During the CPO, there are two (2) work shifts, 6:30 AM to 3:00 PM EST and 2:00 PM to 10:30 PM EST, each shift has a 30-minute break. It is estimated that support during the CCSD Maintenance Period will be 25 hours per month and will be scheduled in advanced. The Contractor shall provide the equivalent of one (1) Full-Time Equivalent (FTE) to cover one (1) work shift during the CPO with the flexibility for this support to also cover weekend shifts. In addition, the Contractor shall provide ad hoc support to perform software patching/maintenance during the CCSD Maintenance Period.

During the Period Of Performance (PoP) of this contract, the CCSD operational workload may increase, or the work shift may expand, and additional hours of coverage may be required The Contractor shall have the capability to increase its support level as the contact center operational workload increases and shall provide increase in support level when requested. The Government will issue a Service Order Request (SOR) to increase support as may be required.

The Contractor shall provide Operations Support with skilled, experienced, and Cisco certified resources with at minimum:

3-7

• Seven (7) years of experience with Cisco UCCE components, UCM, CVP, and Unity products

• Seven (7) years of experience with Windows 2019 Server administration

• Seven (7) years of experience with VMWare Hypervisor products

The Contractor support will be integrated with IRS Operations teams. The Contractor shall provide Operations Support in compliance with requirements described in subsections 3.1-3.7.

3.1 Trouble Tickets Resolution

The Contractor shall comply and adhere to IRS policies and procedures in support of resolving trouble tickets assigned to the Contractor. The Contractor shall comply with trouble tickets response levels/performance targets specified in Table 3.1-1.

Table 3.1-1: Trouble Ticket Priority Level

Priority Code Table

Priority Definition Response Levels

Assignment of Ticket

Updates Through Problem

Resolution

Target Resolution

Time 1 Severe Critical Work

Stoppage. Impact on multiple internal or external customers and impacting service to taxpayers. Immediate action required. Any IT issue impacting safety or health, e.g., fire and shock from equipment.

No later than 30 minutes from issue detection

Hourly Within 4 hours

2 Potential Work Stoppage. Could have a direct impact on the service to taxpayers if its scope is multi-user and there is no work-around. Could lead to severe mission critical work stoppage if actions are not taken to resolve problem.

No later than 1 hour from issue detection

No later than 2 hours

Within 8 hours

3 Work stoppage for one customer with no work around.

No later than 1 hour from issue detection

No later than 4 hours

Within 2 working days

4 Non-Critical problems where it is not a work stoppage and there is a workaround.

No later than 2 hours from issue detection

No later than 3 working days

Within 4 working days

3.2 Change Management

The Contractor shall comply with CCSD change management policies, processes, and procedures on changes made to CCSD CCE components it supports. A CCSD Change

3-8

Transmittal Process guide will be provided to the Contractor after award. The Contractor shall provide input to the Change Control Board (CCB) process as required or requested by CCSD Operations. The Contractor shall provide input to the process of obtaining the appropriate change approvals and implementation of the changes. Prior to installing changes in the IRS contact center production environment, the Contractor shall test changes at an IRS-owned/IRS-approved test facility, following the appropriate change management procedures.

3.3 Configuration Management

The Contractor shall perform configuration management in accordance with CCSD policies, processes, procedures, and standards. The Contractor shall perform routine configuration work on components that it supports as requested.

3.4 Upgrades/Patch Management

The Contractor shall be responsible for implementing software patches for software components it supports including the Microsoft products such as Windows and SQL as requested. Software patches must be deployed on weekends or during the maintenance period of 1:00 AM-5:00 Monday-Friday so as not to impact contact center services to taxpayers. The Contractor shall not deploy system patches during the core period of 6:30 AM - 10:30 PM EST, Monday through Friday, without written authorization from the IRS. In addition to ad hoc security patches, there are regularly scheduled monthly operating system patches that requires the Contractor to deploy outside the core period of 6:30 AM - 10:30 PM EST typically on weekends.

The Contractor shall test software patches prior to deployment at an IRS-owner/IRS-approved test facility prior to installation in a production environment. The Contractor shall test patch deployment based on an IRS approved test plan. The Contractor shall develop the test plan if requested.

3.5 Operations Support Reporting

The Contractor shall provide a weekly Support Activities Report summarizing support provided during the week. The Contractor shall provide this report in electronic form via E-Mail to CCSD Operations. The Contractors shall address in its weekly report:

1. CPO period support activities performed

2. Weekend and Maintenance period activities performed

3. Issues

4. Other information as may be requested by CCSD Operations

The Contractor shall participate in daily CCSD Operations calls/meetings to discuss status of faults and operational issues as requested. The Contractor shall participate in other calls/meetings as requested by CCSD Operations.

3-9

3.6 Disaster Recovery/Continuity of Operations

The Contractor shall support the IRS in the event of a disaster or other events that interrupt contact center continuity of operations. The Contractor shall support restoration of capabilities and services for those components it supports and provide support as necessary with other components in the contact center that interface and/or have dependencies on the ones the Contractor supports. The Contractor shall participate as appropriate and support the IRS in disaster recovery planning, readiness, and execution.

The IRS maintains a contact center Information System Contingency Plan (ISCP) which is updated yearly based on disaster readiness exercises or whenever changes to the CCE are made that impact the plan. The Contractor shall provide input into the contact center ISCP as appropriate based on changes made to the components it supports. The IRS conducts yearly ISCP exercises with mock scenarios. The Contractor shall support these yearly disaster readiness exercises and provide updates input to the ISCP as appropriate based on exercise results.

Following a disaster, the Contractor shall support assessment of impact on components it supports. Assessment may require traveling to IRS locations where equipment is located if access is possible. The Contractor in coordination with the IRS shall prioritize the recovery of contact center components it supports. Once, the contact center components under Contractor support are restored to their full operational state, the Contractor shall provide a status report and postmortem assessment, including lessons learned. The Contractor shall provide update input to the ISCP, as appropriate, based on lessons learned from a disaster.

3.7 Security Management

The Contractor shall comply with all IRS security policies, processes, and procedures for those CCE components it supports. The Contractor shall support the IRS ongoing security certification of CCE components it supports. The Contractor shall participate in required annual FISMA activities to include testing activities (i.e., ISCP testing, Enterprise Continuous Monitoring (ECM) testing and Security Controls Assessment (SCA); support system security plan development/updates, PIA updates, and contingency plan development/updates; provide mitigation of risk and vulnerabilities via the Plan of Action and Milestones (POA&M) process;

and provide the necessary artifacts of control implementation.

The IRS conducts yearly security control assessments or whenever a major change is made to the CCE information systems. The process includes eight (8) major phases (preparation, working sessions to update SSP/ISCP, validation sessions, ISCP tabletop exercise, Security Control Assessment, Security Assessment Report, Finalization and Continuous Monitoring) and spans approximately 109 working days. This timeframe may change some due to system security categorization and does not account for delays. The Contractor shall participate in each phase of the security assessment process as it applies to the CCE components it supports. The Contractor shall provide input as appropriate to updated versions of the SSP and ISCP as part of the yearly SCA. The Contractor shall provide a mitigation plan to correct any security deficiencies identified on components it supports, if requested, during any testing activities.

4-10

4 HARDWARE/SOFTWARE (HW/SW)

4.1 Hardware

During the PoP of this contract, the IRS may need to purchase hardware/hardware parts (e.g., memory, CPU) to expand capacity of the contact center environment or refresh contact center hardware that has reached end-of life/end-of-support (EOL/EOS). The IRS will issue a SOR for the hardware, installation and configuration that may be required at the time the need arises. The Contractor shall supply, rack and stack, and configure hardware per SOR requirements. The Contractor shall provide hardware/hardware parts for the following Make/Models:

• HP SN3600B Fiber Channel Switches

• HP Primera Upgrade 40x3840TB SSDs Storage Area Network

• HP Primera 600, 3.84 TB SSDs Storage Area Network

• HP Primera A630 8x3840GB SSDs Storage Area Network

The Contractor shall offer hardware Premium Delivery services that include, at minimum, the following:

• 24-hour advance notice

• Name of driver provided to IRS point-of-contact 24-hours in advance

• Removal and disposal of pallets, shrink wrap, and other shipping waste

4.2 Software Licenses (Optional)

This Section describes IRS requirements for software licenses. Software licenses are optional.

The IRS may need to purchase software/licenses to expand capacity or enhance capabilities of the contact center environment. The Contractor shall supply software/licenses for the software currently used in the CCE per Attachment J.2 - Price Tables and other contact center related software licenses/SaaS as may be specified in a SOR. The Contractor shall provide licenses based on an enterprise license model – that is, the specific application licenses and their associated quantities (explicitly defined quantities or unlimited) are not assigned to a specific location, or an individual/desktop, but are available for use anywhere within the IRS enterprise.

The IRS will retain full ownership of software licenses with a perpetual right-to-use, as well as have direct access rights to software OEMs for support services (first party access).

The Contractor may propose subscription-based licensing for software installed on IRS premise equipment. The Contractor shall include in the subscription all maintenance and support requirements per Section 4.3.3 Software Maintenance. In addition, the Contractor shall include in the subscription advisory services to assist IRS personnel to install and configure major or minor software upgrades and certification services to certify that the software installed by IRS personnel will be supported.

The table below summarizes the applications used in the CCE for which the Government may acquire additional licenses of current or future versions.

4-11

Table 4.2-1: Contact Center Non-Cisco Software Applications

Vendor/ OEM License Current

Version

Acqueon LCM UCCE Dialer, Server Multi-Tenancy 4.2.1.1.2306

Five9 Contact Center Intelligent, Vault 5.4.1

Alvaria Workforce Management Perform, System, Core, Allocate, Empower 12.6

Cisco Alvaria Real-time Adherence Gateway, Alvaria Workforce Management Adaptor Latest

NexTalk Quad-Span, LDAP GW, Port, Server, Agent, User 8.4 Nuance Recognizer 10.4

TTEC Humanify/VOSS 12.6.3.3

Verint FACR (QM, Voice & Screen Interaction, Face-to-Face, Interaction Data Platform, Data Redundancy, Encryption Management)

15.1

Verint

CR Center (QM, Voice & Scree Interaction, Interaction Data Platform, DC Redundancy, Encryption Management, Encryption Key Management, Speech Analytics, Transcript Export)

15.1

4.3 HW/SW Maintenance and Support

4.3.1 Maintenance/Support Model

This Section describes the IRS/Contractor support model for escalating HW/SW incidents associated with the HW and SW products under the scope of this Contract. The figure below depicts at a high level the HW/SW support model. The Contractor’s role is to provide OEM HW/SW maintenance/support agreements and managing the OEM relationship. The IRS CCSD Level 2/3 support organizations will escalate HW/SW support issues directly to the OEM. If the OEM is not responsive in their support and/or service level targets are not being met, the IRS will escalate OEM performance issues to the Contractor.

4-12

Figure 4-1: HW/SW Maintenance Support Model

4.3.2 Hardware Maintenance

The Contractor shall provide remedial and preventive maintenance for the hardware products identified in Attachment J.2 - Price Tables. Currently such equipment is deployed at the IRS Memphis, TN and Martinsburg, WV data centers. The Contractor shall provide yearly hardware Premier Class Maintenance/Support service agreements that, at a minimum, include the following:

1. Immediate notification of product status, including major and minor upgrades, all patches, and end of sale/end of support announcements

2. Critical security or service patches within 24 hours

3. 24x7 access to support, with a response time of 30 minutes for priority one incidents and a one-hour response time for all other incidents

4. Time to Repair (TTR) or hardware parts replacement/installation and configuration within 4 hours from initial incident report The Contractor shall offer extended hardware warranty, if available from OEMs or other parties, which can be extended on a yearly basis.

The Contractor shall meet the four (4) hours Priority Tickets Resolution Time Service Level Agreement (SLA) on TTR remedial maintenance (See Section 10.1.2 for SLA).

5-13

4.3.3 Software Maintenance

The Contractor shall provide yearly software Premier Class Maintenance/Support agreements that, at a minimum, include the following:

1. Immediate notification of product status, including major and minor upgrades, all patches, and end of sale/end of support announcements

2. Critical security or service patches within 24 hours

3. 24x7 access to OEM support, with a response time of 30 minutes for priority one incidents and a one-hour response time for all other incidents

4. TTR within four (4) hours from initial incident report

The Contractor shall offer Premier software maintenance as described above for all the software products identified in Attachment J.2-Price Tables.

The Contractor shall meet the four (4) hours Priority Tickets Resolution Time SLA on TTR remedial maintenance (See Section 10.1.2 for SLA).

4.3.4 IPV6 Compliance

The Contractor shall provide hardware/software products that are IPV6 compliant and can interoperate with both IPV6 and IPV4 systems. The Contractor shall ensure that any products provided as a replacement of end-of-life products are IPV6 compliant. If the Contractor is unable to provide a replacement product which is IPV6 capable, the Contractor shall inform the IRS and present alternatives and an approach for addressing IRS requirements for IPV6 compliance.

5 TECHNICAL REQUIREMENTS

This section describes requirements that apply to any solutions or products that the Contractor may provide/deploy under a Deployment/Implementation or other Professional Services Service Order Requests.

5.1 System Protocols

The Contractor shall provide components and solutions that support, comply, and interoperate with the following:

1. Internet Protocol Version 6 (IPv6). All hardware and software components provided under this Contract shall be IPv6 compliant and shall comply with the recommendations outlined in National Institute of Standards and Technology (NIST) special Publication 500-267, “A Profile for IPv6 in the U.S. Government.”

2. Session Initiation Protocol.

3. The IRS’ approved private IP addressing schemes for both Ipv4 and Ipv6.

4. Domain Name Service (DNS) Server.

5-14

5. Support use of Dynamic Host Control Protocol (DHCP) for all core network and telephony components including endpoints.

6. DHCP services from the IRS’ DHCP servers.

7. The implementation of Layer-2 CoS and Virtual Local Area Network (VLAN) via

802.1p/q, Layer-3 QoS via IP Precedence, DSCP using the policy framework components.

8. The IRS’s current implementation of QoS and provides flexibility to support additional WAN class of service differentiation as needed in the future.

9. SNMP auto-discovery functionality or other similar services.

10. Synchronization with an IRS provided time source (e.g., Network Time Protocol (NTP)).

11. Application integration standards, e.g., Service Oriented Architecture (SOA), eXtensible

Markup Language (XML), SQL, and ODBC.

5.2 Security

The Contractor shall provide products and solutions that comply with IRS information security policies. The Contractor shall provide secured solutions including secure system management functions that meet IRS security requirements, policies, and guidelines. The Contractor shall implement security controls that protect all services, information, infrastructure, and information processing resources against threats, attacks, or failures of systems.

To secure access to any system applications, the Contractor shall provide solutions that support user identification and authorization. The user credential information shall be protected and shall not be transmitted in the clear between user and application systems. The Contractor shall ensure that the solutions provided under this Contract protect the confidentiality of user login credentials when authenticating using the capabilities described in this PWS, (e.g., Agent Desktop and Lightweight Directory Access Protocol (LDAP) communications.

The Contractor shall provide services and solutions that comply with the following IRS security policies, directives, standards, and guidelines, as applicable.

1. Information Security/Federal Information Security Management Act

Pursuant to the FISMA, Title III of the E-Government Act of 2002, P.L. 107-347, the Contractor shall provide minimum security controls required to protect Federal information and information systems. The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity, and availability.

The Contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the Agency; or information systems used or operated by an Agency or by a

5-15

Contractor of an Agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, Contractors, vendors, and outsourcing providers that use or operate information technology systems containing IRS data.

An IRS information or information system are defined as a General Support System (GSS), Major or Minor Application, with a Federal Information Processing Standards (FIPS) 199 security categorization impact level of low, moderate, or high, and those systems identified by the As Built Architecture (ABA) and Agency FISMA Master Inventory.

2. Department of the Treasury/IRS Policies for Information Technology (IT) Security

The Contractor shall comply with Department of the Treasury Security Manual Treasury Department Publication (TDP) 15-71 and with Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance (IRM 10.8.1 requires that IT products be FIPS 140-2 validated. The Contractor shall comply with IRS Internal Revenue Manuals (IRM) and Law Enforcement Manuals (LEM) when developing or administering IRS information and information systems.

The Contractor shall comply with the Taxpayer Browsing Protection Act of 1997 – Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

3. Oversight of Contractor Systems

The Contractor system is considered a major/minor IT system and subject to an annual FISMA Contractor Review / site visit. All Contractors that manage, operate, or program an IRS Information or Information system are subject to IRS oversight to conduct a FISMA Contractor site review of the Contractor’s IT operation and physical environment/ facilities. At the discretion of IRS Enterprise Network Cyber security and the owning business unit, a FISMA Contractor review shall be determined based on a risk-based decision and whether it is cost-effective to conduct such a review.

4. Certification and Accreditation Process

Contractor’s systems that collect, maintain, operate, or use Agency information or an information system on behalf of the Agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews, risk assessments, security plans, control testing, a Privacy Impact Assessment (PIA), contingency planning, and certification and accreditation, and meet NIST guidance, as required by the IRS.

5. Contractor System Review / Site Visit

The Contractor shall be subject to, at the discretion of the Agency, to periodically test, (but no less than annually) and evaluate the effectiveness of information security controls

5-16 and techniques. The assessment of information security controls may be performed by an Agency independent auditor, security team, or Inspector General, and shall include testing of management, operational, and technical controls of every information system that maintains, collects, operates, or uses federal information on behalf of the Agency.

The Agency and Contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The Contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

6. Information Security Awareness and Training

The Contractor shall comply with IRS mandatory annual Computer Security Awareness briefings and UNAX briefings and receive an initial orientation before gaining access to IRS Information Systems. The Contractor shall undergo Homeland Security Presidential Directive (HSPD)-12 Personal Identify Verification, physical and personnel security screening / background investigation for approval of a Contractor badge for staff like access; then obtain OL5081 approval to IRS information systems.

All Contractors and Contractor employees who are involved with the management, use, programming, or maintenance of IRS information systems must complete the IRS mandatory Computer Security briefing. All Contractor and Contractor employees who could have access to tax return information must complete the mandatory UNAX briefing.

The Contractor shall certify the completion of Computer Security and UNAX training by their employees annually. The certification shall be submitted to the contracting officer, with a copy to the Contracting Officer Representative (COR) and Mission Assurance Security Services Awareness and Training Team.

UNS Cyber security conducts a series of security awareness training; in particularly the UNAX training and Computer Security Awareness training, which is conducted annually, is mandatory for all IRS employees and Contractors. FISMA requires continuous security awareness training to inform personnel, including Contractors, other users, and individuals with significant IT Security responsibilities that support the operations and assets of the Agency, to receive specific training on Agency guidance, policies, and procedures to reduce information security risks.

7. Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

The Contractor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The Contractor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite. In those instances where personally identifiable information is transported

5-17 to a remote site of the Contractor, the Contractor shall implement NIST Special Publication 800-53 Revision 3 security controls and IRS-specific security procedures to ensure that information is transported in encrypted form. The Contractor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information. Links to OMB Circular A-130, other OMB circulars, and OMB Memoranda can be found at http://www.whitehouse.gov/omb/agency/default.

8. OMB Policy M-07-18 Ensuring New Acquisitions Include Common Security Configurations

The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the United States Government Configuration Baseline (USGCB). This includes Internet Explorer 8 configured to operate on Windows XP, Vista (in Protected Mode on Vista) and Windows 7. For the Windows settings, see: usgcb.nist.gov. In accordance with OMB issued policy memorandum M-07-11, Implementation of Commonly Accepted Security Configurations for Windows Operating Systems, “operating systems [Windows XP and VISTA] and/or plans to upgrade to these operating systems must adopt these standard security configurations by February 1, 2008.”

9. Safeguarding / Protecting Sensitive Personally Identifiable Information (PII)

Sensitive PII is defined by OMB as “any information about an individual maintained by an Agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s…