Continuing Education - Sources Sought Notice_ Final.pdf

Department of the Treasury

Internal Revenue Service (IRS) Return Preparer Office (RPO)

SOURCES SOUGHT NOTICE (SSN)

“Continuing Education (CE) Provider Registration and Tracking System”

SSN Release Date: July 9, 2024

SSN Closing Date: July 23, 2024, 9AM EST

Primary Point of Contact: Proc.apmo.mr@irs.gov Attn: Shontae Harley

Secondary Point of Contact: Carrie.D.Smith@irs.gov

NAICS Code: 541511

PSC Code: DA-01

SSN Related to: RFI Notice ID# 05062024 (closed)

SSN Restriction: Only accepting responses from Small Businesses

I. GENERAL PROVISIONS

This is a Sources Sought Notice, not a purchase order or a commitment to purchase. This is not a Request for Proposal (RFP) and does not commit the Internal Revenue Service (IRS) to award a contract now or in the future. This document shall not be construed as a request or authorization to perform work at government's expense. Any expense incurred in and associated with responding to this Sources Sought shall be the responsibility exclusively of the respondent. No costs shall be charged to the government for any reason.

The government may issue an RFP later for substantially similar services as those described in this document. There is, however, no guarantee that the government will issue an RFP. The information provided in this Sources Sought is accurate to the best of the government’s knowledge, but is not guaranteed to be correct, complete or remain the same.

Any information of a confidential or proprietary nature contained in the respondent’s answers should be clearly marked ‘PROPRIETARY’ or ‘CONFIDENTIAL.’ Reasonable precautions will be taken to safeguard any information identified by the respondent as being proprietary or confidential. Submission of a response constitutes acknowledgement that the respondent has read, understood and agrees to be bound by the provisions herein.

II. BACKGROUND

The IRS is a bureau of the Department of the Treasury and one of the world's most efficient tax administrators. The Return Preparer Office’s (RPO) mission is to improve taxpayer compliance by providing oversight and support of tax professionals. The RPO oversees Continuing Education (CE) programs for Enrolled Agents (EA) and Enrolled Retirement Plan Agents (ERPA). It is mandatory that EAs and ERPAs take continuing education from IRS approved CE Providers.

Both EAs and ERPAs must complete 72 hours of continuing education triennially.

RPO oversees registration, testing, suitability and continuing education (CE) programs for certain groups of tax professionals. It is mandatory that these tax professionals take CE courses from IRS-approved CE providers. Learn more at: http://www.irs.gov/Tax-Professionals.

III. INTRODUCTION AND PURPOSE

The Government is seeking to continue developing and administering a similar solution once the current contract expires on August 31, 2026. Therefore, in preparation for possibly awarding a follow-on contract, the IRS is interested in identifying small businesses who can meet the following security requirements that will be required for this recompete award.

IV. REQUESTED INFORMATION

Responses to this Sources Sought are requested in two (2) parts as detailed below. All responses to this Notice shall be emailed to the attention of both the primary and secondary points of contact by the stated due date and time listed in this Notice on page 1. Responses shall be in either MS Word or PDF format, which does not exceed the page limitations set for each part, excluding any cover page. Responses should be concise and fully responsive.

Vendors who do not meet each of the security requirements (or will not meet them within the next few months) may want to reconsider providing a response. All SSN responses will be reviewed, however, the IRS is only looking for viable small business sources.

The IRS will not be accepting any questions in response to this Notice. There will be no Q&A period.

The Government reserves the right to contact some, all or none of the Sources Sought respondents for further discussions regarding their Sources Sought response. The IRS will reach out to the point of contact listed on the response should we choose to contact any vendor(s). This discussion is for clarification or for further information gathering. This exchange should not be misconstrued as the Governments interest to pursue or enter into any contractual agreement or obligation. No telephone requests or inquiries will be accepted. All information provided will become property of IRS and will not be returned.

General Project Scope: (subject to change)

The IRS is looking to procure Contractor support to continue the registration, annual renewal, and review of CE providers. The support includes developing, hosting and maintaining a system to administer CE Provider registration/renewals, course completion records and related tasks by electronic and paper means.

*Note: Historically, this contract has been performed on a “no-cost” basis for the Government, in which the contractor will recoup all costs incurred, plus a reasonable profit, entirely through registration/renewal fees collected directly from CE providers.

The anticipated requirements are substantially as follows:

1. Application must be entirely web-based and must not require any software download and installation on government or CE provider computers.

2. Application must be compliant with the provisions of IRS Internal Revenue Manual

(IRM)10.8.1Information Technology (IT) Security, Policy, and Guidance. If a cloud solution is http://www.irs.gov/Tax-Professionals proposed it must be compliant with IRM 10.8.24 Information Technology (IT) Security, Cloud Computing Security Policy.

3. Application must be compliant with the provisions of the most recent edition of the IRS Publication 4812. IRS Publication 4812 is IRS’ adoption of NIST 800-53 for our contractors.

4. System must be IPv6 compliant.

5. System must implement phishing resistant MFA including Personal Identity Verification (PIV) card authentication for IRS employees accessing the system.

6. System must implement auditing as required by IRM 10.8.24. All required system audit logs must be sent to the IRS Enterprise Security Audit Trails (ESAT) repository.

7. Allow CE providers to register and annually renew their registration.

8. Must be Payment Card Industry (PCI)compliant for secure payment of registration/renewal fees.

9. Include intuitive account management functions for Providers to input information and upload documents.

10. Allow IRS to review and approve Provider registration/renewal applications Online.

11. Allow other “back-office” functions for IRS to track, monitor, audit, analyze and report on

Providers’ status, course offerings and other information available in the system.

12. Allow automated and ad-hoc communication with Providers via secure mailbox.

13. Generate appropriate review outcome letters (approval, rejection, etc.) and electronically transmit to Providers via secure mailbox.

14. Automatically generate Provider registration numbers for approved Providers.

15. Allow for a one-time receipt of historical Program data (Provider, student course completion records, etc.) from the existing system and store same in a database.

16. Receive daily Preparer Tax Identification Number (PTIN) updates from another/existing system and store same in a database.

17. Receive from Providers uploads of course completion records by PTIN and store same in a database.

18. Send course completion records to the system referenced in #12 above.

19. Display certain information about Providers and make accessible Online to the general public.

20. Operate a call center to support Providers.

PART I: Company Profile (1 page limit)

Please provide the following information about your company:

Company Overview

Name of Company

Address

City, State, Zip

Point of Contact Name

Telephone Number

E-mail Address

Number of years your company has been in the application development industry

Provide an overview of your company

Company size and socioeconomic status (if applicable)

PART II: Responses to Qualifications (3-page limit)

The IRS will require the following security qualifications in order to perform the referenced contract. Please identify if your company can meet EACH of the listed security requirements. If your company is currently in the process of meeting a particular security requirement, you must provide an estimated completion date.

(Note: In order to be considered a viable source for this acquisition, your company must be able to meet ALL of the security requirements by the time a formal solicitation is released (i.e.

FY25)).

Provide a response to each item and sub-item listed below. Responses to the below questions shall be either “Yes/ No/ In-Process.” For any ‘in-process’ responses, provide the estimated completion date. Any explanations shall be minimal, brief and limited to 1-2 sentences.

a. Fed-RAMP Certified

i. Is your solution Fed-RAMP certified?

b. Multifactor Authentication (MFA)

i. Does your solution implement phishing resistant multifactor authentication

(MFA)?

c. Personal Identity Verification (PIV)

i. Does your solution implement Personal Identity Verification (PIV) card authentication?

d. Internet Protocol (IPv6)

i. Is your solution IPv6 compliant?

e. Authority to Operate (ATO)

i. Has your solution successfully completed an IRS or other federal agency

Security Assessment and Authorization (SA&A) process?

ii. Has your solution received an IRS or other federal agency Authorization to Operate (ATO)

f. Auditing and Accountability

i. Does the system provide an audit log for the following event types:

a. Successful and unsuccessful logon attempts

b. Account logon events

c. Account management events

d. Object access

e. Policy change

f. Privilege functions

g. Process tracking

h. System events

i. All administrator activity

j. Authentication checks

k. Authorization checks

l. Data deletions

m. Data access

n. Data changes

o. Permission changes

p. Activities that might modify, bypass, or negate IT security safeguards

q. Security-relevant actions associated with processing

r. User generation of reports and extracts containing information categorized High or Moderate for confidentiality (to the extent technically feasible)

ii. Does the system implement comprehensive logging and information-sharing capabilities, as described in OMB M-21-31, Improving the Federal Governments Investigative and Remediation Capabilities Related to Cybersecurity Incidents. (OMB M-22-09 (III)(E)(4))?

iii. Does the system generate audit records containing information that establishes:

a. What type of event occurred

b. When the event occurred

c. Where the event occurred

d. The source of the event

e. The outcome of the event

f. The identity of any individuals, subjects, or objects/entities associated with the event

iv. Does the system generate audit records with details to facilitate the reconstruction of events if unauthorized activity or a malfunction occurs or is suspected?

v. Does the system have the capability to provide a near real-time alert to the System Administrator and IRS Information System Security Officer (ISSO) via email notification, and a warning message visible on the display when an audit failure event occurs?

vi. Does the system have the capability to send audit logs to the IRS no less than twice daily? Audit logs must be provided in a SPLUNK ingestible format (CSV, JSON, XML).

vii. Does the system have the capability to support on-demand audit record review, analysis, and reporting requirements for after-the-fact investigation of incidents?

viii. Does the system have the capability to process, sort, and search audit records for event of interest based on IRS-defined audit fields within audit records?

ix. Does the system implement cryptographic mechanisms to protect the integrity of audit information and audit tools?

x. Does the system generate audit records with details to facilitate the reconstruction of events if unauthorized activity or malfunction occurs or is suspected?

xi. Does the system support the requirement for Federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 &

1236.22 (ref. a), including but not limited to capabilities such as those identified in: DoD STD-5015.2 V3 (ref. b), Electronic Records Management Software Applications Design Criteria Standard, NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of e-mail archiving applications to store e-mail (ref. c), NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8).

xii. Do you have experience completing an IRS System Audit Worksheet?

xiii. Do you have experience integrating required audit logs with the IRS

Enterprise Security Audit Trails (ESAT) repository?

g. Do all of your system data centers reside within the United States of America?

h. Does your solution currently comply with FIPS 140-2.

i. Does your system implement Zero Trust compliance?

j. Has your solution passed an independent third-party penetration test? Third party penetration tests are required on an annual basis.

k. Have all your communication and information technology, including your test administration platform(s), been independently tested for, and comply with, Section 508 of the Rehabilitation Act of 1973 as amended, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards?