DARE Program Management and Engineering Support.docx

PERFORMANCE WORK STATEMENT

For Internal Revenue Service Enterprise Solutions (ES)/ Technology Strategy Management (TSM) Data At Rest Encryption (DARE) Program Management Office (PMO)

Project: DARE Program Management and Engineering Support

1.0 INTRODUCTION AND BACKGROUND

The IRS Information Technology/ Enterprise Services/ Technology Strategy Management/ Infrastructure Platform Strategy & Service Program management office requires DARE Program Management and Engineering Support to protect IRS data at rest via Encryption.

Recent data loss events across the federal government highlight the need for additional protections of sensitive data to ensure the IRS can continue its mission of revenue collection while protecting taxpayer privacy. Data-at-rest encryption (DARE) can be a highly effective security control when applied appropriately, and within the context of other security controls selected through a structured information security risk management approach. The vision for the DARE program is that encryption of data-at-rest will be applied to IRS mission critical assets consistently, effectively, and efficiently to reduce risk of data exposure while optimizing the support of IRS business objectives.

1.1 Key Federal Drivers Influencing DARE Requirements

The table below lists out the Policy and Guidance Drivers that influence on major DARE requirements.

GAO-17-394SU

The Internal Revenue Manual requires that IRS review GAO and TIGTA audits related to financial reporting to determine potential agency risk and the impact to various business and reporting processes. The manual also requires that the agency review and follow up on known significant GAO and TIGTA audit findings and recommendations that directly relate to the objectives of Circular A-123 internal control assessments and document the review activities. In addition, IRS’s documented procedures for reviewing external systems that support financial reporting require that IRS review external systems annually and, when available, review those system’s Statement on Standards for Attestation Engagements (SSAE) No. 16 reports.

Figure 1-1 DARE Policy and Guidance Drivers

1.2 DARE Program

In 2019, the IRS published the IT Modernization Plan (IT Mod Plan), which includes dozens of initiatives to improve how the agency interacts with taxpayers. DARE falls under the Cybersecurity & Data Protection aspect of this plan, and is one of several projects that, together, seek to enhance Vulnerability and Threat Management. The DARE program mission is to implement encryption of stored data across the IRS enterprise consistently, effectively, and efficiently to reduce the risk of data exposure in support of IRS business objectives, Cybersecurity initiatives, and Office of Management and Budget (OMB) data at rest mandates.

DARE program is focused on critical enterprise repositories in data center systems such as those hosted on servers and mainframes, using centralized storage such as shared file systems, storage networks, and backup/replication methods, and database applications such as Oracle, DB2, and SQL server. The program excludes data-at-rest in client-side devices including laptops drives, mobile phones, and local storage media. IRS has classified the IT assets into three different categories, Tier 1 -Mainframe, Tier 2- Servers and Tier 3- Workstations.

An important aspect of the DARE program is the encryption Key Management Infrastructure (KMI). Trusted and reliable management of the encryption keys is critical for protecting and accessing the encrypted information stores. It is important to plan for and protect the KMI as a set of integrated, federated enterprise services that meet system performance objectives while enabling interoperability with user, application, and system object authentication systems from multiple vendors and service providers. DARE Program currently uses Thales CipherTrust Manager Key Management system (KMS) to manage encryption keys for Tier 2 servers and validates International Business Machines (IBM) Enterprise key management system (EKMS) solution to use Enterprise key management Framework (EKMF) for managing encryption keys for Tier 1 Mainframes.

Figure 1-2 below shows DARE in-scope and out-of-scope:

Figure 1-2 DARE in-scope and out-of-scope

1.2 DARE Program Management Office

The DARE Program Management Office (PMO) operates as a “prime integrator” across IT Delivery Partners in the organization across the Enterprise to deliver DARE as outline in the following figure. The DARE PMO is a part of the Enterprise Services in the IRS IT organization.

Figure 1-3 DARE PMO and IT Delivery Partners

The DARE PMO performs the following services:

· Manages the execution of the program and is accountable for overall Program success

· Manages and executes the DARE Roadmap

· Communicates and integrates across the Enterprise

· Executes the governance framework

· Manages scope, schedule, and cost associated with application delivery

· Coordinates resource and risk management

The DARE PMO is led by the Senior Manager of Infra Platform Structure & Services / Enterprise Services - Technology Strategy Management. The DARE PMO functions risk management, prioritization, elaboration, contracts, budgeting, reporting and governance.

DARE Program has changed its approach to go with vendor-built model that entails the chosen contracting teams are responsible to deliver the implementation of Encryption of IRS- wide Data at Rest and Integration of Key management solutions(KMS).

Figure 1-4 IRS Vendor Built Model

In Vendor Built Approach, Government FTEs providing guidance and oversight to a large contractor presence responsible for architecture, design, delivery, integration, implementation of the modernized solution within IRS IT guidelines and principles and requires integration and collaboration with Enterprise services, IT Enterprise Operations and Applications Development.

In Vendor Built Criteria, development of new platforms/ applications or other modernization work that do not require the specialized IRS IT expertise of a Government-Balanced approach and applied to solution components/ products which cannot be purchased As a Service but for which IRS can define clear integration boundaries and requirements.

In Vendor Built approach, selected vendors/ contractors identify requirements and scope, develop the program/ project schedule, conduct program/ project management tasks, build the solution architecture, conduct Initial and full operational capabilities tasks and implementations, implement the encryption and integration of IRS application systems’ Data at Rest and perform transition activities to support Enterprise Operations. Enterprise Operations takes over the operations and maintenance after the implementation of encryption and integration of Data at Rest for each Application system.

DARE program is a very high visibility program that is directed by IRS CIO, ES-ACIO and ES-TSM Director. DARE PMO reports daily to ES-TSM Director, weekly to ES-ACIO and monthly to IRS-CIO on the progress of the DARE program. DARE program strategy is very agile to support the needs of program deliveries.

1.3 Executive Board

The Enterprise Services Governance Board (ESGB) was chartered to govern One Solution Delivery Lifecycle (One SDLC) millstones to approving milestone exits and DARE Integrated Master Schedule (IMS) to baseline IMS.

2.0 OBJECTIVES

The IRS needs to encrypt enterprise-wide data at rest as an effective defense strategy to prevent malicious or unintended access, disclosure of sensitive data and to comply with IRS and other federal directives and guidance.

IRS is seeking contractor support to conduct DARE Overall program/ project management and Tier 2 Encryption and Integration support. The Tier 2 Encryption and Integration support to conduct Encryption and integration using Thales CipherTrust Manager KMS to manage encryption keys for Tier 2 servers.

IRS is seeking contractor support to conduct review on the encryption evidence for all Tier 2 Applications’ Personal Identifiable Information (PII), Federal Tax Information (FTI), Sensitive But Unclassified data (SBU), Information Technology (IT) System User information (e.g., User Accounts) and IT System-related information (e.g., configurations, rulesets) and any other required data. if the evidence is not found then work with the Applications' teams and complete required encryption for IRS Data At Rest.

IRS is seeking contractor support to provide Filling season support to include support rectifying the production and non-production Encryption and integration related issues, risks, breaks and problems on time and Report to leadership on production and non-production issues, risks, possible solutions and implementation schedule to rectify the issues and risks by working with DARE Stakeholders.

IRS is seeking contractor support to update, record and get alignment with delivery partners for the DARE strategy and project plan/ Integrated Master Schedule (IMS) that includes Tier 2 Implementation schedule to support implementation of encryption and integration (store and manage encryption keys in centralized location) of IRS Enterprise-wide Tier 2 Application systems’ Data at Rest; identify, collect, and record IRS portfolio of applications’ information to include functional and non-functional requirements; Identify, record and address program risks, issues, concerns and action items according to IRS standards and Internal Revenue Manual (IRM); and facilitate and support demo sessions, meetings and working sessions to include automation, encryption, integration, testing, IMS, and DARE strategy.

3.0 SCOPE OF WORK AND DESCRIPTION OF TASKS

The scope of this task order is to acquire Program/Project Management, and Technical support to complete Encryption and integration of IRS Enterprise-wide Tier 2 Applications Data at Rest and provide DARE program wide Program/ Project Management support.

Contractor shall follow the IRS vendor-built model that entails the contractor shall be accountable to deliver the implementation of Encryption of IRS- wide Tier 2 Application systems’ Data at Rest and Integration of Key management solutions (KMS) based on Tier 2 implementation schedule in the Integrated Master Schedule (IMS)/ Project File.

The contractor shall be responsible for overall DARE Program/ Project management and implementation of Encryption and integration of KMS to all IRS Enterprise-wide Tier 2 Application systems’ Data at Rest .

The contractor shall provide Program/Project Management and Technical support and implementation addressing all IRS Enterprise-wide Tier 2 Application systems’ data storage technologies to ensure their data is appropriately encrypted and integrated. DARE program management office shall identify, validate, support implementation of encryption and integration for each database technology to include Oracle, MS-SQL, MYSQL, MongoDB, Greenplum, MarcLogic, ServiceNow, Informix and Cloud.

· Program/ Project Management support – Provide necessary project management and admin support to carry out objectives of the task order successfully, providing periodic executive briefings, meeting minutes, Quad charts, work requests, reporting progress on key metrics, manage resources and time for timely and cost-effective deliverables. Create and manage documentation required by the OneSDLC including Organization Readiness support. Authorization to Operate and Cyber Security requirements support. Provide Filling season support and leadership reports on production and no-production issues, risks, possible solutions and implementation schedule to rectify the issues and risks by working with DARE Stakeholders such as EOps, AD, Cyber and others.

· Technical support – Provide necessary technical support for DARE implementation to deploy encryption on Enterprise-wide Tier 2 Application systems’ Data at Rest with integration of Thales Ciphertrust Key Manager KMS for Data at Rest. IRS may provide IRS Portfolio of Applications’ Information, DARE Encryption and Integration Implementation Plan, DARE road map and project plan/ Integrated Master Schedule(IMS), and Automation Strategy to help the Encryption of Enterprise-wide Tier 2 Application systems’ Data at Rest with integration of Thales Ciphertrust Key Manager. IRS expects the contractor to automate the solution based on automation strategy to complete the implementation to avoid human errors and accelerate the implementation.

· Transition Support – Provide necessary support for transition that includes documentations of requirements, scope, risks, issues, solution architecture, details on software/ hardware licenses, standard operating procedures, automation scripts/ strategy, guidelines on implementation of encryption and integrations, step by step instructions of implementation of encryption and integrations with screenshots, Enterprise life cycle information and necessary training.

3.1 Task Area 1. Program Management Support

The contractor shall provide and maintain program management expertise and shall use proven and mature program management practices and processes in the execution of IRS Data At Rest Encryption (DARE) program. The contractor shall provide and maintain program management expertise and shall use proven and mature program management practices and processes to effectively manage resources to meet the delivery expectations on time and budget. The contractor shall support each program workstream with project planning and management, milestone status tracking and reviews, risk and issue identification, tracking and resolution and participation in program and release level activities. Project support shall align with the IRS-selected OneSDLC development path, methodology, and delivery approach.

Program Management support shall include the following:

· Develop and maintain project management plan, risk management plan, issues tracker, communication plans, maintain processes and operating procedures and Contingency Management as required

· Record and communicate dependencies, constraints, risks, impediments to program leadership in a timely manner and track them to either resolution or mitigation

· Support project planning and tailoring to refine application of paths, methodologies, and approaches to fit program needs

· Provide coaching support to assist in IRS adoption and execution of incremental development and delivery approaches including, Agile and DevOps.

· Draft, review, and update project management documentation in accordance with IRS guidelines.

· Develop and maintain to include IMS, quad charts, road maps, DARE/ automation strategy, automation sop, lessons learned and executive briefs

· Monitor, track, review and update project status, and provide analysis to ensure that all impacts are identified early in the project planning

· Develop and maintain a configurable set of project guidance, documents, and plans to be tailored to each project

· Facilitate lessons learned reviews with continuous development, documentation, communication, and application of lessons learned.

· Provide necessary project management and admin support to carry out objectives of the task order successfully

· Provide periodic executive briefings, report progress on key metrics, deliver documents in timely manner and record documents at the IRS specified repository

· Identify, record and address program risks, issues, concerns, and action items according to IRS standards and IRM

· Facilitate and support demo sessions, meetings and working sessions with IRS/ DARE leaderships, DARE shareholders to include road map, IMS, Implementation plan, automation, encryption, integration, testing, IMS, risk, issues, concerns, and executive briefs.

· Coordinate with DARE program stakeholders to include EOps, AD and Cyber to conduct program management activities.

Desired Outcome: Development and application of program management practices and controls that allow the DARE program to effectively establish and maintain control of program status, execution, costs, and schedule.

3.2 Task Area 2. Project Management Support

The contractor shall support the project with project planning and management, milestone status tracking and reviews, risk and issue identification, tracking and resolution and participation in program and release level activities for Tier 1 and Tier 2.

Project Management support shall include the following:

· Develop and record this task order schedule for deliverables and activities

· Conduct/facilitate meetings, workshops, architecture design sessions and provide timely meeting minutes and capture action items

· Provide project planning and management, milestone schedule and status tracking, reviews, participation in program and release level Tier 1 (mainframes) and Tier 2 (servers) activities for Treasury HVAs, IRS HVAs, Remaining Filing Season and Financial Systems, and Remaining Systems coordinate with stakeholders and foster commitment to adopt the solution

· Develop and record this task order schedule for deliverables and activities

· Provide coaching support to assist in IRS adoption and execution of incremental development and delivery approaches including, Agile and DevOps

· Produce weekly/monthly/ad-hoc reports on progress/status of the effort

· Monthly Status Report no later than seven (7) days of the new work month. The IRS and contractor shall agree to a format within 14 business days of award of the contract. All electronic submissions of the Monthly Contract Status Reports shall be provided using Microsoft Office products in accordance with the 508 compliant requirements. The IRS anticipates no more than two (2) ad-hoc reports will be requested during the period of performance.

· The Contractor shall coordinate monthly meetings to demonstrate the Scope vs Cost vs Schedule progress with the IRS Task Manager, this can be fulfilled by a conference call.

If the project is under performing, then the contractor should take necessary actions to remediate. Contractor must be prepared to present the Monthly Status Report. The report should be shared with all meeting attendees at least three (3) business days prior to the meeting.

· The Contractor shall provide to the IRS detailed monthly invoices for the services being billed to the IRS in the prior period. At a minimum, the invoice report must detail: Dollar amount billed to the IRS by contract CLIN, task, labor category, and service incident, by delivery order and the dollar amount exercised versus overall contract period total amount obligated

· Provide periodic executive/stakeholder briefings on progress

· Facilitate buy-in from executives

· Conduct Biweekly Integrated project team meetings, and Weekly Action Items, IMS, stakeholder’s coordination, Quad chart reviews and internal and external Risk forums

· Coordinate with DARE program stakeholders to include EOps, AD and Cyber to conduct project management activities.

Desired Outcome:

Execution of planned activities resulting in an implementation of Data-at-Rest Encryption Enable implementation of a range of data-at-rest encryption solutions for enterprise IT systems, expanding the IRS portfolio of available cyberthreat mitigation options for protecting taxpayer data and the national financial critical infrastructure

3.2.1 Key Personnel

Contractor employees identified as Key Personnel shall be dedicated to this project. If any changes in proposed key personnel become necessary during actual performance, the contractor shall provide written notification 60 days in advance. In the event of a sudden change in key personnel (death, incapacitation, immediate termination, etc.), the contractor shall provide written notice to the CO within 3 calendar days of the event. For any substitution, the contractor shall submit justification with a proposed substitute whose qualifications are equal to or greater than the person being replaced, along with a 1 to 2-page introductory summary, in sufficient detail to permit evaluation within 10 calendar days of notification of a substitution.

Table 1 – Key Personnel

· Experience leading programs of similar scope, size and complexity as the DARE Program

· Nature of work involves complex information technology project management, strategic and tactical planning, coordination, control, and critical decision-making.

· Has significant responsibility for the quality of all deliverables, prepares and performs final reviews on critical written communications documents and regularly makes presentations on program progress.

· Oversees project staff responsible for day-to-day delivery of services; Makes available all resources required to fulfill the needs of the project.

· Project Management Professional (PMP) or Program Management Professional (PgMP) certification

· 5-7 years of experience managing or executing projects of high complexity

· Experience in to Planning, developing and presenting engineering, architecture, program Management slide decks and documents.

· Experience providing strategic guidance in large program planning efforts.

· Experience in Identifying, capturing, and tracking risk and issues.

· Experience in developing and maintaining Integrated Master Schedule (IMS)

· PMP or Program Management Professional certification

· Possesses and applies a comprehensive knowledge across key tasks and high impact assignments.

· Responsible for large complex projects (typically 10 - 50 persons). Has project leadership responsibilities and significant input into the technical decision-making process.

· Develops detailed work plans, schedules, project estimates, resource plans, and status reports. Conducts project meetings and is responsible for project tracking and analysis.

· Recommends and takes action to direct the analysis and solutions of problems.

3.3 Task Area 3. One Solution Delivery Life Cycle Support

The contractor shall support the IRS in the selection, tailoring, management, and execution of OneSDLC paths, methodologies, and approaches for development and delivery of program capabilities. Selected OneSDLC development paths shall include Waterfall, Iterative, COTS, Mobile Apps, Managed Services, or another IRS approved path. Selected development and delivery approaches include Waterfall, Agile, and DevOps. The contractor shall employ best practices and proven expertise in managing and executing capability delivery utilizing these paths, methods, and approaches. Agile expertise shall include the ability to employ the Scaled Agile Framework (SAFe) as appropriate to realize the benefits of Agile and Lean development at enterprise scale. As specified by the IRS, contractor services and support shall be provided in alignment with existing IRS frameworks, processes, standards, and tools.

Monitoring and analysis of processes may require establishing metrics to recommend improvements to the government in accordance with industry best practices. Metrics are to be tracked and reported as required.

OneSDLC support activities shall include the following:

· Assist in the selection and tailoring of OneSDLC paths, methodologies, and approaches to managing and delivering program capabilities.

· Assist in the development, communication, and execution of supporting program delivery strategies, incorporating and blending elements from multiple OneSDLC paths, methodologies, and approaches, as needed, to accomplish delivery within the constraints and limitations of the existing IRS environment and culture.

· Assist the IRS in the adoption of new software development and delivery approaches, including to Agile and DevOps, and provide coaching support to assist the IRS in operationalizing supporting methodologies, processes, practices, and tools, as needed.

· Facilitate capture of business needs through agile practices of defining and decomposing epics and user stories to ensure accurate interpretation of requirements.

· Assist with prioritization of requirements, epics, and user stories, as needed, to facilitate rapid and timely delivery of high-value capabilities in accordance with business needs and priorities.

· Facilitate and participate in stakeholder feedback sessions to ensure solution alignment with stakeholder needs and requirements.

· Support development and execution of strategies for frequent and continuous building, testing, integration, and deployment of software, utilizing automation, whenever possible, to provision, configure, and modify environments and infrastructure.

· Create and manage documentation required by the OneSDLC. Document format will be in accordance with IRS guidelines using either Microsoft or Adobe products.

· Track and report on the delivery of agreed-upon capability, functionality, documentation, and other artifacts.

· Provide continuous analysis of the efficiency and effectiveness of program practices, processes, methodologies, approaches, and tools, along with recommendations for change or improvement, as needed. This includes monitoring and measuring the efficiency and effectiveness of processes.

· Coordinate with DARE program stakeholders to include EOps, AD and Cyber to conduct OneSDLC activities.

Desired Outcome: Rapid, reliable and low-risk delivery of high-value, high-quality program capabilities produced in close collaboration with integrated business and IT stakeholder teams through adaptive planning, evolutionary development and rapid and flexible response to change. Each project shall have the planning and management guidance and insight necessary to successfully deploy assigned capabilities. Lessons learned from other programs, releases, and projects shall be effectively applied to minimize and mitigate project risks and deficiencies.

3.4 Task Area 4. Technical Integration Support

The contractor shall provide technical integration services to implement encryption and integration for IRS enterprise-wide Tier 2 Application systems’ data at rest, and continuous monitoring, management, and response to anticipate and mitigate associated impacts to successful delivery.

Technical Integration activities shall include the following:

· Conduct review on the encryption evidence for all Tier 2 Applications’ PII, FTI, SBU, Information Technology (IT) System User information (e.g., User Accounts) and IT System-related information (e.g., configurations, rulesets) and any other required data. if the evidence is not found then work with the Applications' teams and complete required encryption for IRS Data At Rest.

· Collect and record IRS Portfolio of Applications’ Information for Tier 2 Application systems

· Develop and record data collection assessment questionnaires

· Identify and engage key stakeholders to obtain and record about IRS portfolio of Applications’ following information

· Application Name

· Domain (ex. Compliance, Corporate Data)

· Virtual Server (yes/ No)

· Number of servers

· Hardware Platform (Tier 2)

· Hardware Model Mainframe (ex. Linux, IBM Mainframe)

· Operating System

· Database & file system

· Environments (ex. SBX, Dev)

· Functional Requirements

· Non-Functional Requirements (ex. Cyber, Performance – SLA)

· Completion status

· Categorize the Tier 2 Applications into Tier 2 Technology(tech) clusters and make sure Tech clusters validation is complete as DARE Tech Cluster validation includes Oracle Exadata (18c,19c) on RHEL 8, Windows File System, Informix 12.1 on z/OS, Greenplum/PostgreSQL, MS Access, MS SQL, MongoDB and Microsoft SQL.

· Complete any tech cluster validation if they are not complete

· Coordinate with EOps and AD to complete Ready for use (RFU) activities

· Evaluate and assess the encryption technology cluster types to meet all other and future IRS encryptions requirements

· Deliver DARE Encryption and Integration Implementation Plan, DARE Road map and Project plan/ Integrated Master Schedule(IMS) for Tier 2 Application systems

· Develop, record, and get alignment with stakeholders for encryption and integration implementation plan to include Scope, level of effort, success criteria and duration/ high level Timeline

· Update, record and get alignment on DARE road map

· Update, record and get alignment on Project plan/ IMS

· Continuous maintenance and treatment as living documents for DARE road map and IMS with accuracy

· Deliver Automation strategy and conduct Automation to expedite Tier 2 Encryption and Integration implementation

· Identify areas and applications where automation is feasible

· Develop and record Automation Strategy to include following

· Scope – What can be automated -Identifying areas and applications where automation is feasible

· How can the automation to be developed such as Scripting etc.

· What is required to conduct automation such as level of effort, skillset, tools, access/ privileges, and cost

· Timeline/ Duration required to conduct the automation– When can automation happen and how long it takes

· Benefits, drawbacks and success criteria

· Develop and record Automation Standard operating procedures(SOP)

· Conduct Automation

· Successfully complete Encryption and Integration of IRS portfolio of Tier 2 Application systems Data at Rest in accordance with Applications’ functional and non-functional requirements

· Identify, integrate, and manage dependencies and constraints arising from the intersection of functional and non-functional requirements where non-functional requirements are those that specify solution quality and assurance attributes including security, privacy, availability, reliability, and performance.

· Perform technical integration implementation and support across multiple internal and external projects for testing and deployment cross IRS environment.

· Provide strategy and technical support for the application and integration of tools needed for program execution including tools for program management, development, and automation.

· Research and analysis, assessment, and Independent Verification and Validation (IV&V) efforts to establish or confirm accuracy, completeness, sufficiency, appropriateness, and/or effectiveness of IRS-selected elements of the DARE programs including program solutions, designs, products, technologies, data, frameworks, processes, practices, and documentation.

· Provide support to analyze and resolve issues impacting the quality of data needed for the program to achieve its stated goals and objectives.

· Provide system, technology, program and architecture and engineering subject matter expertise on enterprise key management Thales Cipher Trust

· Provide Performance Engineering SME to develop and execute performance impact analysis report, Performance Engineering Model (PEM), Performance test plan, test Report, and standard operating procedure.

· Conduct a comprehensive design & review of program processes and tools, architecture, and solution for at-rest data encryption.

· Provide analysis, recommendations, and documentation for an initial capability of databases, Microsoft SQL, Oracle, Greenplum, MongoDB, MarkLogic, and ServiceNow within the IRS non-production environments

· Evaluate and assess the encryption technology solutions for an initial capability of each application hosted in an on-prem hybrid infrastructure and external cloud provider within and IRS dev and test environment

· Assist IRS to identify systems requiring encryption technologies, create implementation plans and execution schedule for Cloud encryption

· Provide Functional, Regression, performance, security Test plans, Test cases and Test Reports

· Perform Functional test, performance test, security scans and Regression tests

· Work to close out any defects from the tests.

· Coordinate with DARE program stakeholders to include EOps, AD and Cyber to implement the Encryption and Integration for IRS Enterprise- wide Tier 2 Application Systems’ Data at Rest

· Provide Filling season (FS) support to include

· Develop, update, record and get alignment on FS support plan

· Conduct FS 24/7 support during Filling season

· Report to leadership on Filling Season support status and Escalate when necessary

Desired Outcome: Collection of IRS Portfolio of Tier 2 applications’ information and record the applications’ information at DARE Sharepoint location for future reference. Development, proper recording, and get alignment with stakeholders for encryption and integration implementation plan including prioritization of IRS portfolio of Applications, DARE road map and Project plan/ IMS. Development and proper recording of Automation Strategy, SOP and perform automation.

Successfully complete Tier 2 Encryption and Integration.

3.5 Task Area 5. Transition Support

The contractor shall plan, schedule, prepare and conduct transition tasks to provide transition services after the implementation of encryption and integration for IRS enterprise-wide Tier 2 Application systems’ data at rest to Enterprise Operations.

Contractor shall develop a training program to help Enterprise Operations to handle the daily maintenance of the implemented Encryption and integration for each application

Transition activities shall include the following:

· Provide documentations of followings

· Requirements and scope

· Risks and issues

· Solution architecture

· Details on software/ hardware licenses

· Standard operating procedures

· Automation scripts/ strategy

· Guidelines on implementation of encryption and integrations

· Step by step instructions of implementation of encryption and integrations with screenshots

· OneSDLC information

· Provide necessary training

· Develop the followings to include not limited to

· Training plan and Curriculum

· Encryption and Integration documented training materials

· Video/ Audio training materials

· Virtual classroom sessions

· Conducts Training

· Coordinate with EOps and conduct transition activities.

Desired Outcome: Plan, schedule, prepare and conduct transition tasks to include documentations and training to Enterprise operations to handle operations and maintenance after the implementation.

4.0 DELIVERABLES

The contractor shall be responsible for, and its performance will be measured by, the timeliness and quality of the deliverables set forth below.

4.1 Task Order Kickoff Meeting

Within five (5) business days of task order award, the contractor shall meet with Government representatives at a mutually agreed upon location or via teleconference. The intent of this meeting is to initiate the communication process between the IRS and the contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The completion of this briefing shall result in the following:

· The IRS may show the applicable facilities to the contractor if work will be performed on at an IRS site.

· The Government may provide Government Furnished Equipment (GFE) and/or Government Furnished Information (GFI)

· Any issues concerning the contractor employee security clearances will be discussed.

· The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this Performance Work Statement.

· The contractor shall provide meeting notes (inclusive of any follow-up actions) to the Government within five (5) business days after the meeting.

4.2 Schedule of Deliverables

The contractor shall provide the deliverables as described in Table 1 below during the performance of this Task Order. All contractor deliverables or work products shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government. The deliverables and work products will be provided in electronic format and shall comply with all applicable standards of Section 508 of the Rehabilitation Act.

The final format and content requirements, if not stated in the performance work statement (PWS), may be mutually developed and agreed upon among the IRS Program Manager (PM), the contractor and the contracting officer’s representative (COR).

Table 1: Schedule of Deliverables

Task Area 1. Program Management Support

Task Area 2. Project Management Support

Task Area 3. One Solution Delivery Life Support

Task Area 4. Technical Integration

30 days after award

Task Area 5. Transition Support

Task Order Kickoff Meeting

4.3 Submission of Deliverables

Any deliverable that does not comply with the acceptance criteria outlined in the PWS or the Quality Assurance Surveillance Plan (QASP) shall be considered rejected. Unless otherwise agreed upon by the contractor and the COR or otherwise specified in the Task Order, the COR shall provide written feedback on deliverables within ten (10) business days. The contractor shall provide revisions within five (5) business days of receipt of the COR’s feedback. The number of days allotted to the contactor for re-submission of deliverables may be adjusted if agreed upon by both parties. If the vendor has not been notified of any discrepancies within ten (10) business days after submission of the deliverable or successful completion of a task, the deliverable or task shall be considered accepted.

Unless otherwise specified in the Task Order, all deliverables/ work products shall be provided no later than 4:00 p.m. EST on the applicable due date(s).

4.4 Documentation Requirements

The contactor shall provide all documentation in Section 508 compliant electronic format and, upon request by the Government, in hard copy format. The Government will have the right to request suppression of hard copy deliverables in cases where security and privacy concerns are a factor, or to reduce paperwork burden. All deliverables resulting from work executed under this contact shall convey to the Government. In addition to the requirements set forth in the QASP, all documentation shall be provided in accordance with the criteria set forth below:

· Completeness – The document demonstrates sufficient level of detail to show understanding of the requirements, technology and design, customers and operating environment.

· Feasibility - The document defines information, which is formatted properly, contains valid information in support of this task order and provides a deliverable within time constraints.

· Understandability - The document is to be clean, clearly written, all printed words are legible, and the outline is easy to follow. All diagrams are easy to understand and relevant to the supporting narrative.

· Accuracy – The document is accurate in presentation exhibiting clear and concise information, technical content, and adherence to accepted elements of style, operational content, and consistent within itself and with other documents.

· Practicality - The document provides information and guidance that is practical for implementation within the IRS environment and appropriate given the subject organization’s level of maturity.

5.0 QUALITY CONTROL PLAN

The Contractor shall develop, implement, maintain, and utilize a QCP which correlates to the Performance Requirements Summary and Quality Assurance Surveillance Plan (QASP) throughout the life of the contract. The QCP is designed to implement a standardized methodology for monitoring and documenting Contractor performance. The QCP should be a detailed, well-written plan providing the Government an understanding of services and associated Key Performance Indicators (KPIs) to be performed. Following initial approval, the QCP will be reviewed by the Government and modified by the Contractor on a semi-annual basis.

Within 30 calendar days after task order award, the contractor shall submit a copy of the comprehensive written Quality Control Plan (QCP) to the COR and the CO for review and agreement, and within five (5) business days when changes are made thereafter.

The QCP must contain, at a minimum:

• A description of the inspection system that shall cover all services in the QASP. The description must include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspection, and the title and organizational placement of the inspectors.

• A description of the methods used for identifying and preventing defects in the quality of service performed.

• A description of the records that shall be kept to document inspections and corrective or preventive actions taken.

The records shall be kept and made available to the contracting officer, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims under this contract.

6.0 PERIOD OF PERFORMANCE

The period of performance of this Task Order shall be from date of award for a base period of twelve (12) months and option period of twelve (12) months. The anticipated start date is March 3, 2025.

7.0 PLACE OF PERFORMANCE

All work under this Task Order shall be performed at the contractor’s site and the New Carrollton Federal Building, 5000 Ellin Road, Lanham MD 20706.

Within the National Capital Region, expenses incurred traveling between Washington, D.C., Maryland and Virginia for work performed in New Carrollton, Maryland will not be reimbursed.

Any and all other travel must be within 50 miles of the designated IRS facility the contractor is supporting in order to be considered local travel.

8.0 GOVERNMENT FURNISHED PROPERTY (GFP) AND INFORMATION (GFI)

Government furnished property (to include material, equipment, and/or information) shall be provided in the performance of this Task Order. The IRS will provide the following property:

Government furnished information (to include manuals, notes, memos, instruction materials, and other information) shall be provided during the performance of this agreement. The IRS will provide the following information

Access to standards and guidelines and any other documentation that is required for the satisfactory performance of this requirement will be made available to the contractor no later than five (5) business days after request.

The issuance, handling and disposition of GFP shall be conducted in accordance with FAR 52.245-1, Government Property, Alternate I, 52.245-9, Use and Charges and the requirements set forth in Section 11, Security Requirements. All GFP/GFI shall be returned to the Government upon contract completion, as appropriate.

9.0 TRAVEL

The Contractor may be required to travel in performance of this task order. Travel must be approved in advance by the COR, in writing, prior to the actual travel days. Travel will only be reimbursable to the extent it is authorized by the COR prior to actual travel days. Local travel will not be reimbursed. Cost for transportation and per diem shall be in accordance with the Federal Travel Regulations, including tax on lodging. Allowable travel and per diem charges are governed by Public Law 99 - 234 “Title II-Travel Expenses of Government Contractors” and Federal Acquisition Regulation (FAR) Part 31.205-46 “Travel Costs” and are reimbursable by the Agency.

The actual travel expenditures will be processed on the Contractor’s invoice as Cost Reimbursables items. The Contractor shall provide all documentation to support the Travel items, including the prior written travel approval. Costs not supported by adequate documentation shall not be reimbursed.

10 SECURITY REQUIREMENTS

In accordance with Title III of the E-Government Act of 2002 (Public Law 107-347), also known as the Federal Information Security Management Act of 2002 (FISMA), which requires each federal agency to provide security for the information and information systems that support the operations and assets of the agency and Internal Revenue Manual (IRM) 10.8.1, which provides overall security control guidance for the IRS, the contractor shall comply with the following IRS security clauses and provisions:

1. FAR 52.204-9 – Personal Identity Verification of Contractor Personnel (JAN 2011)

2. FAR 52.224-1 – Privacy Act Notification (APR 1984)

3. FAR 52.224-2 – Privacy Act (Apr 1984)

4. FAR 52.239-1 – Privacy or Security Safeguards (AUG 1996)

5. Submission of Security Forms and Related Materials (APR2024)

6. Notification of Change in Contractor Personnel Employment Status, Assignment, or Standing (APR2024)

7. IRS Specialized Information Technology (IT) Security Training (Role-Based) Requirements (APR2024)

8. Safeguards Against Unauthorized Disclosure of Sensitive but Unclassified Information (APR2024)

9. Mandatory IRS Security & Privacy Training for Information Systems, Information Protection and Facilities Physical Access (APR2024)

10. Staff-Like Access, Use or Operation of IRS Information Technology (IT) Systems by…