DRAFT CIG BPA PWS.pdf

CIG Performance Work Statement

Contents

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 INTRODUCTION

C.1.1BACKGROUND

C.2 CIG OBJECTIVES

C.2.1 Contract Assumptions C.2.2 Contract Constraints

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

C.3.1 Service and Program Integration Services C.3.1.1 Program Management C.3.1.2 Service Delivery C.3.1.3 Service Integration Work Request Support C.3.1.4 Support for IRS Enhanced Activities C.3.2 Infrastructure Services C.3.2.1 Foundation C.3.2.2 Reliability C.3.2.3 Operation C.3.2.4 Performance C.3.2.5 Infrastructure Work Request Support C.3.3 Application Hosting Services C.3.3.1 Application Hosting Support C.3.3.2 Capacity Management C.3.3.3 Incident Management C.3.3.4 Problem Management C.3.3.5 Monitoring C.3.3.6 Application Infrastructure Integration Services (AIIS) C.3.3.7 Configuration and Change Management C.3.3.8 Service Catalog C.3.3.9 Service Desk C.3.3.10 Web User Analysis Data Collection and Analytics C.3.3.11 Hosting Work Request Support C.3.4 Security Services C.3.4.1 Security Risk Management Framework

C.3.4.2 Patch and Vulnerability Management C.3.4.2.1 Vulnerability Management C.3.4.2.2 Patch Management C.3.4.2.3 Cloud Security Management C.3.4.2.4 Reporting and Visibility C.3.4.3 Plan of Action and Milestones (POA&M) C.3.4.4 Security Continuous Monitoring C.3.4.4.1 Continuous Monitoring C.3.4.4.2 Asset Management C.3.4.5 Security Configuration and Change Management C.3.4.6 Security Audit C.3.4.7 Incident Handling C.3.4.8 Business Continuity C.3.4.9 Security Control Assessment (SCA) and Contractor Security

Assessment (CSA) C.3.4.10 Defensive Cyber Operations C.3.4.11 Portal Applications Security C.3.4.12 Security Policy C.3.4.12.1 Protecting Taxpayer Data C.3.4.12.2 Access Management C.3.4.12.3 Authority to Operate (ATO) Management C.3.4.12.4 Conformance C.3.4.13 Security Work Request Support C.3.5 Cloud Professional Services C.3.6 Transition Services C.3.6.1 Operational Transition C.3.6.2 Transition from CIG Operations C.3.6.3 Transition Work Request Support

C.4 PERFORMANCE REQUIREMENTS, STANDARDS AND SURVEILLANCE

C.4.1 Performance Requirements C.4.2 Performance Standards C.4.3 Surveillance

C.5 GOVERNMENT - FURNISHED PROPERTY

C.6 GOVERNMENT - FURNISHED INFORMATION

APPENDICES

TABLE OF FIGURES

Figure 1: IEP 1.5 High-Level Architecture

Figure 2: IRS Cloud Workload High-Level Architecture

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK

STATEMENT

C.1 INTRODUCTION

The Internal Revenue Service (IRS), Web Infrastructure Services (WISD), has embarked on a transformation for its web portals referred to as the Integrated Enterprise Portals (IEP). The IRS seeks multiple qualified Managed Service Providers (MSP) to deliver, operate, and manage integrated Customer Integration Gateway (CIG) services for multiple workloads and to evolve CIG services as needed to support the changing dynamics of the many requirements due to Congressional mandates placed on the IRS.

The CIG MSPs will provide the IRS with secure application hosting services, allowing it to deliver business functionality to its various stakeholders, including taxpayers, tax preparers, and employees. The CIG MSPs delivers these services through fully scalable, virtualized environments and cloud services that are dedicated to the IRS. The CIG MSP provides core services, including IT infrastructure, operations, security, application integration and support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles.

(Refer to the Current State of the IEP Systems and Services, for details of the existing landscape).

The IRS is seeking multiple MSPs to design, gain accreditation for, and implement services that will satisfy the requirements in the PWS; support the scope and scale defined in the Current State of the IEP Systems and Services; and meet the quality levels defined in the, QASP Performance Standards. The MSPs will provide fully managed, scalable hosting services for applications that are accessed by IRS’ external stakeholders and its internal customers. The selected Contractors will be responsible for providing all labor, hardware, software, equipment, materials, communications, facilities, and other IT infrastructure necessary to implement, deploy, operate, manage, and support the CIG-hosted applications and services in a Federal Information Security Management Act (FISMA) “Moderate” secure environment.

C.1.1BACKGROUND

According to the Internal Revenue Manual (IRM) Part 2.25.2, the IRS standards dictate that “…interactive and batch electronic connections are organized through as few portals as feasible and that the use of those portals is appropriate to the IRS’ mission.” The current IEP has evolved into primary gateway for external users – including taxpayers, third-party tax preparers, and other business partners – and internal users – IRS employees and contractors with staff-like access – to access IRS business services.

The current IEP vendor provides a range of application development, hosting, security, and operations services for over 90 IRS business applications. Some of the IEP-hosted application suites, such as Modernized eFile (MeF) and Integrated Customer Communications Environment (ICCE), include multiple applications that are critical to the IRS’ core mission:

delivering a successful Filing Season annually.

The IEP 1.5 vendor delivers IEP capabilities through managed services. Table 1: IEP 1.5 Contract Service Areas provides a brief overview of the IEP contract service areas.

Table 1: IEP 1.5 Contract Service Areas

IEP 1.5 Service Area Description Portal Service and Program Integration Services

Provide IEP program and contract management to ensure quality service delivery.

Portal Infrastructure Services Provide and manage a cloud-like, private, virtualized infrastructure to host the IEP environment and services.

Portal Web Hosting Services

Provide comprehensive hosting support for applications accessed by external users and organizations. Services include IEP monitoring, incident management and application infrastructure Integration.

Portal Security Services Deliver IEP Active/Edge Cyber defense and analytics. Services include security compliance and ATO maintenance.

Portal Application Services

Provide full life-cycle engineering support for IEP-hosted applications, including operations and maintenance. Services include IRS.gov content management hosting. (Application services (for full application lifecycle development) are not included in the CIG acquisition)

Portal Website Help Desk Services Provide the IRS.gov Help Desk for taxpayers, including IEP website questions and navigation. (Help Desk services are not included in the CIG acquisition)

Transition of Portal Operations Services

Provide IEP services operations transition to other IRS designated service provider(s).

The IEP 1.5 is designed and implemented to modernize the IRS technology platform with a fully scalable, managed private cloud capability to provide a consistent, unified customer experience in a cost-effective manner. Figure 1: IEP 1.5 High-Level Architecture provides a brief illustration of the system.

IRS Protected Zone:

Enterprise Computing Center (IRS Managed)

IRS Integrated Enterprise Portal 1.5 (IEP MSP Managed)

External Entities

(Agencies, Trading

Partners, etc.)

ECC

ECC

Content Delivery Network

Drupal PaaS (IEP MSP provided) Web Content Management

System – IRS.gov

CSP GovCloud (IEP MSP provided)

MSP Provided Infrastructure

Affordable Care Act (ACA) Apps

Employee User Portal (EUP) Apps

Registered User Portal (RUP) Apps

Public User Portal (PUP) Apps

Legacy & Modern Applications

Data Storage

Networks

IAM

Legacy & Modern Applications

Data Storage

Networks

IAM

Internal IRS Users

(Employees)

External Users

(Tax Payers)

Registered User Portal (RUP) Apps

Public User Portal (PUP) Apps

IEP Service Offering

PaaS

Other IEP Service Catalog Services

Data StorageNetworks IAM

IEP Service Offering

PaaS

Other IEP Service Catalog Services

CSP Services

IAM Data Storage

Figure 1: IEP 1.5 High-Level Architecture

The IEP vendor delivers web-based services for internal and external users through multiple integrated sub-components. These components are described below.

Table 2: IEP 1.5 Components

IEP Component Description

Public User Portal (PUP) • Consists primarily of the www.irs.gov website and was created to be the online presence of the IRS

• Disseminates tax news and information

• Intended to store non-Sensitive But Unclassified (SBU) information that pertains to Treasury Department Publication (TDP) 85-01 regulations

Registered User Portal (RUP) • Provides the essential security and technology components required for web access to modernized IRS business applications

• Comprised of a web-enabled, electronic commerce infrastructure that provides secure browser-based application services for tax practitioners and taxpayers

Employee User Portal (EUP) • Provides IRS employees and registered users with web-enabled access to conduct tax administration transactions through both the portal and Enterprise Application Integration Broker (EAIB) systems

Transactional Portal Environment

(TPE)

• Provides the essential security and technology components required for secure structure data exchange between the IRS and the Centers for Medicare and Medicaid Services (CMMS) and other agencies external to the IRS

In addition to the components described above, the IEP vendor has been tasked to implement and support additional hosting solutions that enable the IRS mission, including establishment of common services to support Treasury Cloud integration. Figure 2: IRS Cloud Workload High- Level Architecture depicts the cloud integration.

ATT

Netbond

Treasury Cloud (GFE)

IRS Hosted Applications (IEP MSP Integration/O&M)

Application Service

Database Service

IRS NetHub (IEP MSP Integration/O&M)

Trusted Gateway

IRS Protected Zone:

Enterprise Computing Center (IRS Managed)

ECC

ECC

Legacy & Modern Applications

Data Storage

Networks

IAM

Legacy & Modern Applications

Data Storage

Networks

IAM

Internal IRS Users

(Employees)

Figure 2: IRS Cloud Workload High-Level Architecture

C.2 CIG OBJECTIVES

The CIG Managed Service Provider (MSP) vendors will provide services that support the IRS core mission, annual delivery of Filing Season. Continuity of CIG services to support current and future services and technologies is key to supporting the IRS mission.

The CIG Acquisition has the following objectives:

• Serve as a transition phase to enable the agency to implement a Customer Integration Gateway (CIG) as a future state for infrastructure under IRS control to deliver increasingly more complex solutions to taxpayers more quickly.

• Design, gain accreditation for, and implement services that will satisfy the requirements in the PWS; support the scope and scale defined in the Current State of the IEP Systems and Services; and meet the quality levels defined in the QASP Performance Standards.

• Ensure continuity for IEP services and provide access to IRS business systems and services and Taxpayer Transmission capabilities.

• Provide CIG services that efficiently leverage technology over the project's life cycle and accommodate service changes driven by IRS policies and business mandates.

• Complete transition of all IEP services to approved CIG operations prior to the end of IEP 1.5 contract period of performance.

• Enhance IRS oversight and accountability for CIG services by using efficient IT service management processes to continually improve taxpayer experience and enhance customer service.

• Strengthen the CIG security posture by improving processes and utilizing tools to identify, report, and correct or mitigate security-related incidents and anomalies.

• Improved IRS visibility into application hosting costs.

• Minimize the risk, time, and cost required to transition between contracts/vendors.

• Accommodate application modernization to improve portability.

The IRS requires vendor support to provide expertise in program and project management, technical solutions and analysis, and system integration support to integrate modernized business solutions into the IRS. The support is required in all dimensions of the CIG Program, including supporting the deployment of new applications to meet IRS future business needs.

C.2.1 Contract Assumptions The below section describes the contractual assumptions.

Table 3: Contract Assumptions

Assumption Description CIG will continue to be the primary means for the IRS to provide business services to external stakeholders (e.g., taxpayers) based on current IRS policy (primary purpose of the portal is to support external interactions, not internal) The portal will be required to support currently undefined/unknown future IRS business requirements and needs based upon previous historical precedence (e.g., ACA, FATCA, ECM) Enterprise Operations (EOps) will be the organization responsible for the oversight and management of the CIG services (run by the Director of WISD) The solution/alternative will minimize unplanned organizational change impacts to business processes and roles/responsibilities CIG services will support cloud-based application and data hosting solutions

CIG services will support legacy hosting environments

CIG services will be able to scale up and scale down according to demand

Current/modern technology will be leveraged and inserted as it becomes available and driven by business requirements CIG services will provide users with the ability to monitor application performance in CIG environments

The solution will provide an integrated view of portal services.

The solution/alternative will provide additional visibility into service costs (e.g., O&M costs by application).

Service levels will be optimized to meet IRS requirements

CIG service management processes will be able to integrate with IRS processes.

C.2.2 Contract Constraints The below section describes the constraints associated with the contract.

ELM ID CIG Req ID Constraint Description 1364803 PLS-PLC-400 Constraint: Delivery of the proposed solution must comply with all applicable Internal Revenue Manuals (IRMs) - refer to the Solicitation Section C, Appendix B - References.

1364804 PLS-PLC-500 Constraint: In the absence of IRS policy, delivery of the proposed solution must comply with all applicable National Institute of Standards and Technology (NIST) Special Publications and manuals, Current Version.

1364805 PLS-PLC-600 Constraint: The proposed solution must provide an IT infrastructure where all facilities, hardware, software, network, and network connections are located in the United States of America.

1364807 PLS-PLC-800 Constraint: The proposed solution must deliver an infrastructure, including the operation of all devices, in a dual stack (IPv4/IPv6) environment in compliance with FAR requirement on Internet Protocol Version 6 (IPv6) - refer to FAR Section 511.170 Information Technology Coordination and Standards.

1364808 PLS-PLC-900 Constraint: All items delivered in the proposed solution and throughout the lifecycle of this contract must function and transmit, receive, and process data by using the IPv6 in compliance with current USGv6 Profile - refer to NIST SP 500-267B Revision 1.

1364907 PLS-PLC-1200 Constraint: All solutions must comply with the IRS One System Development Lifecycle processes, where applicable.

2665549 PLS-PLC-1210 Constraint: CIG services must align to key IRS strategic initiatives (e.g., Modernization Plan, Technical Roadmap)

2665550 PLS-PLC-1220 Constraint: CIG services must comply with Government security, privacy, and regulatory requirements (e.g., FedRAMP security controls, NIST SP 800-53, HIPAA, NARA)

2665551 PLS-PLC-1230 Constraint: The ability of IRS IT organization to hire additional staff with appropriate skillsets will be limited.

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

This Performance Work Statement (PWS) describes the scope and expectations for a Performance-Based Acquisition with mission-oriented, outcome-driven performance measures and incentives. The tasks performed in this acquisition will leverage a multi-vendor managed service provider approach to enhance the IRS's ability to operate, sustain and transform the services required to securely host IRS business applications and services. It will enable the

CIG services will be capable of supporting migration of CIG applications to the cloud.

CIG services will integrate with other IRS MSPs.

CIG services will be capable of supporting emerging IRS application and common services standards.

CIG services may be utilized to modernize applications.

CIG services will comply with applicable IRS common services and standards.

agency to transition to a future state for infrastructure under IRS control to deliver increasingly more complex solutions to taxpayers more quickly and offer multiple delivery platforms within the CIG application hosting services and operations. By working with multiple service providers, the IRS can access a wider range of talent and general subject matter depth, with the best provider for each specific task or project’s required period of performance. The scope of work to be performed is envisioned to include the following distinct operational service areas:

Table 4: CIG Contract Service Areas

CIG Service Area Description

Service and Program Integration Services

Provide CIG program and contract management services to ensure delivery of high-quality integrated services.

Infrastructure Services Provide and manage an infrastructure to deliver the CIG environments and services.

Application Hosting Services Provide comprehensive hosting support for applications accessed by external users and organizations. Services include CIG monitoring, service management, capacity management and application infrastructure integration.

Security Services Provide secure CIG environments to minimize risk to IRS data, applications, services, and users. Deliver CIG Active/Edge Cyber defense and analytics. Services include security compliance and ATO maintenance.

Cloud Professional Services Provide CIG services needed to support application hosting, integration, and operations for IRS workloads provisioned and deployed in IRS provided cloud environments.

Transition Services Provide CIG services operations transition to and from other IRS designated service provider(s) while minimizing risks to CIG service continuity and operations.

C.3.1 Service and Program Integration Services The objective of the Service and Program Integration Services is for the vendor to provide the management necessary to deliver CIG services at the quality levels defined by the applicable service level objectives (SLOs). The requirements in this section are intended to request solutions from the vendor regarding how it will ensure quality service delivery.

C.3.1.1 Program Management ELM ID CIG Req ID Contents

1369972 PSPIS-FR-100 The Contractor shall document and maintain a Program Management Plan that describes management processes, risk management (including supply chain risks), organizations, and tools that will be used to ensure timely delivery of quality products and services. The Contractor shall define the Program and Project Management approach to integrate program management activities and effective service delivery across all task orders issued for CIG services.

ELM ID CIG Req ID Contents

1369974 PSPIS-FR-1100 The Contractor shall provide a Program Manager who will be responsible for all CIG contract service delivery and work performance. The position of Program Manager is considered to be a Key Personnel. The Program Manager shall ensure that the Contractor satisfies all requirements.

1369975 PSPIS-FR-1200 The Program Manager will serve as the primary focal point for communication with the IRS CIG Program Manager, IRS Executive and Senior leadership, the Contracting Officer (CO), and the CO's Representative (COR). The Program Manager shall act as the central point of contact with the Government for all program-wide technical issues and provide Program Management and Control to manage all CIG services performed under this contract within specified scope, quality, time, and cost objectives.

1369977 PSPIS-FR-1400 The Contractor shall identify subordinate functional and/or technical Project Managers to lead all IRS Customer Integration Gateway (CIG) key processes and ongoing project work.

1369978 PSPIS-FR-1500 The Contractor shall participate in periodic and ad hoc meetings with the Government, as defined by the Task Orders awarded under this contract.

1369979 PSPIS-FR-1600 The Contractor shall support meetings with the Government, including:

agendas, meeting materials (as required), meeting minutes, and action items.

1369989 PSPIS-FR-2500 The Contractor shall collect and report Earned Value Management (EVM) data for work designated as Development Modernization or Enhancement (DME) in compliance with the provisions of the latest Treasury Acquisition Bulletin and the Treasury Earned Value Management Guide. EVM reporting will only by required for those projects which are within the thresholds established in the Treasury EVM Acquisition Bulletin.

1369971 PSPIS-FR-3090 The Contractor shall: include all budget amounts in the reported EVM data, whether allocated or not, load such data into all required formats of the Contract Performance Report (CPR) and ensure validity before transmitting to IRS. The calculation of EVM metrics (e.g., BCWS, BCWP and ACWP) shall comply with the guidelines and rule sets established in the Treasury EVM policy. Undistributed Budget (UB) will only be reported at the WBS level associated with the appropriate contract, task order or interagency agreement.

1369948 PSPIS-FR-3120 The IRS requires CPR formats 1, 3 and 5 to be provided on a monthly basis.

1369994 PSPIS-FR-300 The Contractor shall document a staffing plan in its Program Management Plan that details how it will ensure that it can effectively staff new projects.

1369946 PSPIS-FR-3010 The Contractor shall deliver a Project Management Plan (PMP) to document its processes and procedures to manage and control project execution. The PMP shall include a scope statement, including project deliverables, Work Breakdown Structure (WBS), project schedule, project organization including roles and responsibilities, and the results of an initial risk assessment of the project. The PMP shall also document the Contractor’s approach to performing change management and version control for contract deliverables and work products, quality management, and risk management.

1369957 PSPIS-FR-3020 The Contractor shall document an Operations Management Framework that clearly delineates their managed service lifecycle approach including, at a minimum, the equivalent of the most current version of ITIL practices.

1369969 PSPIS-FR-3070 The Contractor is required to maintain, and report detailed information about project performance, schedule and cost, as well as activity progress, on a monthly basis for project control.

1369970 PSPIS-FR-3080 The Contractor shall prepare and submit a Contract Performance Report (CPR) each month describing the amount of work scheduled and achieved to date and the actual costs associated with that work (Format 1), baseline (Format 3), and variance analysis and explanations (Format 5). The Contractor shall prepare and submit the IRS Contract Performance Reports. All tasks supporting a single deliverable or work product, regardless of the owner/supplier of each task, shall be organized together and roll up to a single CWBS element and summary level task in the project schedule.

1369996 PSPIS-FR-3100 The Contractor shall develop a detailed project schedule that provides sufficient detail to effectively manage the project and minimize delivery risk.

1369949 PSPIS-FR-3130 The Contractor shall establish an overall framework for planning and executing continuous improvement for CIG. Contractor shall reserve 1% of the awarded contract value for innovation activities. The management and spending of innovation funding and its associated innovation activities shall follow IRS Innovation governance process.

1369950 PSPIS-FR-3140 The Contractor shall support all changes as needed by the IRS to the underlying SLO for Performance Targets around Requests, Changes and Releases on the CIG. The Contractor shall routinely report Service Level Objectives metrics.

1369951 PSPIS-FR-3150 The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 and any related IRS guidelines.

2656807 PSPIS-FR-3210 The Contractor shall deliver all formal and work products by following IRM 2.150.2.3 Configuration Identification Index and Document Versioning Guidelines.

C.3.1.2 Service Delivery

1369981 PSPIS-FR-1800 The Contractor shall provide support to CIG stakeholders for IRS governance boards, as required.

1369983 PSPIS-FR-200 The Contractor shall document, execute and maintain a Service Delivery Framework that follows the IRS enterprise processes and incorporates industry best practices (e.g., ITIL). The Contractor shall obtain IRS permission prior to deviation from any IRS enterprise process.

1370005 PSPIS-FR-400 The Contractor shall provide a Communications Plan that describes its stakeholder engagement approach to ensure customer satisfaction.

1408937 PSPIS-FR-430 The Contractor shall provide an integrated service dashboard view across all service areas for near-real time visibility of critical service metrics and status conditions.

1375393 PSPIS-FR-410 The Contractor shall provide an integrated service dashboard with the capability to show service consumption information necessary to reflect service unit consumption and cost over specified time periods. The service consumption information should include granularity necessary to understand CIG hosting costs per hosted IRS application ecosystem (i.e.: at the IRS business service level).

2656808 PSPIS-FR-415 The Contractor shall provide all data/information generated under this contract to the IRS when requested. This includes all data generated by Contractor solutions (e.g., log files, system configuration), as well as information generated through support services (e.g., OEM ticket information, slides, capacity reports).

1375394 PSPIS-FR-420 The Contractor shall perform continuous process improvement for CIG processes across all CIG services. The objective for CIG process improvements should focus on improving the service delivery quality and reflect improvements considered beneficial to the IRS The Contractor will work with CIG staff and stakeholders to identify beneficial targets for improvement.

1408933 PSPIS-FR-110 The Contractor shall comply with the IRS delivery model process for new projects, as required in accordance with IRM 2.31.1.

1408934 PSPIS-FR-1110 The Contractor shall allocate Program Management costs to a single active task order.

1408935 PSPIS-FR-1410 The Contractor shall empower Project Managers to coordinate with IRS stakeholders and make decisions to facilitate task delivery

1408932 PSPIS-FR-1810 The Contractor shall be capable of providing administration support for the operation of a CIG Technical Review Board (EOps TRB SOP).

1408938 PSPIS-FR-440 The Contractor shall provide an integrated service dashboard with the capability to display any operational data reporting elements specified in CIG service area requirements.

1408939 PSPIS-FR-450 The Contractor shall provide an integrated service dashboard capable of tracking service request status from service initiation through service fulfilment. Once the service is operational, the dashboard should display the critical service metrics along with actionable insights and drilldown capability to the lowest service component supporting the service delivery.

1369965 PSPIS-FR-3030 The ITIL Operations Management Framework shall establish a sound Operations program that maintains the integrity of the IRS Integrated Enterprise Portal Program systems and provides operational continuity for activities performed in the environment. It shall enable repeatable service management of Information Technology (IT) components as they evolve in all stages of portal development and transition, and into operations. Any updates to this framework will be provided on a semi-annual basis.

1369966 PSPIS-FR-3040 The Contractor shall propose an ITIL-based Service Strategy process in partnership with the IRS to seek new solutions and initiatives for business problems, and provide proactive recommendations and assessment.

1369967 PSPIS-FR-3050 The Contractor shall develop and maintain an Integrated Master Schedule which incorporates the Contractor, Subcontractor, and IRS stakeholder detailed tasks necessary to ensure successful project execution.

1369968 PSPIS-FR-3060 The Contractor shall propose a methodology for program measurement in the Quality Assurance Program, including a process for developing, implementing, and monitoring a set of performance measures to ensure that program activities are effectively and efficiently supporting both business and IT strategies. This includes implementing program-wide measures, quantifiable outcomes, and providing an approach for monitoring actual-versus-expected performance.

2656809 PSPIS-FR-3220 The Contractor will develop solutions that utilize enterprise common services and standards.

C.3.1.3 Service Integration Work Request Support The objective of Service Integration Work Request Support is for the Contractor to be capable of providing additional services to meet work request requirements.

The Contractor, at the option of the IRS, may be tasked to deliver additional CIG services to support new capabilities in response to evolving IRS business requirements and legislative mandates. When required, the Government will issue Work Requests (WRs) for the Contractor to perform this work. These work requests are intended to be in addition to forecasted CIG service demand and capacity flexibility as required by CIG capacity, scalability, and performance management requirements.

2559808 PSPIS-FR-3160 The Contractor shall be capable of supporting IRS issued work requests (WR) to support new IRS capability requirements.

2559809 PSPIS-FR-3170 The Contractor shall integrate the CIG WR process with the service catalog and CIG governance processes (e.g., Technical Review Board, EOps TRB SOP).

2559810 PSPIS-FR-3180 The Contractor shall develop a WR process to include developing a Very Rough Order of Magnitude (VROM) estimates to support the approval process for draft WRs in accordance with IRM 2.22.1 Unified Work Request (UWR) Process.

2559811 PSPIS-FR-3190 The Contractor shall provide VROM estimates and WR responses that include the following:

a. Description of the technical work to be accomplished to deliver WR requirements

b. Planned schedule to support the WR and meet the WR objectives

c. Level of Effort estimates based on CIG services required to support the WR

d. Assumptions and Constraints associated with the proposed technical solution, cost and schedule

C.3.1.4 Support for IRS Enhanced Activities

The objective of Support for IRS Enhanced Activities is for the Contractor to be capable of supporting IRS activities and support requirements for enhanced activities such as Filing Season and Affordable Care Act (ACA) Open Enrollment. Support includes accommodating increased traffic volume for business systems, enforcing more stringent deployment guidelines, and enabling enhanced service management requirements (e.g., Incident Management, Problem Management, and Capacity Management). During readiness activities, there is a specific escalation of approval levels defined in the IRS Production Environment Control Process for business services and applications impacting production environments.

IRS conducts Filing Season every year, usually extending from January 1st through April 30th.

During the Filing Season, IRS expects increased traffic volume for business systems.

Accordingly, IRS usually performs readiness activities prior to the Filing Season and implements enhanced Filing Season support activities during the Filing Season.

IRS ACA Open Enrollment periods are defined as periods when a large number of citizens are expected to enroll in the ACA via a healthcare exchange and when information verification will be required with IRS via the CIG ACA TPE and ISS. A large number of transactions on the CIG ACA TPE and ISS are expected during this period. This period has generally occurred during the following months:

1. Annual Exchange Enrollment Period: January – April – 1095B/C Submission Period

2. Exchange Enrollment Period: November – January

Accordingly, IRS usually performs readiness activities prior to Open Enrollment period and enables enhanced support activities during the Open Enrollment period.

1369984 PSPIS-FR-2000 The Contractor shall ensure CIG services meets IRS business demands during IRS enhanced readiness activities (e.g., Filing Season and ACA Open Enrollment).

2559813 PSPIS-FR-2010 The Contractor shall ensure CIG service management meets IRS business demands during enhanced IRS readiness activities (e.g., Filing Season and ACA Open Enrollment).

1369985 PSPIS-FR-2100 During enhanced IRS readiness activities, the Contractor shall comply with the more stringent IRS deployment control and approval processes (i.e., Production Environment Control Process).

C.3.2 Infrastructure Services The objective of the Infrastructure Services is for the vendor to provide the infrastructure necessary to deliver CIG services. Infrastructure includes facilities, hardware, software, middleware, network connectivity, operating system, compute resources, storage, and peripherals. It is the government’s intent that for any commercial cloud services required to host IRS cloud-hosted applications, the IRS will be the “Owner” and “Account” holder of any Cloud Service Provider (CSP) subscription accounts supported under the CIG requirements, with all associated rights and responsibilities. Accounts/subscriptions established on the IRS’s behalf in performance of CIG service delivery and application hosting are to be considered Government Furnished Equipment (GFE). The requirements in this section are intended to request solutions from the vendor regarding how it will deliver infrastructure services to support existing and future CIG service needs.

C.3.2.1 Foundation ELM ID CIG Req ID Contents

1382587 PIS-FR-100 The Contractor shall document the CIG infrastructure, including the physical facilities, system architecture, components, and services necessary to establish this infrastructure; and all IRS applications' workloads hosted in this infrastructure.

1382594 PIS-FR-200 The Contractor shall design the CIG infrastructure to host all current IRS CIG applications' workloads, development workflow, and development dependencies.

1385041 PIS-FR-210 The Contractor shall design the CIG infrastructure to host new IRS applications' workloads and development dependencies.

1382596 PIS-FR-400 The Contractor shall design the CIG infrastructure to enable access to all IRS applications' workloads, which are hosted in this infrastructure, over secure communications network.

1385028 PIS-FR-410 The Contractor shall design the CIG infrastructure to handle changes in demands or requirements of all IRS applications' workloads hosted in this infrastructure.

1382600 PIS-FR-800 The Contractor shall design the CIG infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized external users (users from IP addresses outside of IRS enclave) to access these IRS applications.

1385029 PIS-FR-810 The Contractor shall design the CIG infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized internal IRS users to access these IRS applications.

1385030 PIS-FR-820 The Contractor shall design the CIG infrastructure to allow authorized CIG applications to interface with systems and application components hosted in IRS Enterprise Computing Centers (ECCs). The workloads of all such CIG applications also shall be designed to enable this interface.

1385031 PIS-FR-830 The Contractor shall design the CIG infrastructure to allow authorized CIG applications to interface with systems and application components hosted in IRS Enterprise Cloud ecosystem. The workloads of all such CIG applications also shall be designed to enable this interface.

1385026 PIS-FR-1310 The Contractor shall design the CIG infrastructure to be able to control service request rates on API Gateways and web traffic to protect them from abuse.

2457775 PIS-FR-1800 The Contractor shall avoid the use of custom solutions in the CIG infrastructure and all IRS applications' workloads hosted in this infrastructure. The Contractor shall obtain the IRS concurrence on the need to use a custom solution.

1364768 PIS-FR-1810 The Contractor shall design and implement all IT infrastructure platforms by utilizing and meeting the accepted industry and Federal government interoperability requirements, standards, and best practices that minimize the dependence on custom or proprietary solutions.

TBD PIS-FR-1820 The Contractor shall provide the ability for authorized IRS staff to fully manage CIG accounts within the billing parameters of any cloud services.

TBD PIS-FR-1830 The Contractor shall provide a responsibility model (e.g., RACI) that delineates roles and responsibilities for unmanaged cloud services to include the Contractor’s role in account provisioning, financial governance, and core security (e.g., monitoring and incident response).

TBD PIS-FR-1840 The Contractor shall provide account administration to operate, maintain, and sustain any provided cloud hosting environment for the duration of ordered services.

C.3.2.2 Reliability

1383166 PIS-FR-1510 The Contractor shall design the IRS application's workload to scale to meet the workload demands. The term "application workload" is intended to indicate the underlying CIG services and resources allocated to the application necessary to support the application's execution and required performance across all CIG environments and development tool dependencies.

1383190 PIS-FR-1520 The Contractor shall design the CIG infrastructure to meet IRS availability and performance standards for all IRS applications’ workloads hosted in CIG infrastructure.

1383198 PIS-FR-1530 The Contractor shall design the CIG infrastructure with sufficient redundancies to support to all hosted applications' production availability requirements up to 24x7.

1383221 PIS-FR-1540 The Contractor shall design the CIG infrastructure with sufficient redundancies to support to all hosted applications' non-production availability requirements up to 24x7.

1383224 PIS-FR-1500 The Contractor shall maintain the CIG infrastructure in compliance with N/N-1 versions/standards allowable within IRS enterprise guidelines, unless exempted by IRS, and patch or replace them in accordance with IRM 2.17.1, Infrastructure Currency, Infrastructure Currency Policy for Software.

1382592 PIS-FR-1400 The Contractor shall support applications owners to ensure that applications will operate in CIG infrastructure refreshes.

C.3.2.3 Operation ELM ID CIG Req ID Contents

1385019 PIS-FR-1600 The Contractor shall evolve the CIG infrastructure to support improved operations and cost savings.

1385020 PIS-FR-1610 The Contractor shall design the CIG infrastructure to be capable of integrating with IRS enterprise systems and processes.

1385021 PIS-FR-1620 The Contractor shall design the CIG infrastructure to be capable of being decoupled from IRS enterprise systems and processes.

1385022 PIS-FR-1630 The Contractor shall design the CIG infrastructure to be capable of supporting automated provisioning.

1385023 PIS-FR-1640 The Contractor shall schedule joint exercises (e.g., game days) to test the CIG infrastructure; all IRS applications' workloads hosted in this infrastructure; the associated processes, procedures, and alarm solution; and verify that alarm solution recognizes issues correctly.

1385025 PIS-FR-1650 The Contractor shall work with IRS to establish metrics baselines for operational improvement, investigation, and intervention; collect and analyze metrics, and validate and report operations success and how the success changes over time.

C.3.2.4 Performance

2457772 PIS-FR-1700 The Contractor shall design the CIG infrastructure to enable provisioning of reliable, scalable, and secure storage to all CIG hosted IRS applications' workloads.

2457774 PIS-FR-1710 The Contractor shall design and provision network solutions to satisfy application requirements.

C.3.2.5 Infrastructure Work Request Support The objective of Infrastructure Work Request Support is for the Contractor to be capable of providing additional services to meet work request requirements, only as directed.

ELM ID CIG Req ID Contents

2556243 PIS-FR-1720 The Contractor shall provide CIG Infrastructure services necessary to meet specific work request objectives and requirements.

C.3.3 Application Hosting Services The objective of the Application Hosting Services is for the vendor to provide comprehensive hosting support for applications accessed by external users and organizations. Areas covered by these requirements include CIG environment creation and maintenance, service management (e.g., incident management, service catalog), and monitoring. The requirements in this section are intended to request solutions from the vendor regarding how it will deliver application hosting services to support existing and future CIG service needs.

C.3.3.1 Application Hosting Support ELM ID CIG Req ID Contents

1385707 PWHS-FR-100 The IRS is seeking to obtain CIG Application Hosting services. The Contractor shall define and document, in an Application Hosting Concept of Operations (CONOPS), its solution to provide application hosting support for development, testing, integration and production, including provisions for capacity management, incident management, performance monitoring, and infrastructure integration support.

1385709 PWHS-FR-300 The Contractor shall provision application development/testing/production environments according to the current AS-IS IEP specifications and IRS Enterprise standards, to include virtualized servers, containers, API gateways, Low Code Development Platform (LCDP), and security standards (Current State of the IEP Systems and Services).

1385710 PWHS-FR-400 The Contractor shall support release management for each application. Normally each application will have multiple releases and each release needs certain types of CIG application hosting environments. The Contractor shall provide lower-level (non-production) environments and production environments, as requested by each application team. CIG environments interfacing with IRS backend environments should align with the Enterprise-defined environment and security requirements. All CIG provisioned environments shall support flexible configuration options needed to support customer requirements.

1369876 PWHS-FR-600 CIG non-production environments shall be capable of being configured for IRS third-party (i.e., contractors other than CIG Contractors) application developers' access as needed to support external system integration testing.

1368144 PWHS-FR-700 The Contractor shall ensure all CIG non-production environments are synchronized with the corresponding CIG production environment.

1385713 PWHS-FR-1000 The Contractor shall demonstrate the accuracy, validity, effectiveness and maturity of the backup and restore capability, including, but not limited to, satisfying IRS authorized third party auditing needs with contractor's backup and restore parameters.

1390477 PAS-FR-700 The Contractor shall provide the O&M services for all CIG-hosted applications (contractor- and third party- developed), including:

i. Incident management process

ii. Problem management process

iii. Change management process

iv. Deployment process

v. Capacity management process

vi. Patching management process

vii. Technical Review Board process

1385714 PWHS-FR-1100 The Contractor shall provide Application Hosting Operations and Maintenance services in accordance with industry-leading practices for IT service delivery frameworks. The IT service delivery processes should align with IRS service delivery processes.

1385716 PWHS-FR-1300 The Contractor shall ensure CIG services satisfy availability SLOs, regardless of Contractor routine maintenance activities.

C.3.3.2 Capacity Management ELM ID CIG Req ID Contents

1385718 PWHS-FR-1400 The Contractor shall provide sufficient capacity to meet IRS business requirements at the applicable service levels (utilization, performance) in accordance with IRM 2.144 Capacity Management.

1385719 PWHS-FR-1500 The Contractor shall develop a Capacity Management Plan that details how its solution will comply with all applicable SLOs. This Capacity Management Plan will address all components necessary for CIG services (e.g.: systems processing, memory, storage, staffing and licensing for CIG).

1385723 PWHS-FR-1510 The Contractor shall have the ability to scale capacity to meet additional CIG service demand while still satisfying applicable SLOs (e.g., timeliness, utilization, performance).

1385724 PWHS-FR-1520 The Contractor shall have the ability to track and report capacity metrics for discrete components of the CIG environment (e.g., application servers, virtual machines).

1385725 PWHS-FR-1600 The Contractor shall develop Capacity Management plans and processes informed by industry best practices for service management (e.g., ITIL).

1385726 PWHS-FR-1700 The Contractor shall plan for future capacity demand changes by collecting inputs and requirements from available sources (e.g., historical demand change data and projections, stakeholder requirements).

1369918 PWHS-FR-2300 The Contractor shall provide a Capacity Management Plan which describes their process for capacity management to ensure that all current and future capacity and performance aspects of the CIG services are provided to meet business requirements.

1369917 PWHS-FR-2400 The Contractor shall provide the capability to access and view capacity information on-demand. The capacity information available should include real-time, historical, and predictive data and enable views by hosted application services.

2656811 PWHS-FR-2410 The Contractor shall provide "right-sizing" recommendations based on CIG applications resource usage and service consumption.

2656812 PWHS-FR-2420 The Contractor shall provide Capacity Optimization reports summarizing CIG services consumptions and recommendations for CIG applications service consumption/recommendations for capacity optimization for both production and non-production environments.

2656813 PWHS-FR-2430 The Contractor shall provide designated IRS personnel access to CSP-native cost, utilization data and optimization reports for all IRS CIG cloud-hosted applications.

1369916 PWHS-FR-2500 The Contractor shall provide the capability to generate reports on-demand. The reports should allow analysis of real-time, historical, and predictive data and enable views by services (e.g., application).

C.3.3.3 Incident Management

1369914 PWHS-FR-2700 The Contractor shall establish and operate Incident Management processes that incorporate industry best practices and align with IRS policies in accordance with IRM 2.148.2, Incident Management Process and ITOCC Incident Management Section SOP.

1369922 PWHS-FR-3200 The Contractor shall develop a CIG Incident Management Standard Operating Procedure (SOP) prior to the CIG operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1385734 PWHS-FR-3210 The Contractor shall prioritize incidents in accordance with the IRS EOps Incident Management SOP priority criteria (ITOCC Incident Management Section SOP).

1369919 PWHS-FR-2900 The Contractor shall comply with Incident Management SLOs (QASP Performance Standards).

1385736 PWHS-FR-2910 The Contractor shall manage all incidents related to contractor-managed CIG services. For all incidents that impact IRS, the Contractor shall service them and notify IRS in accordance with IRS Incident Management process and incident prioritization designation (ITOCC Incident Management Section SOP).

1369920 PWHS-FR-3000 The Contractor shall participate in the IRS Incident Management process, including ticket creation, triage, assignment, resolution, and closure.

1385738 PWHS-FR-3010 The Contractor shall provide the capability for the IRS to generate reports and view incident status on-demand.

1385739 PWHS-FR-3020 The Contractor shall use the IRS ticketing system to support CIG Incident Management processes and track progress towards resolution.

1385740 PWHS-FR-3030 The Contractor shall comply with the IRS EOps Incident Management SOP regarding entry and tracking of incidents in the IRS system (ITOCC Incident Management Section SOP).

1369923 PWHS-FR-3300 The Contractor shall provide the capability for the IRS to view and verify compliance with incident management SLOs on demand.

C.3.3.4 Problem Management

1269453 PWHS-FR-3310 The Contractor shall develop a CIG Problem Management Standard Operating Procedure (SOP) prior to the CIG operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1369911 PWHS-FR-3320 The Contractor's Problem Management process shall comply with the IRS EOps Problem Management SOP (EOps Problem Management Process SOP).

1369912 PWHS-FR-3330 The Contractor shall use the IRS ticketing system to record problems and track progress towards resolution.

C.3.3.5 Monitoring

1269452 PWHS-FR-3400 The Contractor shall provide monitoring services to enable the successful delivery of CIG services

1272856 PWHS-FR-3600 The Contractor shall document its monitoring processes in a Monitoring and Management Plan. This plan should demonstrate how the Contractor's processes, tools, and staffing enable the IRS to have an integrated, timely view into the health of CIG…