Draft Performance Work Statement 051426.pdf

Performance Work Statement (PWS) Tax Software Acquisition Support

Large Business & International (LB&I), Internal Revenue Service (IRS)

1. Scope This Performance Work Statement (PWS) defines the requirements for the acquisition, integration, maintenance, and support of Commercial Off-The-Shelf (COTS) tax software products, along with associated middleware and technical services.

The objective is to ensure continuity of operations for LB&I and Appeals by maintaining compatibility between IRS systems and industry-standard tax software used by taxpayers. These tools enable efficient processing of complex tax computations and support IRS compliance and enforcement activities.

The Contractor shall provide software licenses, maintenance, technical support, integration services, and training to ensure optimal system performance and alignment with evolving tax laws.

2. Applicable Documents and Definitions

2.1 Definitions

• COR (Contracting Officer’s Representative): Individual designated by the Contracting Officer to monitor technical performance and manage contract administration functions.

• TPOC (Technical Point of Contact): Government technical representative responsible for day-to-day technical oversight and coordination with the Contractor.

• CO (Contracting Officer): Government official with authority to authorize, administer, and terminate contracts.

• PM (Project Manager): Contractor-designated individual responsible for overall contract execution, coordination, performance management, and communication with the Government.

• GFE (Government Furnished Equipment): Equipment provided by the Government for Contractor use in performance of the contract.

• GFP (Government Furnished Property): Property in the possession of, or directly acquired by, the

Government and subsequently made available to the Contractor.

• CTA (Corporate Tax Analyzer): Commercial off-the-shelf tax software used for complex corporate tax analysis and computations.

• ITP (Income Tax Planner): Commercial off-the-shelf tax software used for tax planning and forecasting of income tax liabilities.

• Upgrade: Functional changes including tax law updates, enhancements, or major fixes.

• License: Authorization for a single user/workstation to access the software.

• Software Maintenance: Includes updates, patches, enhancements, and error corrections.

• Workstation: Desktop or laptop used by IRS personnel.

• Commercial Software: CTA and ITP products and associated support.

• IMS Middleware (IMS M): Middleware enabling integration between IRS systems and vendor software.

3. Period of Performance The period of performance (PoP) defines the timeframe in which the Contractor shall perform all required services, provide deliverables, and maintain operational support in accordance with this PWS.

3.1 Contract Ordering Period

• Base Year: April 1, 2027 – March 31, 2028

• Option Year 1: April 1, 2028 – March 31, 2029

• Option Year 2: April 1, 2029 – March 31, 2030

• Option Year 3: April 1, 2030 – March 31, 2031

• Option Year 4: April 1, 2031 – March 31, 2032

The Government may exercise option periods in accordance with FAR 52.217-9 or applicable clause.

3.2 Continuity of Services

The Contractor shall ensure continuity of services across all periods of performance, including transition between base and option years. There shall be no degradation in service levels during transition periods.

3.3 Transition Requirements

If applicable, the Contractor shall:

• Support transition-in activities at the beginning of the Base Year

• Support transition-out activities at the end of the contract period or upon contract termination

• Provide knowledge transfer, documentation, and system access support to the Government or successor contractor

3.4 Performance Commencement

• Contractor’s performance shall begin only after contract award and upon receipt of a valid task/order (if applicable)

• Contractor personnel shall not begin work until all security requirements, including staff-like access approval, are satisfied

3.5 Place of Performance

Work shall be performed at Government facilities, Contractor facilities, remote, or hybrid environments as approved by the COR. The Contractor shall support both on-site and remote operations as required.

3.6 Hours of Operation

The Contractor shall perform work during standard IRS business hours unless otherwise approved by the COR. Standard business hours are defined as Monday through Friday, excluding Federal holidays, typically between 8:00 AM and 5:00 PM local time at the place of performance.

The Contractor shall:

• Not perform routine work on Federal holidays unless specifically authorized by the COR

• Provide support for critical incidents outside normal business hours, as required

• Coordinate any work outside standard hours in advance with the COR

The following Federal holidays are observed by the Government:

• New Year’s Day

• Birthday of Martin Luther King, Jr.

• Washington’s Birthday (Presidents Day)

• Memorial Day

• Juneteenth National Independence Day

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

When a holiday falls on a Saturday, the preceding Friday will be observed as the holiday. When a holiday falls on a Sunday, the following Monday will be observed as the holiday.

No work shall be performed on these holidays without prior written approval from the COR. Work performed outside standard hours, including holidays and weekends, shall be coordinated and approved in advance, and shall be billed at the contractually agreed rates unless otherwise specified.

In the event a new Federal holiday is established by law, Executive Order, or other official Government action during the period of performance, such holiday shall be recognized as a non-workday under this contract. The Contractor shall comply with the same requirements applicable to existing Federal holidays, including restrictions on work performance and the need for prior COR approval.

4. Requirements

4.1 Software and Licensing

The Contractor shall provide:

• Up to 3,500 licenses

• Associated technical support packages

4.1.1 Associated Technical Support Packages

The Contractor shall provide comprehensive technical support packages for all licensed users. These support packages shall be included as part of the license and shall not incur added costs beyond the agreed contract price.

The associated technical support packages shall include, at a minimum:

• Access to Tier 2 technical support services for all licensed users

• Help desk services via toll-free telephone and electronic support channels

• Assistance with software functionality, error resolution, and troubleshooting

• Guidance on tax computations, including explanations and references to applicable tax laws, regulations, and rulings

• Access to software updates, patches, and enhancements as part of maintenance

• User access to documentation, knowledge bases, and FAQs

• Support for installation, configuration, and updates

• Escalation procedures for unresolved or complex issues

• Support coverage during standard IRS business hours, with provisions for critical issue escalation

The Contractor shall ensure that support provided to the IRS is at least equivalent to the level of support provided to its commercial customers and shall not impose additional restrictions or limitations on IRS users.

4.2 Technical Support

4.2 Technical Support

The Contractor shall provide comprehensive, multi-tier technical support services to ensure continuous system availability and performance.

All personnel providing Level 2/3 support shall have completed IRS background investigations in accordance with FAR 52.204-7

4.2.1 Support Tier Structure

• Tier 1 (Level 1 – Initial User Support): First point of contact, basic troubleshooting, issue logging, escalation

• Tier 2 (Level 2 – Advanced Technical Support): Handles complex issues, configurations, integration

• Tier 3 (Level 3 – Expert Support): Code-level fixes, vendor engineering, root cause analysis

• Tier 4 (Level 4 – Low Priority Support): Handles minor issues, cosmetic defects, and low-impact requests that do not affect system functionality

4.2.2 Escalation Requirements

• Tier 1 and Tier 2 within 4 hours

• Tier 2 and Tier 3 within 8 hours

• Tier 4 within 12 hours

4.2.3 Service Levels

• Response: 4 hours

• Resolution: 24 hours

• Critical: 1 hour response, 8-hour resolution

4.3 Help Desk Operations

Provide centralized help desk with toll-free number and direct access to technical support specialist.

The contractor shall operate a ticketing system that tracks, prioritizes and reports on all submitted requests.

Tier Severity Description Response Time

Resolution Target

Tier 1 (Critical) System Down Complete outage or mission-critical failure 15–30 min 4–8 business hours

Tier 2 (High) Major Impact Key functionality unavailable, no workaround 1 hour 1 business day

Tier 3 (Medium)

Moderate Impact Partial issue, workaround exists 4 hours 2–3 business days

Tier 4 (Low) Minor Cosmetic or low-impact issue 1 business day 5–10 business days

Business hours are Monday–Friday, 08:00–17:00 local time, excluding Federal holidays. Scheduled maintenance windows approved by IRS are exempt from Service Level Agreement (SLA) calculations

The Contractor shall provide comprehensive Tier 2 technical support services to ensure continuous system availability and user productivity.

The Contractor shall:

• Provide centralized help desk support accessible via a toll-free number and electronic ticketing system

• Operate during standard IRS business hours, with escalation procedures for critical issues

• Categorize and prioritize incidents based on severity levels agreed upon with the COR

• Escalate unresolved or high-impact issues in accordance with documented escalation procedures

• Maintain a knowledge base of known issues, resolutions, and FAQs accessible to IRS users

• Provide root cause analysis (RCA) for recurring or high-impact incidents

• Provide documentation of support performance, including ticket metrics, response times, resolution times, backlog, trends, and corrective actions

4.4 Data Rights and Source Code Ownership

All IRS-specific data and enhancements are Government property.

If developed under the contract, the Government shall have unlimited rights to the source code.

4.5 Integration Support

The Contractor shall provide integration, maintenance, and enhancement support for IRS case management systems to ensure seamless interoperability between IRS systems and vendor software.

The Contractor shall:

• Support integrations with IRS approved case management systems

• Implement updates to support evolving tax processing needs

• Enable and maintain XML data import/export capabilities, including integration with IRS return systems

• Develop and maintain IRS-specific enhancements such as agent reports, audit logs, and data validation tools

• Perform integration testing prior to deployment

• The contractor shall provide 60 business days advance notice of planned deployments and obtain written COR acknowledgement prior to implementation.

• Provide documentation for all integration changes, including technical specifications and user impacts

• Ensure backward compatibility to prevent disruption to existing workflows

4.6 Training

The Contractor shall develop and deliver comprehensive training to IRS personnel.

The Contractor shall:

• Provide two annual 40-hour training sessions to accommodate as many as 25 participants, covering software functionality, updates, and tax law changes

• Provide quarterly virtual 1-hour training sessions accessible to all licensed users

• Develop and maintain training materials, including user guides, quick reference guides, and recorded sessions

• Ensure all training materials are compliant with Section 508 accessibility requirements in accordance with paragraph 4.8.2

• Update training content to reflect software updates and tax law changes

4.7 Software Maintenance

The Contractor shall provide comprehensive software maintenance services to ensure the software remains current, secure, and fully functional.

The Contractor shall:

• Provide all software updates, upgrades, and patches at no additional cost to the Government

• The software shall be updated to incorporate tax law changes and regulatory updates o Vendor must monitor legislative and IRS changes continuously o Provide impact analysis within 2 business days o Implement critical changes within 10 business days o Ensure no disruption to filing or payment processing

• Maintain compatibility within the supported operating systems in use within the IRS environment

• Provide 60 calendar day notification of upcoming releases and changes that may impact IRS operations

• Perform integration testing prior to deployment

• Provide release notes and documentation for all updates

• Ensure continued support for all versions in use by the IRS during the period of performance

• Coordinate with IRS for deployment schedules to minimize operational impact

• Address software defects and vulnerabilities in a timely manner consistent with 4.2.3 Service

Levels

4.8 Major Version Release Documentation

The Contractor shall provide software approval package prior to implementation of each release.

4.8.1 IPv6 Conformance Documentation

The Contractor shall provide an IPv6 Conformance Statement on official company letterhead, signed by an authorized technical representative or executive (not a sales representative). The statement shall confirm that the software is fully compatible with IPv6-only network configurations and does not implement its own networking stack independent of the operating system.

4.8.2 Section 508 Compliance Documentation

In addition to ensuring that all training materials meet Section 508 requirements, the Contractor shall provide Section 508 compliance documentation for all software delivered under this contract. The Contractor shall submit a completed IRS-approved Standalone Section 508 Questionnaire.

5. Deliverables All deliverables shall be submitted to the COR for approval.

Deliverable Frequency Due Date Format Reference

Root Cause Analysis (RCA) Report

As Required Within 5 business days

PDF 4.3

Integration Updates & Documentation

Annual + Updates

As required PDF 4.5

Integration Test Results Initial +

Prior to deployment

PDF 4.5

Training Delivery (Annual & Quarterly)

Annual + Quarterly

Per schedule Presentation/PDF 4.6

Training Materials & Records

Initial + Updates

Within 3 business days

PDF 4.6

Software Maintenance (Critical Changes)

Initial + Updates

Within 10 business days

PDF 4.7

Software Maintenance (Release Notifications)

Initial + Updates

60 days prior PDF 4.7

Software Release Notes & Documentation

Initial + Updates

With each release

PDF 4.7

Software Impact Analysis Initial + Updates

Within 2 business days

PDF 4.7

Software Testing Results & Validation

Initial + Updates

Prior to release PDF 4.7

Software Approval Package

Initial + Updates

Prior to release PDF 4.8

Monthly Technical Status Report

Monthly 5 business days

PDF 5.1.1

Quarterly Program Review Quarterly 5 business days

Presentation/PDF 5.1.2

Contract Staff Status Report

Bi-weekly Recurring Excel 5.1.3

Risk Management Report Quarterly 10 business days

PDF 5.1.4

Configuration Management Plan

Initial + Updates

Per requirement

PDF 5.1.5

COOP Plan Initial + Updates

Per requirement

PDF 5.1.6

SLA & Help Desk Performance Report

Monthly 5 business days

PDF 5.1.7

Cybersecurity Compliance Report

Monthly 5 business days

PDF 5.1.8

Quality Control Plan Initial +

Per requirement

PDF 5.1.9

IPv6 Conformance Documentation

Initial + Updates

60 days prior PDF 5.1.11

Section 508 Compliance Documentation

Initial + Updates

60 days prior PDF 5.1.12

Security Incident Reports As Required Within 1 hour PDF 7

Security Training Records Annual Annually PDF 7

Invoice Submission Monthly 15th calendar day

PDF 7

5.1 Deliverable Definitions

All due dates identified in this section are on calendar days unless otherwise specified as business days.

Business days are defined as Monday through Friday, excluding Federal holidays.

5.1.1 Monthly Technical Status Report

Shall include performance metrics, incident summaries, system status, risk status, progress against requirements, and contract employee name and hours identified for tasks invoiced.

5.1.2 Quarterly Program Review Meeting

Formal review of performance, risk management report (paragraph 5.5), deliverables, and strategic alignment.

5.1.3 Contract Staff Status Report (Bi-weekly)

Shall include current staffing names, onboarding/offboarding/revalidation/reinvestigation status, security clearance status, Government Furnished Equipment Status (PIV Card and Laptop), challenges, and any staffing risks. Report is due one (1) business day prior to the recurring meeting established by the

COR.

5.1.4 Risk Management Report

Identification, assessment, mitigation strategies, and status of all program risks.

5.1.5 Configuration Management Plan (CMP)

Defines processes for controlling changes to software, middleware, and system integrations.

5.1.6 Continuity of Operations Plan (COOP)

Ensures continuity of critical services during disruptions.

5.1.7 Service Level Agreement (SLA) Performance Report

Tracks compliance with defined service levels (e.g., response time, resolution time, system availability) in accordance with 4.2.3 Service Levels

5.1.8 Help Desk Support Performance Report

Provides detailed documentation of technical support performance including number of tickets, categories, response times, resolution times, backlog, and trends in accordance with paragraph 4.3. This report must contain the Quality Assurance Surveillance Plan (QASP) in accordance with paragraph 6.

5.1.9 Cybersecurity / Federal Information Security Modernization Act (FISMA) Compliance Report Provides documentation demonstrating compliance with FISMA, IRS security policies (IRM 10.23.2), and applicable federal cybersecurity requirements. Includes incident reporting, vulnerability status, Plan of Action and Milestones (POA&M) updates, and security training compliance.

5.1.10 Vendor Quality Control Plan (QCP)

Describes the Contractor’s internal quality assurance processes, performance monitoring approach, and corrective action procedures aligned with the Government’s QASP. Provide detailed documentation of technical support performance including number of tickets, categories, response times, resolution times, backlog, and trends. This report shall support QASP monitoring and SLA validation.

5.1.11 IPv6 Conformance Documentation

The Contractor shall provide an IPv6 Conformance Statement on official company letterhead, signed by an authorized technical representative. The statement shall confirm compatibility with IPv6-only networks and shall be submitted prior to each release.

5.1.12 Section 508 Compliance Documentation

The Contractor shall provide Section 508 compliance documentation, including completion of the IRS-approved Section 508 Questionnaire. Documentation shall be updated and submitted prior to each release.

6. Quality Assurance Surveillance Plan (QASP) Mapping

Requirement Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Help Desk Response Initial response within 24 hours

95% compliance Ticket sampling / reports

Incident Resolution Resolution within defined

SLA

90% within SLA Monthly SLA report

Software Updates Delivered on schedule 100% on time Deliverable review Middleware Integration

Fully functional with IRS systems

98% success rate Testing validation

Training Delivery Delivered as scheduled 100% completion Attendance records Monthly Reporting Accurate and timely submission 100% on time COR review

Security Compliance All staff meet IRM 10.23.2 requirements

100% compliance Security audits

Risk Management Risks identified and mitigated

No critical unmanaged risks

Quarterly review

Requirement Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Configuration Management

Changes documented and approved

100% compliance Change logs

COOP Readiness Plan maintained and testable Annual validation complete

Plan review

Cybersecurity Compliance

FISMA/IRM adherence 100% compliance Audit / reports

7. Security Requirements The Contractor shall comply with all applicable IRS, Treasury, and Federal information security policies and regulations, including but not limited to IRM 10.23.2, the Federal Information Security Modernization Act (FISMA), and National Institute of Standards and Technology (NIST) guidelines.

Security requirements under this contract are mandatory and enforceable. Failure to comply may result in removal of personnel, suspension of work, or other contractual remedies as determined by the COR and provided to the Contracting Officer.

7.1 General Security Compliance

The Contractor shall:

• Safeguard all IRS Sensitive but Unclassified (SBU) data and any other sensitive information accessed or generated under this contract

• Ensure compliance with all applicable Federal cybersecurity and privacy laws, regulations, and policies

• Implement administrative, technical, and physical safeguards to protect IRS data

• Ensure that all Contractor personnel understand and comply with IRS security requirements prior to performing work

7.2 Staff-Like Access Requirements

• Contractor personnel shall NOT begin work under this contract until staff-like access has been granted specific to this contract number

• Staff-like access shall only be granted after completion of required background investigations, submission of required documentation, and approval by IRS HCO Security

• Interim or escort access may only be granted at the discretion of the Government and shall be limited in scope and duration

• Contractor personnel denied staff-like access shall not perform any work under this contract

• The Contractor shall track and manage staff-like access approvals, expirations, and renewals for all personnel

7.3 Personnel Security and Background Investigations

The Contractor shall:

• Submit all required onboarding documentation (e.g., OF-306, FCRA forms, Non-Disclosure Agreements, proof of citizenship, etc.) when required to the COR

• Ensure all personnel complete fingerprinting and background investigation requirements prior to access being granted

• Maintain records of personnel security status and provide updates to the COR upon request

• Submit reinvestigation requests within required timeframes prior to expiration of staff-like access

• Immediately remove personnel from contract performance upon notification of access denial, suspension, or revocation

All onboarding, revalidation, and reinvestigation requests shall be submitted using the IRS-approved Resource Access Control (RAC) Excel document or other electronic means as designated by the COR. The Contractor shall ensure submissions are complete, accurate, and submitted as required to the COR.

7.4 Access Control and System Security

The Contractor shall:

• Ensure access to IRS systems and data is restricted to authorized personnel on a need-to-know basis

• Submit Business Entitlement Access Request System (BEARS) requests for system access as required

• Ensure all work is performed using Government Furnished Equipment (GFE) unless otherwise authorized

• Prohibit the storage of IRS data on non-Government systems unless explicitly authorized in writing

• Ensure proper handling, transmission, and storage of IRS data in accordance with security requirements

7.5 Training and Awareness

The Contractor shall:

• Ensure all personnel complete mandatory IRS IT Security Awareness Training (SAT) and Unauthorized Access (UNAX) training prior to beginning work and annually thereafter. Once the vendor has access int the IRS systems, these courses can be downloaded by the vendor at https://irsgov.sharepoint.com/sites/ETD-EoT-MB/SitePages/Contractor-Briefings.aspx or if the vendor doesn’t have access, upon request, the COR will provide copies of the training documents.

If the contract person doesn’t have access, the vendor will administer the courses and sign off on Form 11370, and the contract person will sign off on Form 14616. Upon request, the COR will provide a copy of the forms.

o IRS Annual Cybersecurity Awareness Training o Facilities Management and Security Services Physical Security Mandatory Briefing o Privacy, Information Protection, and Disclosure Briefing o Insider Threat Awareness Briefing o Records Management Awareness o Introduction to Unauthorized Access (UNAX) briefing for IRS Contractors o IRS CUI General Awareness Briefing https://irsgov.sharepoint.com/sites/ETD-EoT-MB/SitePages/Contractor-Briefings.aspx o Inadvertent Sensitive Information

• Ensure all personnel complete Disclosure Awareness Training prior to accessing SBU data and annually thereafter

• Maintain documentation of training completion and provide verification to the COR upon request

• Ensure personnel understand responsibilities related to Unauthorized Access (UNAX), data protection, and incident reporting

7.6 Incident Reporting and Response

The Contractor shall:

• Report all actual or suspected security incidents, breaches, or unauthorized disclosures immediately upon discovery, but no later than one (1) hour after identification

• Notify the COR and designated IRS security officials in accordance with IRS incident reporting procedures

• Support incident investigation, containment, and remediation activities

• Document all incidents and corrective actions taken

7.7 Data Protection and Privacy

The Contractor shall:

• Ensure all IRS data remains the property of the Government

• Not disclose, reproduce, or use IRS data for any purpose other than contract performance

• Ensure all data is returned to the Government or securely destroyed upon contract completion or termination

• Comply with all applicable privacy and disclosure laws and regulations

7.8 Continuous Monitoring and FISMA Compliance

The Contractor shall:

• Support FISMA compliance activities, including reporting and audits

• Maintain and update Plans of Action and Milestones (POA&M) for identified vulnerabilities

• Provide monthly Cybersecurity / FISMA Compliance Reports as defined in Section 5

• Cooperate with Government security assessments, audits, and reviews

8. Invoicing and Payment The Contractor shall submit accurate and complete invoices for services performed under this contract.

Invoices must be submitted monthly by the 15th and must include required labor and contract details.

Each invoice shall clearly identify, at a minimum:

• Contract employee name(s)

• Description of work performed for the billing period

• Number of hours billed per employee

• Applicable labor category and rates (if applicable)

• Period of Performance

• Contract number or Technical Order (TO) number

• Invoice number

• Company name

• Invoice billing date

Invoices shall align with submitted deliverables and supporting documentation for the billing period. For labor billing to the IRS, the contract employee must be active on the contract. All non-compliant invoices will be rejected.

9. Quality Assurance The Government will monitor Contractor performance in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP establishes performance standards, acceptable quality levels (AQLs), and surveillance methods for all critical tasks under this contract.

The Contractor shall:

• Develop, implement, and maintain a Quality Control Plan (QCP) that aligns with the Government’s

QASP

• Ensure all deliverables meet defined performance standards prior to submission

• Conduct internal reviews and quality checks to prevent deficiencies

• Identify performance issues and implement corrective actions in a timely manner

• Provide documentation demonstrating adherence to performance standards

The Government will use the following surveillance methods:

• Review of deliverables and reports

• Random sampling of help desk tickets and service requests

• Performance trend analysis

• Periodic program reviews and meetings

Failure to meet performance standards may result in:

• Corrective action requirements

• Increased Government surveillance

• Negative performance evaluations (e.g., CPARS)

• Invoice withholds or other contractual remedies

10. Government Furnished Property (GFP) (GFP) The Government will provide the Government Furnished Equipment (GFE) necessary for contract performance.

GFE shall include, at a minimum:

• Government-issued workstations (desktop and/or laptop computers configured to IRS standards)

• Personal Identity Verification (PIV) Cards required for logical and physical access to IRS systems and facilities

The Contractor shall:

• Use GFE only for authorized contract-related activities

• Comply with all IRS policies regarding use, protection, and accountability of GFE

• Immediately report any loss, damage, or security incidents involving GFE

• Return all GFE upon contract completion, personnel removal, or as directed by the Government

The Government retains ownership of all GFE provided under this contract.

The Contractor shall ensure timely return of all GFE upon employee separation or contract completion.

When the Contractor becomes aware that a contract employee is separating, or upon contract expiration/termination, the Contractor shall:

• Recover all issued GFE, including laptops and PIV cards, from the employee

• Return all GFE to a designated IRS facility within five (5) business days

• Coordinate return logistics with the COR or designated IRS office

• Certify in writing to the COR that all GFE has been returned

Failure to return GFE within the required timeframe may result in administrative action, including potential withholding of payments or other contractual remedies.

11. Acceptance Criteria Deliverables shall be reviewed by the COR to ensure compliance and completion with all contract requirements, technical specifications, and performance standards.

Acceptance occurs when:

• Deliverables are complete, accurate, and meet all requirements defined in this PWS, including format, content, timeliness, and quality expectations. Deliverables must demonstrate that all required work has been performed satisfactorily and that supporting documentation is sufficient to validate performance. The Government reserves the right to request revisions, additional information, or clarification prior to acceptance.

If deficiencies are identified, the Contractor shall correct and resubmit the deliverable within a timeframe specified by the COR.

12. Points of Contact (POC) Role Name Phone Number Email Address Gov Contracting Officer (CO) TBD TBD TBD Gov Contracting Officer’s Representative (COR) TBD TBD TBD Gov Technical Point of Contact (TPOC) TBD TBD TBD Vendor Project Manager (PM) TBD TBD TBD

Vendor Security POC TBD TBD TBD

Vendor Contracting Officer TBD TBD TBD

Vendor Finance/Billing POC TBD TBD TBD

The Contractor shall provide and maintain current POC information throughout the period of performance.

Any changes shall be reported to the COR within one (1) business day.

13. Service Level Agreement (SLA) Metrics The Contractor shall comply with defined Service Level Agreements (SLAs) governing system performance, incident response, and resolution. SLAs shall be measurable, enforceable, and aligned with mission-critical IRS operations.

• Response and resolution times shall be tracked and reported monthly

• SLA compliance shall meet adherence unless otherwise specified

• Failure to meet SLA thresholds may result in corrective action, increased surveillance, or contractual remedies as determined by the Contracting Officer

The Contractor shall provide the following additional deliverables in support of SLA monitoring and Help Desk operations:

• Monthly SLA Performance Report including compliance metrics, response times, and resolution times

• Detailed Help Desk Metrics Report including ticket volumes, categorization, backlog, and trend analysis

• Root Cause Analysis (RCA) reports for recurring or high-impact incidents

Performance shall be reported monthly and enforced through SLA reporting and QASP monitoring.

• Tier 4 (Low): 1 business day response, 5–10 business day resolution; 95% compliance

• Tier 3 (Medium): 4 hour response, 2–3 business day resolution; 90% compliance

• Tier 2 (High): 4 hour response, 24-hour resolution; 90% compliance

• Tier 1 (Critical): 1 hour response, 8-hour resolution; 95% compliance

The Contractor shall align Tier support levels with measurable Service Level Agreements (SLAs) and Quality Assurance Surveillance Plan (QASP) metrics as follows:

QASP shall validate Tier-based SLA compliance as defined in Section 4.2.3.

14. QASP Enhancements The Government will incorporate the following additional performance measures into the Quality Assurance Surveillance Plan (QASP):

a. Tiered Support Compliance: Verification of escalation timelines and adherence to support structure.

b. Help Desk Performance: Monitoring response times, resolution times, and customer satisfaction.

c. SLA Compliance: Monthly validation of performance against defined SLA thresholds.

d. Incident Management: Evaluation of root cause analysis and corrective actions for recurring issues.

15. IRS Information Technology Security Policy (IRM 10.23.2) The Contractor shall comply with IRM 10.23.2 including all IRS IT security requirements, continuous monitoring, incident response, ATO support, data protection controls, Information Technology (IT) Security, and all applicable IRS cybersecurity requirements.

The Contractor shall:

• Comply with all IRS IT security policies, procedures, and controls defined in IRM 10.23.2

• Ensure all systems, applications, and services meet IRS security architecture requirements

• Support Authorization to Operate (ATO) processes and continuous monitoring activities

• Implement required security controls aligned with NIST standards as adopted by the IRS

• Ensure all personnel complete required IRS security awareness and disclosure training

• Maintain audit logs, access controls, and monitoring capabilities

• Report and respond to security incidents in accordance with IRS requirements

• Remediate vulnerabilities in accordance with IRS timelines and POA&M requirements

• Coordinate with IRS Cybersecurity for compliance validation and incident handling

Failure to comply with IRM 10.23.2 may result in removal of personnel, suspension of access, or other contractual remedies.