DRAFT PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

For

Financial Operations (FinOps) Office of the Chief Technology Officer

1.0 INTRODUCTION AND BACKGROUND

The Internal Revenue Service (IRS) CTO leads Information Technology (IT) technical activities that include engineering, architecture and design activities, infrastructure, applications development, networks, enterprise information security and compliance with security standards and computer operations and support. The passing of the Inflation Reduction Act (IRA) lays a path for IRS IT to innovate the ways in which the IRS engages with taxpayers, business customers, and internal IT personnel. By leveraging the FY2019 IRS Modernization strategy and the IRS IRA Strategic Operating Plan (SOP) FY2023-2031, there is an opportunity to transform IRS operations and ways of working, upskill the IT workforce to meet the demands of the ever-evolving tech landscape, and lay the foundation for a modern, customer-centric IT. The IRS is interested in an evolutionary approach to implementing a FinOps practice that supports strategic objective 4.2 (Accelerating Technology Delivery) and incorporates lessons learned and practices already in operation. The outlined initiatives will equip the IRS with the necessary support to develop a mature FinOps practice modeled on the FinOps framework to develop a successful operating model over time. The primary objective is to transition from linear processes to exploratory methods, operating a FinOps practice by continuously iterating through the framework resulting in optimized cloud expenditure and delivering actionable insights. The expected outcomes will enhance the IRS's understanding of cloud costs and provide cost transparency.

2.0 OBJECTIVES

The scope of work for this requirement is set forth in the task area necessary to successfully advise the CTO. The task area supporting this scope of work is as follows:

(1) Task 1: Analyze and Design a FinOps Practice

(2) Task 2: Implement FinOps Practices

3.0 SCOPE OF WORK AND DESCRIPTION OF TASKS

This Performance Work Statement (PWS) is for a Firm Fixed Price (FFP) type performance-based acquisition with mission oriented and event-driven performance measures.

The Office of the Chief Technology Officer (OCTO) requires contractor support to develop a comprehensive FinOps technical and strategic management approach using industry best practice to set the broader IT organization up for success. The IRS faces increasing demands of efficiency, accuracy, and security, while the growth of digital technologies creates new opportunities and challenges. IRS is taking on critical challenges in a dynamic environment; to successfully accelerate the transformation of

IRS, the CTO will require strategic, financial, and technical advisory management support to lay the groundwork for foundational IT efforts and the long-term execution of the strategies across the enterprise.

3.1 Task 1, Analyze and Design a FinOps Practice

The contractor shall provide and maintain technical project management, analysis, and financial expertise and shall use proven and mature project management practices and processes, representative activities shall include the following:

Strategic Analysis and Design:

• Provide project management overview of the requisite tasks to conduct strategic analysis and design outputs.

• Conduct interviews and analysis to map existing IRS cloud applications and assigned stakeholders.

• Conduct exploratory analysis and assessment to identify organizational gaps and challenges; provide an assessment report and quantitative model leading to the development of a FinOps Implementation Strategy and timeline.

• Develop a Stakeholder / Persona engagement plan and RACI Matrix.

• Identify data and applications sources required for cost analysis.

• Develop a plan and begin execution of the data collection.

• Design IRS FinOps practice based on proven industry best practices and other Treasury FinOps practices, specifically the Treasury Cloud (TCloud) model.

• Identify and inventory the sources of data required for cost analysis.

• Develop assumptions and seek data for exploratory analysis.

• Identify patterns through cluster analysis.

3.2 Task 2, Implement FinOps Practices

The objective of task two will build off task 1 and is a decency to ensure comprehensive cost management, enhanced transparency, and optimized resource utilization in cloud operations. This involves determining the ingress/egress costs of spinning up and maintaining services, establishing a continuous monitoring framework for cloud operations, and evaluating the actual costs of cloud infrastructure across various platforms such as AWS and Azure. The goal is to develop strategies for reducing unnecessary cloud resource spend, create a cost decision framework, and foster a cultural practice around FinOps through effective stakeholder engagement. The contractor shall provide and maintain technical project management, analysis, and financial expertise and shall use proven and mature project management practices and processes, representative activities shall include the following:

Operational Implementation and Mature State FinOps Practices:

• Establish a process for ingesting data from the data sources identified in task 1

• Produce a reporting framework for providing holistic views of cloud cost and usage.

• Design a resource tagging schema factoring in existing Treasury tagging schemas.

• Determine the ingress/egress cost i.e., what does it cost to spin up and maintain services.

• Establish a continuous monitoring framework to provide transparency of tracked cloud operations.

• Evaluate the actual cost of the cloud infrastructure, including AWS, Azure, and other managed service provider footprints.

• Develop an inventory of unfinished cloud projects that are consuming resources.

• From the inventory, develop a strategy and recommendations for reducing unnecessary cloud resource spend.

• Develop a cost decision framework (e.g., decision tree) that can be applied against plans for applications in a rapid manner.

• Consolidate reports for visibility across multiple Cloud Service providers (AWS, Azure, etc.) to facilitate data-driven comparisons and decisions between on-prem and cloud.

• Analyze the costs associated with an application or system migrating to the cloud, considering technological transformation and refactoring (e.g., moving information returns from on-prem to cloud, refactoring SQL and moving to MongoDB).

• Project costs to ensure affordability of keeping services in the cloud.

• Establish a capability that can ingest generic cost data from AWS, Azure, etc., and show back and charge back capabilities.

• Engage stakeholders, build relationships, and communicate effectively to foster a cultural practice around FinOps.

4.0 SECTION 508 OF THE REHABILITATION ACT

4.1 IR1052.239-9000 Section 508 Information, Documentation and Support (Dec 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the performance work statement. The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services

_X__ 601 General https://www.section508.gov/index.php https://www.section508.gov/index.php

_X__ 601.1 _X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4 _X__ 603 Support Service _X__ 603.1 _X__ 603.2 _X__ 603.3

(End of clause)

4.2 IR1052.239.9002 Section 508 Services (Dec 2019)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

N/A Chapter 4: Hardware

_X__ Chapter 5: Software

_X__ 501 General _X__ 501.1

_X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G)

_X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4

_X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards

_X__ 701 General _X__ 701.1

_X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___

702.7 ___ 702.8 _X 702.9 ___ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

https://www.section508.gov/content/is-it-ict https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria

_X__ 301 General _X__ 301.1

_X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9

(End of clause)

5.0 DELIVERABLES

The contractor shall be responsible for, and its performance will be measured by, the timeliness and quality of the deliverables set forth below.

5.1 Task Order Kickoff Meeting

Within five (5) business days of task order award, the contractor shall meet with Government representatives at a mutually agreed upon location or via teleconference.

The intent of this meeting is to initiate the communication process between the IRS and the contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The completion of this briefing shall result in the following:

• The contractor and Government personnel who will perform work under this task order will be introduced.

• The IRS may show the applicable facilities to the contractor, if work will be performed on at an IRS site.

• The Government may provide any GFP to the contractor at this time.

• Any issues concerning the contractor employee security clearances will be discussed.

• The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this Performance Work Statement.

• The contractor shall provide the accounting period end dates to be used for the term of this task order.

• The contractor shall provide meeting notes (inclusive of any follow-up actions) to the Government within five (5) business days after the meeting.

5.2 Schedule of Deliverables

The contractor shall provide the deliverables as described in Table 1 below during the performance of this Task Order. All contractor deliverables or work products shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government. The deliverables and work products shall be provided in electronic format and shall comply with all applicable standards of Section 508 of the Rehabilitation Act.

The final format and content requirements, if not stated in the performance work statement (PWS), may be mutually developed and agreed upon among the IRS Program Manager (PM), the contractor and the contracting officer’s technical representative (COR).

Table 1: Schedule of Deliverables

Task 1, Analyze and Design a FinOps

Deliverable No.

Deliverable Due Date/Frequency

1.1 Monthly Status Report Monthly

1.2

Work Products

• Materials/ taking points for Executive Strategy Sessions and CTO meetings

• Update materials and talking points

• Journey Maps, Models and associated frameworks, Stakeholder /Persona Engagement Plan

• Reports and PM Status Overview Materials (delivered on determined cadence)

As Requested by PM/ NLT than specified due date

1.3 RACI Matrix

NLT 30 Days After Award

1.4 Application Inventory

First Draft NLT 90 Days After Award

1.5 Data Collection/Ingestion Plan

First Draft NLT 90 Days After Award

1.6 Current State Assessment

First Draft NLT 90 Days After Award

Task 2, Implement FinOps Practices

2.1

Implementation Packet

• Resource Tagging Schema

• Unfinished Cloud Projects Inventory

• Cloud Cost Decision Framework

• Reporting Framework

• Resource Tagging schema

As Requested by PM/ NLT than specified due date

5.2 Submission of Deliverables

Any deliverable that does not comply with the acceptance criteria outlined in the, the Task Order or the Quality Assurance Surveillance Plan (QASP) shall be considered rejected. Unless otherwise agreed upon by the contractor and the COR or otherwise specified in the Task Order, the COR shall provide written feedback on deliverables within ten (10) business Unless otherwise specified in the Task Order, all deliverables/ work products shall be provided no later than 4:00 p.m. EST on the applicable due date(s).

The contractor shall provide revisions within five (5) business days of receipt of the COR’s feedback. The number of days allotted to the contactor for re-submission of deliverables may be adjusted if agreed upon by both parties. If the vendor has not been notified of any discrepancies within ten (10) business days after submission of the deliverable or successful completion of a task, the deliverable or task shall be considered accepted.

Unless otherwise specified in the Task Order, all deliverables/ work products shall be provided no later than 4:00 p.m. EST on the applicable due date(s).

5.3 Documentation Requirements

The contactor shall provide all documentation in Section 508 compliant electronic format and, upon request by the Government, in hard copy format. The Government will have the right to request suppression of hard copy deliverables in cases where security and privacy concerns are a factor, or to reduce paperwork burden. All deliverables resulting from work executed under this contact shall convey to the Government. In addition to the requirements set forth in the QASP, all documentation shall be provided in accordance with the criteria set forth below:

• Completeness – The document demonstrates sufficient level of detail to show understanding of the requirements, technology and design, customers and operating environment.

• Feasibility - The document defines information, which is formatted properly, contains valid information in support of this task order and provides a deliverable within time constraints.

• Understandability - The document is to be clean, clearly written, all printed words are legible, and the outline is easy to follow. All diagrams are easy to understand and relevant to the supporting narrative.

• Accuracy – The document is accurate in presentation exhibiting clear and concise information, technical content, and adherence to accepted elements of style, operational content, and consistent within itself and with other documents.

• Practicality - The document provides information and guidance that is practical for implementation within the IRS environment and appropriate given the subject organization’s level of maturity.

6.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The contractor’s performance under this Task Order shall be measured against and monitored by the performance standards, acceptable quality levels and surveillance methods contained in the QASP, Contract PWS Attachment 1 (Attached).

The QASP provides a means for evaluating the contractor's performance to ensure that the Government receives the level of service required to achieve the objectives of this requirement.

7.0 PERIOD OF PERFORMANCE

The period of performance for any resultant award shall include a 12-month base period.

8.0 PLACE OF PERFORMANCE

All work will be performed at the contractor’s site.

9.0 GOVERNMENT FURNISHED PROPERTY (GFP) AND INFORMATION (GFI)

Government furnished property (to include material, equipment, and/or information) shall be provided in the performance of this Task Order. The IRS will provide the following property:

ITEMS QUANTITY

Laptops with Local Area Network Access TBD

Contractor Identification Badge TBD

Contractor Building Access/Proximity Card TBD

*TBD – To be determined.

The issuance, handling and disposition of GFP shall be conducted in accordance with FAR 52.245-1, Government Property, Alternate I, 52.245-9, Use and Charges and the requirements set forth in Section 11, Security Requirements. All GFP/GFI shall be returned to the Government upon contract completion, as appropriate.

10.0 TRAVEL

Contractor travel is not anticipated under this task order.

11.0 SECURITY REQUIREMENTS

In accordance with Title III of the E-Government Act of 2002 (Public Law 107-347), also known as the Federal Information Security Management Act of 2002 (FISMA), which requires each federal agency to provide security for the information and information systems that support the operations and assets of the agency and Internal Revenue Manual (IRM) 10.8.1, which provides overall security control guidance for the IRS, the contractor shall comply with the following IRS security clauses and provisions:

1. FAR 52.204-9 – Personal Identity Verification of Contractor Personnel (JAN

2011)

2. FAR 52.224-1 – Privacy Act Notification (APR 1984)

3. FAR 52.224-2 – Privacy Act (Apr 1984)

4. FAR 52.239-1 – Privacy or Security Safeguards (AUG 1996)

5. IR1052.204-9000 – Submission of Security Forms and Related Materials (JUN

2020)

6. IR1052.204-9001 – Notification of Change in Contractor Employee

Employment Status, Assignment, or Standing (NOV 2020)

7. IR1052.204-9002 – IRS Specialized Information Technology (IT)

Security Training (Role-Based) Requirements (NOV 2020)

8. IR1052.224-9000 – Safeguards Against Unauthorized Disclosure of Sensitive but Unclassified Information (NOV 2020)

9. IR1052.224-9001 – Mandatory IRS Security Training for Information

Systems, Protection and Facilities Physical Access (NOV 2020)

10. IR1052.239-9007 – Staff-Like Access, Use or Operation of IRS Information

Technology (IT) Systems by Contractors (NOV 2020)

11. IR1052.239-9008 – Information Systems and Information Security Controls for Contracting Actions Subject to Internal Revenue Manual (IRM) 10.8.1

(JUN 2020)

12. IR1052.239-9009 – Information Systems and Information Security Controls for Contracting Actions Subject to IRS Publication 4812 (JUN 2020)

13. IR1052.239-9010 – Information System and Information Security Control

Standards and Guidelines Applicability (JUN 2020)

FISMA Contract Language (IT Systems / Applications or Services) Revised July

INFORMATION SECURITY / FEDERAL INFORMATION SECURITY

MODERNIZATION

ACT (FISMA)

Pursuant to the Federal Information Security Modernization Act (FISMA), Title III of the E-Government Act of 2014 (Pub. L. 113–283), the contractor shall provide minimum security controls required to protect Federal information and information systems in accordance with NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. The contractor shall provide a risk-based process for selecting the security controls necessary to satisfy the minimum-security requirements in accordance with Federal Information Processing Standard (FIPS) 199.

The term information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability. An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor or subcontractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data. IRS information or information system with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

The potential impact values for confidentiality, integrity, and availability may not always be the same for a particular information system; the high-water mark concept must be used to determine the overall impact level of the information system. Thus, a low-impact system is an information system in which all three of the security objectives are low. A moderate-impact system is an information system in which at least one of the security objectives is moderate and no security objective is greater than moderate. And finally, a high-impact system is an information system in which at least one security objective is high. The determination of information system impact levels must be accomplished prior to the consideration of minimum-security requirements and the selection of appropriate security controls for those information systems.

Federal Risk and Authorization Management Program (FedRAMP) security requirements shall be applied to all IRS cloud services and products and shall be implemented and complied with as part of a competed FedRAMP authorization.

The enforcement of FedRAMP requirements shall be done through Service Level Agreements (SLA)/Contracts. IRS shall utilize aggregated and individual security categorization information when assessing interagency and Cloud Service Provider

(CSP)

connections with different FIPS 199 Category Impact levels.(e.g., High Impact system connecting to Moderate Impact system etc.)

THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

GUIDANCE

FOR INFORMATION SECURITY

The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum-security controls identified in NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations for FISMA compliance. The contractor shall follow the best practices and guidance established by NIST Special Publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

The contractor shall implement protections for personally identifiable information being accessed remotely or transported outside of the agency’s secured, physical perimeter, and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information.

TREASURY / IRS POLICIES FOR INFORMATION TECHNOLOGY (IT) SECURITY

The contractor shall comply with FedRAMP Framework, Department of Treasury Directive TD P 85-01, Internal Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security

Policy and Guidance and Internal Revenue Manual (IRM) 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy. The contractor shall comply with IRS IRMs when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

The contractor/contractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

FEDERAL INFORMATION PROCESSING STANDARD (FIPS)-201-2

Homeland Security Presidential Directive-12 [HSPD-12], August 27, 2004, established the requirements for a common identification standard for identity credentials issued by Federal departments and agencies to Federal employees and contractors (including contractor employees) for gaining physical access to federally controlled facilities and logical access to federally controlled information systems. HSPD-12 directs the Department of Commerce to develop a FIPS publication to define such a common identity credential.

In accordance with HSPD-12, this Standard defines the technical requirements for the identity credential that:

a) is issued based on sound criteria for verifying an individual employee’s identity.

b) is strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.

c) can be rapidly authenticated electronically; and

d) is issued only by providers whose reliability has been established by an official accreditation process.

The standard for a Personal Identity Verification (PIV) system is based on secure and reliable forms of identity credentials issued by the Federal government to its contractors.

These credentials are intended to authenticate individuals who require access to federally controlled facilities, information systems, and applications. A PIV Card must be personalized with identity information for the individual to whom the card is issued, to perform identity verification both by humans and automated systems. Humans can use the physical card for visual comparisons, whereas automated systems can use the electronically stored data on the card to conduct automated identity verification

IRS will determine the level of security and authentication mechanisms appropriate for their applications and will employ only information technology products on the FIPS 201-approved products list for PIV capability implementation within organization information systems.

CSPs must review SP 800-63-3, use its decision trees to obtain an overview of all digital identity requirements, and read the applicable 800-63 volumes to determine specific requirements that apply to their cloud offerings.

SECURITY AUTHORIZATION / CERTIFICATION AND ACCREDITATION PROCESS

CSP/Contractor systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), with a

FIPS

199 security categorization) must ensure annual reviews and continued security certification and accreditation. Some of the key elements of this IT risk and impact assessment process are project security deliverables such as the System Security Plan (SSP), Information System Contingency Plan (ISCP), Interconnection Security Agreement (ISA), Security Risk Assessment (SRAs), Data Impact Assessments (DIAs), Risk Analyses, Security Threat Analyses, Audit Plan, Source Code Review, Security Control Assessment (SCA), and/or Event-Driven Security Control Assessment (ED- SCA). All systems that complete this process will, at a minimum, meet FedRAMP, Treasury and IRS requirements.

INFORMATION SYSTEMS AND INFORMATION SECURITY CONTROLS FOR

CONTRACTING ACTIONS SUBJECT TO IRS PUBLICATION 4812 REVISION 10-201

(Note: Publication 4812 is a layperson's guide to NIST SP 800-53, Rev. 5 when access to IRS information or information systems under contracts for services on behalf of the IRS is outside of IRS controlled facilities or the direct control of the Service as opposed to Internal Revenue Manual 10.8.1 - Information Technology (IT) Security, Policy and Guidance, which applies when contractors are accessing IRS information and information systems at Government controlled facilities.) In performance of this contract, the contractor agrees to comply with the following requirements and assumes responsibility for compliance by its employees and subcontractors (and their employees):

a) General. The contractor shall ensure IRS information and information systems (those of the IRS and/or the contractor, as appropriate) are always protected. In order to do so, the contractor shall develop, implement, and maintain effective controls and methodologies in its business processes, physical environments, and human capital or personnel practices that meet or otherwise adhere to the security controls, requirements, and objectives described in applicable security control guidelines, and their respective contracts.

b) The contractor will be required to input data into a system, to be defined by the IRS, to describe the security controls being used to protect information.

c) Publication (PUB) 4812 Applicability. This contracting action is subject to

Publication 4812 – Contractor Security & Privacy Controls. PUB 4812 is available at: https://www.irs.gov/pub/irs-pdf/p4812.pdf

CONTRACTOR (AND SUBCONTRACTOR) SITE AND INFORMATION

TECHNOLOGY

(SOFTWARE, HARDWARE AND DATA) LOCATION

The CSP/Contractor headquarters, infrastructure, servers (including back-up servers) and data must be physically located in the United States (or U.S. territories).

The infrastructure associated with services outsourced by the CSP/Contractor must located in the United States (or U.S. territories).

The current version and all subsequent versions of the software implemented by the CSP/Contractor must be escrowed in the United States (or U.S. territories) at the CSP’s expense to protect the code in the event the CSP declares bankruptcy.

Data stored outside the United States cannot be protected under the Privacy Act of 1974 or safe harbor framework and may allow for certain local or foreign law enforcement authorities to search IRS data pursuant to a court order, subpoena, or informal request outside the control of the IRS.

The Clarifying Lawful Overseas Use of Data ("CLOUD") Act enacted into law on March 23, 2018 provides that U.S. law-enforcement orders issued under the Stored Communications Act (SCA) may reach certain data located in other countries.

Recognizing the limits of existing law enforcement tools and privacy laws to govern requests for electronic evidence in the age of cloud computing, the CLOUD Act establishes processes and procedures for law enforcement requests for data in other countries.

Although the Act expands the geographic scope of the SCA, it does not change who is subject to SCA orders or what type of data is subject to U.S. law-enforcement requests under the SCA.

The CLOUD Act lays out the circumstances under which a "provider of electronic communication service or remote computing service" must comply with a U.S.

law-enforcement order to disclose data within its "possession, custody, or control," even when that data is "located … outside the United States."

ALTERNATE STORAGE

The CSP/Contractor shall establish an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information.

The alternate storage site shall be geographically separated within the United States (or U.S. territories) from the contractor site to enable recovery of operations. The alternate storage site is separated from the primary storage site so as not to be susceptible to the same hazards and identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. All backup data that contains SBU information shall be encrypted.

The alternate storage site shall provide information security safeguards equivalent to that of the primary site.

BACKUPS

Backups must be provided as part of the CSP service offering.

All backup data that contains SBU information shall be encrypted.

(1) The IRS or CSP/Contractor shall conduct backups for information contained in the information system at the following frequency:

• User-level: daily incremental; weekly full

• System-level: daily incremental; weekly full

• Information system configuration; daily incremental; weekly full

Not: The defined backup frequencies are above IRM 10.8.1 baseline and assigned by FedRAMP.

(2) The CSP/Contractor shall maintain:

• At least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.

• At least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.

Note: This requirement is defined by FedRAMP.

(3) The IRS or CSP/Contractor shall determine what elements of the cloud environment require the Information System Backup control.

Note: This requirement is defined by FedRAMP.

(4) The CSP/Contractor shall determine how Information System Backup is going to be verified and the appropriate periodicity of the check.

Note: This requirement is defined by FedRAMP.

(5) Backup copies of the operating system (i.e., deployed operating system with agency defined configurations and controls) and other critical information system software, as well as copies of the information system inventory (including hardware, software, and firmware components) shall be stored in a separate facility or in a fire-rated container that is not collocated with the operational system.

Note: This requirement is assigned to Moderate and High impact systems by FedRAMP.

DATA LOSS PREVENTION (DLP) SOFTWARE

The CSP/Contractor shall implement data loss prevention (DLP) software to assure existing software will operate effectively in the cloud.

The CSP/Contractor shall be responsible for all patching and vulnerability management (PVM) of software and other systems’ components supporting services provided under this agreement so as to prevent proactively the exploitation of IT vulnerabilities that may exist within the CSP/Contractor operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of NIST SP 800-40, as amended, with special emphasis on assuring that the vendor’s PVM systems and programs apply standardized configurations with automated continuous monitoring of the same to assess and mitigate risks associated with known and unknown IT vulnerabilities in the CSP/Contractor operating environment.

Furthermore, the CSP/Contractor shall apply standardized and automated acceptable versioning control systems that use a centralized model to capture, store, and authorize all software development control functions on a shared device that is accessible to all developers authorized to revise software supporting the services provided under this agreement. Such versioning control systems shall be configured and maintained to make sure all software products deployed in the CSP/Contractor operating environment and serving the IRS are compatible with existing systems and architecture of the IRS.

CONTINUOUS MONITORING BASELINE CONTRACT DELIVERABLES

Cloud Continuous Monitoring baseline contract deliverables are needed as applicable, such as, but not limited to:

• Weekly Security Status Report

• Monthly Security Status Report

• Continuous Monitoring Plan

• Security Configuration and Change Management Plan

• Security Patch Management Plan

• Security Incident Handling, Monitoring and Response Plan

• Information System Contingency Plan (ISCP)

• Security Concept of Operations (Security CONOPS)

• Access Management Plan (AMP)

• System Security Plan (SSP)

• Authorization Boundary Memorandum

• Interconnection Security Agreements (ISA)

• Security Control Assessment (SCA) Test Plan

• Security Assessment Report (SAR) Mitigation Plan

• Privacy/Civil Liberties Impact Assessment (PCLIA)

• State of Security (SoS) Package

• FISMA Compliance Reports including, but not limited to, inventory, inventory change log, security configuration compliance reports, personal security, and POA&Ms.

• Information Security Status Package

• Alternate Site Processing Environment (ASPE) Plan

• Executive Summary of Analytical Results and Recommendations

• Key Management Practices Statement

• Contractor Security Assessments (CSA) Test Plan

• Configuration Compliance Summary Report

• Security Incident Report

• Mitigation Report

• FSTAR Mitigation Plan

• Incident Response Test Report

USE OF OUTSOURCED / CONTRACTOR FACILITIES TO PROCESS IRS SBU

DATA

The infrastructure associated with services outsourced by the CSP/contractor must located in the United States (or U.S. territories).

If IRS products/applications/data/services/solutions are hosted and/or managed by a

CSP

(outside the IRS network boundaries/facilities (e.g., outsourced)) then all such products/applications/data/services/solutions shall go through (and maintain) the Federal Risk and Authorization Management Program (FedRAMP) certification, and meet all of the IRS unique business/legal requirements (including applicable PUB 4812 requirements, etc.).

(Note: FedRAMP is mandatory for all IRS cloud deployments and cloud service models at the Federal Information Processing Standards (FIPS) 199 Low, Moderate and High impact levels. FedRAMP does not apply for internal housed IRS systems that are operated for

IRS

use only. This service model would be considered an On-Site-Private Cloud.)

Special contract language shall be included in all types of Cloud Service Provider (CSP) contracts/non-disclosure agreements/Service Level agreements to address all potential CSP risks (e.g., Data Governance, Data Protection, Data Location, Data Availability, Data Confidentiality, Data Integrity, Data Access, Data Backup, Data Encryption, Data Breach Notification, Contract

Exit Conditions, Contract Termination Conditions, Data Disposal, Data Retention, User/Device/Service AAA services (e.g., Authentication, Authorization, Audit Logging, Background Checks etc.). The Vendor shall pay special attention to the logical and physical separation of IRS data, applications, and communications to maintain security. Vendors are encouraged to manage any cloud environments containing IRS data with only other Federal or State and local Government customers operating at the same security level.

The IRS shall control and maintain the centralized/authoritative control (in-house) of ALL the IRS authorized Users/Devices/Services Authentication, Authorization, and Auditing (AAA) functions, even if a particular IRS application/data/service/solution is hosted in a third-party cloud environment.

Outsourced operations shall report monthly for FISMA and Treasury submission. This includes all systems in the following environments: production, disaster recovery, training, development, and testing.

ENCRYPTION

(1) The IRS or CSP shall ensure that the information system implements FIPS-validated or National Security Agency (NSA)-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Note: This requirement is defined by FedRAMP. IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information (PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation. The vendor shall provide a system that implements (encryption standard) that provides for origin authentication, data integrity, and signer non-repudiation. Consider AU-11 audit Records retention.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

The CSP/Contractor shall ensure all SBU information is protected at rest, in transit, and in exchanges (i.e., internal and external communications). Limit access to SBU information to authorized personnel (those favorably adjudicated and trained) with a need to know and ensure internal and external exchanges are conducted only through secure or encrypted channels. The CSP/Contractor shall employ encryption concepts and approved standards to ensure the confidentiality, integrity, and availability of the SBU information, consistent with the security controls under Publication 4812 and any security requirements specified elsewhere in the contract.

Contractual liability to the government only exists with the prime contractor.

The CSP/contractor shall retain operational configuration and control of data repository systems used to process and store government data to include any or remote work. The CSP/contractor shall not subcontract the operational configuration and control of any government data.

IRS retains exclusive ownership over all its data; the CSP/Contractor acquires no rights or licenses through the agreement, including intellectual property rights or licenses, to use the IRS data for its own purposes; and that the CSP/Contractor does not acquire and may not claim any interest in the data due to security. If CSP/Contractor moves data, the IRS will not lose rights and access to conduct audits.

Intellectual property, including original works created using the cloud infrastructure, may be stored. IRS must ensure that the cloud provider contract respects the IRS’ right to any intellectual property or original works as far as possible without compromising the quality of service offered (e.g., backups may be a necessary part of offering a good service level).

CONTRACTOR SYSTEM REVIEW / SITE VISIT

In conjunction with the use of outsourced / Contractor facilities, the contractor shall be subject to at the option / discretion of the IRS, to periodically test and inspection (annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls, as indicated by the security plan, of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

CONTRACTOR SYSTEM OVERSIGHT/COMPLIANCE

a) The Contractor, service providers, and third-party vendors must complete the IRS

Security – Assessments (IT Security Product Questionnaire) and submit the assessments to the Contracting Officer and Cybersecurity for review and evaluation.

This is a supplemental requirement and does not replace contract requirements under FISMA. The federal government has the authority to conduct site reviews for compliance validation. Full cooperation by Contractor and third-party providers is required for audits and forensics.

b) The Contractor must support IRS in its efforts to assess and monitor the Contractor systems and infrastructure. The Contractor must provide logical and physical access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases upon request. The Contractor will be expected to perform automated scans and continuous monitoring activities which may include, but will not be limited to, authenticated and unauthenticated scans of networks, operating systems, applications, and databases and provide the results of the scans to the IRS Cybersecurity, or designate, or allow IRS (or its designate) to run the scans directly.

c) All Contractor systems must participate in Information Security Continuous Monitoring (ISCM) and Reporting as defined in the IRS IT Policy.

d) All Contractor systems must perform vulnerability scanning as defined by IRS IT Security Policy and provide scanning reports to the IRS Cybersecurity, or designate, on a monthly basis.

e) All Contractor systems must participate in the implementation of automated security controls testing mechanisms and provide automated test results in Security Compliant Automation Protocol (SCAP) compliant data to the IRS Cybersecurity, or designate, on a monthly basis.

SAFEGUARDING / PROTECTING SENSITIVE PERSONALLY IDENTIFIABLE

INFORMATION (PII)

Sensitive PII is defined as any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, legal permanent resident, or employee or contractor to the Department. Sensitive PII is Personally Identifiable Information, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Information Systems can be either electronic or manual. IRM 10.8.1 requires IRS sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearance required; receive security awareness and specialized IT security training required for contractor activities or facilities; and any facility physical security requirements.

IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information

(PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

(1) The CSP/Contractor shall ensure that individuals accessing an information system processing, storing or transmitting information requiring special protection satisfy the personnel screening criteria.

http://csrc.nist.gov/groups/STM/cmvp/validation.html

Note: This requirement is defined by FedRAMP.

(2) The organization shall:

Screen individuals prior to authorizing access to the information system; and Rescreen individuals according to FedRAMP Assignments: for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low-risk positions.

The CSP/Contractor shall ensure that data is used, only as identified, in the IRS contract and that the data will be used for nothing else to ensure the privacy of the individual.

The CSP/Contractor is responsible for maintaining an inventory of all PII provided to the contractor, generated by the contractor, or used by the contractor sufficient to enable notification to taxpayers, if disclosed. The inventory of PII must be updated semi-annually with a final inventory notification provided to the COR.

Most IRS information is categorized as Sensitive But Unclassified (SBU). This includes:

(a) Federal Tax Information (FTI)

(b) Personally Identifiable Information (PII)

(c) Protected Health Information (PHI)

(d) Certain procurement information

(e) System vulnerabilities

(f) Case selection methodologies

(g) Systems information

(h) Enforcement procedures

(i) Investigation information

(j) Proprietary processes or algorithms used in investigative work or tax processing

Note: Live data, which is defined as production data in use (production, testing, development), often contains SBU.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Modernization Act (FISMA), the EGovernment Act of 2014, the Privacy Act of 1974, and OMB Circular A- 130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information.

Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information.

CONTRACTOR RIGHTS TO ACCESS DATA

Access Control requirements shall be implemented as defined within Internal Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security, Policy and Guidance and Publication 4812.

1) The CSP/Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order issued hereunder. If authorized by the terms of this contract or a task order issued hereunder, any access to, or use, or disclosure of Government data shall only be for purposes specified in this contract or task order.