DRAFT RFQ Digital Support _PWS-DSS-BPA_040924.docx

REQUEST FOR QUOTATIONS (RFQ)

For the Establishment of:

Multiple Award Blanket Purchase Agreements (BPAs) for Information Technology Services in support of:

Department of Treasury Internal Revenue Service (IRS) Digital Support Services

Solicited to:

Contractors Under GSA Multiple Award Schedule (MAS) Information Technology (IT) Services

SIN: 54151S

Conducted under FAR 8.4

Issued by:

Internal Revenue Service (IRS) Corporate Support Branch 5000 Ellin Rd Lanham Md, 20706

Solicitation Number: 2032H5-24-Q-00080

B. SUPPLIES OR SERVICES AND PRICES

B1.0 Introduction This Blanket Purchase Agreement (BPA) is for the “Digitalization Service and Support Contract” requirement.

Internal Revenue Services (IRS) expects to deploy Digitalization Service to enhance the taxpayer and tax professional experiences and obtain Contractor support with a comprehensive solution, which adheres to the agency’s standards and guidance, and aligns with and supports the Taxpayer Experience Strategy (TXS).

B2.0 Background

B2.1 Digital Support Service Programs With over 240 million tax filings in the United States every year, the IRS is emphasizing the use of technology to be smarter, faster, and completely accessible to its customers. The goal is to provide taxpayer’s access to their tax account information twenty-four hours per day both online and through mobile devices. The Digital Services Program provides modern, online, and mobile products with increasingly robust capabilities such as tax account status, payment functionality, and on-demand self-service. Key drivers include:

· Increasing satisfaction among all individual taxpayer groups by ensuring taxpayer self-service needs are met efficiently and effectively online

· Reducing call volumes and manpower support required by providing an improved online user experience

· Consolidating IRS service options to a centrally accessible location online by positioning self-service as the primary channel for all taxpayer interactions with the IRS

· Automating the authorized disclosure of tax information to third parties

· Authentication of users of electronic services accounts

· Allows tax professionals to access their client data, make changes, and communicate with the IRS online

· Provide taxpayers personalized/seamless online experience

· Chat Bot (Virtual Assist): Chat bot to attempt to answer questions or direct tax professional to helpful information on IRS.gov or to their online account based on a taxpayer’s browsing preferences on IRS.gov. Chat bots will also be able to connect taxpayers to an IRS assistor for a web chat. If the chatbot cannot resolve a taxpayer’s issue, contact routing will guide the taxpayer to live support from an IRS employee.

· AI-Powered Digital Appointments: Allows taxpayers to speak with an assistor or schedule an appointment if the chatbot is unable to resolve a taxpayer’s issue.

· AI-Powered Employee Assistant: Supports IRS employees when answering taxpayers’ questions with an AI-powered knowledge base that will make suggestions based on a taxpayer’s experience, questions or pages visited on IRS.gov

· Provide online services to underserved communities are not limited to but include:

· Translate Forms, Publications and Notices: Support translation of forms and tax information to taxpayers with limited English proficiency. Increase the languages (Spanish, Chinese Traditional/Simplified, Korean, Russian, Vietnamese) available online.

· Section 508 Compliance: Support taxpayers with disabilities, including taxpaying populations needing special assistance due to sight, hearing, dexterity, limited mobility, and cognitive challenges.

· Collaborate with stakeholders and expand our community presence to support the unique needs of underserved communities.

B2.2 Digital Services Products The Digital Services Program is providing improvements to taxpayer service by delivering a unified Online Account product accessible through a single online account, to provide and enhance taxpayers experience via digitalization and transformation. Online Account is the first product delivered in 2019. Additional prioritized products/capabilities that will be added to be determined in IT Mod Plan such as the following but not limited to:

· Individual Online Account (IOLA) which formally named as Online Account with components including Digital Notices & Letters (DN&L), Modernized Online Payment Plan, Integrated Payment, etc.

· Tax Professional Account (TPA)

· Business Tax Account (BTA)

· Digital Transformation (DT)

· Integrated Customer Communication Environment (ICCE)

· Enterprise Digital Communication Platform Integration

· Other modernization programs for digitalization

In addition, the digital services program will include the O&M support to sustain digital service products in production. The contractors shall deliver IT solutions accordingly to the IT Modernization Plan scope and timeline.

B2.3 Digital Services Organization The program management offices (PMO) operate as a “prime integrator” across Business and IT Delivery Partners in the organization across the Enterprise to deliver digital service-based applications as outlined in the following figure.

The PMO performs the following services:

· Manages the execution of the program and is accountable for overall Program success

· Acts as the front door between IT and the Business

· Manages and executes the Product Roadmap & Release Plan

· Communicates and integrates across the Enterprise

· Executes the governance framework

· Manages scope, schedule, and cost associated with application delivery

· Coordinates resource and risk management

B2.4 Program Delivery Cadence The PMO has drawn upon best industry practices in agile development to pilot the delivery process. However, the operating model is not limited to Agile but other frameworks to deliver faster and sooner. In principle it consists of a Governance and Investment cadence and a Development/Delivery cadence, utilizes industry best practices, and is tailored to meet the IRS governance and compliance needs.

B2.5 Operating Model The Program Operating Model is comprised of four layers: The Executive Boards, Program, Teams, and Delivery Partners.

B2.5.1 Executive Boards The Executive Oversight Team (EOT) is represented by leadership from the Program and Business and Delivery partners. The team meets once monthly to review the key accomplishments of Digital Service development and deployment. The team reviews progress made by the Program, highlighting delivery status, risks, partner updates, and spotlights on areas of interest.

The Web Apps Governance Board (GB), or equivalent board, was chartered by the Strategic Development Executive Steering Committee (SD ESC) and governs all investments and any associated investments or components as deemed appropriate by the SD ESC. The primary objectives of the GB are to ensure information technology investments, and Digital Services program and product objectives are met. Additional responsibilities of the Web Apps Governance Board include reviewing and approving budget increases, approving milestone exits, recommending the approval of new products, and oversight of the performance of the Digitalization portfolio.

The Strategic Development Executive Steering Committee (SD ESC), or equivalent board, is the foremost governing organization for the program. The SD ESC governs the design, development, and deployment of projects and investments. Digital support service briefs the SD ESC on the status of approved work. The SD ESC determines which prioritized potential investments will be chosen for development and identifies potential products to be transitioned out of the development process.

The Business Technical Advisory Council (BTAC) was established to advance IRS digital capabilities to move toward the future state--providing the taxpayer with a more complete online experience. The BTAC reviews and makes recommendations for all digital capabilities referenced in the future state vision as well as all planned IT initiatives, ongoing major projects, and essential administrative projects.

B2.5.2 Program Management Office The Program Management Office provides support such as Strategic Planning and Delivery Management Support throughout the solution development, integration, implementation, and production support.

B2.5.3 Managed Application Teams PMO Managed Applications Teams consist of Product Planning Teams and Federated Delivery Teams (FDTs).

2.5.3.1 Product Planning Teams

Product planning teams include a Product Manager, Product Owner, UX team and PMO Analyst. Product planning is responsible for establishing a prioritized roadmap/backlog for the program.

The PMO partners with various Delivery Partners across the IRS to facilitate and support product planning. These supplier organizations include Enterprise Operations, Enterprise Services, Identity & Access Management (IAM), Privacy, Strategy and Planning, Information Resources Accessibility Program, User and Network Services, Applications Development, Cybersecurity, and Enterprise Services Testing.

2.5.3.2 Federated Delivery Teams (FDT)

The PMO leverages Federated Delivery Teams (FDT) as part of the operating model to develop and deliver the Digital support service products. Each FDT typically consists of the following team members, though the number of team members may vary per FDT:

· Delivery Release Manager

· Scrum Master

· Product Owner

· Product Manager

· Developers

· Cyber Engineers

· System Engineer

· Testers

· 508 Specialists B3.0 Objectives The IRS is seeking to deliver information technology solutions and digital capabilities with improved reliability, using a common services approach to application development. The focus of the IRS model will be utilizing Test Driven Development (TDD) and Continuous Integration (CI) methodologies to deliver applications that are fully tested with release-ready products scheduled for implementation.

The IRS has chosen a strategy for application development that will maintain an IRS staff presence but outsources much of the work, which alleviates resource shortages in the IRS IT organization while maintaining IRS oversight and direction for product development.

Applications will be designed to be user friendly for taxpayer self-assistance across a broad audience and seamlessly integrated with the rest of the IRS offerings. Work products will be designed pursuant to an agile or iterative development process as a preferred methodology. As IRS applications are subject to accessibility and early security reviews, close coordination with review protocols and stakeholders is necessary to achieve short development cycle(s) and application deployment(s).

B4.0 Skill Requirements The IRS has chosen a strategy for program management, cybersecurity, and application development which combines IRS team members with contractor staff in all components of its Agile product development process from product planning to delivery to operations and maintenance. As a result, team members well-versed in Agile product development, cybersecurity, and program management are needed to participate in the planning, elaboration, development, testing, delivery, and operations and maintenance of Digital Services (Web Apps) products essential to the success of the Digital Services (Web Apps) Program. This strategy will provide flexibility to add product teams quickly while maintaining IRS oversight and direction for product development.

The Digital Services PMO is highly interested in Agile thought leadership, innovative development methodologies, and proven delivery track records. Contractors must ensure that personnel quoted have enough knowledge, skills, and experience identified to accomplish designated tasks in the below Task Areas.

Vendors should meet the following high level skill requirements:

· 5 Years Previous Experience with Authenticated Portals

· Agile Web Development using the technologies listed below

· Demonstrated Experience with IRS Architecture, Portals, and Processes

· Demonstrated ability to rapidly staff teams in order to deliver capabilities per delivery plan

· Vendor must be able to develop 4 or more capabilities from different value streams simultaneously

· Vendor must have been/or currently is a prime on a two $75M+ contracts over the past 5 years

The contractor should provide personnel who are experienced and operationally adept with the following tools, operating systems, coding languages and concepts:

Java Development: JDK1.8 and 11, MDC, HTTP Filters, Loggers, Concurrency, Security, JPA, JUnit, Selenium, AppScan, REST Service, JBoss EAP, RESTful, OpenShift, Kubernetes, AWS, ISTIO, Ephesoft

Spring Projects: MVC, Boot, WebFlux, Cloud, Test, Security, Cache, JPA

Persistence: Oracle, PostgreSQL, SQL, MongoDB

Client Development: React, JavaScript (ECMA6), CSS3, HTML5, Node.js, NPM, Babel, Webpack, Jest, Testing Library, Selenium, WCAG 2.0 (Section 508/WCAG 2.0 AA) and WAI-ARIA, Multi-Lingual: Accessibility Standards (a11y), Internationalization (i18n) and Localization (l10n), Storybook

DevOps: GitHub, GitLab, GitLab CI/CD, Maven, Jenkins build pipelines (including groovy pipeline scripting), SonarQube, Nexus, Babel, Webpack, Node.js, NPM, Git, Kubernetes, Kustomize, OpenShift, ISTIO, Kubernetes, AWS, Bash scripting, GitFlow

Design Patterns: Microservices, Containerization

Section 508 Testing: JAWS, Dragon, Zoom Text

Cybersecurity: Netsparker BurpSuite, Nmap, Nessus, Wireshark, Native Lunix, Exploitdb, AppScan, Maven, Jenkins, SonarQube, Nexus IQ, Guardium, BigFix

Other Skills: Splunk, IBM CLM, Excel, PowerPoint, AppDynamics

Other Concepts: Agile methodology (including SAFE, Scrum, and Kanban)

Cybersecurity personnel should have the following high-level skills:

· Experience serving as the security engineer of complex technology implementations in a product-centric environment.

· Bridging the gap between legacy development or operations teams and working toward a shared culture and vision.

· Working to ensure that developers create secure systems while enhancing the privacy of all system users.

Experience with white-hat hacking and fundamental computer science concepts strongly desired.

Additionally, the contractor shall provide:

· CLM Subject Matter Experts (SME) with knowledge of Agile, development methodologies, and proven delivery track records developing filters and reports out of CLM for statuses, system and product performance, briefings, and tracking.

· Extensive knowledge and expertise in the following tools necessary to support this task effort: Rational Collaboration Lifecycle Management (CLM), Microsoft Excel, and Microsoft PowerPoint.

· Vendor/Technical Leadership must have a minimum of 3 years skills and experience building enterprise class online account systems with multiple layers of enterprise dependencies and IRS operational domain knowledge.

· Should be able to demonstrate multi-year (3 plus) Cloud and microservice architecture, design, implementation and deployment experience with different cloud providers. Cloud certifications would be a plus.

· Vendor/Technical Leadership must have a minimum of at least five years Agile Development Experience

· Vendor/Technical Leadership must demonstrate IRS Enterprise Life Cycle (ELC) or OneSDLC experience.

B5.0 Contractor Key Personnel The positions identified below will be considered Key Personnel.

The Program Manager and other key personnel shall be designated during individual Task Order quotation. Key personnel (KP) are defined as personnel: (i) identified in the quote as key individual(s) to be assigned for participation in the performance of the BPA and its associated orders; (ii) whose resumes were submitted with the quote; or (iii) which are designated as key personnel by agreement of the Government and the Contractor during negotiations.

In the Table below, the Contractor shall identify individuals considered as KP in their quoted staffing projection to fulfill Technical / Price Quote. Positions listed below may be used at BPA and/or Task Order Level.

The BPA Program Manager shall be responsible for the performance of work performed under their designated Task Order(s). The Program Manager shall have full authority to act on behalf of the Contractor on all award matters relating to daily operation. The Program Manager shall be available during core hours – 8:00 a.m. to 4:30 p.m., Monday thru Friday except Federal holidays or when the IRS facility is closed for administrative reasons.

· The Contractor shall submit resume for identified PM for review and qualifications verification.

· Personnel whose resumes are proposed key personnel are subject to the evaluation process for skillset accessibility. Agreement of the selection by the government and the contractor will be determined before award of BPA(s) and associated TO(s). The Task Order level Key Personnel proposed at this phase are representative and will be rebid and finalized with the task order proposal.

The Contractor must notify the Contracting Officer prior to making any changes or substitutions in key personnel. No substitutions shall be made except in accordance with the below process and substitution clause located within IRS Security Clauses specifically BPA Clause #26 IR1052.204.9006 – NOTIFICATION OF CHANGE IN CONTRACTOR EMPLOYEE EMPLOYMENT STATUS, ASSIGNMENT, or STANDING.

1. Contractor promptly notifies the Contracting Officer in writing, at least fifteen (15) working days in advance of the proposed substitutions. The Government has 30 days to approve or disapprove key personnel or they are deemed acceptable substitutions. Contractor must provide:

a. detailed explanation of the circumstances necessitating the proposed substitutions,

b. complete resume for the proposed substitute, and

c. any other information requested by the Contracting Officer needed to approve or disapprove the proposed substitution.

2. All proposed substitutions must have qualifications that are equal to or greater than the labor category position requirements.

3. The Contracting Officer (CO) will forward request to authorized Program Office representative (usually BPA or Task Order Level COR) to conduct evaluation of request. Representative will notify CO approval or disapproval.

C. Description/Specifications/Performance Work Statement

C.1 ORDERING PROCEDURES

In accordance with FAR 8.405-3, IRS intends to establish one or more BPAs under GSA Multiple Award Schedule (MAS) – Information Technology (IT) Services, SIN: 54151S. Specifically, the IRS intends to award a BPA to up to six (6) companies with at least two (2) reserved for small businesses. All appropriately warranted IRS Contracting Officers (CO) are authorized to place orders against this BPA. COs shall follow the BPA ordering procedures as stated below:

1. The CO is responsible for considering the level of effort and the mix of labor proposed to perform, and for determining that the proposed price is reasonable. Factors such as mandatory criteria, technical capability, and price, on prior Task Orders (quality of deliverables/services, timeliness, and cost control), may be considered in determining award of individual Task Orders.

2. IRS CO will evaluate all responses received and place the Task Order with the BPA holder that represents best value.

3. BPA holders will be given a minimum of five (5) business days to respond to a BPA Call Order RFQ.

4. Contractors shall identify potential conflicts of interest and address/resolve any concerns prior to the BPA Call Order award.

5. All orders shall be placed via email.

6. The Government may issue individual BPA Call Orders on a Firm Fixed Price (FFP) or Labor Hour (LH) basis. For labor-hours orders, COs shall follow the procedures in FAR 8.404(h).

7. Contractors shall submit a response on all BPA Call order(s) request for quotes. If a vendor does not intend to submit a quote on a BPA Call order(s) request for quotes, the vendor shall send via email a “No Bid” and include a brief explanation as to the reason for the “No Bid.”

8. The CO shall seek additional discounts to the established BPA hourly labor rates when placing orders over the simplified acquisition threshold (SAT).

9. IRS COs have discretionary authority to set-aside orders for small businesses at the BPA Call Order level in the event that multiple small businesses are awarded Agreements.

C.2 APPLICABLE LABOR CATEGORIES

The labor categories (GSA Multiple Award Schedule (MAS) – Information Technology (IT) Professional Services, SIN: 54151S) applicable to the BPAs are listed in the Pricing Schedule for the general labor category descriptions.

The IRS is seeking product development, support services and O&M support with an emphasis on Agile, test-driven development, and continuous integration methodologies to enhance and assist efforts to secure and maintain new applications and capabilities. The scope is for high performing, delivery teams to provide software development and support services for completion of applications based on user story requirements that are evolving and emerge as the business climate shifts. The contractor shall provide technical methods, techniques, and concepts that are innovative, practical, cost-effective, and conducive to Agile/iterative application development, and Section 508 compliance and security testing. It is expected that all code developed by the teams will be for new functionality or critical changes to existing functionality as identified and prioritized by the Government product owners.

Each user story will have acceptance criteria which specify expected functionality for a user story, as well as any non-functional requirements that must be met in story development. The IRS Product Owners, supported by Subject Matter Experts (SMEs) and Business Analysts, will determine whether acceptance criteria have been satisfied.

A User Story will only be considered done when all the following conditions have been met:

· Code Completed and meets defined acceptance criteria

· Unit Test Passed

· Code Reviewed by EA and/or other applicable party

· Necessary logging has been incorporated (when applicable)

· Penetration Test Assessment/Vulnerability/Weakness/Defect Reports provided to Cybersecurity group

· Functional Testing Passed

· 508 Testing Passed (if applicable)

· Integration Testing Passed (if applicable)

· Performance Testing Passed (if applicable)

· Product Owner signs off on functionality delivered For the CLM SME, the vendor will function as the SME and design, develop, and deploy, filters and reports within Rational CLM to help meet the organizational goals and address the report, filter and dashboard needs. This effort includes hands on configuration of the tool, knowledge transfer of CLM, and provides consulting services to address any related challenges that may arise.

The contractor is to acquire testing support to assist the PMO and Enterprise Systems Testing (EST) in planning, executing, tuning, and reporting on test activities associated with the delivery of digital capabilities.

EST is partnering with the PMO to provide thorough, comprehensive, and independent testing of the digital service. The PMO and EST have identified a need for ongoing Contractor technical support to supplement federal personnel in the testing activities. The Contractor will provide support to PMO and EST in three key areas:

· Strategic Test Support

· Embedded FDT Test Support

· Product Performance Test and Engineering Support

Additionally, PMO will require support to assist the Digital Services Program in the communication via various mediums of planning, technical integration, and release/deployment planning activities associated with delivery of digital capabilities.

C.4.1 Task Area 1 – Transition Plan and Orientation Briefing (BPA) The Contractor shall provide transition plans and an orientation briefing for the government. Contractor shall discuss and present plans for transitioning task order activities with the incumbent service provider as necessary and will ensure transition plan is implemented within a time frame agreed upon by the contractor and the government. Contractor shall discuss and present plans for transitioning task order activities with the incumbent service provider as necessary. Within one week of task order award, the contractor shall conduct an orientation briefing for the Government. The Government does not desire an elaborate orientation briefing, nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held at the Government's facility and both parties shall mutually agree upon date and time. The completion of this briefing shall result in the following:

· The contractor and Government personnel who will perform work under this task order will be introduced

· The Government will show the applicable facilities to the contractor, if the contractor will be performing work on the Government's site

· Any issues concerning the contractor clearances for contractor personnel will be discussed

· The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS Desired Outcome –PMO and the Contractor have a solid understanding of the task order requirements and all key personnel are introduced to the IRS team.

Work Products – The contractor shall provide orientation briefing meeting minutes and actions items within one week of the meeting to the PM&I Senior Manager.

C.4.2 Task Area 2 – Director, PMO Briefing and Status Reporting (BPA) The Contractor shall schedule and conduct a bi-weekly 45-minute status briefing with the Director, senior managers, and delivery release managers of PMO on the major activities related to this task order. Additionally, the Contractor shall provide a monthly status report of all activities related to the tasks outlined in this task order.

Desired Outcome – The Director, senior managers, and delivery release managers of PMO are kept informed on the major activities in this Task Order and can provide feedback and direction to the Contractor.

Work Products – The contractor shall provide status Briefing meeting materials, team roster by projects and meeting minutes.

C.4.3 Task Area 3 – New Development and Support Services (BPA) The scope of this task area is to acquire support to assist the Program in planning, technical integration, and release/ deployment planning activities associated with delivery of digital capabilities in support of Digital Products. The IRS is seeking to implement capabilities for the below positions in support of Application Development.

The IRS will choose a delivery plan and strategy for program management and application development that will determine the involvement of the IRS team members with contractor staff in all components of its Agile product development process and system maintenance. Type of service is defined as IT software services where it is determined that a total vendor solution and/or vendor-built solution is most beneficial to the government.

As a result, team members well-versed in Agile product development and program management are needed to participate in the planning, creation, delivery, and support of digital products necessary for the success of the Program. The PMO is highly interested in Agile thought leadership, development methodologies, and proven delivery track records. Contractors shall ensure that personnel quoted have sufficient knowledge, skills, and experience identified to accomplish designated tasks in the roles identified below.

Personnel will establish/maintain framework, develop processes, and perform functions to plan for and rapidly deploy, test, and integrate applications and tools into the IRS production Web environment, without disruption to the users or impact to system performance. Task descriptions include tasks appropriate for Elaboration and Development.

All Federated Delivery Teams (FDTs) will be under the direction of a Release Manager. The Release Manager will coordinate activities across multiple FDTs for a single product or release. Each FDT will be self-directed teams with no direct team lead. Self-direct teams are defined as a group of people working together in their own ways, toward a common goal, which the team defines.

Vendor Built or Managed Service support may include providing the team members to contribute a full suite of development, testing (to include security and 508), integration and delivery tasks using Agile/iterative methodologies, including, but not limited to:

· Participating in solution design and developing code and other artifacts against the user stories and security requirements documented in the task or as assigned by the government

· Software code testing, including creating test cases and automated test scripts to support test automation activities; sharing test scripts as needed; working to increase the coverage, quality, and speed of existing tests. Unless stated differently, testing shall be in accordance with the most current version of the Testing Strategy Implementation Plan

· Performing integration and delivery activities to ensure the automatic build and deployment process works effectively across all environments

· Contractor team should consist of majority members having IRS and OLA institutional knowledge. Contractors should be in the IRS facility collaboration space Tuesday to Thursday when possible.

· Support the definition of epics and user stories for Federated Delivery Teams (FDT) and architecture for anticipated products and features

· Support the Engineering teams with updates and input to the Simplified Design Specification Report (SDSR) documentation to Enterprise standards as required by Solutions Engineering

· Support the Engineering teams with updates and input to the Interface Control Document (ICD) documentation to Enterprise standards as required by Solutions Engineering

· Support the Enterprise Architecture teams with updates and input the Solution Architecture to Vision, Scope, and Architecture (VSA) documentation to Enterprise standards as required by Enterprise Architecture

· Support FDTs in the identification of pragmatic solutions to address implementation challenges that arise to minimize technical debt

· Support input to- and refinement of the Performance Engineering Model (PEM) based on test results for current and anticipated digital products in conjunction with the performance team as required

· Support the discovery of data needs, design of data structures, and data flows, including input to the conceptual and logical design of systems as they relate to both data and applications

· Support the development of conceptual and logical solutions for desired products, features, and platform architectures to capture software requirements from a business perspective and develop tangible acceptance criteria for developer and testers to perform in epics, stories, and tasks

· Conduct technical reviews on application design artifacts, epics/user stories/tasks, test plans, test results, deployment plans, and tabletop scenarios The Contractor shall provide support for emerging DevOps practices that align with Enterprise Architecture DevOps standards and guidelines.

Desired Outcome – The IRS is seeking development support personnel to work with government personnel, creating three FDTs to develop, test, and deploy business capabilities. Personnel will perform the applicable /assigned FDT role by participating in solution, design, development, and test, within the guidelines of the Web Apps Federated Delivery Model and FDT roles and responsibilities. Ensure that the Web Applications delivery organization has the appropriate resources and skill sets to execute the delivery of digital products, specifically working software code at the end of each iteration.

C.4.3.1. Solution Engineering Support To accomplish this section, the contractor shall be responsible for providing the team members to contribute the full suite of solution engineering to support the FDT teams in 6.3 (FDTs) 6.4 (TDC ON), and 6.5 (Infrastructure Modernization) including, but not limited to:

· Participating in solution design and other artifacts against the user stories and security requirements documented in the task or as assigned by the government

Desired Outcome– The IRS can deliver stable, extensible, and valid designs and solutions.

Work Products:

1. Provide engineering analysis for new products, and Lean Business Cases (LBCs).

2. Updated Performance Engineering Model.

3. Updated architecture components and artifacts in available design tools and repositories, e.g., Rational Architect, MS Visio, Rational Team Concert (RTC).

4. Produce data model designs, flows, types, and structures related to data and application needs.

5. Provide engineering support for design and implementation of digital products and features, create SDSRs, ICDS, create documentation as required.

6. Provide proof of concept, alternative analysis for any feature or product.

7. Perform engineering tasks at the direction of IRS SE FTE.

C.4.3.2 FDT Support Functions To accomplish this section, the contractor shall work to ensure that developers create the most secure systems in the world while enhancing the privacy of all system users. Bridges the gap between legacy development or operations teams and working toward a shared culture and vision. The contractor shall work with other security related specialists within and outside the digital team to determine the best response to emerging security needs

· Security Transformation - The contractor will continue work with PMO and Cyber teams to transform Cyber security practices and FISMA activities to fit into an Agile Model. The agency understands that there is a significant gap today between current Cyber security compliance processes and the agile development practices. The contractor will provide expert level advice and guidance to help transform these processes.

· Security Documentation - The contractor will work with PMO, the Federated development teams and other agency stakeholders to develop FISMA and other IT security documentation necessary to support and maintain the certification and compliance process for product development.

· Security Processes - The contractor will provide advice and guidance for the appropriate FISMA and security engineering and compliance practices to meet agency security requirements.

Desired Outcome – Identify, manage and support remediation of defects discovered throughout the Program Iteration and capture evidence (documentation or electronic) that meets or exceeds Federal Standards and Guidelines (NIST, FISMA, OMB, etc.).

See supplemental spreadsheet for desired capabilities.

The program has staff with the appropriate skillsets to provide software development, testing, and technical leadership and can monitor and report readiness status for each product deployment or drop deploying the system to production within schedule.

Work Products – The table below describes the Product Planning, Program Increment (every 9 weeks) and FDT Iteration (2-week sprints) work products that will be delivered on a continuous basis for support under this Task Area:

User Acceptance Test

Conduct code review

Section 508 Applicable Provisions and Testing DID (APT) with test results and implemented methodologies Demonstration of application using Assistive technology (standalone screen reader, screen magnifier and Voice command software compatible with the IRS COE*)

* IRS COE Assistive technology

Knowledge Transfer Documented Working Sessions

Status Updates and Reporting Updates to the ROAD Guide

Update Computer Operator Handbook (COH)

Updates to Interface Control Documents (ICDs)

Updates to Security Compliance Documents Security Compliance documents

Updates to Vision, Scope and Architecture (VSA)

Incorporate Swagger API documentation

C.4.4 Task Area 4 – Technology Strategy and Planning (BPA) To accomplish this sub-task the contractor shall:

· Support the Product Planning process by assisting in the scoring and sizing of technical epics and stories of proposed functionality

· Provide input and estimations to the rough-order-of-magnitude (ROM) costs for proposed functionality if requested

· Work with enterprise partners to develop solution concepts as part of product elaboration and assist with the solicitation of product capabilities and features using Event Storming, User Story Mapping, and principles of the INVEST strategy

· Support enterprise partners in the identification and documentation of IT dependencies

· Provide support to PMO in negotiations with enterprise partners to define services that will be integrated into the Digital platform and prepare UWRs, and Change Requests (CRs) as required and based on the outcomes of negotiations

· Conduct research to support the planning for and development of the next version of the digital platform, identified products, and features

· Support the development of a release plan for functionality beyond the currently planned set of activities, including future product and feature integration

· Provide support for analysis, adoption, and implementation of new technologies into the target environment

· Provide technical solution assessment for developing roadmap and analyze new business products and emerging technology

· Provide technical solution analysis and sizing information for lean business cases Desired Outcome – The Program can execute technical planning to support the program short- and longer-term product planning and the investment selection process.

Work Products:

1. Solution concept diagrams, decision trees, workflows, descriptions, models, patterns, established methods, and additional information and / or updates to existing solution concepts.

2. Technical size and costs estimate components and risk components as input to proposed capabilities and potential investments.

3. Updates to conceptual, logical, and physical architecture.

4. Development and submission of Enterprise Architecture (EA) Change Requests on an Ad Hoc basis or as directed by Solutions Engineering for new tools and technologies to support program initiatives.

C.4.5 Task Area 5 – Embedded Architecture and Engineering Support Enterprise Architecture (BPA) The embedded architects and engineers will support the activities in New Development and Support or others as applicable.

To accomplish this sub-task the contractor shall:

· Provide technical architecture assessment for developing roadmap and analyze new business products and emerging technology

· Provide technical solution analysis and sizing information for lean business cases

· Support the definition of epics and user stories for Architecture Team, Federated Delivery Teams (FDT) Teams for anticipated products and features

· Support EA team by following EA guidance and direction in the creation, review, and delivery of ELC architecture related artifacts while ensuring compliance and integrity to IRS enterprise standards, policy, procedures and EA processes

· Support the conceptual and logical architecture development of Taxpayer Experience Target State Architecture

· Support and coordinate the review analysis of alternatives for product recommendations from an architecture perspective per EA team’s guidance and direction

· Support the architecture teams with updates and input to the Solution Concept documentation in compliance with IRS enterprise standards as required by Enterprise Architecture and Solution Engineering

· Support the architecture and engineering teams with updates and input to Vision, Scope, and Architecture (VSA) documentation to IRS enterprise standards as required by Enterprise Architecture

· Support the architecture teams for the Simplified Design Specification Report (SDSR) per IRS enterprise standards as required by EA

· Support the architecture teams for the Interface Control Document (ICD) per IRS enterprise standards as required by EA

· Support EA team in the identification of pragmatic solutions to address architecture/design/implementation challenges that arise to minimize technical debt

· Support the discovery of data needs, design of data structures, and data flows, including input to the conceptual and logical design of systems as they relate to both data and applications

· Support the development of conceptual and logical solutions for desired products, features, and platform architectures to capture software requirements from a business perspective and develop tangible acceptance criteria for developer and testers to perform in epics, stories, and tasks

· Conduct technical reviews on application design artifacts, epics/user stories/tasks, test plans, test results, deployment plans, and tabletop scenarios in support of program initiatives

· Provide Architecture and Engineering support with experience in IRS backend systems Current Production Environment (CPE) including prior experience in understanding IRS's organizational roles and responsibilities, established processes, policies and guardrails in alignment with IRS Enterprise Architectural Roadmap and Taxpayer experience platform.

Desired Outcome– At the direction of IRS EA and SE SMEs, the IRS can deliver stable, extensible, and valid architecture and designs to support the digital program products, features, and platform.

Work Products:

· Updated Target State Architecture, and Roadmap.

· Updated architecture components and artifacts in available design tools and repositories, e.g., Rational Architect, MicroSoftVisio, Rational Team Concert (RTC).

· Updated and new data model designs, flows, types, and structures related to data and application needs.

· Updated architecture support for architecture, design, and implementation of Solution Concept/Architecture (SC/SA), Vision, Scope, and Architecture (VSA), SDSRs, ICDs, alternative of analysis artifacts.

· Embedded resources for architecture support for EA team.

C.4.6 Task Area 6 – Elaboration (BPA) The Contractor shall assign a team of resources experienced in supporting all activities/roles listed in this TO, as resources can be asked to support more than one activity, as needed.

Elaboration Process Support Lead The Product Elaboration process takes products/capabilities from the list of SD ESC approved products/capabilities and prepares them for the start of development. This process is a collaborative effort involving representatives from program, OLS, Business SMEs, AD, EA, IAM, Cyber, and additional Delivery Partners. To support program initiatives in successful implementation of the above activities, the Contractor shall support or lead the following activities:

· Identify the list of stakeholders and POC(s) for supporting the Elaboration Process activities; develop, distribute, and maintain the POC list

· Develop timeline for conducting Elaboration process, present the proposed timeline to PMI management and communicate the timeline with stakeholders, and facilitate Elaboration Process kick off meeting for epics and capabilities

· Develop, distribute, and maintain Elaboration Product Backlog and status reports

· Schedule and facilitate meetings to complete eRisk Assessment, decompose product epics, develop vertical slices, story maps, and define acceptance criteria

· Schedule and facilitate elaboration sessions involving stakeholders for decomposing epics into features and acceptance criteria, identify dependencies and data services, and capture additional information and artifacts relevant to the lean business case and story map

· Coordinating with Delivery team for completion of transition criteria and conducting transition

· Develop and deliver input for PMO briefings as requested.

· Provide input, process improvement, and feedback for the artifacts (such as Operating Model) developed by other groups under PMO as requested by Web Apps management

· Facilitate regular/ad-hoc meetings with resources assigned for conducting Elaboration activities to discuss and track the status of their activities, these meetings included but not limited to daily Scrum meeting

· Coordinate with Delivery Partners to collect requirements from other partners that may not be a part of the specific project

· Participate in all Delivery Ceremonies (PI Planning, Cadence Calls, Scrum Calls, Retrospectives)

· Ensure all the artifacts (final and work in progress) are being maintained in program SharePoint designated folders and/or other repositories defined by the IRS

· Communicate with and escalate the issues and risks, impacting the on-time completion of artifacts, to PPR manager

· Provide recommendations and input for improving the elaboration process Desired Outcome –Timeline and approach for conducting and completing the Elaboration Process activities are defined and are tracked to completion. Risks and issues impacting the process are identified and mitigated. Stakeholders input for developing/updating the artifacts are captured and addressed. Technical Stakeholders are involved in the elaboration discussions and Elaboration meetings are held as planned. Vertical slices, story map, and a roadmap are developed for the capability. Product Features and required user stories are developed and stored in CLM. Product(s) eRisk Assessment is complete. The IRS leadership, Program Director, PMO, and other stakeholders are kept informed of the status of the elaboration process.

Work Products: Work products shall include but are not limited to:

Elaboration Process artifacts such as timeline, kickoff meeting materials, Product Backlog, Sprint Backlog. Elaboration Process status reports and materials such as story maps, roadmaps, vertical slice definition, executive briefings, meeting minutes. Developed features, user stories, non-functional requirements ready to be developed by the federated delivery teams.

C.6.7 Task Area 7 - Vulnerability and Configuration Assessment (BPA 6.3.3) The vendor shall test and review vulnerability threats and assess the configurations for vulnerabilities including threat models, rules of engagement, penetration testing. To accomplish this the contractor shall:

Test Preparation

· System and Project Introduction

· Work with IRS to refine the Threat Model

· Create test plans based on the agreed-upon threat model

· Establish test accounts in the appropriate environments

· Prep test Virtual Machine (VM) systems, install any additional tools in IRS environment, with approval

· Conduct “walk-through” of Digital Products Portfolio and supporting infrastructure

· Develop and finalize Rules of Engagement document

Desired Outcome –PMO and the Contractor will review the Threat Model Assessment, Conduct Penetration Test Assessment Criteria and provide preliminary recommendation to Cyber SME and Security Team.

Work Products – Threat Model document, Rules of Engagement, Penetration Test Assessment Criteria.

C.6.8 Task Area 8 - Test Execution (BPA) To accomplish this sub-task the contractor shall:

Conduct infrastructure scanning of IEP and supporting infrastructure in Performance Testing Environment (PTE)

· Application / Web Servers

· Middleware

· Audit system servers and databases

· Network Infrastructure Conduct testing of web interfaces of Digital Product Portfolio applications in development/test environments

· User interface

· OLA, BTA or equivalent digital services

· SADI/PING

· OLA- Tax Payer Protection ID Verify

· Product applications downstream data processing and audit systems

· eGain

Desired Outcome –PMO and the Contractor have a solid understanding of conducting penetration testing on Digital Applications, interfaces and infrastructure and vulnerability scanning tools.

Work Products – Vulnerability Scanning tools analysis/recommendations and scan results report.

C.6.9 Task Area 9 - Reporting and Analysis (BPA) To accomplish this sub-task the contractor shall:

Develop Vulnerability Assessment Analysis and Report.

Desired Outcome –PMO and the Contractor have a solid understanding of conducting penetration testing on Digital Applications, interfaces, and infrastructure.

Work Products – Vulnerability assessment report.

C.6.10 Task Area 10 - Penetration Test (BPA) The scope of the testing will be the physical infrastructure (i.e., web server, applications servers, database servers, etc.) of the IEP infrastructure production and test environments. The test team will also test and confirm the existence of any vulnerabilities introduced by the Digital Products in development as well as test emerging products that are currently under technical insertion. Each subsequent release will result in an increased effort over the testing for the previous release as features are added, system interfaces are introduced, and as the IRS introduces Application Programming Interfaces (API) to support additional functionality.