Draft VDI SOO - (Attachment 2).docx

Draft Statement of Objective (SOO) Virtual Desktop Infrastructure (VDI) Cloud Solution User and Network Services

Version 1 March 28, 2025

SOO for VDI Cloud Solution | ii Table of Contents

Appendix A - Selected Unique Requirements 13

SOO for VDI Cloud Solution |

Project Title Internal Revenue Service (IRS) Virtual Desktop Infrastructure (VDI) Cloud Solution.

Background The IRS is implementing cloud-based VDI as a key component of its modernization strategy to enhance technology, digital services, data security, customer service, and process efficiency. VDI enables centralized management, scalability, and consistent user experience across devices. By enforcing controlled access and robust security measures, VDI strengthens data security and enhances customer service by enabling Information Technology (IT) teams to resolve issues from anywhere, at any time, using various devices to maximize resource utilization. Additionally, VDI supports process improvements by reducing hardware dependencies, promoting automation and standardization, and contributing to cost savings and adherence to federal laws and regulations for data protection, privacy, cybersecurity, and information management. Finally, VDI lowers capital expenditure by minimizing the need for physical hardware and associated maintenance costs as the desktop interface and applications are hosted on a remote server rather than on a local physical computer.

The VDI implementation will follow a phased approach. In Calendar Year 2025 (CY25) 4,000 users consisting of IRS personnel and cleared contractors will migrate to the VDI Cloud Solution, increasing to 8,000 users in Calendar Year 2026 (CY26). This approach allows the IRS to thoroughly evaluate system performance and operational readiness, address any potential challenges in a controlled environment, and provide an opportunity to plan for future expansion to additional personnel and contractors. This approach aligns with the Federal Cloud Computing Strategy (“Cloud Smart”), enabling the IRS to create a scalable platform that accounts for future growth. By adopting VDI, the IRS is positioning itself to better meet evolving operational demands while ensuring secure and reliable IT services for its users.

Purpose The purpose of the VDI Cloud Solution project is to provide a flexible, secure, and cost-effective solution for delivering desktop environments to users and enhance operational efficiency. This cloud-based solution enables the IRS to elastically scale infrastructure, increasing resiliency, promoting workload portability, and reducing operational overhead costs and lead times traditionally associated with provisioning and maintaining physical laptops.

Agency Mission The IRS' mission is to provide top-quality service to taxpayers by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness. The VDI Cloud Solution project aligns with IRS' strategic focus to modernize taxpayer services, streamline operations, and strengthen cybersecurity. The VDI Cloud Solution will improve information IT service delivery of secure and reliable employee and contractor access to IRS systems.

Scope The scope of this SOO includes the following:

· VDI Desktop-as-a-Service (DaaS) Managed Services: The scope includes VDI as a fully managed, cloud-hosted service tailored to the specific number of users and user types specified in Table 1. The managed services include DaaS vendor options to meet the objectives and performance requirements outlined in this SOO, such as monitoring, maintenance, user support, configuration management, and security management. The VDI services must be hosted by a Federal Risk and Authorization Management Program (FedRAMP) High authorized Cloud Service Provider (CSP). The cloud services include compute and storage resources that meet stringent federal security standards, ensuring taxpayer information is protected with advanced security measures and that the solution adheres to federal regulations for data handling and privacy.

· VDI Configuration, Integration, and Test: The scope includes configuration of the VDI Cloud Solution to deliver the required functionality and technical capabilities identified in this SOO and integration with existing IRS IT infrastructure to ensure secure connectivity. The scope also includes testing support in accordance with IRS processes prior to the VDI Cloud Solution being transitioned to production. These processes may require support for setting up test environments, providing access to necessary tools and resources, and troubleshooting and resolving any issues that arise during testing to ensure smooth and efficient operations.

· Commercial Product Licensing: The scope includes all necessary commercial product licenses required to implement and maintain the VDI Cloud Solution. This includes identifying and managing license compliance and ensuring that all licensing agreements are adhered to, thereby avoiding any legal or operational issues related to software usage.

· Documentation: Section 9 (Deliverables) outlines required deliverables and defines the quality standards for measuring acceptability.

Table 1. User Types Per Year

Outcomes The IRS’ desired outcomes for the phased implementation of the VDI Cloud Solution are:

· CY25: Deploy a cloud-based virtual desktop solution to implement virtual workstation capacity and reliability for up to 4,000 users simultaneously.

· CY26: Deploy a cloud-based virtual desktop environment to expand virtual workstation capacity and reliability for up to 8,000 users simultaneously.

These desired outcomes of the VDI Cloud Solution align with IRS’ efforts to improve technology operations, specifically:

· Improve Efficiency of IT Operations and Customer Service: Reduce operational overhead costs and timeline associated with provisioning and maintaining physical laptops by transitioning to a cloud-based solution.

· Support IRS Modernization Goals: Align with the IRS' broader modernization strategy to enhance technology, digital services, and process efficiency.

· Ensure Compliance and Security: Adhere to IRS and federal security mandates to protect sensitive tax data and ensure cybersecurity compliance.

· Facilitate Scalability and Future Growth: Create a scalable platform that can accommodate future growth and evolving mission requirements, supporting additional users as needed.

Current IT Network Environment Currently, the User and Network Services (UNS) team supports IRS personnel and contractor access by provisioning physical laptops. During the first phase of the VDI project, the capability was added to provision virtual desktops from the IRS' Martinsburg data center using Citrix Virtual Desktops for up to 1,800 users. The VDI Cloud Solution will extend this capability to serve a larger number of users, eliminating the need to manage the associated hardware, and securely support user access from outside of IRS facilities and other remote work needs.

The VDI Cloud Solution will integrate with existing IRS infrastructure and services in the following ways:

· Identity Services: The IRS' existing identity service (Microsoft Entra ID) will be used to authenticate and authorize VDI users.

· Cloud Applications[footnoteRef:2]: VDI users will connect to Software-as-a-Service (SaaS) applications such as SharePoint to work with IRS documents and data. [2: Cloud applications are internet-based programs where processing and storage occur on the internet ("the cloud"), accessible through web browsers or apps, offering features like data storage, email, and collaboration tools. ]

· On-Premises Applications: The VDI Cloud Solution will need a secure, reliable connection between the CSP and the IRS Martinsburg data center to connect to services and applications running on-premises, such as the Domain Name System (DNS).

· Security Services: The VDI Cloud Solution will integrate with the IRS' Secure Access Service Edge (SASE) tool to provide an additional layer of security and consistent end user experience. In addition, logs from the VDI Cloud Solution will be sent to IRS' Security Information and Event Management tool for auditing and responding to security incidents.

· Endpoint Management: The VDI Cloud Solution must support IRS' endpoint management solution to protect against unauthorized usage and prevent data leakage from client devices.

Objectives The VDI Cloud Solution must meet the objectives outlined in the subsections below. Selected unique requirements are specified in Appendix A. Additionally, the IRS has standard requirements for Section 508 compliance, Internet Protocol version 6, operations, privacy, and security.

Business Objectives The VDI Cloud Solution must satisfy the following business objectives:

· Virtual Desktops: Deploy and manage fully configurable virtual desktops hosted in a secure cloud environment to provide users with reliable, highly available access to their applications and data from anywhere with an internet connection, at any time, using various devices such as laptops, tablets, or smartphones via various network configurations. Devices may include IRS-issued thin clients or user-furnished devices that comply with IRS Bring Your Own Device policy.

· User Experience Consistency: Provide a virtual desktop user experience that replicates the experience of using a physical workstation, including familiar interfaces and settings and Section 508 accessibility compliance. All necessary applications must be available and function seamlessly within the virtual desktop environment, just as they would on a physical workstation including comparable fast boot times, quick application launch, and smooth operation. This includes support for peripherals such as printers, audio/video conferencing, video playback, and high-resolution graphics as well as seamless integration with enterprise storage, databases, services, and applications. Robust network connectivity is essential to minimize latency and increase response times and ensure that users can access their virtual desktops without interruption, regardless of their location.

· Resource Allocation and Scalability: Provide the capability to efficiently allocate adequate computing resources (i.e., central processing unit (CPU), memory, storage) for each virtual desktop based on demand to maintain efficiency and performance and reduce over-provisioning. Provide the capability to quickly scale desktop resources up or down to accommodate varying numbers of users and workloads based on business needs, supporting growth and seasonal fluctuations without significant infrastructure changes and without performance degradation.

· Centralized Management: Provide a centralized platform for managing and configuring virtual desktops that enhances control over desktop environments while simplifying provisioning, Common Operating Environment (COE) image management and deployment, software updates, patches, security settings, and troubleshooting. The centralized platform should enable faster deployment of applications and services and enhance overall productivity to improve operational efficiency.

· Secure Access and Data Protection: Ensure that data and applications are secure, by fully integrating with IRS security controls, tools, and existing systems that support the IRS desktop infrastructure using measures such as encryption, access controls, use of key and certificate management, and network security that comply with industry standards, regulations, and IRS security policy. Support secure user authentication methods, including single sign-on and multi-factor authentication, and integrate with existing IRS identity management systems. The virtual workstations will access the IRS network access through existing firewalls, proxies, ports, and protocols.

· Disaster Recovery and Business Continuity: Minimize downtime caused by component failure or other unforeseen events. Implement reliable disaster recovery measures such as automated back-up/recovery and redundancy/failover to ensure data and applications remain accessible during disruptions.

· VDI Monitoring, Alerting, and Reporting: Provide tools for monitoring the performance of virtual desktops and applications to analyze resource usage and address bottlenecks, as well as the ability to provide alerting methods in the event that monitoring thresholds are exceeded. Generate reports, dashboards, and analytics on usage, performance, and security metrics in specified formats. Provide tools for auditing and compliance reporting that are compatible with existing IT management and monitoring tools.

Program Management Objectives Successful project execution will require consistent and well-organized program management that leverages existing IRS processes and tools, to deliver the successful integration and operation of the VDI Cloud Solution.

The contractor shall follow established IRS and Treasury program management processes, including:

· Contractor Performance Monitoring and Analysis: Provide meaningful reporting and analytics that provide UNS with up-to-date and comprehensive information regarding technical and management performance.

· Schedule: Develop and manage schedules for implementation along with planned maintenance and upgrades

· Cost and Resource Management: Implement effective cost management practices for implementation and operation of the VDI Cloud Solution including rightsizing of environments and staffing, following IRS IT standards for resource tagging and cloud cost management tools.

· Risk Management: Provide and maintain a Risk Management Plan that documents mitigation strategies, likelihood, impact, severity and an overall risk rating for project risks.

· Communication Plan: Develop a Communication Plan that establishes communication goals, identifies stakeholders, and identifies communication methods and frequency to ensure awareness across impacted organizations.

· Configuration Management Plan: Develop a Configuration Management Plan that identifies and baselines Configuration Items and controls modifications to these items for completeness and consistency.

· Training and Technical/User Documentation: Develop a Train-the-Trainer program tailored to the VDI Cloud Solution, encompassing the various types of training needed to ensure IRS IT staff, end users, and administrators can effectively use and support the system. Provide training materials, technical documentation, and resources to support the program and conduct the initial trainer training.

· Status Reports: Provide weekly and monthly status reports that provide visibility into program cost, schedule, technical performance, risks, and other key aspects of contractor progress and concerns.

· Implementation Plan: Develop an implementation plan detailing milestones, activities, and timelines for the VDI Cloud Solution and report status via the weekly status reports.

Operational Objectives The VDI Cloud Solution will support the following operational and maintenance objectives:

· Ensure the efficient, effective, and timely development and integration of all services.

· Maintain high availability, scalability, and performance to handle peak processing times and a growing user base.

· Ensure the solution can initially support up to 4,000 users in CY2025, and it is scalable to meet VDI deployment goals of up to 8,000 users in CY 2026.

· In the event of an outage, meet the applicable IRS service level agreements (SLA) for system recovery and end-use notification. Provide integration with established IRS Incident Response procedures to ensure awareness of system status per contract SLAs to assist in triaging and resolving outages (per IRS Master Service Level Agreement and IRS Incident Management Process).

· Plan and effectively execute timely updates and adjustments in response to evolving IRS needs along with updates to regulations and mandates.

· Provide plans and timelines for any required updates, whether vendor-led or in collaboration with the IRS.

· Provide expert integration services, ensuring the VDI Cloud Solution is successfully integrated with IRS operations and is fully compatible with existing IRS technologies.

· Provide support to assist IRS IT with technical issues related to the VDI environment and ensure rapid response times to IRS IT inquiries and technical problems.

In addition to the general Operations Objectives stated in this section, the VDI Cloud Solution must support IRS operational standards. This includes service objectives for availability and key IT Services Management processes such as Change Management, Configuration Management, Incident Management, Release Management, and Problem Management.

Technical Objectives The VDI Cloud Solution must provide a secure, scalable, and flexible cloud-based virtual desktop and application environment, enabling users to access applications and data from authorized devices. The landing zone[footnoteRef:3] design must be planned to initially support 4,000 concurrent users, with the capability to expand and accommodate up to 8,000 users. Designing and supporting the landing zone involves planning, implementing, and maintaining an infrastructure that encompasses network hardware, software, protocols, and services to ensure efficient communication and data transfer. When considering VDI performance, particularly in the context of network design, cloud services, or application development, two key factors need to be considered. [3: “Landing zone” is a term used by various cloud providers to refer to the basic cloud infrastructure and supporting components that enables efficient and secure deployment of applications based on an organization’s IT policies.]

· Bandwidth Considerations:

· Basic User Activity: For typical office productivity tasks, a minimum of 10 Mbps per user is generally considered adequate.

· Graphics Intensive Applications: Users of graphics-heavy applications will require higher bandwidth, potentially impacting shared circuits that connect to IRS data centers. Bandwidth usage must be monitored, and the IRS notified if additional circuits are required to maintain service levels.

· Scaling Considerations:

· Number of Users: As the number of concurrent users increases, so does the required network bandwidth.

· Application Type: Applications with high graphical demands require more bandwidth and computer resources than text-based applications.

· Region Selection: Choose a region with low network latency to users' locations.

· User Scalability: Virtual desktops can be adjusted to meet changing resource needs by increasing or decreasing CPU and random-access memory allocations.

Security Objectives Provide support and services in compliance and alignment with the FedRAMP High security requirements and standardized controls, assessment, authorization, and continuous monitoring policies. In addition to FedRAMP, comply with IRS-specific security requirements required to achieve an IRS Authority to Operate (ATO). The VDI CSP must maintain FedRAMP High authorization and the VDI Cloud Solution provider must support ATO reauthorization cycles.

· Assessment and Authorization activities will be included as part of the VDI Cloud Solution, as well as supplementary IRS-specific requirements described in IRS Policy Alert Update PA 24-03 – “Federal Information Security Modernization Act (FISMA) Cybersecurity Requirements Language”.

· Provide cloud-based VDI services regarding security and privacy that are consistent with the National Institute of Standards and Technology (NIST) Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” and other applicable standards and guidelines.

· Provide support personnel who have Minimum Background Investigation clearance at the vendor’s expense.

· Provide support to the IRS to obtain an ATO and establish a Risk Management Framework (RMF) process prior to implementation.

Deliverables

Timeline: Monthly

Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact Contractor Performance Assessment Report (CPAR) ratings.

Timeline: initial phases

Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: Weekly

Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: Initial phase

Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: As needed

Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: Ongoing

Timeline: Ongoing Compliance is consistently achieved with only minor adjustments required.

Surveillance: 100% Inspection Surveillance Performed by: COR, PM, CO, or other Government personnel as directed. Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: As needed Compliance is consistently achieved with only minor adjustments required.

Surveillance: 100% Inspection Surveillance Performed by: COR, PM, CO, or other Government personnel as directed. Incentive/Disincentive: Any quality deficiencies or missing deadlines may adversely impact CPARs ratings.

Timeline: As per needed

Constraints The following constraints will shape the VDI Cloud Solution.

· Regulatory Compliance: Mandatory compliance with IRS standards and policies and federal laws and guidelines.

· Standard Adherence: Mandatory adherence to IRS, NIST, FISMA, and Federal Information Processing Standards (FIPS) standards for cloud security and information management. Periodic audits, as specified in Federal Acquisition Regulation (FAR) Subpart 42.15, will assess compliance.

· One Solution Delivery Lifecycle (OneSDLC) Integration: Contributions to IRS' cloud modernization must align with the IRS' OneSDLC requirements and follow IRS and NIST frameworks for information security and privacy management.

· Project Coordination: The effectiveness of IRS coordination, evaluated against IRS and NIST guidelines, will be measured by meeting project milestones and OneSDLC requirements.

Performance Requirements Summary The Performance Requirements Summary is the list of performance elements and standards that must be performed by the contractor. The table below details the delivery or required service, performance standard, acceptable quality level, and method of surveillance the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.

VDI Service Availability (SOO Section 6, 8, and 10)

99% Availability during weekday off-hours (9pm – 6am) and weekends.

COR and/or PM continuous surveillance, which may include, but is not limited to the following: electronic dashboard and log reviews, periodic inspections, report reviews, random observations, and/or planned observations.

VDI Service Latency (SOO Section 8)

VDI Solution Authorization (SOO Section 5, 7, and 8)

Performance

· Place of Performance: This work will be performed at contractor facilities. Local travel (within a 50-mile radius of Washington, DC, or any IRS field offices) required for on-site meetings will not be reimbursed by the IRS. The Contractor must provide the COR, Government Technical Monitor (GTM), and other IRS staff, as appropriate, with advance notice to make necessary arrangements.

· Period of Performance: The performance period for any resulting award will consist of a 12-month base period followed by a 12-month option period. The agency will evaluate the option to execute FAR 52.217-8, Option to Extend Services.

Travel No travel other than local travel is expected under this contract.

Appendix A - Selected Unique Requirements

Table A1. Selected VDI Unique Requirements

Table A2. Selected Security Unique Requirements

The contractor shall provide to the IRS to be used in accordance with OMB Memo 21-31, the system logs for both services implemented on servers within the authorization boundary and services deployed on Cloud Service Offerings. The contractor shall collect and maintain network and system logs on Federal Information Systems for both on-premises systems and connections hosted by third parties, and when it is necessary to address a cyber incident on Federal Civilian Executive Branch Information Systems.

The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified IRS Administrators that will allow IRS designated personnel the ability to perform management duties on the system. The contractor shall support MFA including phishing resistant MFA (e.g., Fast Identity Online/Web Authentication and public key infrastructure (PKI)) as required by Office of Management and Budget (OMB) Memo 22-09. The contractor shall support a secure, multi-factor method of remote authentication and authorization to identified contractor administrators that will allow contractor designated personnel the ability to perform management duties on the system.

Use of federated MFA may be leveraged by adopting one or more of the following Treasury/IRS Enterprise Services:

i. Secure Access Digital Identity (SADI) for authenticating external users.

ii. IRS Active Directory Federation Services (ADFS) for internal IRS users

iii. Common Access Identity Assurance (CAIA)/Treasury Enterprise Authentication Service (TEAS) in support of all Treasury.