e-Payment Card Services PWS.pdf

Section C – Description/Specification/Performance Work Statement

C.1 Performance Work Statement

C.1.1 Introduction

According to the Internal Revenue Service (IRS) 2020 Data Book, the IRS is one of the largest processors of information in the world, collecting nearly $3.5 trillion in Federal taxes annually. As described in the IRS Strategic Plan, the IRS is planning to improve service to taxpayers by improving service options for the taxpaying public, facilitating participation in the tax systems by all sectors of the public and simplifying the tax process. This will be accomplished as the IRS increases the scope and accessibility of electronic payment services and simplify the paying experience for all taxpayers. The IRS will continue to launch new and enhanced filing and payment programs to create an environment where electronic interaction is the preferred option for our customers. Electronic payment options will be enhanced allowing for greater flexibility for the taxpayer through more choices. To do so, the IRS will continue to partner with private industry to develop products that will encourage taxpayers to electronically pay estimated and balance due taxes.

Since January 1999, individual taxpayers have been able to electronically pay the balance due on individual tax returns by way of an electronic funds’ withdrawal or credit card payment. Currently, individual and business taxpayers can pay electronically by authorizing an electronic funds withdrawal (direct debit) from a checking or savings account or through an authorized e-file provider; by credit or debit card using a touch-tone phone or Internet; or by credit or debit card through an integrated e-file and e-pay solution. These payment options are made possible by the Taxpayer Relief Act (TRA) of 1997, which authorized the acceptance of tax payments via any commercially acceptable means.

As described in the TRA of 1997, the Secretary of Treasury is authorized to receive internal revenue taxes through any commercially acceptable means; however, the Secretary may not pay any fee or provide any other consideration under any related contracts. Please note this may change pending approval of Legislation H.R.5445 21st Century IRS Act or any other legislation of similar nature that may impact the IRS Pay by Card Program. If the legislation is approved, it is anticipated this may have an impact to the contract.

In the 2023 filing season, credit or debit card payment options for taxpayers could include (1) pay by phone or Internet through service providers; (2) electronically file and pay through service providers who partner with software developers; (3) electronically file and pay through authorized IRS e-file providers and commercial tax preparation software; and (4) pay with cash for the unbanked and underbanked.

C.1.2 Objective

The IRS is looking for the best solutions for making electronic payment options the preferred method for paying taxes. The IRS is seeking contractor(s) who can identify and provide approaches to move balance due return payments, estimated tax payments, installment payments and other tax forms with related payments to electronic transactions.

The government is looking to minimize cost to the taxpayer and ensure privacy and security guidelines are adhered. Electronic payment options should simplify payment transactions in such a way as to encourage taxpayers to explore other opportunities for electronic exchanges with the IRS. A goal is to communicate that electronic payment options are (1) convenient, safe, and secure and (2) a normal outgrowth the trend in electronic filing and overall e-commerce.

The IRS vision is to improve the taxpayer experience through continuous innovations in taxpayer service and compliance programs. The IRS intends for the taxpayers when accessing the contractor’s website through the IRS.gov to make a debit or credit card payment, the process should include clear sequential steps to minimize abandonment, and be a maximum of five steps, clearly showing progress through the steps on each page.

C.1.3 Scope

The primary objective of this Performance Work Statement (PWS) will focus on expanding the use of electronic payment methods to collect federal tax payments and encouraging taxpayers to use electronic media to interact with the IRS. The contractor shall provide all personnel, material equipment, and supervision necessary to provide e-Payment Services as outlined in this PWS, including all deliverables, at no cost to the Government.

Integrated e-file and e-pay credit card service provider option is available non-competitively and is outside of the scope of this contract. Refer to the Credit Card Bulk Provider (CCBP) requirements for information on how to become an integrated e-file and e-pay credit card service provider. The CCBP is available upon written request to the COR and/or CO.

Additionally, Automated Clearing House (ACH) is an electronic network for financial transactions in the United States. An ACH product solution is outside the scope of this contract

C.1.4 Background

The COVID-19 pandemic impacted nearly every facet of life during 2020. In response to the pandemic, IRS modified the way it conducted day-to-day activities, provided tax administration relief to millions of taxpayers, and served an essential role by implementing legislative programs that provided financial assistance, this included delivery of Economic Impact Payments (EIPs).

During Fiscal Year 2020, the IRS processed more than 240 million tax returns, including individual income, corporate income, and employment income tax returns. IRS provided nearly $736 billion in refunds (including $268.3 billion in EIPs issued during the fiscal year, which were classified as refunds) to taxpayers and collected $3.5 trillion in federal revenue. IRS provided self-assistance to taxpayers through more than 1.6 billion visits to IRS.gov and assisted 64.3 million taxpayers through correspondence, its enterprise-wide telephone helplines, or at Taxpayer Assistance Centers Of the more

3.4 billion third-party information returns, 89.9% were filed electronically. The data was derived from the IRS 2020 Data- Book.

The following chart is based on actual combined data of credit and debit payments (amount & volume) received per year.

HISTORICAL CREDIT/DEBIT PAYMENT DATA

Credit Cards Only (Approx.

Dollars Collected by IRS) Debit Cards Only (Approx.

Number of Transactions)

Jan – Dec 2018 $5,789,504,370 4,638,638 Jan – Dec 2019 $6,750,459,320 4,740735 *Jan – Dec 2020 $5,983,741,082 4,391,287 **Jan -Dec 2021 $5,769,078,724 4,056,157 Totals $24,225,810,686 17,826,817

*Tax season 2020 decreased due to impacted by COVID19 **Projected totals for tax season 2021 based on the following: 2021 CC$ Jan-Sep $5,738,160,822 + 2019 CC Oct-Dec x 3.2% ($30,917,902) = $5,769,078,724 and 2021 DC Vol = 4,022,072 + 2019 DC Vol Oct-Dec x 3.2% (34,085) = 4,056,157.

Data collected from 2019 and not 2020 due to impact by the pandemic. For 2021, decrease due to impacted federal taxpayers are slowly regaining economic stability to pay their federal taxes.

Note: The totals for credit cards are calculated differently than debit cards because the convenience fee for credit cards is based on a percentage of the tax liability whereas the convenience fee for debt cards is based on a fixed flat fee.

C.1.5 CREDIT CARD PROGRAM REQUIREMENTS

The contractor’s URL will be displayed on IRS.gov in section Pay Taxes by Credit or Debit Card. The contractor shall be limited to one Uniform Resource Locator (URL) to collect and process payments which will be promoted in the e-pay service providers and fees list and integrated in the IRS e-file and e-pay list.

The IRS reserves the right to promote the contractor(s) based on price, user experience, or other factors, or to pick a preferred provider each year and to utilize the preferred provider on IRS.gov and through the call centers.

The phase-in period is from March 1st, 2022 through December 1st, 2022. During this period, the contractor shall adhere to C.2, Business Requirements for implementation. Only after the Annual Requirements Review Meeting (Kickoff) through June 30th of each year, may the contractor submit proposed changes to the upcoming filing season preparation (Refer to the chart in Section C.7 Schedule of Performance).

C.2 BUSINESS REQUIREMENTS

C.2.1 The contractor shall participate in the Annual Requirements Review Kickoff Meeting in accordance with Section C.7.

C.2.1.1 The contractor shall provide a Project Plan Work Breakdown Schedule (WBS) using, MS Word or MS Excel (i.e., using current IRS version), covering the system development life cycle and update the Project Plan WBS after the Annual Review Kickoff meeting. (Refer to Sections C.6.8 and C.6.22).

C.2.2 The contractor shall be limited to up to 100 contractors to work on the contract throughout the life of the contract.

C.2.3 The contractor shall provide an electronic payment processing service in American English and Spanish, which allows taxpayers to make federal tax payments through a convenient, safe, and secure means. The contractor shall comply with electronic payment regulations of the Internal Revenue Code, including Treasury Regulations 301.6311-2, Payment by credit card and debit card and any subsequent updates and revisions.

C.2.3.1. The contractor is subject to Section 508 of the Rehabilitation Act of 1973 (as amended by the Workforce Investment Act of 1998) and the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards (36 C.F.R.

Part 1194). The electronic payment processing service shall include applicable accessibility provisions of part 1194 Subparts B, C and D; such as, 1194.22 Web-bases Intranet/Internet Information and Applications and 1194.23 Telecommunications Products in accordance with

FAR 39.2.

C.2.3.2 The contractor shall exercise best practices and industry standards for preparing and maintaining systems and application documentation. The documentation shall be Section 508 compliant. The contractor shall provide a detailed narrative on the IT configuration as it applies to the IRS contract. This shall include the type of IT environment being used at the contractor site, virtual machines, how many and the operating system (if applicable) and all IT assets being used at the site or at remote sites identified in “Alternate Work Locations.” The locations shall include servers, workstations, laptops, routers, switches, and virtual environments.

C.2.3.3 The contractor’s electronic payment system shall allow connection with the IRS securely using Application Programming Interface (API) technology.

C.2.3.4. The contractor shall include CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) on their website as a layer of security when a taxpayer enters their federal payment.

C.2.3.5 The contractor shall allow the taxpayer to make a debit or credit card web payment by accessing the contractor’s website through IRS.gov. This process shall include clear sequential steps to minimize abandonment, and be a maximum of five steps, clearly showing progress through the steps on each page.

C.2.3.6 The contractor shall provide a mobile-friendly version of their website for tablets and Smartphones (e.g., Android, Apple, or other similar devices), with the capability to allow the taxpayer a “View Full Site” option.

C.2.3.7 The contractor shall complete any necessary modifications to software, systems, and services with its commercial business practices to conform to the provisions of Treasury Regulations 301-6311-2 (d)(1). The government will inform the contractor regarding any significant changes which shall have an impact on the current contract (Refer to Section C.6 and C.7.).

C.2.4 The contractor shall provide a system that allows a wide array of taxpayers’ (i.e., domestic, international) access for making federal income and business tax payments. All Interactive Voice Response (IVR) and Internet applications are required to provide taxpayers with a unique toll-free number (domestic), non-toll-free number (International), and web address (URL) for the completion of federal payments only.

C.2.4.1 The contractor shall provide a system that allows international taxpayers access for making federal individual and business tax payments. All IVR and internet applications are required to provide international taxpayers with a unique non-toll-free number for the completion of federal payments only.

C.2.4.2. The contractor shall provide an IVR system and WEB applications with capabilities to capture required fields determined by the government to validate the taxpayer’s entity (refer to C.2.12).

C.2.4.3 The contractor shall provide taxpayers live and automated customer service including frequently asked questions and problem resolution assistance. The contractor shall provide clear, concise messaging and consistent treatment. Live customer service assistance shall be available, at a minimum, Monday through Friday, 7:00 am to 7:00 pm, local call center time.

C.2.5 The contractor shall provide a system that accepts federal income for individuals (i.e. 1040, 1040ES, 4868) and business (i.e. 94X) tax payments including balance due, extension, installment, and estimated payments. The IRS reserves the right to increase tax payment types annually. Payments shall be accepted in accordance with written filing season credit card processing periods as defined by the IRS.

C.2.6 The contractor shall provide a privacy policy notice on their system to protect the taxpayer’s personally identifiable information.

C.2.7 The contractor shall provide a secure a payment method that converts cash payment to electronic transactions for the unbanked or underbanked.

C.2.7.1 The contractor shall enable the cash payments method system to have the capability to accept a range of taxpayer payments. The contractor should allow the maximum limit per state requirements.

C.2.8 The contractor’s system shall have the capability to process, at any given day, the federal tax payment volume, at a minimum, 300K transactions per day.

C.2.9 The contractor shall inform taxpayers of the dollar amounts of all fees, if any, related to the payment transaction and obtain taxpayers’ acknowledgement or acceptance of fees prior to completing any payment transactions. The contractor shall inform the taxpayer that fees charged are by the contractor, not by the IRS.

C.2.9.1 The contractor’s proposed method for obtaining taxpayer’s acknowledgement or acceptance of fees must be approved in advance by the government.

C.2.10 The contractor shall provide taxpayers with confirmation of payment transactions through the payment means used to complete the payment. An integrated database shall be used whereby taxpayers may verify all payments through either payment application regardless of input channel.

C.2.10.1 The contractor shall provide a merchant descriptor on the taxpayer’s card statement describing the tax payment amount as a unique line item entitled “U S Treasury Tax Payment.”

C.2.10.2 The contractor shall provide a merchant descriptor on the taxpayer’s card statement describing the transaction fee amount as a unique line item and include the card authorization number.

C.2.11 The contractor shall provide a primary and backup transaction processing system and complete necessary contingency planning to ensure that disaster recovery processes include actions to continue transaction processing in the event of unplanned events. Backup systems should be deployed within one hour after the primary system experiences an outage. At the contractor site, the contractor shall maintain a full inventory of the IT assets, including serial number so that any lost, stolen, or misplaced equipment may be easily detected. (Referred to in Section C.6.13, Table 6.1).

C.2.12 The contractor shall, in accordance with the Credit Card Bulk Provider (CCBP), prepare and complete the Bulk Filer certification/re-certification process annually.

C.2.12.1 The contractor shall submit payment data files in accordance with the CCBP requirements for transmitting payment data to the government’s TFA. The contractor shall forward settlement files to the TFA one business day prior to settlement.

C.2.12.2 The contractor shall provide settled funds where the payment transaction date is less than 11 days prior to the settlement date (cards only). In the event that funds settlement is delayed beyond this period due to a reject condition, such as invalid entity, the payment must be re-initiated, and the new payment date submitted for posting.

C.2.12.3 The contractor shall settle funds through the Treasury Financial Agent (TFA). All funds must settle within 24 to 48 hours (refer to section 5 (6) in the CCBP requirements).

C.2.12.4 The contractor shall provide only guaranteed payments to the government for federal taxes owed. Funds shall be available in the contractor’s designated bank account one business day after the settlement file is submitted.

C.2.12.5 The contractor shall submit daily, payment detail records or settlement files using the American National Standards Institute (ANSI) X12 Electronic Data Interchange (EDI) 813 transaction set. The TFA will initiate one bulk debit each business day from the contractor’s account, which must be established for this purpose (refer to CCBP requirements).

C.2.12.6 The contractor shall adhere to government banking regulations regarding debit and credit card rate fees.

C.2.12.7 The contractor shall convert payment transactions to Automated Clearing House (ACH) debit authorizations and settle funds through the TFA.

C.2.12.8 The contractor shall provide to the government a signed IRS CCBP agreement form and an IRS Annual CCBP registration form. (Refer to Section 5 in the CCBP requirements).

C.2.12.9 The contractor shall secure entity validation, in accordance with the CCBP requirements, prior to forwarding settlement files to the TFA.

C.2.12.9.1 The contractor shall implement processes and procedures in notifying taxpayers of entity rejections within ten (10) days or less. The contractor shall assist the taxpayers with their entity rejection corrections to ensure that federal tax payments are applied accurately and as intended by taxpayers, without providing the given reason from IRS (IRS reject code reason) following IRS security guidelines for Taxpayer Protection Act. Processes and procedures shall be documented and subject to IRS’s review and approval.

C.2.12.10 The contractor shall complete annual integrated readiness testing with IRS and TFA (includes use of simulated payment data on test systems and production systems). The tests shall cover the contractor’s primary and back-up host sites and ensure readiness to accept transactions as well as forward settlement files from both sites. The contractor shall complete this testing by following the guidelines in the CCBP requirements. (Refer also to Section C.7 SOP for the due dates).

C.2.12.11 The contractor shall perform full cycle, live transaction processing (all applications) through the back-up site for a at least 10 labor days (24-hour period). This is also referred to as Bulk Filer testing. This will be scheduled annually, coordinated with IRS’s Internal and External Stakeholders, and completed prior to December 1st.

C.2.13 The contractor shall provide documentation (i.e. application test plans, test cases and test results, and certification(s)) to the government prior to the certification of the contractor’s IVR and Web systems. (Refer to Section C.6.23 and C.7).

C.2.13.1 The contractor shall provide initial and final functional requirements (refer to sections C.6 and C.7) and user interface documentation to the government, including but not limited to interactive voice response scripts and call flows, web pages, desktop software input, Funds Settlement Timeline detailing payment data flow from transaction authorization to settlement, and information screens, application design and architecture schematics describing (a) work processes, business rules, error conditions and data flow from payment initiation through completion and (b) customer service functions and outputs (reports, etc.) for review and approval before the program commences. Once the program commences, subsequent functionality and user interface changes (scripts, web screens, etc.) and the complete user experience including page flow, content, and design is subject to IRS review, revisions, and approval.

C.2.14 The contractor shall utilize and provide a separate test environment from production for system security and functional testing.

C.2.14.1 The contractor shall provide necessary systems and data accesses to the government’s representative performing independent verification and validation (IV&V) reviews of system’s readiness, including, but not limited to, application functionality testing, and stress testing.

C.2.15 The contractor shall support the need for confidentiality, integrity, and availability of information relating to electronic payment transactions with absolutely no disclosure or use except to the extent authorized by written procedures in the Treasury Regulation 301-6311-2.

C.2.15.1 The contractor shall maintain the confidentiality of any information relating to federal electronic payment transactions completed in a single transaction. Information collected during the transaction shall not be disclosed or used for any purpose prohibited by law and the Internal Revenue Code. All federal tax information shall be segregated, logically and physically from any other work being handled or processed by the contractor.

C.2.16 The contractor shall comply with technical, procedural and security requirements and controls as defined by the IRS. The contractor shall meet the IRS requirements for system and data security requirements in the areas of computer, communications, personnel, physical, procedural, and training. (Refer to IRM 10.8 in Section C.8 Reference).

C.2.16.1 In addition the contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the NIST SP 800-53, Recommended Security Controls for Federal Information Systems & Organizations, rev 4 and any applicable IRMs. (Refer to IRM 10.8 in Section C.8).

C.2.17 The contractor shall provide the Transaction Processing Networks Documentation employed in the program and the network’s interfaces according to National Institute of Standards & Technology (NIST), to the government before the program commences. Documentation requirements include the System Security Plan (SSP), Risk Assessment, Configuration Management Plan, Contingency Plan or Disaster Recovery Plan, Incident Response Plan, Security Awareness Training & Education Plan, Information Security Policy (ISP), and Acceptable Use Policy (AUP). Configuration control and management shall be exercised and documented as system and functionality changes occur. (Refer to Section C.6.13, Table 6.1).

C.2.17.1 The contractor shall ensure NIST approved tools are available to routinely monitor and manage network devices, servers, and workstations. In addition, the contractor shall have FIPS 140-2 compliant encryption tools to enable the contractor to securely transmit security-related or performance-related information to the IRS. A list of NIST approved tools may be obtained from the following web site: http://nvd.nist.gov/scapproducts.cfm#scapproducts

C.2.17.2 The contractor shall provide a Capacity Plan, i.e., an assessment of the level of storage and transaction processing capabilities of the computer system/network. The contractor shall utilize documentation management and defect reporting tools to organize and control systems, applications and documentation changes and track problems from the point of awareness to resolution. The government or government representative will conduct on-site security reviews.

(Refer to Section C.6.9).

C.2.17.3 The contractor shall adhere to IRS policy and prepare their worksite host location(s) for the annual IRS onsite security reviews. The contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the NIST Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems & Organizations, rev 4 and any applicable IRMs. (Refer to IRM 10.8 in section C.8).

C.2.18 The contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the NIST SP 800-53, Recommended Security Controls for Federal Information Systems & Organizations, rev 4 and any applicable IRMs. (Refer to IRM 10.8 in Section C.8.).

C.2.19 The contractor shall implement systems controls that provide fraud detection and limit fraudulent payment transactions. The system shall have the capability to prevent transactions from certain cards or to certain accounts. The contractor shall incorporate best practices and industry standards. The contractor shall adhere to Publication 4812 to inform the COR of all incidents within 24 hours of occurrence or awareness and shall provide an incident report within 5 business days.

C.2.19.1 The contractor shall provide incident reports of any material network outages, work stoppages, or other payment processing problems. This includes, but is not limited to, systemic problems related to authorizing credit on-line and human errors that result in duplicate http://nvd.nist.gov/scapproducts.cfm#scapproducts payments or non-payment. Incident reports shall include a description of the incident, the cause, number of taxpayers impacted, and dollars involved, duration of the incident, and actions taken by the contractor to remedy the incident

C.2.19.2 Outages and stoppages in excess of one hour are considered to be material in nature during non-peak processing periods. All outages during peak processing are considered material.

Peak processing periods include the seven-day period ending on the 15th day of January, April, June, September, and October (or the next business day if the 15th falls on a weekend or holiday), including any outages outside of the peak periods.

C.2.20 The contractor shall provide a Plan of Actions and Milestones (POA&M) to the COR/CO or as specified by the COR/CO to monitor remediations of security findings (low, medium, high) during the contract period of performance. (Refer to Sections C.6.19 and C.7.0).

C.2.20.1 The contractor shall remediate all high security findings and all functionality findings annually by December 1st.

C.2.21 The contractor and their employees who have or could potentially have access to taxpayer information are subject to the Taxpayer Browsing Protection Act of 1997 provisions, section 6103 provisions of the Act and IRS Unauthorized Access (UNAX) briefing requirements. In accordance with the Security Annual Training (SAT) program, all electronic contractor SAT completion certificates and UNAX forms for the initial on-boarding training (5-day requirement) and annual training, and all questions pertaining to the SAT requirements, shall be emailed to the COR/CO or as specified by the COR/CO.

C.2.22 The contractor shall provide a payment card application to be available on IRS mobile devices only to be used by IRS authorized personal (e.g., Revenue Officer) during their field visit to individuals/business taxpayer.

C.2.23 The contractor shall release the chargeback refund to the taxpayer once received from the IRS within 48 hours (Refer to Section C.6.4).

C.2.23.1 The contractor shall provide a weekly chargeback report, if applicable, by close of business each Friday. (Refer to Section C.6.4).

C.2.24 The contractor shall provide monthly development status report by the 5th day of each month through the life of the contract (the initial report will be discussed in the Kickoff). The report shall be provided to the COR or as specified by the COR.

C.2.25 The contractor shall provide, if applicable, a monthly report of transaction requiring exception handling such as payments requiring annual correction due to the entry of an erroneous taxpayer identification number (TIN/EIN) or tax year/tax period. The report shall be provided by the 5th day of each month to the COR.

C.2.26 The contractor shall provide weekly and monthly transaction reports. The reports shall include volumes and dollars for individuals and businesses according to card issuer, as well as, whether these payments were credit or debit transactions. The contractor shall provide this report in MS Excel (i.e., using current IRS version). (Refer to Section C.6.3).

C.2.26.1 The payments shall be broken out separately in weekly and monthly reporting. The report shall be provided to the Contracting Officer’s Representative (COR)/ Contracting Officer (CO) or as specified by COR/CO. (Refer to Section C.6.3 and C.2.7).

C.2.26.2 The contractor shall distinguish mobile payments by smartphone and tablet within the daily reports. The contractor shall do the classification by using an indicator called which will identify the device, browser, and operating system.

C.2.27 The contractor shall provide at the end of each calendar year quarter a transaction report showing the debit and credit card convenience fees collected for tax payments. The contractor shall provide four transactions reports annually. The report shall include the number of debit card payments received and the quarterly debit card convenience fee amount collected. The report will shall also include the number of credit card payments, the quarterly credit card convenience fee amount collected, and the average credit card convenience fee charged. The report shall be cumulative for each quarter and showing annual amounts. The transaction reports shall be delivered to the IRS before the end of the third week of the month following the end of the calendar year quarter.

C.2.28 The contractor shall actively encourage and promote the use of electronic payment product(s).

The contractor shall provide a Marketing Plan and deliverables that support and facilitate public awareness of IRS e-file and electronic payments during performance periods. The contractor shall adhere to the Marketing Plan once it’s approved by the government. (Refer toC.6.26 and Chart C.7.0). Additionally, the contractor shall collaborate with the IRS to agree on the Marketing Plan and on measures for success.

C.2.28.1 The contractor shall submit Findings and Marketing reports during the contract period of performance. The reports shall be provided to the COR/CO or as specified by the COR/CO.

(Refer to Sections C.6.7 and C.7.0).

C.2.29 The contractor shall adhere to a Quality Control Plan (QCP) for measuring and attaining quality of performance under this contract. A sustaining focus throughout the QCP shall be the attainment of continuous quality improvement and shall emphasize deficiency prevention over deficiency detection.

C.2.30 The contractor shall conduct post implementation review of live application including production monitoring, reporting, user/non-user surveys and user free-form comments.

C.2.31 Prior to the expiration (or termination), December 31st at 11:59 PM, all user interface methods (payment IVR, customer service IVR and Web) shall be updated to inform taxpayers that the payment services are no longer available and refer taxpayers to the IRS customer service number and web site for assistance. (Refer to Section C.6.25 Shutdown).

C.3 QUALITY ASSURANCE SURVEILLANCE PLAN

C.3.1 In accordance with the FAR 37.604 and 46.401, the contract performance requirements will be evaluated to ensure the services conform to the contract requirements; the government will perform the inspection based on the Quality Assurance Surveillance Plan (QASP) (see Section J.1, Attachment A). The government QASP should be used as one measurement factor in the contractor’s Quality Control Plan as defined in section C.2.29.

C.3.2 It is anticipated that there will be 100% inspection for all Business Requirements. The frequencies of inspections and Acceptable Quality Limits (AQL) are listed in the QASP; however, the government may change the inspection frequency and AQL as required to maintain the level of quality assurance requirements. The contractor will receive a written notice from the CO and COR regarding any changes to the QASP requirements.

C.3.3 The COR will ensure the contractor is informed regarding the results of all QASP inspections.

Depending on the QASP inspection results, the COR may require a meeting with the contractor’s Program Manager to review the contractor’s Quality Control measures.

C.3.4 The contractor shall be responsible for the quality of products and services provided under the terms of this contract, to include those products and services provided by sub-contractors. The contractor shall re-perform work that does not meet contract requirements, unless it is of a nature that re-performance is not possible or otherwise directed by the COR/CO or as specified by the COR/CO. Re-performance of work shall not constitute an excusable cause to miss any timeliness standards (e.g., if a report is due the first business day of the month, then the report shall be submitted in final form no later than the first business day of the month). To ensure that the requirements of this Contract are met, the contractor shall implement an effective QCP in accordance with FAR 52.212-4(a).

C.4 DUTIES AND RESPONSIBILITIES OF THE GOVERNMENT

The government’s duties and responsibilities during the term of this contract will be to:

C.4.1 Provide electronic record specifications necessary for funds settlement and posting of tax data related to the electronic payment transactions.

C.4.2 Provide functional requirements documentation annually, outlining validity checks and processing periods.

C.4.3 Designate Treasury Financial Agent(s) to act on the government’s behalf for settlement of funds in payment of taxes owed.

C.4.4 Provide outline of required reports and plan documents – Refer to outline in section C.6.

C.4.5 Provide no monetary consideration (zero-dollar contract) to the contractor for electronic payment transactions. The contractor will be paid through convenience fees charged to the taxpayer when they use the payment service.

C.4.6 Process credit card chargeback actions in accordance with the provided IRS Chargeback Procedures. This shall include reimbursing the contractor for unauthorized or erroneous charges that are substantiated by the cardholder and approved by the contractor’s duly authorized management representative. The contractor shall have completed and delivered the appropriate IRS chargeback form and supporting documentation to the IRS as described in the procedures. Such chargeback requests shall be processed based on the contractor’s determination of the appropriateness of this action as signified by its authorized claimant’s signature. In the event, the IRS notifies the contractor of duplicate payments that may be subject to chargeback action, it is incumbent upon the contractor to research the nature of the duplicate payment and timely initiate the appropriate action.

Chargebacks have no effect on the zero-dollar contract as the chargeback reimbursement process has to do when the cardholder has established an erroneous or unauthorized charge, and not merely because the taxpayer has made an overpayment and is entitled to a refund.

Chargeback requests received within 150 days of the contract end date will be processed in accordance with the previously established procedures. Refer to IRM 21.4.4.7.2.1 and

21.4.4.7.2.2 referenced in C.6.4 and C.8 for “Credit Card Chargebacks” and for “How is a Chargeback Initiated?”

C.4.7 In accordance with FAR 42.1502 and 42.1503, the contractor’s performance will be evaluated and input into the Past Performance Information Retrieval System (PPIRS) using the Contractor Performance Assessment Reporting System (CPARS).

C.4.8 Provide a hyperlink from the IRS Web Site to the contractor’s Web Site. IRS may identify participating partners in its information materials or products. All decisions involving these, or other marketing decisions will be solely at the discretion of the IRS.

C.4.9 The IRS may identify participating partners in its information materials or products.

C.4.10 The IRS Credit Card Program marketing approach will be addressed annually solely at the discretion of the IRS throughout the life of this contract.

C.5 Key Personnel

Key personnel are essential to the performance of the contract. The contractor’s Project Manager is designated as key and may only be replaced with the approval of the CO, in accordance with the terms and conditions of section C.5.2.

C.5.1 Contractor’s Key Personnel

The contractor shall provide a Project Manager, or designated representative, for this contract who shall have the authority to make any no-cost contract technical decisions, or special arrangement regarding this contract. The Project Manager shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the government. The Project Manager, or designated representative, shall have full authority to act for the contractor in the performance of the required services.

The Project Manager, or a designated representative, shall meet with the COR to discuss problem areas as they occur. The Project Manager, or designated representative, shall respond within four hours after notification of the existence of a problem.

C.5.2 ALL PROPOSED SUBSTITUTES

The contractor shall notify the CO and COR, prior to making any changes to key personnel. No changes in key personnel will be made unless the contractor can demonstrate that the qualifications of prospective replacement personnel are equal to or better than qualifications of the key personnel being replaced. The contractor shall provide a detailed resume. All proposed substitutes shall have qualifications equal to or exceed the person being replaced. The CO shall be notified in writing of any proposed substitution at least 15 days or 30 days if a security clearance is obtained in advance of the proposed substitution.

C.6. DELIVERABLES

The contractor shall submit the following deliverables in accordance with sections C.2 Business Requirements, C.6 Deliverables and C.7 Schedule of Performance (SOP) After contract award, sections C.2, C.6 and C.7 requirements will be discussed during a contractor and government kickoff meeting.

Additional meetings may be held based on the government’s requirements; these meetings will be announced to the contractor prior to the meetings dates. The kickoff meeting formalizes the final content, format, delivery dates, inspection and process flow for C.2, C.6 and C.7 requirements prior to the Implementation of Electronic Payment Services for the filing season.

All deliverables shall be submitted electronically. Documentation formatting and contents are subject to inspection, verification, and approval by the COR.

Table 6.1

Deliverables Summary

Deliverables Summary:

C.6.1 Electronic Payments (C.2.2, 2.19)

C.6.2 Monthly Development Status Reports (C.2.24)

C.6.3 Weekly and Monthly Transaction Reports (C.26)

C.6.4 Weekly Chargeback Reports (If Applicable C.2.23.1)

C.6.5 Exception Handling Reports (C.2.25)

C.6.6 Ad Hoc and Incident Reports (C.2.19.1)

C.6.7 Findings and Marketing Reports (C.2.28.1)

C.6.8 Project Plan WBS (C. 2.1.1)

C.6.9 Capacity Analysis (C.2.17.2)

C.6.10 System Security Plan (C.2.17)

C.6.11 Configuration Management Plan (C.2.17)

C.6.12 Risk Assessment Plan (C.2.17)

C.6.13 Contingency Plan or Disaster Recovery Plan (C.2.17)

C.6.14 Incident Response Plan (C.2.17)

C.6.15 Security Awareness Training & Education Plan (C.2.17, C.2.21)

C.6.16 Information Security Policy (C.2.17)

C.6.17 Acceptable Use Policy (C.2.17)

C.6.18 Network Design and Architecture Schematic (C.2.13.1)

C.6.19 Plan of Action and Milestones (POA&M) (C.2.20)

C.6.20 Process and Data Flow Schematic (C.2.13.1)

C.6.21 Funds Settlement Timeline (C.2.12.2)

C.6.22 System Development Life Cycle (C.2.1.1)

C.6.23 Test Plans, Test Cases and Test Results (including test data output reports) (C.2.13)

C.6.23.1 Section 508 Test Plan (see C.2.3.1 & Section H.4)

C.6.24 Functional Requirements/User Interface Documentation (C.2.13.1, C.7)

C.6.25 Shut down Plan (C.2.32)

C.6.26 Marketing Plan (C.2.28)

C.6.27 Quarterly Convenience Fee Report C.2.27)

C.6.1 ELECTRONIC PAYMENTS

The required data fields for each tax payment include (refer to the CCBP requirements document):

1 A nine-character Taxpayer Identification Number [first social security number (SSN) as shown on the tax return for the year for which the payment applies or the employer identification number

(EIN)],

2 Four-character name control (provided to contractor in the entity validation response file, 824 transaction set), 3Payment type, 4 Tax period ending date (six-character date field), 5 Payment amount, 6 Payment authorization date, 7 Daytime telephone number, and 8 Confirmation number.

C.6.2 MONTHLY DEVELOPMENT STATUS REPORTS

Upon the commencement of initial requirements meeting through the implementation date, the contractor shall provide monthly development reports by the 5th day of each month. The report shall be provided to the COR. The report shall contain the following information:

1 Date of report, 2 Project manager names, 3 Project manager telephone number, fax number and e-mail address, 4 A brief description of the work accomplished, emphasizing the progress made since the last reporting period, 5 A description of any unresolved and/or anticipated problems, if any (include schedule impacts), 6 An estimate of the percent of work accomplished to date, and 7 A statement on the status of the program as it relates to the WBS, either confirming that milestones are on schedule or explaining the nature and extent of the pending delay.

C.6.3 WEEKLY AND MONTHLY TRANSACTION REPORTS

The contractor shall provide weekly and cumulative monthly transaction reports. The reports shall cover the post-implementation progress of the program. Weekly reports shall include all required transactions and cumulative data from Sunday through Saturday. The reports shall be provided no later than 6:00 pm Eastern Time on the following Monday. Monthly reports shall be provided by the 5th day of each month and include all prior month transactions cumulative data and reconcile any adjustments made during that month. The contractor(s) shall submit all reports in Microsoft Excel format. After contract award the government will provide the contractor(s) with a template of the report format. The reports shall contain aggregate payment volumes by payment type and dollar amount broken down by the categories listed below. Historical data shall also be provided (if applicable) to compare changes in volumes from the prior year. All reports shall be provided to the COR.

The report shall contain the following information:

1. Date of report,

2. Period covered,

3. Total volume and total dollar amount of transactions by:

a. Web-PC, Web-Mobile/Tablet and IVR

b. Point-of-Sale and Integrated File & Pay, if applicable

c. IRS Form tax type

d. Card Issuer for debit and credit card

e. Mobile payments

f. Pay by Cash

4. Total number and total dollar amount of successful (authenticated) attempts,

5. Average payment amount,

6. Largest dollar payment amount,

7. Total number of failed (unauthenticated) attempts,

8. Reasons for failed (unauthenticated) attempts,

9. Total number of abandoned or incomplete transactions, and

10. Report of entity rejects, where the user has provided invalid entity information.

C.6.4 WEEKLY CREDIT CARD CHARGEBACK REPORTS (IF APPLICABLE)

The contractor shall provide weekly reports of all credit card chargeback actions identifying the transaction date, dollar amount, action request date, and reason for action. These actions shall be in conformance with chargeback procedures issued by the IRS and meet the definition of chargeback provided by the contractor and agreed to by the IRS. These reports shall be sent to the designated IRS point of contact (POC) and the COR by close of business each Friday.

Additionally, the contractor shall be responsible for monitoring for trends or patterns of suspicious activity and reporting this information to the COR. (Refer to IRM 21.4.4.7.2 and 21.4.4.7.2.1 at IRS.gov and in Section C.8 in the contract).

C.6.5 EXCEPTION HANDLING REPORTS

The contractor shall provide a monthly report of transactions requiring exception handling such as payments requiring manual correction due to the entry of an erroneous taxpayer identification number (SSN/EIN) or tax year/tax period. The report shall be provided by the 5th day of each month to the COR.

C.6.6 AD HOC AND INCIDENT REPORTS

The contractor shall provide ad hoc reports as necessary. Ad hoc reports may include but are not limited to reporting information that supports or further defines incident reports where payment transactions are delayed or otherwise impacted. The contractor shall provide an incident report of any material network outages, work stoppages, or other payment processing problems as described in section C.2.

The reports shall be provided to the COR.

C.6.7 FINDINGS AND MARKETING REPORTS

C.6.7.1 Findings Reports

The contractor shall provide an initial and supplemental findings report. A copy of this report shall be provided to the COR and the IRS Senior Manager or his/her designee. The Findings Report shall describe:

a. The Credit Card Program features

b. Conduct and findings of the program as they relate to the contractor’s and any subcontractor’s performance (including a summary of all payment transactions, features such as Spanish language, recurring payments and payment reminders, any problems, changes made during the filing season and lessons learned)

c. Recommendations for improvement including changes to the contractor’s and/or IRS processes

d. Practitioner and/or client feedback including customer satisfaction survey results

e. Customer service activity based on automated and live assistance provided

f. Summary of trends or patterns of suspicious activity

The initial report shall include activity occurring between January 1 and April 30 (each year). The supplemental report shall be submitted which includes a summary of the initial report’s findings and activity from May 1 through December 31 (each year). (Refer to Sections C.6 and C.7).

C.6.7.2 Marketing Reports

The contractor shall provide an initial and supplemental marketing report in conjunction with the Findings Reports described above. A copy of this report shall be provided to the COR and the IRS Senior Manager or his/her designee. The Marketing Reports shall contain a narrative description of (1) accomplishments; (2) cooperative marketing statistics including the number of unique visits to and from the contractor’s Web site by way of a hyperlink established with the IRS; and (3) measurement of success (for example, number of unique taxpayers that electronically pay as a result of the marketing campaign and special offers). The initial report shall include activity occurring between January 1 and April 30 of each year during the life of the contract. The supplemental report shall include a summary of the initial report’s findings and activity from May 1 through December 31 (each year).

C.6.8 PROJECT PLAN WORK BREAKDOWN SCHEDULE

The contractor shall provide a Project Plan WBS as described in C.2. This plan shall be delivered to the COR in MS Word or MS Excel in a readable and accessible format (for IRS) through electronic mail.

C.6.9 CAPACITY ANALYSIS

The contractor shall provide an assessment of the level of storage and transaction processing capability of the computer system/network.

C.6.10 SYSTEM SECURITY PLAN (SSP)

The contractor shall provide a System Security Plan (SSP) that describes procedures that address computer and data security. The intent of these procedures is to ensure the integrity, availability, appropriate access, and appropriate use of data and systems within the group. The SSP shall address system integrity, data integrity, access controls, handling of sensitive data (if any), incident reporting, training, and continuity of operation. The SSP shall follow the format and intent of NIST 800-18, Guide for Developing Security Plans for Federal Information Systems, including:

a. An overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements

b. Identify responsibilities and expected behavior of all individuals who access the system

c. Documentation of the structured process of planning adequate, cost-effective security protection for a system The System Security Plan shall identify and define in detail:

a. The processing environment (Components of the system, Major application, or General Purpose)

b. All data shall be categorized as moderate risk, unless identified otherwise by the CO

c. The laws and regulations pertaining to the system (OMB A-130, Privacy Act, etc.)

d. Identify management, operational, and technical controls

e. Identify plans for testing the security controls

f. Procedures for providing access to users

g. Identify an Incident Response Plan

h. Identify Security Annual Training

i. Management commitment and approval (authorization to operate)

NOTE: A secure information system communication ensures that information is protected from unauthorized disclosure or tampering during transit, and ensures that the network communication paths, where IT assets are being used to transmit IRS SBU information, are protected. The contractor shall develop, document, disseminate, and review/update policies and procedures every three years or if there is a significant change to ensure adequate information, system, and communications, protection policies are developed and implemented.

C.6.11 CONFIGURATION MANAGEMENT PLAN