4365 QA Responses_EA Answers_24FEB25.pdf

RFI EA 4365 Q&A Responses

February 2025

QUESTIONS ANSWERS

1 Are there any specific emerging technologies or trends that the IRS is particularly interested in exploring or adopting?

The IRS is heavily invested in the future of AI/ML Please read IRS’ Inflation Reduction Act (IRA) Strategic Operating Plan (SOP) for more info on goals and approach to implementation.

2 Are there any specific interoperability requirements or challenges that need to be addressed?

Disparate systems legacy systems are integrated with modernized systems with plans to migrate to the cloud. As IRS modernizes its disparate legacy systems, IRS needs to increasingly rely on open standards and vendor-agnostic solutions to port modernized workloads across off-premises and on-premises landing zones. Also, while IRS is rationalizing and normalizing its technology stack, there are instances where IRS uses various products to provide similar capabilities across landing zones, complicating IRS’ efforts to centrally manage and monitor workload and platform performance across landing zones.

3 What are the core functional and non - functional requirements that drive Cloud Landing Zone selection?

IRS program teams often drive cloud landing zone selection decisions in accordance with their capability and schedule requirements. IRS is now planning to consider cloud service providers’ (CSPs’) relative service offering capabilities; the managed service provider’s (MSP’s) capability to provide high availability and resilience; the MSP’s/CSP’s security certifications (e.g., FedRAMP);

the CSP’s network, compute, and storage performance; the CSP’s ability to address compatibility and interoperability requirements across IRS’ landing zones; and potential cost savings.

4 How will the IRS ensure interoperability across cloud service providers (CSPs) and multi - cloud landing zones?

IRS needs to optimize use of open standards and vendor-agnostic solutions as much as possible. At the same time, IRS recognizes the benefits of leveraging CSPs’ unique cloud-native service offerings to address IRS’ capability requirements by exception. IRS is also in the process of implementing an enterprise continuous integration / continuous delivery (CI/CD) standard for all project teams to reduce variability in deployment patterns, increase deployment velocity, and optimize workload/platform portability across landing zones.

IRS also plans to reuse common services across landing zones more efficiently, enabling IRS to optimize performance, resilience, scalability, and cybersecurity as well as reduce operational expenditures over time.

5 Can the IRS provide insight into the current distribution of cloud workloads across public, private, and hybrid environments? Understanding

Most of IRS’ workloads/platforms exclusively run in on-premises environments. Some workloads/platforms leverage community or public

QUESTIONS ANSWERS

the existing cloud footprint will help vendors propose scalable and effective architecture solutions.

cloud deployment models, but most IRS workloads/platforms in community or public cloud environments leverage hybrid cloud deployment models.

6 What specific criteria will be used to evaluate non - FedRAMP cloud services before the IRS sponsors them for authorization?

Per the PWS, all services must comply with FedRAMP certification requirements.

7 Will the IRS provide an approved list of FedRAMP -authorized Cloud Service Offerings (CSOs) that vendors must work with, or are all FedRAMP services available?

Vendors should consult FEDRAMP for current listing.

8 How does the IRS envision enforcing Zero - Trust security policies across hybrid cloud environments?

The IRS has followed the directive to shift the security focus from perimeter defense to a zero-trust model of securing data, users and services.

We are accomplishing this shift through strong authentication for users and machines, encryption of data both at rest and in transit, and cloud-based policy enforcement points for all traffic. For example, the Treasury cloud infrastructure environments leverage native and third-party cloud services to encrypt communications, endpoints, and storage by default. As part of Treasury, the IRS plans to further implement zero trust principles, leveraging concepts such as TIC 3.0 for systems and applications, following the NIST, CISA and OMB guidance, building on the zero-trust architecture offered by the current cloud platform.

9 IRS mentions automating Security Change Management (SecChM), firewall rule approvals, and ATOs - what specific compliance frameworks will this automation align with?

IRS’ security approval processes align to NIST’s compliance frameworks.

10 Will the IRS provide a baseline reference architecture for DevSecOps pipelines, or are vendors expected to propose one from scratch?

The IRS maintains reference architectures and maintains related DevSecOps pipelines.

11 How does the IRS plan to measure the success of DevSecOps implementation?

The IRS maintains reference architectures and maintains DevSecOps pipelines. The enterprise CI/CD pipeline standard referenced above prescribes how IRS will measure success of DevSecOps implementations based upon industry leading practices implemented by Department of Defense, other agencies, and private sector organizations.

12 IRS wants to consolidate multiple API Gateway platforms (Layer 7, Forum Sentry, AWS API GW) into a single API Management Platform on Software AG/IBM’s webMethods - how will IRS evaluate migration success?

A successful migration will result in:

- Reduced time to deployment

- Cost reductions through efficiency increases

- Enhanced enterprise API portfolio management

(Reduced duplication, increased re-use)

- Enhanced, modernized security for users and enterprise

QUESTIONS ANSWERS

- Enhanced taxpayer and enterprise user experience

13 What standards or frameworks should be followed for API lifecycle management and governance across IRS cloud environments?

API Lifecycle Process includes the following phases with major activities defined under each: Request, Design, Develop, Test, Deploy, and Consume & Analyze

14 IRS wants AI/ML architecture guidance - what specific use cases will be prioritized?

Generative AI built on top of mission-critical organizational knowledgebase, e.g., the Internal Revenue Manual (IRM).

15 How does IRS plan to integrate AI/ML workloads into its hybrid cloud environments while maintaining data privacy compliance (e.g., FedRAMP, FISMA, IRS Pub 1075)?

Follows all security and privacy requirements and mandates, define and create security boundaries between different environments and landing zones, implement standard network security policies and protocols.

16 IRS wants FinOps best practices to be incorporated

- will vendors have access to IRS cloud cost data to provide real - time cost analysis?

Yes, if necessary

17 What KPIs will the IRS use to measure cloud cost optimization success?

KPIs will be released if an RFP is released

18 How will the vendor’s cloud governance recommendations be evaluated and approved?

Refer to Performance Requirement Standards in the draft PWS

19 How does the IRS measure “effective” Cloud Governance?

Effective cloud governance means IRS has the right info at the right time to properly inform key stakeholders and formally communicate cloud landing zone selection decisions as well as other relevant cloud implementation decisions and approvals with respect to scope, schedule, cost, quality, and capability performance factors across the enterprise. In addition, Enterprise Services would be able to optimize use of data and automation to enforce implementation of architectural prescriptions.

20 What level of automation does the IRS expect in IRWorks for cloud provisioning?

IRS expects to leverage IRWorks to trigger the provisioning of new environments in the cloud without manual intervention.

21 Is there an existing roadmap for integrating Microsoft Teams, Pega, and Ansible into IRWorks?

No

22 What are the biggest pain points the IRS has with the current Cloud service request process?

It is very difficult for customers to understand the end-to-end process and track progress. Customers also often “discover” new requirements during the process, resulting in unanticipated schedule delays.

23 Will vendors have direct access to IRS cloud cost data for FinOps analysis?

Yes, if necessary

24 What executive briefing format does the IRS expect for cloud modernization updates?

Per direction of leadership

QUESTIONS ANSWERS

25 What are the top risks IRS anticipates in cloud modernization?

Please refer to PWS.

26 How does the IRS plan to enforce Cloud governance policies across cloud service providers?

IRS will leverage solutions like Splunk and AppDynamics to observe solution implementation details. Ideally, IRS would eventually integrate its new enterprise architecture modeling solution with IRWorks and IRS’ enterprise CI/CD pipeline platform to trace implementation of architectural prescriptions from end to end in the future.

27 What specific criteria does the IRS use to prioritize legacy system retirements?

The IRS currently maintains a structure and conditions of legacy systems requiring refresh or decommissioning. Criteria to determine retirement feasibility covers many facets, including age of system, programming language, # of users, interfaces, dependencies, type of data. Meeting the thresholds for assessment is further evaluated using Business value measuring an application's importance to organizational goals, operations, and financial impact. In addition, technical fit is also evaluated for stability, security, scalability, and maintainability.

28 Are there any high - priority IRS systems identified for retirement in the near term?

Yes

29 What is the expected timeline for completing a full retirement cycle of a system?

6 to15 months Case by Case

30 Will the IRS provide baseline risk assessment data on legacy applications, or is the vendor responsible for conducting fresh risk assessments?

Case by Case

31 What is the estimated completion timeline for fully transitioning to the Alfabet/ARIS - based EAR?

The estimated time for transition is April 2025

32 What data quality issues currently exist in the legacy EAR format?

Inconsistency between Enterprise Architecture and Domain Architecture. Incomplete Data views.

33 Will the vendor have access to previous EAR iterations to analyze historical trends, or will they only be working with current data?

Yes, Vendor will have access to previous iterations

34 What governance bodies are responsible for approving changes to the Enterprise Architecture Roadmap (EAR)?

CIO, ASM Senior Manager / EA Leads

35 How frequently will governance reviews take place for EAR updates?

Monthly/ Quarterly, Annually

36 Will the contractor be responsible for directly engaging IRS stakeholders (e.g., Treasury, OMB, TIGTA), or will engagement be handled by IRS leadership?

In general, IRS Leadership will lead and direct necessary engagement with external, 37 What level of automation does the IRS expect for tracking technology retirements in Alfabet?

The As-Built- Architecture repository which is housed in Alfabet has capabilities that need t be enhanced to track technology retirements along with integration into ServiceNow.

QUESTIONS ANSWERS

38 How will Alfabet be used to manage retirement backlogs?

The As- Built- Architecture repository which is housed in Alfabet will capture retirement related information along with integration into ServiceNow.

39 What level of executive reporting does the IRS expect from the contractor?

Reporting responsibilities would come in an RFP.

Weekly, Monthly, Quarterly

40 What briefing formats and documentation templates does the IRS currently use for EAR and technology retirement updates?

Guidance is given by the Tech lead, however, MS products may be leveraged.

41 If a Solicitation will be issued as a result of this RFI, will this activity be considered a new requirement or a follow-on to an existing contract? If there is an incumbent, would you be able to share the vendor’s name and the contract number so that I may identify it in FPDS?

Follow-on

42 Is there an organizational conflict of interest risk for awardees on the work within this RFI that would preclude them from working on future requirements/contracts for this work?

No, Vendors will disclose any conflict of interest, per the RFP

43 With this award be an 8(a) sole source, or 8(a) competitive? Will 8(a) contract amount dollar limits apply to this work?

No determination, market research not completed

44 What is the anticipated procurement vehicle for this contract?

No determination, market research not completed

45 What is the scope of cloud strategy implementation

– how many program/project teams, divisions, and partners (both internal and external) are involved?

There are numerous Stakeholders within and outside the IRS

46 What is IRS’ current cloud environment setup? Commercial Cloud 47 Will a copy of the “2-year Cloud Transition Strategy” be provided as part of the RFQ process?

No

48 Will a copy of the EA’s vision, target state Enterprise architecture, Enterprise Architecture Roadmap (EAR), IRS Modernization Plan, IRA Strategic Operating Plan be provided as part of the RFQ process?

References will be provided as applicable. IRS Modernization Plan and IRA Strategic Operating Plan are available to the public on irs.gov.

49 Does the work include hands-on execution (engineering, development, coding, etc.) or is this primarily strategic advisory and technical program guidance?

Yes - Both

50 Extent of Development/Engineering work? Refer to the draft PWS.

51 Team Size: Is total team size limited to four Key

Personnel or are other roles anticipated? What is the total number of FTEs for this requirement?

No. Number based on the requirement, Vendor discretion

52 Will IRS provide software applications for the documentation and tracking of work, for example, Atlassian’s Confluence and Jira?

Yes

53 The RFI reads “The MSR must be submitted within 10 days of the end of the month.” Is this business days or calendar days?

Business days

QUESTIONS ANSWERS

54 What level of clearance is expected for Key

Personnel and contractor’s project team?

NAC/ Local, MBI

55 The Department of Treasury has several programs in place for cloud-and “as a service” related work, including the T-Cloud contract and the IRS MIDS contract. How will these existing contracts be used by IRS in conjunction with this new effort? Please clarify if either of these (T-Cloud or MIDS) will also be used for (1) cloud consumption or (2) cloud architecture or migration services?

No, those are separate contracts, unrelated to what the IRS is doing.

56 The Draft PWS notes that an objective of this initiative is to “enable the modernization of workloads and applications in the cloud as well as provide comprehensive cloud modernization planning services.” In order to optimize these services, please describe IRS’ current process for modernizing workloads and moving applications to the cloud today.

IRS project teams refactor applications in on-premises environments to use containers and then deploy them to the most suitable CSP landing zone through IRS’ enterprise CI/CD platform solution.

57 The Draft PWS mentions the need for solution architectures for high availability, disaster recovery, and data backup/restore operations across all landing zones. Please clarify RTO and RPO requirements for these architectures to ensure that the solutions meet IRS data recovery requirements.

IRS will provide RTO and RPO requirements for specific applications to the vendor after contract award.

58 The Draft PWS notes that IRS wants to move to an IT as a service model where resources (compute, storage, etc.) are provided via subscription or service level agreement. Please provide the types of service level agreements in place today for on-premises and cloud-based services.

Not applicable.

59 The Draft PWS cites the need for procedures to optimize utilization of existing storage and compute capacity. Please clarify if this means both on premises and cloud-based storage and compute capacity.?

This means both on-premises and cloud-based storage and compute capacity. Refer to PWS for details.

60 The Draft PWS requires that offerors “prescribe solutions to enable multiple project teams to use and share the same pre-development sandbox environment’s storage… as well as reduce IT’s footprint of storage…”.

Vendor needs to prescribe architectural solutions to enable project teams to share and reuse pre-development environments as well as the compute, memory, and storage capacity in said environments to reduce costs and schedule delays as much as possible.

61 Please clarify the average required storage capacity of these testbeds and how many sandbox environments does IRS foresee.

If necessary, Government will provide more info on storage capacity after contract award. Number of sand-box environments is not applicable/relevant.

QUESTIONS ANSWERS

62 The Draft PWS requires that offerors “Prescribe and/or update guidance on how to implement a Cloud Native Computing Foundation (CNCF) Kubernetes architecture to support all core multi- Cloud tooling/capabilities and allow testing, rollback, and conditional routing for production and test deployments to accelerate Cloud adoption.

Please clarify the types of persistent storage that will be required to support the Kubernetes containers.

Storage requirements will depend on the data processing requirements of each application.

Government may provide more detailed info after contract award, but the Government is primarily interested in the vendor’s approach to prescribe and estimate the types and amounts of persistent storage in accordance with the relevant application architecture pattern.

63 IRS wants to move to an ITaaS and cloud-based model for compute as well as storage services. In order to provide “reusable cloud architecture patterns” as well as guidance to provision new or reuse existing environments for application modernization, it is important to understand existing IRS storage capacities and breakdown of block, file and object storage (on premises and cloud-based) as well as expected performance and latency requirements for cloud-based workloads.

Please clarify if and when IRS intends to provide this data or will offerors be expected to assess existing IRS environments to obtain this data.

IRS will provide this data after contract award.

64 Can the IRS provide insight into the expected period of performance and renewal options?

Most contracts are given a base year with 4 one-year options

65 Will the IRS allow teaming arrangements or require prime contractors to demonstrate the ability to fulfill all requirements independently?

Yes, Teaming is allowed

66 The RFI references 120 planned and 30 unplanned application architecture and design support requests per year. Can the IRS provide examples of recent requests to clarify expected scope?

1. Joint Enterprise Tax Calculator Service (JETCS) Vision, Scope and Architecture (VSA);

2. API Management Platform (APIMP) Enterprise Architecture Guidance (EAG);

3. Event-Driven Architecture (EDA) Enterprise Architecture Guidance (EAG)

67 The two-year Cloud Transition Strategy is a key driver. Can IRS share key milestones and priorities within this strategy to ensure alignment with proposed solutions?

IRS has summarized the key milestones and priorities in the PWS.

68 Can the IRS provide more detail on current cloud environments (e.g., AWS, Azure, Google Cloud, hybrid mix) and preferred tools/technologies for cloud architecture?

IRS will provide more detail after contract award.

69 Software AG Alfabet and ARIS are mentioned as preferred tools. Will the IRS consider alternative enterprise architecture tools, or must vendors demonstrate expertise in these specific platforms?

No, but the vendor needs to demonstrate expertise with the preferred Software AG Alfabet and ARIS tools

70 Is IRS open to recommendations on alternate modernization approaches, such as serverless

Yes

QUESTIONS ANSWERS

computing, AI/ML integration, or cloud-native development best practices?

71 Is the IRS considering a multi-award contract structure, or will this requirement be awarded to a single vendor?

No determination, market research not completed