The file's text, extracted by GovTribe without its formatting.
Draft Performance Work Statement For 1099 Replacement 01/26/2026
1.0 BACKGROUND
The Defense Finance and Accounting Service (DFAS), hereafter referred to as "the Government," requires a comprehensive software solution to replace its legacy system. This action is driven by the Internal Revenue Service (IRS) mandating a transition from the Filing Information Returns Electronically (FIRE) system to the new Information Returns Intake System (IRIS). The IRIS platform and its Application-to-Application (A2A) interface will be the sole method for electronic bulk filing, representing a significant technical shift from FIRE's legacy flat-file format to a structured XML schema. Consequently, a new software solution is required that is natively compatible with these new technical specifications.
This initiative aligns with a broader, government-wide mandate for digital transformation and the Department of War (DoW) strategic imperative to acquire modern, adaptable, and secure systems. A "modern" 1099 software solution for this PWS is defined by its core compliance with the IRIS platform and the following architectural and functional attributes:
· Cloud-Native Architecture: The solution shall be a true cloud-based platform (SaaS) to ensure accessibility, automatic updates, and scalability without requiring on-premise installation.
· API-First Integration: The system shall be built with an API-first approach, enabling seamless, automated data exchange with existing financial, ERP, and payroll systems.
· Comprehensive Compliance Workflow: The solution shall provide an end-to-end workflow including flexible data import, integrated real-time TIN verification, electronic and print/mail recipient delivery, a streamlined corrections process, and full support for the Combined Federal/State Filing (CF/SF) program.
· Robust Security: The platform shall adhere to stringent security protocols, including data encryption at rest and in transit, to protect sensitive taxpayer information.
2.0 SCOPE
The Vendor shall be responsible for the complete software development lifecycle, including the design, development, testing, and deployment of a modern information return filing solution. The software will be deployed on a Government-provided Joint Warfighting Cloud Capability (JWCC) environment, which is accredited at FedRAMP Impact Level 4 (IL4). The solution should adhere to principles of accessibility, efficient data processing (both real-time and batch), and be built upon a robust, non-proprietary, object-oriented codebase. The use of low-code or no-code development platforms is prohibited.
3.0 PERFORMANCE REQUIREMENTS
The Vendor shall perform the following tasks and meet the requirements detailed below.
3.1 Information Return Filing Module Requirements
The Vendor shall develop and provide a software module that meets the following functional requirements:
| Supported Forms |
| The software shall support the creation and management of a wide range of information returns, including but not limited to W-2C, 1099-NEC, 1099-MISC, 1099-INT, 1099-R, and 1099-DIV. |
| IRIS Compatibility & Volume |
| The software shall be fully compatible with the IRS's IRIS A2A platform. It must be capable of generating, transmitting, and tracking a high volume of over 130,000 forms in the required XML format. |
| Data Import/Export |
| The solution shall facilitate data import from CSV files and direct data links, and export data into various formats, including Microsoft Excel. It must support electronic reporting by generating files compliant with both legacy FIRE and modern IRIS platform formats. |
| User-Friendly Interface |
| The software shall feature a modern, intuitive interface with a central dashboard summarizing key information (deadlines, statuses, pending actions). The interface must be fully responsive and accessible across desktops, tablets, and mobile devices. |
| Guided User Experience |
| The software shall deliver a guided, step-by-step user experience for the creation, validation, and filing process. It shall incorporate intelligent, user-friendly error handling that identifies the specific field in error and provides clear, actionable instructions for resolution. |
| Data Management Tools |
| The solution shall support the import of recipient and payment data from CSV and Excel and offer features for bulk editing of recipient information to streamline data management. |
| Automated Calculations |
| As data is entered or imported, the software shall provide immediate feedback on potential errors (invalid TINs, formatting, missing data) and automatically calculate and populate all required fields and transmittal forms. |
| Recipient Delivery |
| The solution shall offer an integrated service to print and mail recipient copies, as well as a secure portal for electronic delivery to consenting recipients. |
| Error Checking & Validation |
| The Vendor shall implement a robust, multi-layered data validation framework that performs real-time validation at the point of data entry and during batch processing. It must integrate with external sources, including real-time TIN Matching with the IRS. Records failing validation shall be quarantined in a dedicated rework queue for user review and correction, and shall not be posted to primary system tables until successfully validated. |
| Corrections & History |
| The system shall allow for the creation and submission of corrected information returns and include a migration module for data from at least five (5) previous years filed using the IRS FIRE system. |
| State Filing Support |
| The solution shall provide comprehensive support for the IRS Combined Federal/State Filing (CF/SF) Program, including maintaining an up-to-date database of participating states and their rules. For states not in the CF/SF program, the solution must handle direct electronic filing to the respective state agencies. |
| API for Vendor Access |
| The Vendor shall provide a secure, RESTful API allowing DoW vendors to programmatically access their tax forms using their CAGE code. All data interchange shall be in JSON. A successful request shall return a JSON object containing a list of forms with metadata and a secure, time-limited download URL for each form in PDF format. Access shall be secured at a minimum through API Keys, with a strong preference for OAuth 2.0. |
3.2 Security and Compliance Requirements
The Vendor shall ensure the solution is fully compliant with all DoW-specific mandates.
· 3.2.1 RMF and STIGs: The Vendor shall provide a tool that complies with the latest DoDI 8510.01 (RMF), DISA STIGs, and NIST SP 800-53. The software must also meet supply chain requirements, with the company and country of origin clearly identified. All products shall be analyzed for vulnerabilities with tools like Fortify or ACAS, and vulnerabilities must be tracked in a POAM. The tool shall be configured to avoid any CAT 1-3 STIG violations. Waivers for CAT 1 violations will not be granted.
· 3.2.2 FedRAMP Compliance: Any cloud service offering (CSO) must meet security requirements equivalent to the FedRAMP Moderate baseline. The Vendor shall provide a Body of Evidence (BoE).
· 3.2.3 Information Handling: The software shall be capable of handling and protecting Controlled Unclassified Information (CUI), including Personally Identifiable Information (PII), in accordance with DoD Instruction 5200.48.
· 3.2.4 Identity and Access Management (ICAM): The system shall support authentication using DoD Common Access Card (CAC) and Public Key Infrastructure (PKI) certificates. The Vendor shall describe how the solution integrates with DoW-approved identity providers and enforces Attribute-Based Access Control (ABAC) and device validation to support a Zero Trust framework. The Vendor must demonstrate the security of users through Role-Based Access Control (RBAC).
· 3.2.5 Cybersecurity Maturity Model Certification (CMMC): The Vendor shall demonstrate the ability to meet CMMC Level 2 requirements.
· 3.2.6 Records Management: All records-generating components of the solution must be certified compliant with DoD 5015.02-STD. The Vendor shall provide evidence of current certification or a detailed plan to achieve it.
· 3.2.7 Section 508 Compliance: All electronic and information technology (EIT) must meet the applicable accessibility standards at 36 CFR 1194, specifically 1194.21 (applications) and 1194.22 (web-based). The Vendor shall provide a Voluntary Product Accessibility Template (VPAT) or equivalent documentation.
3.3 Development, Migration, and Testing Requirements
· 3.3.1 Phased Release Methodology: The Vendor shall employ a phased release methodology, installing completed and successfully tested code modules into the production environment iteratively, avoiding a single, large-scale cutover event. The architecture shall be modular to allow for future enhancements.
· 3.3.2 Data Migration: The Vendor shall conduct a thorough analysis of the legacy system's data structures and develop a comprehensive Data Migration Plan for Government approval. This plan must detail the ETL methodology, tools, and a robust data validation and reconciliation strategy. The Vendor shall execute the migration and provide detailed validation reports.
· 3.3.3 Testing and Validation: The Vendor shall conduct and provide evidence of thorough Unit Testing, System Integration Testing (SIT), security testing, and full regression testing. The Vendor shall provide full support to the Government during all testing phases, including User Acceptance Testing (UAT).
· 3.3.4 Continuous Authority to Operate (cATO) Support: The Vendor's solution and DevSecOps methodology must be designed to enable and maintain a cATO. This includes:
· Automated Monitoring: Integrating with government tools (e.g., ACAS) for continuous scanning for vulnerabilities and non-compliance.
· DevSecOps Integration: Integrating security throughout the CI/CD pipeline, including SAST/DAST and SCA from the earliest stages.
· Data Exposition: Providing security-relevant data (logs, events, scan results) through a secure API or standardized feed for integration with the Government's SIEM/SOAR platforms.
· Dynamic Vulnerability Management: An agile process for rapid identification and remediation of production vulnerabilities without disrupting mission operations.
3.4 Customer Support and Sustainment
· 3.4.1 Support Channels: The Vendor shall provide 24/7/365 real-time customer support via phone and/or email. The Vendor shall also provide a self-service web portal containing documentation, how-to guides, best practices, and support ticket creation.
· 3.4.2 Service Level Agreements (SLAs): The Vendor shall respond to support requests according to the Government-defined severity levels outlined in Section 10.0.
· 3.4.3 Software Maintenance: The Vendor shall provide adaptive, corrective, and preventative maintenance. This includes annual IRS tax updates, latency error correction, security vulnerability resolution, and performance improvements. The Vendor shall provide software release upgrade notifications including milestone charts, change logs, and bug lists.
4.0 DELIVERABLES
| CLN |
| Deliverable |
| Delivery Schedule |
| 001 |
| Proof of Concept (POC) |
| Due within 90 days of contract award. |
| 002 |
| Software Development Plan (SDP) |
| Due 30 days after contract award. |
| 003 |
| Fully Functional Software Solution |
| Phased delivery per approved project plan. |
| 004 |
| Data Migration Plan |
| Due 60 days after contract award. |
| 005 |
| Security Scan Reports (Static/Dynamic) |
| Provided with each major release. |
| 006 |
| Comprehensive Documentation Suite |
| Drafts with each release; final upon system acceptance. This includes User Manuals, O&M Manual, System Architecture docs, commented source code, and all test plans/results. |
| 007 |
| End-User Training Plan & Materials |
| Due 60 days prior to first phased rollout. |
| 008 |
| Monthly Status and Maintenance Reports |
| Monthly. |
| 009 |
| Handoff and Transition Plan |
| Due 90 days prior to end of final option period. |
| 010 |
| Transition-Out Plan |
| Due 180 days prior to contract end. |
5.0 PERFORMANCE REQUIREMENTS SUMMARY
| PWS Ref |
| Performance Requirement |
| Performance Standard |
| Method of Surveillance |
| 3.0 |
| Initial Proof of Concept (POC) |
| POC delivered within 90 days of award and accepted by Government. |
| 100% Inspection |
| 3.4.2 |
| Customer Support (Critical Outage) |
| Acknowledge and respond to Severity 1 incidents within 30 minutes. |
| 100% Inspection of support logs. |
| 4.0 |
| Deliverable Submissions |
| All deliverables submitted on time and are of acceptable quality. |
| 100% Inspection |
| 3.2.1 |
| Security Compliance (STIGs) |
| Zero CAT 1 STIG violations in production environment. |
| Periodic Audits; Review of Scan Reports. |
6.0 PLACE OF PERFORMANCE
All work shall be performed within the Continental United States (CONUS), the District of Columbia, and its outlying areas by U.S. Persons.
7.0 DATA RIGHTS
· Custom Code: The Government shall receive Unlimited Rights to all custom code developed specifically for this contract.
· COTS and Pre-existing Components: The Vendor shall describe the proposed Government Purpose Rights or other licensing agreements for any proprietary or pre-existing components used.
· Technical Data: The Government shall have the rights to access and use all technical data, schemas, and documentation required to operate, maintain, and sustain the system.
· Data Ownership: The Government will retain full ownership of and access to all of its data, in a non-proprietary format, throughout the life of the contract and upon termination.
8.0 PERIOD OF PERFORMANCE
The contract consists of a six (6) month base period for the Proof of Concept (POC). Following a successful POC, the contract will be structured with subsequent one (1) year option periods, contingent upon successful performance evaluations.
10.0 SERVICE LEVEL AGREEMENTS (SLAS)
| Severity Level |
| Description |
| Required Response Time |
| 1 - Critical |
| Any event or combination of events which causes a 100% loss of system availability. |
| Within 30 minutes. |
| 2 - High |
| Any event or multiple events causing a continuous or chronic impact to service. |
| Within 2 hours. |
| 3 - Medium |
| Any event or multiple events with the potential to cause a service impact. |
| Within 4 hours. |
| 4 - Non-Service Affecting |
| A condition having no immediate impact on service but requiring maintenance action. |
| By Next Business Day. |
ACRONYMS AND ABBREVIATIONS
| A2A |
| Application-to-Application |
| ABAC |
| Attribute-Based Access Control |
| ACAS |
| Assured Compliance Assessment Solution |
| API |
| Application Programming Interface |
| CAGE |
| Commercial and Government Entity |
| cATO |
| Continuous Authority to Operate |
| CI/CD |
| Continuous Integration/Continuous Delivery |
| CMMC |
| Cybersecurity Maturity Model Certification |
| CONUS |
| Continental United States |
| COTS |
| Commercial-Off-The-Shelf |
| CSO |
| Cloud Service Offering |
| CUI |
| Controlled Unclassified Information |
| DAST |
| Dynamic Application Security Testing |
| DFAS |
| Defense Finance and Accounting Service |
| DoD |
| Department of Defense |
| EIT |
| Electronic and Information Technology |
| ETL |
| Extraction, Transformation, and Loading |
| FedRAMP |
| Federal Risk and Authorization Management Program |
| FIRE |
| Filing Information Returns Electronically |
| GFE/GFI |
| Government-Furnished Equipment/Information |
| ICAM |
| Identity, Credential, and Access Management |
| IRIS |
| Information Returns Intake System |
| IRS |
| Internal Revenue Service |
| JWCC |
| Joint Warfighting Cloud Capability |
| NIST |
| National Institute of Standards and Technology |
| O&M |
| Operations and Maintenance |
| PII |
| Personally Identifiable Information |
| PKI |
| Public Key Infrastructure |
| POAM |
| Plan of Action and Milestones |
| PWS |
| Performance Work Statement |
| RBAC |
| Role-Based Access Control |
| RMF |
| Risk Management Framework |
| SaaS |
| Software as a Service |
| SAST |
| Static Application Security Testing |
| SCA |
| Software Composition Analysis |
| SDP |
| Software Development Plan |
| SIEM |
| Security Information and Event Management |
| SIT |
| System Integration Testing |
| SLA |
| Service Level Agreement |
| SOAR |
| Security Orchestration, Automation, and Response |
| STIG |
| Security Technical Implementation Guide |
| UAT |
| User Acceptance Testing |
| XML |
| Extensible Markup Language |
1099 REPLACEMENT
image1.png
Defense Finance and Accounting Service