I_01_b PWS ENISE_06Nov2025 v2.pdf

Performance Work Statement (PWS)

Enterprise Network and Information Security Enhancement (ENISE)

1. Background

The Internal Revenue Service (IRS) administers America’s tax laws and collects the revenues that fund most government operations and public services. The IRS and its employees represent the face of government to more U.S. citizens than any other agency.

IRS provides services to millions of taxpayers to help them understand and meet their tax obligations. We also deter people inclined to evade their responsibilities and vigorously pursue those who violate tax laws. Service and enforcement are equally important priorities for the IRS.

We are committed both to providing excellent service to taxpayers and enforcing America’s tax laws in a balanced manner.

Beginning in mid-2006, the Office of Management and Budget (OMB) released several memorandums to address protecting the vast quantities of information managed by the Government. OMB’s Memorandum 06-16 speaks directly to the ability to manage Sensitive but Unclassified (SBU)/Personally Identifiable Information (PII) extracts for legitimate use, and OMB M-07-16 which emphasizes protection and management of SBU/PII as a federal requirement.

2. Objective

The IRS has identified cloud technology as a key support enabler: hosting and managing big data and enabling IT operational excellence through use of complex applications and programs.

Cloud computing will allow the IRS to efficiently manage, operate and run a very large-scale computing infrastructure that delivers the capacity, availability and performance that will permit nearly 90,000 end users to focus on mission accomplishment while accessing more than 500 applications and programs.

This effort supports the Cybersecurity Information Protection Enhancement Controls (CIPEC) program’s mission to enhance and standardize data protection controls across the enterprise, safeguarding sensitive taxpayer data, and ensuring the integrity and security of the IRS systems.

2.1 Purpose

Given the services provided to the Taxpayers of the United States of America, the volume and sensitivity of Taxpayer data (e.g., IRS Employee data, IRS Affiliate Organizational Entities - Public, Private or Non-profit) has grown exponentially. Associated with this reality is the mission-critical need to protect this PII and SBU Information and guard against the increased occurrence of Enterprise Data (or Privacy) breaches and identity theft.

Privacy breach1 and identity theft are among the most prevalent and publicized cyber-crimes in the news today. According to the Open Security Foundation, which hosts “DataLossDB” a database which records unauthorized Personally Identifiable Information (PII) incidents.

Despite increased awareness, data privacy legislation, federal guidance, as well as the implementation of Agency-specific policies and security awareness training programs to help guard against the unauthorized disclosure of and access to Agency SBU information and PII, the inadvertent disclosure of this data continues day to day by well-meaning and dedicated employees.

2.2 Agency Mission

Considering these trends over the past quarter of a century, the U.S. Department of the Treasury and the IRS recognized the need for the implementation of a comprehensive system to:

Accurately discover or prevent SBU/PII data leakage.

Maintain the confidentiality of SBU/PII being stored and used by the IRS.

Ensure public trust in conducting business with the IRS electronically (e.g., IRS

Modernized eFile (MEF)system).

Prevent unauthorized disclosure of SBU/PII being stored and used by the IRS.

As an element of the Treasury Department’s ongoing efforts to improvement its Cybersecurity program, the Office of the Chief Information Officer (CIO) provided additional controls, in its memorandum “TCIO-M-09-04”, related to the management of Treasury’s Cybersecurity environment. These new controls focus particularly on the storage of data on removable media and the unauthorized transmission of information outside the Department.

3. Scope of Work

The purpose of the ENISE Project is to augment the IRS CIPEC Program’s DLP Technical team with experienced Cloud Technical, Federal Information Security Management Act (FISMA) Compliance, and Program support Subject Matter Experts (SMEs), who have successfully supported the implementation/integration of an “on prem” Enterprise DLP Commercial-Off-The- Shelf (COTS) Solution within an Enterprise Agency’s Hybrid Cloud Ecosystem – primarily utilizing the COTS Cloud product offerings of Microsoft, Skyhigh, Broadcom, Palo Alto etc.

The primary goal of this acquisition is to ensure the continued provision of trained and certified Information Technology (IT) professionals with extensive experience in developing and implementing Cloud Migration projects. This effort supports the CIPEC program’s mission to enhance and standardize data protection controls across the enterprise, safeguarding sensitive taxpayer data, and ensuring the integrity and security of the IRS systems. Additionally, the government seeks to future-proof its technical environment by integrating emerging technologies and solutions. It also aims to explore innovative mechanisms to incorporate artificial intelligence

1 The term “breach” is also defined by OMB memoranda M-07-16,: “Safeguarding Against and Responding to the Breach of Personally Identifiable Information”, May 22, 2007, as: “For the purposes of this policy, the term “breach” is used to include the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic.”

and machine learning (AI/ML) technologies to further enhance operational capabilities and efficiencies.

The ENISE Project will be implemented as a multi-year multiple-release effort. Although the “on prem” and “Cloud” solutions are intended to be functionally equivalent, the Architecture, Infrastructure, Configuration, Security Compliance model and Implementation approach required for the successful implementation of the IRS DLP in the Cloud solution is to be fundamentally different.

The IRS Business Units and IT organizations rely on the CIPEC to provide Subject Matter Expertise relating to the implementation and operational support of Broadcom, Inc’s, Symantec DLP Suite COTS solution and Cloud Computing, related to the specific solutions the IRS has already acquired and have implemented. This requisite expertise that the DCM ENISE Project must continue to provide, is associated with related competencies including: solution architecture/engineering, requirements elicitation, project management techniques and approaches, cloud solution FISMA security & privacy compliance, Cloud DLP systems and database administration, data leakage event troubleshooting, solution DLP detection rule development, detection rule triggers & configurable exceptions, systems upgrade work for solutions of various vendors, event management and triaging workflow development, role based access management and control. In addition to protecting the IRS from data exfiltration the ENISE project will also be configuring Palo Alto Cloud Hosted Security Stack to enhance the organizational network secure posture. To support the DCM ENISE project needs, while maintaining a cost-effective price structure, the PWS will include Firm Fixed Price (FFP) tasks.

Tables below project the estimated number of resources needed to support the contract.

Table 1- Estimated Resources under FFP Base Period CLIN 0001

Project Role Hours Program/Project Manager - SME 956 Project Manager 1752 Systems Engineer – SME 1912 Subject Matter Expert - Zero Trust 1912 Subject Matter Expert - Data Security 3824 Subject matter Expert – Network Security Engineer 3664 Information Security Analyst - SME 1752 Technical Writer / IT Analyst 1752

Table 2- Estimated Resources under FFP Base Period CLIN 0002

Project Role Hours Systems Engineer – SME 1912 Subject Matter Expert - Zero Trust 956 Subject Matter Expert - Data Security 1912 Subject matter Expert – Network Security Engineer 1912 Information Security Analyst - SME 1912 Technical Writer / IT Analyst 1912

Table 3 - Estimated Resources under FFP Base Period CLIN 0003 Project Role Hours

Project Manager 160 Information Security Analyst - SME 160 Subject Matter Expert - Data Security 160 Technical Writer / IT Analyst 160

3.1 Current Information Technology (IT)/Network Environment

In 2013, the SPIIDE Project was initiated and the IRS Cybersecurity A&I’s DLP Program Management Office (PMO) was stood-up to execute the implementation of a Commercial-Off- The-Shelf DLP solution.

The IRS DLP solution was implemented in two separate software releases:

Release 1.0 focused on implementing the first of three Functional Uses Case components:

Data-In-Motion (DIM). The Data-In-Motion (DIM) component, implemented in the IRS Production Operational environment, monitors the presence unencrypted PII or SBU data in outbound email messages and posted to public-facing IRS Web Sites. Using this IRS DLP COTS component, certain instances of unencrypted PII and SBU data is detected, their transmission outside of the IRS Network perimeter is blocked and the responsible IRS employee is notified by an auto-generated email response.

Release 2.0 focused on implementing the final two of three Functional Uses Case components: Data-At-Rest (DAR) and Data-In-Use (DIU). Data-At-Rest (DAR) component specifically scans fileshares, SAN/NAS storage, SharePoint, Websites, Databases, etc. for files containing sensitive content (such as PII, PCI, HIPAA, etc.)

and/or other content/context including age of the file, file types, encrypted files, etc. The deployment scope of the DIU component, via use of endpoint agents locally installed on enterprise workstations (Laptops) and on servers, monitors and responds to the presence of PII & SBU Data (currently configured as DLP policies).

4. Tasks

Outlined in this PWS is a detailed description of the professional services that the selected Contractor shall provide to the ENISE Project, to support the continued instantiation of the IRS enterprise DLP solution in the emerging IRS Cloud ecosystem. This effort also includes the deployment and configuration of Palo Alto Next Gen Firewall (NGFW) technologies, as well as related activities (e.g., authoring required OneSDLC documentation, participation in established Integrated Project Teams (IPTs) and/or establishing a new IPT for the DLP in the Cloud effort, support for IRS FISMA Annual Security Compliance Assessments (ASCA).

The following tasks are the high-level summary of the scope for this Performance Work Statement:

1. CLIN 0001

Task 01 – Solution Delivery Support

Task 02 - Architecture, Analysis, Solution Selection, Acquisition, Configuration, Implementation & Operations Support

Task 03 - On Prem” DLP Detection Rules Integration Task 04 - Critical Gap Analysis Between the On-Prem and Cloud Hosted DLP

Solutions for Implementation

2. CLIN 0002

Task 01 - Palo Alto NGFW Proxy Configuration Implementation Task 02 - Web Application and API Security Deployment Task 03 - Threat Detection and Cloud Detection & Response Implementation Task 04 - Data Security Posture Management (DSPM) Development Task 05 - Prisma Access Browser Architecture and Deployment Task 06 - Enterprise DLP Configuration with IRS Policies Task 07 - AI/ML Augmentation and Enhancement in E-DLP Task 08 - Strata Cloud Manager Configuration

3. CLIN 0003

Task 01 - Transition-Out

4.1 CLIN 0001

4.1.1 TASK 1 –SOLUTION DELIVERY SUPPORT

4.1.1.1 SUBTASK 1 – ORIENTATION /PROJECT KICK -OFF BRIEFING

Within two weeks of Task Order award, the contractor shall conduct an orientation briefing for the Government. The Government does not desire an elaborate orientation briefing, nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the Government and contractor by introducing key Task Order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of Task Order requirements and objectives.

The orientation briefing shall be held virtually via Microsoft Teams and both parties shall mutually agree upon the date and time. The completion of this briefing shall result in the following:

The contractor and Government personnel who will perform work under this Task Order will be introduced.

The Government will show the applicable facilities to the contractor if the contractor will be performing work on the Government's site.

The Government may provide any Government Furnished Property (GFP) to the contractor at this time.

Any issues concerning the contractor clearances for contractor personnel will be discussed.

Government will provide instructions for their personnel on how to obtain Government Furnished Equipment (GFE) laptops with Enterprise Remote Access Project (ERAP) access capabilities to allow contractor personnel to work at alternate locations during inclement weather or other authorized periods, if needed.

The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

4.1.1.2 SUBTASK 2 –COORDINATION OF SOLUTION DELIVERY ACTIVITIES AND GOVERNANCE

PROCESSES

The contractor shall provide support for the planning strategizing for project initiatives and project engagement. The contractor shall provide documentation, reporting, and briefing support as required. The contractor shall coordinate project and program activities and governance processes. The contractor shall coordinate, facilitate, monitor, and support interfaces with other IRS projects, initiatives, and programs to ensure cohesiveness between all IRS security initiatives. The contractor will provide acquisition support for supplemental solution planning and integration to address risks, limitations, and gaps. The contractor will support FISMA, OMB, Treasury Inspector General for Tax Administration (TIGTA), and Government Accountability Office (GAO) requests or requirements. The contractor will coordinate with Cyber and Privacy stakeholders, as needed, to ensure that all required tasks are met.

DESIRED OUTCOMES: The contractor will develop an approach to strategize and track program and project activities to meet federal initiatives and governance requirements.

4.1.1.3 SUBTASK 3 – DOCUMENTATION SUPPORT

The contractor shall produce thorough, clear, concise, and usable documentation, reporting, and briefing materials.

Participate and assist in the preparation of the full systems development life cycle (Plan, Design, Development, Testing, Implementation & Disposition)

Develop, update and maintain project schedules, identify and track issues, actions, risks, constraints, mitigation strategies, and governance reporting.

Assemble and prepare documentation related to meeting agendas.

Assist facilitation and documentation of meetings, conference calls, workshops and group forms.

Create & Maintain OneSDLC documents, as required.

Support other project documentation, including the develop of technical and non-technical documentation (e.g., communication plans, instructions, guidelines, procedures, computer operators’ handbooks, test plans, etc.)

DESIRED OUTCOMES: The contractor will create and maintain Project Management documentation. The contractor will create, maintain, and update documents as needed to reflect changes throughout the life of the project (including existing IRS documentation). The Contractor will ensure that all stakeholders validate all documentation. The Contractor will ensure that documentation is completed and delivered by the due dates. The Contractor will track and provide status of all documents throughout the life of the project. The contractor will create and present project-related documentation, presentations, and reports. Presentations may target all levels of technical and non-technical IRS staff.

4.1.1.4 SUBTASK 4 – REPORTS, MEETING FACILITATION AND PRESENTATIONS

The contractor shall produce standardized, complete, and useful status reports, presentations, reports, meeting-related records, and other documentation, as needed. The contractor shall evaluate project progress and prepare reports. Reports may consist of monthly progress reports and status reports required for Management Review Boards. The contractor shall ensure meeting goals are communicated to attendees through agendas and meeting minutes. The contractor shall create and track action items including status, owners, and due dates. The contractor shall prepare and deliver presentations to various stakeholder groups/executives and provide updates as determined in the work request. The contractor shall maintain group lists (e.g., distribution lists) for the project team and report project information and advice to all levels of leadership, as required.

DESIRED OUTCOMES: The contractor will organize and schedule meetings, update and maintain attendee lists, record, and post meeting notes. The contractor will prepare reports and facilitate project meetings.

4.1.1.5 SUBTASK 5 – RISK MANAGEMENT

The contractor will create a risk evaluation summary detailing potential impact and likelihood of occurrence. The contractor will facilitate the enterprise risk assessment methodology to review requirements with the project team to allow the IRS to prioritize work based on risk mitigation, ease of implementation, user impact, etc.

Support of FISMA Annual Security Compliance Assessments (ASCA) for DLP in the Cloud, including documentation preparation, security controls testing participation and tabletop exercises (TTE)

Remediate Plan of Action and Milestones (POA&M) items identified Conduct Disaster Recovery Failover exercises, and recovery activities after a Disaster

Recovery event.

DESIRED OUTCOMES: The contractor will create and maintain an DCM risk evaluation summary and facilitate risk review sessions, when necessary, for the CIPEC program.

4.1.1.6 SUBTASK 6 – COMMUNICATIONS PLANNING AND SUPPORT

The contractor shall establish and abide by regular, organized stakeholder communications about all pertinent CIPEC DCM activities. The contractor shall develop feedback mechanisms to allow the team to measure the users experience with the various technologies and adjustment as necessary. The contractor will be responsible for:

Developing a key message platform to be used in briefings, presentations, and communications to executives, stakeholders, and end-users.

Writing DCM educational material, as required (ex. Frequently Asked Questions, Data Classification Guides, ITM articles, Knowledge Articles, etc.).

Working with other Integrated Project Teams (IPTs) and executive workstreams to provide responses to questions from the end-users.

Establishing and maintaining a project communications plan.

Producing dashboards / status reports for executives, governance bodies (e.g., TRB, SecChM, etc.) and other stakeholders.

Producing written communications (e.g., newsletter articles, emails, briefing presentations) and other stakeholder communications, as needed.

DESIRED OUTCOME: The contractor shall develop, maintain, and execute a Stakeholder Coordination Plan. The contractor shall develop and maintain briefing materials.

4.1.1.7 SUBTASK 7 –ORGANIZATIONAL READINESS AND STAKEHOLDERS MANAGEMENT

The contractor shall conduct organizational readiness and stakeholder management activities to facilitate deployment and use of capabilities. These activities include but are not limited to:

Development and maintenance of gap analyses of current state compared with the future state.

Support for implementation of capability testing to be conducted by the receiving organizations.

Support of capability training across both receiving organization and implementation teams.

Collection and execution of capability training requirements.

DESIRED OUTCOMES: The contractor will conduct organizational readiness and stakeholder management activities.

4.1.1.8 SUBTASK 8 – QUALITY CONTROL PLAN (QCP)

Contractor shall develop a Quality Control Plan (QCP) for measuring and attaining quality of performance under this delivery order within the first 90 days of award. The Contractor’s QCP shall explain the way they shall ensure all Task Order requirements are being accomplished.

Sustaining focus throughout the QCP shall be the attainment of continuous quality improvement.

The Contractor shall submit any changes in the plan to the CO and the COR at least five business days prior to implementation. These measures will be monitored and reported as part of the monthly In-Progress Review or as part of other scheduled reviews with the Contractor and PM.

DESIRED OUTCOMES: The contractor shall provide Quality Control Plan.

4.1.2 TASK 2 - ARCHITECTURE, ANALYSIS, SOLUTION SELECTION, ACQUISITION,

CONFIGURATION, IMPLEMENTATION, OPERATIONS & MAINTENANCE SUPPORT

Support the ongoing Operations and Maintenance (O&M) of the IRS Cloud-based Data Loss Prevention (DLP) environment by completing the development of a comprehensive Technical Strategy Document that ensures continuity, scalability, and alignment with enterprise security objectives. This activity will sustain and enhance DLP functionality across multiple project releases. The Technical Strategy Document will, at a minimum, include:

o Sustainment and Optimization: Define a long-term technical roadmap and operational strategy to sustain, enhance, and optimize DLP performance across multiple IRS cloud releases and environments.

o Implementation and Integration Support: Maintain and update the engineered DLP solution architecture, ensuring continued alignment with the IRS Cloud Ecosystem and supporting the integration, validation, and lifecycle management of DLP components.

o Continuous Research, Testing, and Validation: Conduct O&M-level research and validation of DLP functionality in coordination with IRS-designated Cloud Access Security Broker (CASB) solutions—including Microsoft Defender for Cloud Apps (MDCA), Palo Alto Networks Prisma Cloud, Zscaler, and other approved native cloud-hosted platforms—to ensure continued operational effectiveness, compatibility, and compliance.

System upgrade and testing in DEV, TEST and PROD environments. Updates or releases must be tested in a non-production test environment first, to ensure stability before being introduced into the IRS production environment. Work shall be properly planned for execution in conjunction with the IRS’s filing season plans and other high priority initiatives.

Development of detailed installation instructions, termed transmittal sheets, for DEV, TEST and PROD.

Coordination and communication with stakeholders from other organizations internally within the IRS and externally, when required.

Initiate and track all Change Requests, IRWorks or Task Requests, Universal Work Requests (UWR), UWR Impact and Cost Analysis Summary (ICAS) & UWR Impact and Cost Analysis Details (ICAD) Request and other Change Management actions.

o Identify resource needs and ensure timely submission of resource requests using

Work Request Management System (WRMS) and the Unified Work Request (UWR) process or other organizational processes.

As needed coordination with the EOPS and/or UNS and the vendor for troubleshooting support.

Provide engineering support for the sustainment, modernization, and optimization of existing DLP operations and workflows.

o Modernization, Optimization and Automation (MOA) of event handling and resolution Data collection, data cleansing, data formatting and data normalization from

Cloud hosted as well as on-prem DLP solutions Performing advanced analytics including using AI/ML to reduce False

Positives and detect notable events for resolution Develop metrics and dashboard in cloud hosted tools and the enterprise IRS

SIEM platform (Splunk) Develop automated notifications, alerts and alarms o Modernization, Optimization, and Automation (MOA) of Event Handling and Resolution

The Contractor shall provide ongoing Operations and Maintenance (O&M) support focused on the Modernization, Optimization, and Automation (MOA) of DLP event handling and resolution processes across both cloud-hosted and on-premises environments. Activities shall include, but are not limited to:

Data Management and Quality Assurance:

The Contractor shall perform continuous data collection, cleansing, formatting, and normalization from Cloud-hosted and on-premises DLP solutions to ensure consistent, high-quality data for operational analysis and reporting.

Operational Analytics and Event Efficiency:

The Contractor shall perform ongoing advanced analytics to improve operational efficiency, leveraging AI/ML-driven techniques to reduce false positives, identify notable events, and enhance the speed and accuracy of event triage and resolution.

Performance Metrics and Visibility:

The Contractor shall maintain, refine, and enhance operational metrics and dashboards within Cloud-hosted tools and the IRS Enterprise SIEM platform (Splunk) to provide real-time visibility into DLP system health, event volumes, and operational trends.

Automation and Proactive Monitoring:

The Contractor shall sustain and optimize automated notifications, alerts, and alarms to enable proactive detection of anomalies, expedite response efforts, and reduce manual monitoring efforts within day-to-day operations.

o Maintain and enhance automated event orchestration workflows utilizing Robotic

Process Automation (RPA) and Security Orchestration, Automation, and Response (SOAR) capabilities within Splunk to streamline operational response and reduce manual effort.

o Submit change requests and help desk tickets as needed Attend change request meetings to address questions raised Follow up on help desk tickets until closure Timely report delays in any approvals or ticket closures to the PM o Troubleshooting o Coordination of implementation with all stakeholders o Lead O&M activities to maintain and enhance DLP operations, ensuring stable performance and continuous improvement.

Additional DLP rule-set development and execution o Documentation of test plan o Development of test schedule o Coordination with stakeholders

Process Coordination o Review and help revise IRMs as needed o Develop communication material and workflows o Lead meetings to guide stakeholders o Communicate with the National Treasury Employee Union (NTEU) as needed (e.g.

notifications of changes to MOUs/policy) o Coordinate and engage the appropriate IRS technical and business stakeholders as necessary to implement the DLP in the Cloud solution and functional and technical processes.

o Conduct analysis and research activities in support of IRS processes, procedures, and associated workflows.

o Support revision of cybersecurity standards and guidance published through the IRM.

o Ensure documentation is completed for modified or newly created workflows, processes, guidance or IRMs.

Advance M365 Purview DLP (PDLP) toward full operational status in production across the IRS Microsoft tenant.

o Conduct necessary operational readiness activities and perform the steps required to maintain authorization to operate (ATO) status with DLP-specific requirements.

o Coordinate with all relevant IRS stakeholders to produce a well-defined and achievable timeline and sequence of activities leading to successful deployment of this capability.

o Devise and implement enterprise-level maintenance procedures to support full operational status of PDLP in production.

o Document these procedures in an appropriate set of Standard Operating Procedures (SOPs) to be used by operations support staff for training and operational guidance.

DESIRED OUTCOMES:

Contractors shall develop relevant documentation for the development, acquisition, configuration, integration testing and implementation in support of all known and new requirement associated with the DCM aggregate solution, incorporating DCM Future Release Requirements functionality enhancements and related work. Achieve fully operational deployment of the PDLP solution across the IRS production Microsoft tenant.

4.1.3 TASK 3 - “ON PREM” DLP DETECTION RULES INTEGRATION

Review History and Lifecycle of Symantec DLP Detection Rules configured within the IRS Cybersecurity A&I, CSD, DI&D, CIPEC Office’s DLP “on prem” System.

Plan, test, and activate new or enhanced DLP detection rules (i.e., detection policies).

Provide support to event responders.

Provide operational triage services for DLP events in the IRS Cloud ecosystem.

Assist in data gathering and metrics reporting.

As needed 24/7 on call support to assist with DLP event detection in the IRS Cloud ecosystem.

Execute and refine processes and workflows.

Provide DLP in the Cloud training as needed for the DLP detection rule enhancements.

DESIRED OUTCOMES: Contractors shall support the configuration, testing, integration, maintenance and documentation of DLP detection rules for DCM, within the IRS Cloud ecosystem. DLP PII or SBU detection rules maintenance takes place on a Monthly or on an “as-needed” basis (when DLP false-positive detections occur).

4.1.4 TASK 4 - CRITICAL GAP ANALYSIS BETWEEN THE ON-PREM AND CLOUD HOSTED DLP

SOLUTIONS FOR IMPLEMENTATION

Although Contract Cloud DLP SMEs will focus their core efforts on ensuring that core DLP Functionality (e.g., DIM, DIU, & DAR) is effectively instantiated and functional within the IRS Enterprise Cloud Ecosystem, their work may result in the emergence of additional functional requirements, which may result in the need to acquire additional Cloud computing data loss prevention, or data protection solutions, or the acquisition of supplemental components, or features of Cloud Computing solutions already implemented at the IRS.

Should these circumstances arise, the following tasks may need to be supported:

Support Supplemental Requirements Elicitation/Documentation, Change and Risk Management and their implementation/integration to enhance the established IRS Cloud Ecosystem.

Coordinate with the IRS organizational entities responsible for architecting, implementing, and maintaining all components of the emerging IRS Cloud Ecosystem.

Support supplemental Logical & Physical Design, Configuration and Integration of emergent requirements with established IRS Cloud Computing infrastructure and solutions, as well as the updating of any relevant ELC Documentation.

Support supplemental Solution selection & Acquisition to extend existing capabilities inherent with the emerging IRS Cloud Ecosystem and/or to add new capabilities, in line with emerging IRS Cloud computing capabilities.

Support Program Management for the migration of the “on prem” DLP IRS enterprise solution into the IRS Cloud ecosystem.

Provide technical subject matter expertise to support IRS Cloud DLP application integration, parallel testing with IRS “on prem” DLP solution.

Support testing and production readiness assessment of all Cloud DLP COTS solutions by the contractor and development of reusable integration processes and procedures.

Interface with DCM technical teams to coordinate integrated application testing with DLP “on prem” project to ensure viability of all defined/configured Cloud DLP solutions.

Facilitate the integration of supplemental solutions or capabilities, which may be required to further support the DLP in the Cloud Project and may include other Request types including, Work Request, Change Requests, Filing Season Black-out Waiver Requests, Live Data Waiver Requests, as well as POA&M & PCA Risk Management Tracking Issue Tickets.

Support the CIPEC program’s ongoing Operations and Maintenance (O&M) mission to enhance and standardize data protection controls across the enterprise by continuously improving and future-proofing the technical environment through the evaluation and integration of emerging technologies and solutions.

Provides specific guidance and strategies to explore innovative mechanisms to incorporate AI/ML technologies to further enhance operational capabilities and efficiencies.

DESIRED OUTCOMES: Contractors shall support required integration and production readiness testing of capabilities and/or solutions which may be required to address functional gaps associated with the current architecture/infrastructure of the IRS “on prem” DLP solution and DLP capabilities within the IRS Cloud Ecosystem.

4.2 CLIN 0002

4.2.1 TASK 1 - PALO ALTO NGFW PROXY CONFIGURATION IMPLEMENTATION

Assess network architecture and identify proxy use cases and integration points.

Configure NGFW proxy features: Explicit Proxy, URL filtering, SSL decryption, authentication, threat prevention.

Enable logging and monitoring; forward logs to Panorama and/or SIEM; create custom dashboards.

Test proxy functionality and enforcement policies.

Document configuration, enforcement policies, and provide diagrams and a management runbook for the following NGFW configurations:

o Panorama: Panorama is a centralized management solution that provides visibility and control over multiple Palo Alto Networks firewalls. It simplifies policy management, device configuration, and reporting across distributed environments.

o Palo Alto Networks PA-Series NGFW: The PA-Series is a family of next-generation hardware firewalls that deliver high-performance, application-aware security. These firewalls use App-ID, User-ID, and Content-ID technologies to inspect traffic and enforce granular policies, enabling organizations to prevent known and unknown threats across their network perimeter.

o VM-Series Virtual NGFW: The VM-Series is a virtualized version of Palo Alto’s NGFW, designed to secure virtualized data centers and cloud environments. It provides the same advanced threat prevention and traffic visibility as the physical appliances, optimized for platforms like AWS, Azure, and VMware.

o CN-Series Container NGFW: The CN-Series is a containerized firewall built for Kubernetes environments. It secures east-west traffic between containers and namespaces, providing micro segmentation and threat prevention for cloud-native applications.

o Cloud NGFW: A fully managed firewall-as-a-service offering available through public cloud marketplaces like AWS and Azure. It provides elastic scalability and deep security capabilities without the need to manage infrastructure.

o Advanced URL Filtering: A cloud-delivered web security service that protects users from malicious websites, phishing attacks, and command-and-control traffic using real-time analysis and threat intelligence.

o Advanced Threat Prevention: A next-generation intrusion prevention system (IPS) that uses machine learning and behavioral analysis to detect and block exploits, malware, and evasive threats in real time.

o Prisma SD-WAN: A software-defined WAN solution that integrates with Palo Alto’s security stack to provide intelligent, application-aware routing and secure connectivity across distributed networks.

DESIRED OUTCOMES: The Contractor will develop a comprehensive guide outlining the configuration, validation, and management of proxy services to enhance network security and compliance. The guide will include proxy setup details, logging and monitoring configuration, testing results, and an operational runbook to support ongoing management and oversight.

4.2.2 TASK 2 - WEB APPLICATION AND API SECURITY DEPLOYMENT

Monitor API traffic between cloud applications and third-party services.

Enforce granular access controls and data loss prevention (DLP) policies.

Detect and block anomalous behavior or malicious API calls.

Integrate with identity providers (IdPs) for user-based policy enforcement.

Validate protection using simulated attacks and test cases.

Deploy security configurations across dev, test, and production environments.

Document protection mechanisms and operational guidance Configure Prisma Access, cloud-delivered security service that provides secure access to applications for remote users and branch offices. It includes firewall-as-a-service, secure web gateway, CASB, ZTNA, and DLP capabilities.

Configure Strata Cloud Manager, a cloud-native management platform that unifies policy, configuration, and operational oversight across NGFWs and SASE deployments.

It uses AI-driven insights to optimize security posture and streamline operations.

DESIRED OUTCOMES: The Contractor will develop a deployment guide detailing the configuration, validation, and operation of web application and API security controls. The guide will include the API Protection Validation Report, deployment summary, and operational guidance manual to ensure secure implementation, consistent policy enforcement, and effective ongoing management.

4.2.3 TASK 3 - THREAT DETECTION AND CLOUD DETECTION & RESPONSE IMPLEMENTATION

Configure network traffic analysis tools for anomaly detection.

Validate detection capabilities using baselines and test scenarios.

Deploy Cloud Detection and Response (CDR) across cloud platforms.

Develop incident response workflows and reporting templates.

DESIRED OUTCOMES: The Contractor will develop an implementation guide outlining the configuration, deployment, and operation of cloud-based threat detection and response capabilities. The guide will include the Threat Detection Configuration Report, CDR Deployment Summary, Incident Response Workflow Guide, and Reporting Templates to ensure proactive monitoring, rapid response, and standardized reporting of cloud security events.

4.2.4 TASK 4 - DATA SECURITY POSTURE MANAGEMENT (DSPM) DEVELOPMENT

Discover and classify cloud-hosted data assets.

Configure DSPM tools to monitor access and usage.

Validate classification accuracy and access control enforcement.

Develop a data protection report and monitoring plan.

DESIRED OUTCOMES: The Contractor will develop a comprehensive guide detailing the configuration and validation of Data Security Posture Management capabilities. The deliverable will include the Data Discovery & Classification Report, DSPM Configuration Guide, Access Control Validation Summary, and Ongoing Monitoring Plan to ensure continuous visibility, proper data governance, and sustained compliance with federal security standards.

4.2.5 TASK 5 - PRISMA ACCESS BROWSER ARCHITECTURE AND DEPLOYMENT

Architect client-level security controls using Prisma Access Browser.

Validate browser-based security policies and user experience.

Deploy solution across designated endpoints.

Provide configuration documentation and user training materials

DESIRED OUTCOMES: The Contractor will develop a guide outlining the architecture, configuration, and deployment of Prisma Access Browser to extend client-level security controls.

The deliverable will include the Prisma Access Architecture Document, Policy Validation Report, Endpoint Deployment Summary, and User Training Materials to ensure secure implementation, policy alignment, and effective user adoption.

4.2.6 TASK 6 - ENTERPRISE DLP CONFIGURATION WITH IRS POLICIES

Configure Enterprise DLP with IRS-specific policies.

Implement regex and AI/ML-based detection for SBU, PII, and FTI.

Validate detection accuracy and blocking mechanisms.

Map policies in compliance with requirements and document them.

Develop incident response workflows and reporting templates.

DESIRED OUTCOMES: The Contractor will develop a comprehensive guide detailing the configuration and validation of Enterprise DLP with custom IRS policies. The deliverable will include the DLP Configuration Guide, Detection Accuracy Report, Blocking Mechanism Validation, and IRS Policy Compliance Mapping to ensure accurate detection, effective data protection, and alignment with IRS security and compliance requirements.

4.2.7 TASK 7 - AI/ML AUGMENTATION AND ENHANCEMENT IN E-DLP

Integrate AI/ML tools to reduce false positives in DLP.

Validate detection using historical event data.

Tune models for performance and alert fatigue reduction.

Document performance metrics and tuning procedures.

DESIRED OUTCOMES: The Contractor will develop documentation outlining the integration and optimization of AI/ML models within the Enterprise DLP environment. The deliverable will include the AI/ML Integration Summary, Detection Validation Report, Model Tuning Documentation, and Performance Metrics Dashboard to ensure improved detection accuracy, reduced false positives, and enhanced adaptive response capabilities.

4.2.8 TASK 8 - STRATA CLOUD MANAGER CONFIGURATION

Configure Prisma Cloud, a comprehensive cloud-native security platform that provides visibility, compliance, and threat prevention across public, private, and hybrid cloud environments. It includes CSPM, CWPP, CIEM, WAAS, and code security modules.

Configure Strata Cloud Manager for centralized policy enforcement.

Validate reporting and event management capabilities.

Deploy across cloud and hybrid environments.

Deliver administrative guides and dashboard customization.

DESIRED OUTCOME: The Contractor will develop documentation outlining the integration and optimization of AI/ML models within the Enterprise DLP environment. The deliverable will include the AI/ML Integration Summary, Detection Validation Report, Model Tuning Documentation, and Performance Metrics Dashboard to ensure improved detection accuracy, reduced false positives, and enhanced adaptive response capabilities.

4.3 CLIN 0003

4.3.1 TASK 1 – TRANSITION OUT (OPTION)

At the end of this Task Order, the Contractor shall provide transition-out services. The Contractor shall facilitate the transition of contracted activities and services to the Cybersecurity Program personnel and to a follow-on Contractor in accordance with the Government Approved Transition-Out Plan. The transition period shall not exceed sixty (60) calendar days.

The Contractor shall:

Minimize transition impact to the user community.

Ensure no breaks in service availability.

Maintain existing service quality and performance levels.

Ensure a transparent and seamless transition.

Maintain support and meet delivery milestones of ongoing projects.

Ensure that the IT security posture during transition is maintained at current levels without creating gaps and/or vulnerabilities.

4.4 DELIVERABLE TABLE

ID Deliverable Description Due Date 1 Project Kickoff /

Orientation Briefing Deliverable: Virtual project kick-off meeting with the COR, GTM and PM including an orientation briefing presentation outlining contractual requirements.

Within two weeks of Task Order award at a date and time mutually agreed upon by both parties

2 Project Schedule Deliverable: Identifies and defines the overall plan and required documentation for the execution, management, and control of projects or initiatives to be undertaken in support of this contract.

Within six weeks of award at a date and time mutually agreed upon by both parties

Thereafter, on the fifth business day of every month.

3 Monthly Status Report

Deliverable: Provide Monthly Status Reports and discuss current funding, expected projections, task shortfalls, project’s performance, project schedule for the previous month/term including scheduled, completed and outstanding tasks, and any other issues/concerns relating to completing the task.

On the fifth business day of every month; and on the tenth business day of the last month of the Task Order.

Within five business days of COR/PM request (up to two additional annual ad hoc reports)

4 Meeting Materials Work Product: To include meeting goals, agendas, attendee lists, minutes, and action items. Action items to include status, owner, and due dates.

As needed (Work Product shall be submitted within 5 business days after requested by the PM unless otherwise specified)

5 Presentations and Briefings

Work Product: Presentations and briefings to various stakeholder groups and executives providing updates.

As needed (Work Product shall be submitted within 5 business days after requested by the PM unless otherwise specified)

6 Vendor Product Capabilities Report

Work Product: An evaluation and documentation of vendor capabilities against the established Business and Technical Requirements

As needed (Work Product shall be submitted within 5 business days after requested by the PM unless otherwise specified)

7 DLP Detection Rules Work Product: Create and maintain integration & testing Approach document for migration/implementation of DLP detection Rules into the Cloud.

Monthly (the first working day of the month) or as needed

8 Risk Evaluation Summary

Deliverable detailing potential impact and likelihood of occurrence.

Due 60 business days After Project kick off meeting; updates as project changes occur, no less frequently than annually

9 Quality Control Plan Contractor shall develop a Quality Control Plan (QCP) for measuring and attaining quality of performance under this requirement. The Contractor’s QCP shall explain the way they shall ensure all award requirements are being accomplished.

Within 60 business days After Project Kick-Off Meeting; updated as changes

10 Performance Metric Report

Work Product: Create dashboard/report to measure how well the model differentiates between true security threats and benign activities, along with other relevant metrics.

Monthly (the first working day of the month) or as needed

11 Provide Reports, Facilitate Meetings and Prepare Presentations for DCM processes and procedures

Work Product: Overall project progress status reports that incorporate status provided by solution vendor, status of project working groups, status of IRS resources, summary ELC status. Organize and schedule meetings, update and maintain attendee lists, record and post meeting notes. Update and maintain the

Weekly, as needed (on the last working day of the week.

list of Integrated Project Team members and any project sub-groups.

12 Standard Operating Procedure (SOP)

Work Product: Standard operating procedure documentation outlining CIPEC’s maintenance and support processes for M365 Purview DLP in production.

Due 10 months after the award of the Task Order.

13 Proxy Configuration Implementation Guide

Work Product Containing, Proxy Configuration, Logging & Monitoring Setup Report, and Proxy Testing Results

Due 11 months after Project Kick off meeting.

14 Web Application and API Security Deployment Guide

Work product containing API Protection, Validation Report, Deployment Summary and Operational Guidance Manual

Due 10 months after Project Kick off

15 CDR Implementation Guide

Work product containing Threat Detection Configuration Report, CDR Deployment Summary, Incident Response Workflow Guide and Reporting Templates

Due 9 months after Project Kick off

16 Data Security Posture Management (DSPM) Development Guide

Work product containing Data Discovery & Classification Report, DSPM Configuration Guide, Access Control Validation Summary, and Ongoing Monitoring Plan

Due 7 months after Project Kick off

17 Prisma Access Browser Architecture and Deployment Guide

Work product containing Prisma Access Architecture Document, Policy Validation Report, Endpoint Deployment Summary, and User Training and Materials

Due 6 months after Project Kick off

18 Enterprise DLP Configuration with IRS Policies Guide

Work product containing DLP Configuration Guide, Detection Accuracy Report, Blocking Mechanism Validation, and IRS Policy Compliance Mapping

Due 6 months after Project Kick off

19 AI/ML Augmentation and Enhancement in E-DLP Guide

Work product containing AI/ML Integration Summary, Detection Validation Report, Model Tuning Documentation, and Performance Metrics Dashboard

Due 11 months after Project Project kick off meeting

20 Strata Cloud Manager Configuration Guide

Work product containing Strata Cloud Manager Configuration Guide, Reporting & Event Management Validation, Deployment Summary and Admin Guide & Dashboard Customization Manual

Due 8 months after Project kick off

21 Transition Out Plan Deliverable: Create a transition plan Due at the end of 9 months after project kick off meeting.

5. PERIOD OF PERFORMANCE

The period of performance for this Task Order shall consist of 12 months period of performance.

The estimated period of performance is Jan 11, 2026 – Jan 10, 2027. The actual dates may change and will be updated at time of award, but the overall duration of 12 months will remain unchanged.

6. TRAVEL

No travel required for the execution of assigned tasks.

7. PERFORMANCE REQUIREMENTS

Performance requirements are defined by the Government. The table in Section 4.4 of this PWS details the desired outcomes for successful completion of specified deliverables, work products and support required to be produced. This performance requirements aligns the Contractor’s objectives with the Government objectives, which are to complete tasks in a manner that delivers value-added products and services to the end users.

7.1 PLACE OF PERFORMANCE

Contractor’s site, with authorized access to the IRS network and associated application systems – teleworking via use of the ERAP AnyConnect application installed on all IRS-issued laptops to facilitate wireless access through the IRS VPN to the IRS Network.

Telework is authorized for all contractor staff supporting the IRS DLP in the Cloud System 100% of the time and has been approved by both the Program & Contract Manager.

The contractor shall abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at facilities.

7.2 HOURS OF OPERATION

Normal business hours are considered 7:30 am to 4:30 pm. local time for the location where services are performed.

7.3 SECURITY CLEARANCES

Contractor employees assigned to the Task Order and granted access to IRS information are subject to investigation by the government. Applicable contractor employees who undergo Minimum Background Investigation (MBI) checks which reveal, but are not limited to, the following, may be unacceptable under this Task Order: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay Federal income tax.