I_01_b RFQ 8380 DRAFT PWS.docx

Performance Work Statement (PWS) Information Technology (IT) | Cybersecurity | Architecture & Implementation (A&I) Cyber Solutions Development (CSD) | Data Integration & Delivery (DI&D) Cybersecurity Information Protection Enhancement Controls (CIPEC) Enterprise Data Management (EDM) – Strategy & Solutions Consulting Services

Introduction and Background The Internal Revenue Service (IRS), Office of Information Technology (IT) Cybersecurity Information Protection Enhancement Controls (CIPEC) program supports the IRS as directed by the Department of Homeland Security (DHS) to protect the Federal government IT infrastructure within the Cyber Solutions Development (CSD) Branch’s three core missions:

Identity and Access Management (IAM), Security and Operations Management (SOM), and Vulnerability and Threat Management (VTM).

The CIPEC program supports critical cybersecurity requirements and functions across IRS and Treasury domains. The primary objective of this requirement is to support the Agency’s initiative to expand on the current Enterprise Data Management (EDM) Microsoft/Azure implementation of Sensitivity Labels with the development of enterprise-wide IRS Cybersecurity data security management strategy and solutions throughout its complex environment of on premises, hybrid and clouds/cloud app systems that are non-Microsoft/Azure based. Subject Matter Experts (SMEs) are required to support the Agency’s initiative to:

1) Research, establish, and implement enhanced EDM techniques and capabilities, including the establishment of data management frameworks, methods and means by which data and content artifacts pass through and/or are stored within the IRS on premises and cloud environments to apply protection from unauthorized access, both inside and outside the organization; and

2) Achieve the following IT Cybersecurity FY24 CIPEC Expansion Milestones to increase the IRS’s Security Posture in response to recent data breach investigation:

a. Streamline and optimize enterprise-wide encryption methodologies to reduce DLP monitoring visibility gaps.

b. Develop a CIPEC Program EDM Strategic Plan for expanding Microsoft/Azure EDM capabilities into non-Microsoft clouds.

c. Establish a CIPEC front door service for pre/post-acquisition evaluations & requirements for EDM; and

d. Scale UNAX and data exfiltration monitoring & reporting for internal and encrypted traffic.

BACKGROUND

The Office of Management and Budget (OMB) has released several memorandums to address protecting information managed by the Government. OMB’s Memorandum (M) 06-16 speaks directly to the ability to manage sensitive data extracts for legitimate use, and OMB M-07-16 which emphasizes protection and management of sensitive data as a federal requirement. Starting in 2021, several other federal and agency security requirements were released, including:

· Executive Order #14028 Improving the Nation’s Cybersecurity

· NIST SP 800-207 Zero Trust Architecture

· OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

· IRS Zero Trust Strategy (ZTS) Plan

· IRS Internal Revenue Manual (IRM) Policy guidelines for IT Security, Cloud Computing Security (IRM 10.8.24)

· IRM 10.8.1, IT Security Policy and Guidance; and

· IRM 10.8.2, IT Security Roles and Responsibilities.

· IRS Enterprise Cloud Program Organizational Structure, Foundational Workstreams & Portfolio

· IRS Cloud Security Reference Architectures

· Treasury OCIO Organizational Structure, Cloud Products & Services

Significant “mission-enabling” knowledge that contractors supporting the EDM – Strategy & Solutions project must have is a comprehensive understanding of the IRS CIPEC Program’s systems and suites of tools currently managing data protection on premises and in the cloud, including vendors, systems, their components and associated functionality, architecture, infrastructure, workflow, and operational processes.

Given the services provided to the Taxpayers of the United States of America, the volume and sensitivity of Taxpayer and Agency data has grown exponentially, driving the mission-critical need to protect Federal Taxpayer Information (FTI), Personally Identifiable Information (PII), and Sensitive but Unclassified (SBU) Information and guard against the increased occurrence of sensitive data (or privacy) breaches and identity theft.

Despite increased awareness, data privacy legislation, federal guidance, and implementation of Agency-specific policies and security awareness training programs to help guard against the unauthorized disclosure of and access to sensitive Agency data, the inadvertent disclosure of this data continues day to day.

Considering these trends, the IRS Office of Information Technology (IT) recognizes the need for a program to provide information protection capabilities serving a very large-scale computing infrastructure that delivers the capacity, availability, and performance for nearly 90,000 end users to focus on mission accomplishment while accessing more than 500 on premises and cloud-based applications and programs.

To meet these needs, the CIPEC Program is seeking support for the implementation of a comprehensive EDM approach within the IRS-managed hybrid on-prem and cloud environment to:

· Accurately discover, classify, protect, and track sensitive data.

· Maintain the confidentiality of sensitive being stored and used by the IRS.

· Prevent unauthorized disclosure of sensitive being stored and used by the IRS.

The EDM – Strategy & Solutions project will consider how best to identify, protect, and control data within the current hybrid environment, including the following:

· Evaluation of the current and roadmapped EDM business rules and capabilities within the Microsoft M365 GovCloud G5 suite of cloud-based tools for data protection limitations/gaps.

· Research of CIPEC integration capabilities with other non-Microsoft on premises, hybrid, and cloud systems, applications, and capabilities.

· Research and develop of stop gaps and alternative solutions to architect a hybrid EDM approach where necessary to protect data outside of the IRS-managed Microsoft cloud environment.

· Research of alternate solutions and hybrid frameworks for sensitive data protection to scale across multiple common enterprise use cases to meet its specific needs, such as:

· Data classification and tagging capabilities without access controls to share unrestricted sensitive data with other trusted organizations.

· Access controls on sensitive data without data classification and tagging to prevent unauthorized access, copying, or distribution.

· A comprehensive approach to data protection with data classification, tagging, and access controls.

· Support the Commissioner’s priority FY24 Cybersecurity Milestones, including:

· Streamline and optimize enterprise-wide encryption methodologies to reduce DLP monitoring visibility gaps.

· Develop a CIPEC Program EDM Strategic Plan for expanding Microsoft/Azure EDM capabilities into non-Microsoft clouds.

· Establish a CIPEC front door service for pre/post-acquisition evaluations and requirements for EDM.

· Scaled unauthorized access (UNAX) and data exfiltration monitoring and reporting for internal and encrypted traffic.

Scope of Work and Task Descriptions The Contractor shall provide responsible and knowledgeable support, facilitation, coordination, guidance, and oversight in the following areas to architect, implement and maintain EDM for non-IRS-managed Microsoft cloud systems, applications, and capabilities, as needed:

· Program and project management support:

Documentation, reporting, and briefing support, Coordination of project and program activities and governance processes, Supplemental solution planning and integration to address Microsoft product risks, limitations, and gaps, Assistance with responses to scheduled and ad-hoc requests and requirements associated with CIPEC EDM programs, projects, and capabilities.

· Technical architecture, implementation, and operation subject matter expertise support:

Strategic, tactical, and operational plans for all non-IRS-managed Microsoft cloud instances of EDM, Custom and native EDM solution architecture, implementation, and integration support with CIPEC tools and capabilities, EDM security policy development and IRM review, Research and solutioning for alternatives to the EDM – MSFT solution for identified/tracked product risks, limitations, and gaps, Maturation of data classification, data visibility, governance, and data format augmentation/manipulation and usability/traceability, Organizational readiness and change management support, Operational support and maturation beyond the initial functionality,

· Strategy & Solutions for enhancement of Enterprise business process and procedure:

Strategic communication and stakeholder/vendor engagement, Expansion for data discovery, tagging, and permission/authentication remediation.

Research and enhance current business rules to classify and protect confidential and critical information, Research and supplement current CIPEC tool capabilities for increased data protection via auto-response rules for applying increased authentication, encryption, and other forms access controls to sensitive data via data tagging techniques, Development of comprehensive tool agnostic EDM frameworks, governance, and procedures, and EDM business process design and reengineering support.

The goal of the EDM – Strategy and Solutions project is to develop data management techniques for the IRS’s complex, hybrid and multi-cloud environment with data protection policies designed to preserve data integrity at scale, control access to-and the data in all states (DIM, DIU, DAR) across all disparate platforms (on premises, clouds, apps, etc.), create audit trails, data insights, user behavioral analytics, data mapping, and support the development of new data management capabilities.

TASK 1 – Program and Project Management Support

1.1 Orientation/Project Kickoff Briefing

Within two weeks of task order award, the contractor shall conduct an orientation briefing for the Government. The Government does not desire an elaborate orientation briefing, nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held virtually via Microsoft Teams and both parties shall mutually agree upon the date and time.

The completion of this briefing shall result in the following:

· The contractor and Government personnel who will perform work under this task order will be introduced.

· The Government will show the applicable facilities to the contractor if the contractor will be performing work on the Government's site.

· The Government may provide any Government Furnished Property (GFP) to the contractor at this time.

· Any issues concerning the contractor clearances for contractor personnel will be discussed.

· Government will provide instructions for their personnel on how to obtain Government Furnished Equipment (GFE) laptops with Enterprise Remote Access Project (ERAP) access capabilities to allow contractor personnel to work at alternate locations during inclement weather or other authorized periods, if needed.

· The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

· The contractor shall provide the accounting period end dates to be used for the term of this task order.

1.2 Coordination of Project & Program Activities and Governance Processes:

The contractor shall provide support for the planning strategizing for project initiatives and project engagement. The contractor shall provide documentation, reporting, and briefing support as required. The contractor shall coordinate project and program activities and governance processes. The contractor shall coordinate, facilitate, monitor, and support interfaces with other IRS projects, initiatives, and programs to ensure cohesiveness between all IRS security initiatives. The contractor will provide acquisition support for supplemental solution planning and integration to address EDM risks, limitations, and gaps. The contractor will support FISMA, OMB, TIGTA, and GAO requests or requirements. The contractor will coordinate with Cyber and Privacy stakeholders, as needed, to ensure that all required tasks are met.

DESIRED OUTCOMES: The contractor will develop an approach to strategize and track program and project activities to meet federal initiatives and governance requirements.

1.3 Documentation Support:

The contractor shall produce thorough, clear, concise, and usable documentation, reporting, and briefing materials – including but not limited to:

· EDM tool-agnostic Health Assessments

· Strategic, tactical and operations level plans for adopted alternative solution(s)

· Program roadmap

· Security policy development

· IRM reviews and policy enhancement recommendations

· Strategic communications, data classification guides, and training material, as needed

· Framework and governance materials

DESIRED OUTCOMES: The contractor will create and maintain Project Management documentation. The contractor will create, maintain, and update documents as needed to reflect changes throughout the life of the project (including existing IRS documentation). The Contractor will ensure that all stakeholders validate all documentation. The Contractor will ensure that documentation is completed and delivered by the due dates. The Contractor will track and provide status of all documents throughout the life of the project. The contractor will create and present project-related documentation, presentations, and reports. Presentations may target all levels of technical and non-technical IRS staff.

1.4 Reports, Meeting Facilitation and Presentations:

The contractor shall produce standardized, complete, and useful status reports, presentations, reports, meeting-related records, and other documentation, as needed. The contractor shall evaluate project progress and prepare reports. Reports may consist of monthly progress reports and status reports required for Management Review Boards. The contractor shall ensure meeting goals are communicated to attendees through agendas and meeting minutes. The contractor shall create and track action items including status, owners, and due dates. The contractor shall prepare and deliver presentations to various stakeholder groups/executives and provide updates as determined in the work request. The contractor shall maintain group lists (e.g., distribution lists) for the project team and report project information and advice to all levels of leadership, as required.

DESIRED OUTCOMES: The contractor will organize and schedule meetings, update and maintain attendee lists, record, and post meeting notes. The contractor will prepare reports and facilitate project meetings.

1.5 Risk Management:

The contractor will create a risk evaluation summary detailing potential impact and likelihood of occurrence. The contractor will facilitate the enterprise risk assessment methodology to review requirements with the project team to allow the IRS to prioritize work based on risk mitigation, ease of implementation, user impact, etc.

DESIRED OUTCOMES: The contractor will create and maintain an EDM risk evaluation summary and facilitate risk review sessions, when necessary, for the CIPEC program.

1.6 Communications Planning and Support:

The contractor shall establish and abide by regular, organized stakeholder communications about all pertinent CIPEC EDM activities. The contractor shall develop feedback mechanisms to allow the team to measure the users experience with the various technologies and adjustment as necessary. The contractor will be responsible for:

· Developing a key message platform to be used in briefings, presentations, and communications to executives, stakeholders, and end-users.

· Writing EDM educational material, as required (ex. Frequently Asked Questions, Data Classification Guides, ITM articles, Knowledge Articles, etc.).

· Working with other Integrated Project Teams (IPTs) and executive workstreams to provide responses to questions from the end-users.

· Establishing and maintaining a project communications plan.

· Producing dashboards / status reports for executives, governance bodies (e.g., TRB, SecChM, etc.) and other stakeholders.

· Producing written communications (e.g., newsletter articles, emails, briefing presentations) and other stakeholder communications, as needed.

DESIRED OUTCOME: The contractor shall develop, maintain, and execute a Communication Plan. The contractor shall develop and maintain briefing materials.

1.7 Organizational Readiness and Stakeholder Management:

The contractor shall conduct organizational readiness and stakeholder management activities to facilitate deployment and use of capabilities. These activities include but are not limited to:

· Development and maintenance of gap analyses of current state compared with the future state.

· Support for implementation of capability testing to be conducted by the receiving organizations.

· Support of capability training across both receiving organization and implementation teams.

· Collection and execution of capability training requirements.

DESIRED OUTCOMES: The contractor will conduct organizational readiness and stakeholder management activities.

Task 2 – Technical architecture, implementation, and operations subject matter expertise support:

The contractor shall have the technical subject matter expertise required to develop a suitable EDM solution for the IRS within non-Microsoft cloud environments. The contractor shall architect and implement native and alternative solutions complementary to the Microsoft instance of EDM, including the creation and maintenance of strategic, tactical, and operational plans. The contractor shall ensure EDM integration with CIPEC tools and capabilities. The contractor shall support the development of EDM security policies specific to the use of data marking, tagging and tracking products and tools for incorporation into new/updated IRM policies.

2.1 Technical Subject Matter Expertise Support:

In support of this requirement, the Contractor shall possess significant experience with the following core competencies:

· EDM and Data Classification best practices.

· Microsoft Purview and Azure Information Protection solutions.

· M365 Cloud DLP detection rules (policies) configuration and implementation strategies.

· Event analysis/management for DLP and EDM.

· CIPEC SEIM event management and dashboarding.

· CIPEC incident reporting and response workflows.

· Incident response - triage, incident analysis, remediation.

· Data behavior assessment & exfiltration analytics.

· IRS encryption techniques and best practices.

· IRS Zero Trust Architecture and strategy.

· IRS Cybersecurity and Privacy sensitive information policies.

The Contractor shall have at least three years of hands-on experience with the following:

· Knowledge of CIPEC deployments and capabilities at IRS both on premises and in the cloud.

· Knowledge of Federal Zero Trust implementation mandates.

· Deployment of CIPEC DLP tools (Broadcom Symantec & Microsoft Purview).

· IRS institutional knowledge of Change Management.

· Engagement with IRS IT & Business functions/stakeholders.

· Development, deployment, and management of end user training across the IRS.

· Performed business process re-engineering related to CIPEC data flows.

· Planning, creating, and executing communication plans for the expansion of data classification and sensitivity types with new, NARA-compliant and Business Unit-specific Sensitivity Labels and access controls within the suite of Microsoft CIPEC Data Management tools.

Desired Outcomes: Contractors shall demonstrate expert-level knowledge in the defied core technical competencies (above) and provide timely knowledge transfer to designated IRS CIPEC staff members, throughout this engagement.

2.2 Enterprise Business Process Evaluation and Re-Engineering Support:

Contractor shall provide continuous process improvement support by identifying non-Microsoft cloud business processes that need to be re-engineered to support program effectiveness. This includes but is not limited to:

· Review current state business processes.

· Identify necessary improvements to business processes.

· Document updates or draft new business processes for future state use.

· Facilitate use of updated or new processes with CIPEC EDM program, personnel, and other identified stakeholders.

DESIRED OUTCOMES: The contractor will identify, develop, and facilitate use of improved business processes.

2.3 Architecture & Implementation Support

In support of this requirement, the contractor shall:

· Develop a viable strategic and tactical implementation plan to guide the CIPEC Program in efforts to implement EDM across multiple project phases, IPTs, and environments.

· Lead in development and deployment of multiple project efforts.

· Participate and assist in the preparation of the full systems development life cycle (Plan, Design, Development, Testing, Implementation & Disposition).

· Identify and track issues, actions, risks, constraints, mitigation strategies, and governance reporting.

· Provide engineering support for development and implementation.

· Submit and track troubleshooting/enhancement tickets, change requests, and help desk tickets, as needed. Follow up on tickets till closure and timely report delays in any approvals or ticket closures to the PM.

· Provide additional technical policy development and execution, including test plans and schedules.

· Coordinate and engage the appropriate IRS technical and business stakeholders as necessary to implement the EDM solution and functional and technical processes.

· Conduct analysis and research activities in support IRS processes, procedures, and associated workflows.

· Support revision of cyber-security policy published through Interim Guidance and IRMs.

DESIRED OUTCOMES: The contractor shall develop relevant planning documentation for the development, acquisition, configuration, integration testing and implementation in support of all known and new requirement associated with the EDM solution.

2.4 Operations & Maintenance Planning & Support

In support of this requirement, the contractor shall:

· Develop Operations and Maintenance (O&M) processes and procedures.

· Provide OneSDLC assessments for stakeholders, as required.

· Support program governance activities, as required.

· Plan, test, and fine tune EDM policies, ensuring as-intended integration with current CIPEC functionality.

· Support of FISMA Annual Security Compliance Assessments (ASCA), as necessary.

· Support other project documentation, including the develop of technical and non-technical documentation (e.g., communication plans, instructions, guidelines, procedures, computer operators’ handbooks, test plans, etc.).

· Conduct system upgrade and testing in DEV, TEST and PROD environments, as applicable.

· Assist in data gathering and metrics reporting.

· Execute and refine processes and workflows.

· Provide EDM end user training, as needed.

· Provide transition-put support to an incoming vendor, as directed by the federal PM, with appropriate O&M documentation to ensure continuity of services upon transition off of the program.

Desired Outcome: The contractor shall support the timely delivery and review of O&M processes and procedures for EDM with designated IRS CIPEC staff. The contractor shall support the operations and maintenance of the EDM solution(s). The contractor shall provide transition-out support, as required.

Task 3 Supplemental Solution support to address Data Protection Gaps Although EDM - MSFT contracted SMEs will focus their core efforts on ensuring that core MSFT Functionality (e.g., Sensitivity Labeling) is effectively instantiated and functional within the IRS cloud environment, their work may result in the emergence of additional functional requirements, which may result in the need to acquire additional data protection solutions or the acquisition of supplemental components or features of solutions already implemented at the IRS. Should these circumstances arise, the following tasks may be supported:

· Support supplemental requirements elicitation/documentation, change and risk management and implementation/integration to enhance the established IRS data flows.

· Provide technical consultation(s) with IRS organizational entities which are responsible for architecting, implementing, and maintaining all components of the emerging IRS systems.

· Support supplemental logical and physical design, configuration, and integration of emergent requirements with established IRS infrastructure and solutions.

· Support supplemental solution selection and acquisition to extend existing capabilities inherent with the emerging IRS environment and/or to add new capabilities, in line with emerging capabilities.

· Support testing and production readiness assessment of all EDM solutions and development of reusable integration processes and procedures.

· Interface with CIPEC technical teams to coordinate integrated application testing to ensure viability of all defined/configured EDM solutions.

Additional enhanced EDM capabilities may include, but are not limited to:

· Providing data quality metrics and tools to track data integrity and audit trails.

· Creating Data Flow Diagrams and models to identify vulnerable access points.

· Recommending security controls to ensure sensitive data is adequately protected across disparate technologies.

· Supporting “Smart Data Labeling” techniques to classify and tag data to filter access at scale and track movement of sensitive data across the enterprise.

· Developing EDM business rules, policies, and procedures

· Defining business unit-specific requirements to establish granular access controls, filters (masked, unmasked), and expected tool response actions (e.g., authenticate permissions, monitor, quarantine, encrypt, label, tag, etc.).

· Defining Enterprise and Business Unit data use cases to establish a baseline of expected/approved user behavior around sensitive data, including:

· Define Enterprise Architecture elements (ex. SRNVU nomenclature mapping for identifying sources/raw, normalization, virtualization, utilization)

· Model the structures, connections, exchanges, and transformations.

· Develop data flow diagrams and create data modeling.

· Report gaps and discoveries

· Gathering and using baseline data user behavior analytics (UBA) and data flow paths to defend against insider threat and data sharing risks (ex. unauthorized/unintended access, misuse/browsing, malware, encryption key misuse, rogue replication, physical loss of control, device theft, encryption key availability)

· Using current and/or update existing data flows to:

· Define complexities and granularity of user communities and related access levels, and

· Implement a data management strategy and framework that supports IRS Cybersecurity objectives and enables IT to control data flows and audit policy violations.

Desired Outcomes: Contractors shall support required integration and production readiness testing of capabilities and/or solutions which may be required to address functional gaps associated with the current architecture/infrastructure of the IRS CIPEC solutions and EDM capabilities within the IRS environment.

Task 4 IT Cybersecurity FY24 CIPEC Expansion Milestones In support of this requirement, the contractor shall provide technical support for the Commissioner’s priority FY24 Cybersecurity Milestones, including:

· Streamline and optimize enterprise-wide encryption methodologies to reduce DLP monitoring visibility gaps.

· Develop CIPEC Program EDM Strategic Plan for expanding Microsoft/Azure EDM capabilities into non-Microsoft clouds.

· Establish a CIPEC front door service for pre/post-acquisition evaluations and requirements for EDM.

· Scale unauthorized access (UNAX) and data exfiltration monitoring and reporting for internal and encrypted traffic.

Desired Outcomes: To provide SME surge support for completing the Commissioner’s priority FY24 Cybersecurity Milestones.

Task 5 Transition-out (Optional) The transition of contracted activities and services from the incumbent to the incoming Contractor as described in the Government-approved transition-out plan, shall begin 90 days prior to the end of the task order, in accordance with standard workdays.

The Incumbent shall develop, document, and provide a transition-out plan no later than 60 calendar days prior to the beginning of the transition-out period or earlier if directed by the COR. The plan shall identity transition activities, schedules, and milestones for the turnover of work (e.g., operations, maintenance, engineering, training, asset management, and logistics functions) and identify how it shall coordinate with the incoming Contractor’s personnel to transfer knowledge.

Desired Outcomes: To provide transition-out services for the accomplishment of a seamless transition from the Incumbent to the incoming Contractor.

Performance Measurements and Acceptance Standards The Contractor’s performance will be monitored by activities/items such as, but not limited to, conducting status meetings which will require reports showing individual accomplishments for the period; and requiring supporting documentation with monthly invoices.

For all deliverables meeting the AQLs stated below, “Positive” customer feedback will be reported to the Contractor by summarizing the past year’s surveillance activities under the Contractor Performance Assessment Reporting System (CPARS). For deliverables which do not meet the AQL’s stated below, “Negative” customer feedback will be reported to the Contractor by summarizing the past year’s surveillance activities under CPARS.

Required Services (Tasks) Performance Standards

Levels

Submit additional personnel within 30 days of need.

Quality Control Plan (QCP) The contractor shall develop a Quality Control Plan (QCP) for measuring and attaining quality of performance under this delivery order within the first 90 days of contract award. The contractor’s QCP shall explain the way they shall ensure all task order requirements are being accomplished. A sustaining focus throughout the QCP shall be the attainment of continuous quality improvement. The contractor shall submit any changes in the plan to the CO and the COR at least five business days prior to implementation. These measures will be monitored and reported as part of the monthly In-Progress Review or as part of other scheduled reviews with the Contractor and PM.

Key Personnel The contractor will provide the following key resources:

· IT Project Manager – SME

· Data Security Specialist – SME

· Cloud Security – SME

The offeror will identify (in their proposal based on information provided in the table below), certain positions or roles and associated labor categories considered to be Key Positions. The Contractor will submit the name and resume of the Contractor employee proposed in each Key Position.

Substitution of Key Personnel The personnel specified as key personnel are considered essential to the work performed under the task order. The Offeror shall not substitute key personnel without written permission of the Contracting Officer (CO). Before substituting or replacing the specified individuals, the Offeror shall notify the CO no less than 30 calendar days in advance and shall submit justification (including the names and resumes of the proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. The proposed substitutions shall possess qualifications equal or superior to those of the key person(s) being replaced. The Offeror shall make no diversions or substitutions without the written consent of the CO. If a change in key personnel is caused by an individual’s sudden illness, death, or termination of employment, the Offeror shall promptly notify the CO and provide the information required by the key personnel clause.

Performance Required Beyond Standard Workday Performance may be required beyond the standard workday. The standard workday is defined as any eight hours of productive labor during the core business hours of 8:00 A.M. through 6:00 P.M., Monday through Friday. When performance outside of the standard workday become necessary, the COR or PM will notify the contractor in writing.

Place of Performance Services shall be primarily performed within the U.S. borders remotely with authorized access to the IRS network and associated application systems via the IRS’s AnyConnect application installed on all IRS-issued laptops to facilitate wireless access through the VPN to the IRS Network. Telework is authorized for all contractor staff supporting the EDM project and has been approved by both the Program & Contract Manager.

Period of Performance The period of performance for this requirement is 12 months from date of award as follows:

Travel Requirements No travel is authorized, and local travel will NOT be reimbursed.

Contract Type A FFP award will be required, with one Base Year and two Option Years.

Deliverables and Project Schedule The contractor shall deliver all products concurrently to the IRS PM and the COR. The PM will notify the contractor whether the formal deliverable has been accepted or provide written comments within ten (10) government workdays of receipt. Contractor shall then resubmit the final deliverable within ten (10) government workdays to the IRS PM and the COR, if necessary. All documents will be provided in electronic format.

Thereafter, on the fifth business day of every month.

Within five business days of COR/PM request (up to two additional annual ad hoc reports)

Within five business days of COR/PM request (up to two additional annual ad hoc reports)

Security Requirements All Contractor employees, providing support under this task order, shall complete Unauthorized Access (UNAX) and IT Security Training annually. In addition, each individual Contractor employee shall sign a non-disclosure form. The Contractor shall conduct Disclosure Awareness training prior to giving his officers and employees access to the SBU data and annually thereafter if the contract is renewed or extended. Each participant must sign and data the training roster.

The Contractor is to provide written certification to the COR that this training was held.

Due to the requirement for continuous availability of the system, Contractor resources assigned to the Task order shall have approved Moderate Background Investigations (MBIs).

Under FISMA, government employees and Contractors are subject to Federal information security laws, regulations and policies, including annual security awareness training. This training requirement is satisfied by the IRS mandatory Information Protection briefing, which covers computer security, disclosure, privacy, and UNAX.

The Contractor Officer will ensure contractor personnel are in compliance with IRS HSPD-12 PIV Procedures Manual. This manual will be provided to the awardee.

The Contractor shall comply with the following:

· New system installations/system upgrades shall be compliant with IRS requirements, including but not limited to FedRAMP, NIST, OMB and IRM policies.

· All services provided by the Contractor shall meet and/or exceed NIST, OMB and IRS standards.

Performance At Government Sites If any of this effort is performed at specified government facilities, the contractor will abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at these facilities.

Identification / Badges The applicable contractor employees will not begin working under this PWS until all security forms have been properly completed and submitted. All contractor employees will be required to wear identification badges when working in government facilities.

Personnel Removal and Replacement The applicable contractor employees are subject to investigation by the government. Applicable contractor employees who undergo contractor clearances that reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay federal income tax. The government reserves the right to determine if a contractor employee assigned to a task will continue with the task. The contractor will agree to remove the person assigned within one day of official notification by the government and provide a replacement within five days. New hires or substitutions of personnel are subject to the contractor clearance requirement.

Government Furnished Equipment, Information and Services

1. IRS will provide all software and hardware needed.

2. IRS will provide existing technical artifacts from prior efforts which can help reduce or avoid rework.

3. IRS will provide Security Policies, Policy Checkers, guidelines and applicable mandates with awarded vendor.

At the end of this task order, disposition of GFI shall be in accordance with FAR 52.245.5.

Background Investigations All Offeror employees are required to undergo a background investigation. Employees are subject to background investigations based on the level of access required. A Moderate Risk Minimum Background Investigation (MBI) is required for all employees (federal and Offeror). A Special Appointment Check (SAC) is required for all Offerors’ who will be on-site for 60 days or less and will require access to live or non-live data and/or non-sensitive program management resources.

SF 85P Questionnaire for National Security Positions All Offeror employees will be required to complete the SF 85P Questionnaire for National Security Positions form, approve a credit check and have fingerprints taken as part of the background investigation package.

Quality Assurance Surveillance Plan (QASP) Section 508 Requirements IR1052.239-9000 Section 508 Information, Documentation and Support (DEC 2019) In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the performance work statement. The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services _X__ 601 General _X__ 601.1 _X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4 _X__ 603 Support Services _X__ 603.1 _X__ 603.2 _X__ 603.3 (End of clause)

IR1052.239-9001 Section 508 Conformance (NOV 2020) Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachment entitled, “Section C.16. Voluntary Product Accessibility Template (VPAT) – Broadcom - SYMC DLP v16.0“.

The following technical standards have been determined to be applicable to this contract:

_X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10 The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9 (End of clause)

IR1052.239.9002 Section 508 Services (DEC 2019) All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR, Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10 The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9 (End of clause)