I_05 Sources Sought Notice 50000221599.docx

This is a Sources Sought Notice (SSN) for market research purposes only. This SSN is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This SSN does not commit the IRS to contract for any supply or service. Further, the agency is not at this time seeking proposals and will not accept unsolicited proposals. This SSN is being published to identify potential sources capable of providing support for the Agency’s initiative to expand on the current Enterprise Data Management (EDM) Microsoft/Azure implementation of sensitivity labels by developing an enterprise-wide IRS Cybersecurity data security management strategy and corresponding solutions throughout the complex IRS environment of on premises, hybrid and clouds/cloud app systems that are non-Microsoft/Azure based.

Responders are advised that the agency will not pay for any information or administrative costs incurred in response to this SSN; all costs associated with responding to this SSN will be solely at the interested party’s expense. Not responding to this SSN does not preclude participation in any future RFP, if any is issued. It is the responsibility of the potential offerors to monitor the agency sources for additional information.

Background

The Internal Revenue Service (IRS), Office of Information Technology (IT) Cybersecurity Information Protection Enhancement Controls (CIPEC) program supports critical cybersecurity requirements and functions across IRS and Treasury domains. Despite increased awareness, data privacy legislation, federal guidance, and implementation of Agency-specific policies and security awareness training programs to help guard against the unauthorized disclosure of and access to sensitive Agency data, the inadvertent disclosure of this data continues day to day. To meet these needs, the CIPEC Program is seeking support for the implementation of a comprehensive Data Inventory and Tagging (DIT) approach within the IRS-managed hybrid on-premises and multi-cloud environment to:

· Accurately discover, classify, protect, and track sensitive data.

· Maintain the confidentiality of sensitive being stored and used by the IRS.

· Prevent unauthorized disclosure of sensitive being stored and used by the IRS.

Objective

No decision has yet been finalized regarding the small business strategy for this acquisition. The purpose of this SSN is to identify interested vendors with capabilities to meet all the Government requirements at a fair market price. The agency anticipates awarding one Contract/Task Order to obtain contractor support services.

This effort supports the Cybersecurity Information Protection Enhancement Controls (CIPEC) program’s mission to enhance and standardize data protection controls across the enterprise, safeguarding sensitive taxpayer data, and ensuring the integrity and security of the IRS systems.

The primary objective of this requirement is to support the Agency’s initiative to expand on the current Enterprise Data Management (EDM) Microsoft/Azure implementation of sensitivity labels by developing an enterprise-wide IRS Cybersecurity data security management strategy and corresponding solutions throughout the complex IRS environment of on premises, hybrid and clouds/cloud app systems that are non-Microsoft/Azure based.

The agency anticipates that it will issue an RFP in the second Quarter of FY26. Vendors’ SSN responses shall be sent to Contracting Officer, Michelle McGibbon, at michelle.m.mcgibbon@irs.gov, Supervisory Contracting Officer, Jillian Staskin, at jillian.n.staskin@irs.gov , and Contracting Specialist, Dylan Feezell, at dylan.w.feezell@irs.gov , on or before 24 November 2025, 12PM EST. The agency is not seeking marketing information and will not review it. Please ensure that all correspondence includes all 3 contracting personnel on the emails.

Submission Instructions

The North American Industry Classification Systems (NAICS) Code proposed for the requirement is 541512 with a size standard of $34M.

The Government requests that all interested parties submit the information outlined below.

1. Contractor Name

2. Address

3. Point of Contact (POC)

4. POC phone number and e-mail address

5. System for Award Management (SAM) Unique Entity Identifier (UEI)

6. Brief description of the company's business size (i.e., annual gross revenue for the prior three (3) years) to include all Small Business information and any Government Wide Vehicles of which the Contractor is an awardee.

7. Anticipated teaming or subcontracting arrangements (delineate between work accomplished by prime and work accomplished by teaming partners)

8. Provide a statement addressing Section 9.2 Contractor Eligibility, that the Contractor is certified CMMI Level 3 for services and ISO/IEC 2700/2000/9001.

9. No more than three (3) corporate experiences in similar size, scope and complexity to the enclosed PWS scope shall be submitted. The corporate experience shall demonstrate the company’s experience in completing the information as stated in all list Tasks of the draft PWS included in this announcement. Contractors shall include the contract number, funded dollar value(s), period of performance, and a relevant scope summary.

10. Page limit and formatting requirements: The company's standard format is acceptable; however, the limit for all responses shall be five (5), 11 font size, 8 ½ x 11-inch pages.

It is requested that all responses submitted are clear, concise, and provide accurate detail to provide that the Contractor is both capable and interested in performing the tasks as stated in the draft PWS.

If you have any questions, please contact the Contracting Officers listed above.

image1.png