I_1_b PGLD TTX PWS.pdf

Part I - PWS

Performance Work Statement (PWS)

Privacy, Governmental Liaison and Disclosure (PGLD) Tabletop Exercise (TTX)

I. BACKGROUND

As required annually by OMB Memo 17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), IRS seeks an independent assessment of its Incident/Breach Response Playbook by conducting a tabletop exercise. This assessment is reported in the IRS Annual FISMA report, which is required by law. The OMB memo requires a third-party audit/assessment/report. Different scenarios will be developed annually to test IRS data breach policies and procedures.

II. SCOPE

IRS, Privacy, Governmental Liaison and Disclosure (PGLD) Office seeks contractor support to perform an independent assessment of its Incident/Breach Response Playbook by conducting a tabletop exercise.

III. TASK DESCRIPTION

Annually, during the period of June 1 through August 30 (3-months), the contractor will:

A. Develop, in concert with the Incident Management/Cybersecurity team, a data breach scenario.

• The contractor shall, develop drill material, based on the agreed upon scenario. Tabletop design will focus on specific plan elements.

• The objectives and key issues shall drill down on specific items identified during the historical IRS breach/incident/event reactions and potential areas needing attention in the Playbook, other guidance, or absence of guidance.

• Facilitation will include managing the exercise process, challenging drill participants to engage and providing key insights based on the contractor’s experience within this space.

• Conduct a rehearsal/briefing with IRS leadership.

o Prior to the event, the contractor shall:

Conduct a rehearsal/briefing with IRS leadership to ensure the design and mechanics are sufficient to accomplish the objectives and outputs of the event.

Provide draft exercise materials to include both a facilitator guide and game deck.

• Facilitate 7-hour, hybrid in-person/virtual tabletop exercise session, including a 1-hour break, with key IRS executives and other key participants.

• The contractor shall execute the exercise with the necessary staff to provide the structure, knowledge and facilitation support that will allow SME participants to achieve the desired objectives.

B. Provide an Executive Summary and a Project Completion Report

• Provide an Executive Summary and a Project Completion report with drill feedback along with suggested guidance/process changes extracted from their observation of the session.

• Executive Summary o Within 5 business days of the exercise, the contractor will conduct preliminary analysis of insights and findings summarized in an Executive Summary to provide senior leadership a high-level depiction of the key takeaways gleaned from the event.

• Completion Report o Within 15 business days of the exercise, a formal project completion report will be provided; this will be comprehensive to include anything significant identified during the Exercise, recommendations to improve the IRS data breach response process and playbook, and suggestions for subsequent drills.

C. Monthly Status Report

• Report to include deliverables with status, risks, and accomplishments.

IV. PERIOD OF PERFORMANCE

A. The period of performance shall be for one (1) base year of 12 months and four (4) 12-month option years.

CLIN 001 Base Year June 1, 2024 – May 31, 2025 CLIN 1001 Option Year 1 June 1, 2025 –May 31, 2026 CLIN 2001 Option Year 2 June 1, 2026 – May 31, 2027 CLIN 3001 Option Year 3 June 1, 2027 – May 31, 2028 CLIN 4001 Option Year 4 June 1, 2028 – May 31, 2029

V. PLACE OF PERFORMANCE

The majority of work shall be performed at the contractor’s place of business with occasional meetings and the tabletop exercise occurring at the IRS, 1111 Constitution Ave, Washington, D.C.

20024, with contingencies for conducting all meetings virtually dependent upon travel restrictions.

VI. DELIVERABLES

Deliverable Est. Due Date PGLD TTX Scenario Development in concert with IRS Incident Management/Cybersecurity team

10 business days after contract award

PGLD TTX Master Scenario Events List Meeting 15 business days after contract award

PGLD TTX Save the Date Communication (language only) 15 business days after

VII. ACCEPTANCE CRITERIA FOR DELIVERABLES

Privacy Policy and Compliance shall have the right to reject or require corrections to a deliverable that does not address the requirements set forth in the description of the deliverables. The Government will perform an initial review of deliverables, and if problems are encountered during the review, the contractor must correct them. If necessary, a meeting may be convened to resolve any differences. The contractor shall make all required changes to achieve an acceptable deliverable. The Government will perform its review within approximately 7 calendar days from receipt of the deliverable or as otherwise specified in each task order.

Deliverable Est. Due Date contract award

PGLD TTX Monthly Status Report to include deliverables with status, risks, and accomplishments

Within 5 business days after the end of the reporting month

PGLD TTX Draft Exercise Materials to include both a facilitator guide and game deck. The facilitator guide will include detailed guidelines for conducting the tabletop and provides a precise time schedule for each inject and the full exercise, as well as the detailed purpose of each inject. The game deck will include the purpose, objectives, tasks, roles, the breach scenario and multiple injects that will drill down on specific items identified as potential areas needing attention in the Playbook, other guidance, or absence of guidance.

30 business days after contract award

PGLD TTX Invite to TTX Participants (language only) 30 business days after contract award

PGLD TTX Final Exercise Materials which will finalize all the materials described in the draft (see above).

35 business days after contract award

PGLD TTX Rehearsal with the core PGLD/Cybersecurity participants to walk through the drill materials and ensure the injects are properly sequenced and time frames for each inject are of appropriate length.

40 business days after contract award

PGLD TTX Exercise Conduct a 7-hour tabletop exercise, including a one-hour break, with key IRS executives and stakeholders

40 business days after contract award

PGLD TTX Executive Summary which highlights initial findings and insights identified during the exercise.

Within 5 business days after the exercise

PGLD TTX Final Project Completion Report with drill feedback along with suggested guidance/process changes extracted from their observation of the session. It should also include an overview of participant feedback.

Within 15 business days of the exercise

Late submissions- The Contractor shall notify the CO, PM, and COR as soon as it becomes apparent to the Contractor that a scheduled deliverable will be late. The Contractor shall include in the notification the rationale for the late delivery, the expected date for the delivery and the project impact of the late delivery. The PM will review and approve the new schedule. The Government will reflect any change(s) to task order terms and conditions via modification executed by the CO.

VIII. SOURCES OF DATA AND ENVIRONMENT

National Institute of Standards and Technology (NIST) Special Publication 800-53 revision 5, Security and Privacy Controls for Information Systems and Organizations, Privacy Act of 1974, the requirements of OMB Memo 17-12, and the Federal Information Security Modernization Act (FISMA) of 2014 annual requirements.

Privacy Policy and Compliance (PPC) will provide the necessary the IRS Breach Response Playbook and any other documentation needed for this task.

IX. INVOICING

Invoices must be submitted via the Invoice Processing Platform at www.ipp.gov, and they may be submitted monthly based on of FPP contract award amount.

X. SECURITY REQUIREMENTS

Contractor staff will be provided with escorted access in IRS facilities while performing work tasks at IRS buildings.

Contractor staff will not require IRS systems access.

XI. Resumes

Resumes of key personnel that will be assigned to this contract are required to be sent in the vendor’s proposal. Vendors need to highlight resumes that will be beneficial to the scope of this task order/contract to highlight experience and technical approach of evaluation factors.

XII. Key Personnel

For the requirement are identified as followed:

Program Manager: The Program Manager shall have a minimum of a bachelor’s degree in business management or other related business field; and a minimum of 7 years of experience with work similar to what is outlined in the PWS, including experience and knowledge of FISMA requirements, IRC 6103, OMB Memo M-17-12, and IRS organizational structure and operations.

Program/project manager experience with tabletop exercises in the federal government and Agile management certification is preferred (e.g., Certified ScrumMaster, Agile Facilitator, Agile Coach).

http://www.ipp.gov/

Facilitator: The Facilitator shall have a minimum of 10 years’ experience working as a facilitator with executive level personnel within an organization with preferred knowledge of FISMA, IRC 6103, OMB Memo M-17-12, and IRS organizational structure/operations.

XIII. Section 508 Compliance

IR1052.239-9000 Section 508 Information, Documentation and Support (DEC 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work, performance work statement or statement of objectives (select one). The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services

_X__ 601 General _X__ 601.1

_X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4

_X__ 603 Support Services _X__ 603.1 _X__ 603.2 _X__ 603.3

(End of clause)

IR1052.239.9002 Section 508 Services (JUN 2022)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology(ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at FAR 39.204 Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

___ Chapter 4: Hardware ___ 401 General

___ 401.1 ___ 402 Closed Functionality

___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5 ___ 403 Biometrics

___ 403.1 ___ 404 Preservation of Information Provided for Accessibility

___ 404.1 ___ 405 Privacy https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ https://www.section508.gov/buy/inventory-your-ict/ https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ https://acquisition.gov/far/part-39#far_subpart_39_2

___ 405.1 ___ 406 Standard Connections

___ 406.1 ___ 407 Operable Parts

___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8 ___ 408 Display Screens

___ 408.1 ___ 408.2 ___ 408.3 ___ 409 Status Indictors

___ 409.1 ___ 410 Color Coding

___ 410.1 ___ 411 Audible Signals

___ 411.1 ___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 ___ 413 Closed Caption Processing Technologies

___ 413.1 ___ 414 Audio Description Processing Technologies

___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions

___ 415.1 _X__ Chapter 5: Software

_X__ 501 General _X__ 501.1

_X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G)

_X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4

_X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards _X__ 701 General

_X__ 701.1 _X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria

_X__ 301 General _X__ 301.1

_X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7

_X__ 302.8 _X__ 302.9

(End of clause)

IR1052.239-9003 Section 508 Accessibility of Information and Communication Technology (100% Compliance) (DEC 2019)

Each information and communication technology (ICT) product or service furnished under this contract shall comply with the Information and Communication Technology Accessibility Standards (36 CFR, Appendix C to Part 1194). If the Contracting Officer determines any furnished products or services are not in compliance with the contract, the Contracting Officer will apply the remedies described under FAR 52.246-2, Inspection of Supplies – Fixed Price or FAR 52.246-4, Inspection of Services – Fixed Price.

The following technical standards and provisions have been determined to be applicable to this contract:

___ Chapter 4: Hardware

___ 401 General ___ 401.1

___ 402 Closed Functionality ___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5

___ 403 Biometrics ___ 403.1

___ 404 Preservation of Information Provided for Accessibility ___ 404.1

___ 405 Privacy ___ 405.1

___ 406 Standard Connections ___ 406.1

___ 407 Operable Parts ___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8

___ 408 Display Screens ___ 408.1 ___ 408.2 ___ 408.3

___ 409 Status Indictors https://www.access-board.gov/ict/

___ 409.1 ___ 410 Color Coding

___ 410.1 ___ 411 Audible Signals

___ 411.1 ___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 ___ 413 Closed Caption Processing Technologies

___ 413.1 ___ 414 Audio Description Processing Technologies

___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions

___ 415.1 _X__ Chapter 5: Software

_X__ 501 General _X__ 501.1

_X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G)

_X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4

_X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards _X__ 701 General

_X__ 701.1 _X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria

_X__ 301 General _X__ 301.1

_X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7

_X__ 302.8 _X__ 302.9

(End of clause)