I_1b_PWS for RFI posting.docx

DRAFT PWS ONLY

Performance Work Statement (PWS) Data Inventory and Tagging (DIT)

1. Background Given the services provided to the Taxpayers of the United States of America, the volume and sensitivity of Taxpayer and Agency data has grown exponentially, driving the mission-critical need to protect Federal Taxpayer Information (FTI), Personally Identifiable Information (PII), and Sensitive but Unclassified (SBU) Information and guard against the increased occurrence of sensitive data (or privacy) breaches and identity theft.

The Office of Management and Budget (OMB) has released several memorandums to address protecting information managed by the Government. OMB’s Memorandum (M) 06-16 speaks directly to the ability to manage sensitive data extracts for legitimate use, and OMB M-07-16 which emphasizes protection and management of sensitive data as a federal requirement. Starting in 2021, several other federal and agency security requirements were released, including:

· Executive Order #14028 Improving the Nation’s Cybersecurity

· NIST SP 800-207 Zero Trust Architecture

· OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

· IRS Zero Trust Strategy (ZTS) Plan

· IRS Internal Revenue Manual (IRM) Policy guidelines for IT Security, Cloud Computing Security (IRM 10.8.24)

· IRM 10.8.1, IT Security Policy and Guidance

· IRM 10.8.2, IT Security Roles and Responsibilities

· IRS Enterprise Cloud Program Organizational Structure, Foundational Workstreams & Portfolio

· IRS Cloud Security Reference Architectures

· Treasury OCIO Organizational Structure, Cloud Products & Services

2. Objective This effort supports the Cybersecurity Information Protection Enhancement Controls (CIPEC) program’s mission to enhance and standardize data protection controls across the enterprise, safeguarding sensitive taxpayer data, and ensuring the integrity and security of the IRS systems.

The primary objective of this requirement is to support the Agency’s initiative to expand on the current Enterprise Data Management (EDM) Microsoft/Azure implementation of sensitivity labels by developing an enterprise-wide IRS Cybersecurity data security management strategy and corresponding solutions throughout the complex IRS environment of on premises, hybrid and clouds/cloud app systems that are non-Microsoft/Azure based.

2.1 Purpose

The purpose of this task order is to establish and sustain enterprise-level data protection capabilities that allow IRS Cybersecurity to:

· Catalog and tag all sensitive data (PII, FTI, CUI, and SBU) across IRS systems.

· Strengthen the confidentiality, integrity, and availability of taxpayer information.

· Integrate automated classification and protection controls into the broader CIPEC DLP and Zero Trust frameworks.

· Meet compliance obligations under Executive Order 14028, OMB M-22-09, and NIST SP 800-207.

· Provide standardized dashboards, analytics, and reports that improve data governance, audit readiness, and situational awareness.

2.2 Agency Mission

The DIT project advances the IRS Cybersecurity strategic objectives to:

· Safeguard taxpayer data against unauthorized access or exfiltration.

· Implement Zero Trust data controls to modernize enterprise security.

· Promote continuous monitoring and data-centric risk management across all IRS systems.

· Ensure alignment with Treasury’s broader cybersecurity modernization and Zero Trust transformation initiatives.

As an element of the Treasury Department’s ongoing efforts to improvement its Cybersecurity program, the Office of the Chief Information Officer (CIO) provided additional controls, in its memorandum “TCIO-M-09-04”, related to the management of Treasury’s Cybersecurity environment. These new controls focus particularly on the storage of data on removable media and the unauthorized transmission of information outside the Department.

3. Scope of Work The Contractor shall provide responsible and knowledgeable support, facilitation, coordination, and guidance in the following areas to architect, implement and maintain DIT for non-IRS-managed Microsoft cloud systems, applications, and capabilities:

· Program and project management support to develop data management techniques for the IRS complex, hybrid, multi-cloud environment with data protection policies designed to:

· Preserve data confidentiality, security, and protection at scale;

· Control access to data in all states (DIM, DIU, DAR) across disparate platforms (on premises, clouds, apps, etc.);

· Create audit trails, security analytics, data insights, dashboards, and reports; and

· Support the development of new data management capabilities, including data mapping, cataloging, classification, monitoring, and protection.

· Align DIT capabilities with IRS Zero Trust / Data Pillar principles, ensuring solutions contribute to the agency's broader Zero Trust maturity goals.

· Technical architecture, implementation, and operations support to:

· Expand data discovery, cataloging, tagging, authentication, access control, and digital rights management capabilities, including solutions for AWS, GCP, Oracle Cloud, and other non-Microsoft ecosystems;

· Develop comprehensive, tool agnostic DIT frameworks, governance, and related policy-driven procedures;

· Design processes for identifying, protecting, and controlling data within the current hybrid multi-cloud environment, including leveraging current and planned DIT business rules; and

· Configure capabilities within alternate solutions and hybrid frameworks for sensitive data protection, including data classification and protection methods that extend beyond MPIP to integrate with legacy and emerging systems effectively.

· Strategy and solutions support for enhancing enterprise business processes and procedures:

· Research and enhance current business rules to classify and protect confidential and critical information;

· Evaluate and supplement current CIPEC tool capabilities for increased data protection through rule-based automated application of increased authentication, encryption, and other forms of access controls to sensitive data via data tagging techniques; and

· Perform DIT business process design and reengineering to scale across multiple common enterprise use cases to address specific limitations and gaps within the Microsoft M365 G5 suite of cloud-based tools.

To support the DIT project needs, while maintaining a cost-effective price structure, the PWS will include Firm Fixed Price (FFP) tasks.

Table below project the number of resources needed to support the contract under Firm Fixed Price.

Table 1- Estimated Resources under FFP Base Period CLIN 001

The contractor may distribute the estimated hours among different Labor Categories as business requirements dictate, provided the total estimated cost for the engagement, including costs for any executed change request, are not exceeded.

3.1 Current Information Technology (IT)/Network Environment

The IRS currently performs a complex mission to serve its broad taxpayer constituency and to fulfill its mandate to protect taxpayer Personally Identifiable Information (PII), Federal Tax Information (FTI), and Controlled Unclassified Information (CUI). Correspondingly, the agency has made significant investments in enterprise information protection in recent years, working steadily to evolve its cybersecurity capabilities to keep pace with the information technology advancements supporting its mission, while simultaneously addressing the ongoing threat landscape confronting all federal agencies.

· Current Environment The IRS maintains a large-scale enterprise computing infrastructure that delivers the capacity, availability, and performance sufficient to enable its nearly 90,000 end users to focus on performing the mission through more than 500 applications and programs. This enterprise infrastructure consists of a complex hybrid cloud architecture, encompassing products and services from major vendors including Microsoft (Azure G3/G5), Amazon Web Services (AWS), Palo Alto (Prisma), Accenture, and many others. The agency’s IT ecosystem comprises a worldwide infrastructure encompassing several Enterprise Computing Centers (Martinsburg, Memphis, and Ogden), and numerous Position of Duty (POD) centers with a footprint in both the USA and other countries.

The federal mandate to adopt a Zero Trust model has been a central component of the IRS approach to enterprise cybersecurity. The IRS has adopted the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model as the preeminent driver of its Zero Trust Strategy. The key components of the five (5) Zero Trust pillars (Identity, Devices, Networks, Applications/Workload, and Data) enable the structure of the IRS Zero Trust architecture to defend against advanced attacks across its complex IT ecosystem and protect sensitive data.

The IRS has made substantial initial progress in key components of the Zero Trust Data Pillar, particularly in the areas of Data Access and Data Availability. Collateral infrastructure for enterprise-wide security data collection and analysis has been broadly implemented, which supports Zero Trust Visibility and Analytics capabilities. These efforts dovetail with progress made in other pillars such as Identity, Network, and Devices to form a solid enterprise information protection foundation.

The existing collection of IRS enterprise information protection initiatives provides a coordinated set of technologies employed to protect IRS enterprise information in all three states of data, namely, Data-in-Motion (DIM), Data-at-Rest (DAR) and Data-in-Use (DIU). These initiatives form a solid foundation of information protection security upon which the desired expanded architecture can be built

The IRS DLP solution was implemented in two separate software releases:

· Release 1.0 focused on implementing the first of three Functional Uses Case components: Data-In-Motion (DIM). The Data-In-Motion (DIM) component, implemented in the IRS Production Operational environment, monitors the presence unencrypted PII or SBU data in outbound email messages and posted to public-facing IRS Web Sites. Using this IRS DLP COTS component, certain instances of unencrypted PII and SBU data is detected, their transmission outside of the IRS Network perimeter is blocked and the responsible IRS employee is notified by an auto-generated email response.

· Release 2.0 focused on implementing the final two of three Functional Uses Case components: Data-At-Rest (DAR) and Data-In-Use (DIU). Data-At-Rest (DAR) component specifically scans fileshares, SAN/NAS storage, SharePoint, Websites, Databases, etc. for files containing sensitive content (such as PII, PCI, HIPAA, etc.) and/or other content/context including age of the file, file types, encrypted files, etc. The deployment scope of the DIU component, via use of endpoint agents locally installed on enterprise workstations (Laptops) and on servers, monitors and responds to the presence of PII & SBU Data (currently configured as DLP policies).

· Target Environment:

To achieve the desired target end-state for Data Inventory and Tagging consistent with the IRS mission and aligned with the goals of Zero Trust Architecture, the scope and integration of information protection measures need to be expanded to build upon existing systems that have been put in place.

As mentioned above, the IRS has made incremental progress toward implementing components of its Zero Trust strategy within the Data Pillar through an array of enterprise data protection initiatives. While each these initiatives has been successful on its own to contribute a piece to the larger puzzle of comprehensive cybersecurity, in many ways they have been limited (by design) to proof-of-concept (POC) and pre-validation efforts prior to expanding to full enterprise scale and scope. A critical next challenge on the IRS Zero Trust roadmap is to extend and expand upon these efforts to achieve comprehensive implementation of the IRS Zero Trust Data Pillar priorities.

The Zero Trust Maturity Model is not static, but rather defines a progressive framework by which federal enterprises like the IRS and Treasury can develop, improve, and enhance their cybersecurity posture over time through successive initiatives that build upon prior capability implementations. This flexible approach allows each agency to establish and follow a cybersecurity roadmap uniquely optimized to its mission and information security concerns.

Maturation in the Data Pillar at the enterprise level strongly depends upon further data protection policy development and implementation. Lessons learned from more isolated policy development and implementation efforts embedded in existing data protection projects will inform and benefit this broader initiative.

4. Tasks Outlined in this PWS is a detailed description of the professional services that the selected Contractor shall provide to the DIT Project, to support the data inventory and tagging services to identify, classify, and protect IRS data across hybrid environments, supporting CIPEC’s Zero Trust and cybersecurity mission.

The following tasks are the high-level summary of the scope of work for this Performance Work Statement:

· Task 01 – Program and Project Management

· Task 02 – Requirements, Architecture and Implementation Support.

· Task 03 - Operations and Maintenance Support

· Task 04 – Strategy and Solutions Support

· Task 05 - CIPEC Program IT Cybersecurity Initiatives

4.1 TASK 1 – PROGRAM AND PROJECT MANAGEMENT

The Contractor shall provide program and project management support under this contract. This includes management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS).

4.1.1 SUBTASK 1 – PROJECT KICK-OFF MEETING

Within fifteen (15) business days weeks after task order award, the Contractor shall conduct an orientation briefing (Project Kick-Off Meeting) with the Government. The intent of the briefing is to initiate the communication process between the Government and Contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held virtually via Microsoft Teams and both parties shall mutually agree upon the date and time. The completion of this briefing shall result in the following:

· The Contractor and Government personnel who will perform work under this task order will be introduced.

· Any issues concerning the Contractor clearances for Contractor personnel will be discussed.

· Government will provide instructions for their personnel on how to obtain Government Furnished Equipment (GFE) laptops with Enterprise Remote Access Project (ERAP) access capabilities to allow Contractor personnel to work at alternate locations during inclement weather or other authorized periods, if needed.

· The Contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

· The Contractor shall provide the accounting period end dates to be used for the term of this task order.

Deliverables: Project Kick-Off Meeting Presentation and Project Kick-Off Meeting Minutes Report

4.1.2 SUBTASK 2 – MONTHLY STATUS REPORT (MSR)

The Contractor shall develop and provide a Monthly Status Report (MSR). The MSR shall include discussion of current funding, expected projections, task shortfalls, project performance, project schedule for the previous month/term (including scheduled, completed and outstanding tasks), and any other issues/concerns relating to completing tasks under this PWS.

Deliverable: Monthly Status Report

4.1.3 SUBTASK 3 – PROJECT MANAGEMENT PLAN (PMP)

The Contractor shall document all support requirements in a PMP and shall provide it to the Government. The PMP shall:

· Describe the proposed management approach.

· Include milestones, tasks, and subtasks required in this PWS.

· Provide for an overall Work Breakdown Structure (WBS).

· Describe in detail the contractor’s approach to risk management under this contract.

· Describe in detail the contractor’s approach to communications, including processes, procedures, format, and other rules of engagement between the contractor and the Government.

The PMP is an evolutionary document that shall be updated annually at a minimum and periodically as project changes occur. The contractor shall work from the latest Government-approved version of the PMP.

Deliverable: Project Management Plan (Section 4.6, Deliverable 1.4).

4.1.4 SUBTASK 4 – QUALITY MANAGEMENT PLAN (QCP)

Contractor shall develop a Quality Control Plan (QCP) for measuring and attaining quality of performance under this delivery order within the first 90 days of contract award. The Contractor’s QCP shall explain the way they shall ensure all task order requirements are being accomplished. Sustaining focus throughout the QCP shall be the attainment of continuous quality improvement. The Contractor shall submit any changes in the plan to the CO and the COR at least five business days prior to implementation. These measures will be monitored and reported as part of the monthly In-Progress Review or as part of other scheduled reviews with the Contractor and PM.

Deliverable: Quality Control Plan

4.1.5. SUBTASK 5 – PROGRAM MANAGEMENT SUPPORT

Contractor shall help to develop repeatable and strategic processes to track program activities meeting federal initiatives and governance requirements. In support of contract program management requirements, the Contractor shall:

· Provide coordination assistance to the Government in support of program activities and establishing applicable governance processes.

· Provide documentation, reporting, and briefing support as required for program support, including: DIT tool-agnostic health assessments; strategic level plans for adopted alternative solutions; program roadmap; IRM reviews and security policy enhancement recommendations; strategic communications; data classification guides; training materials; and framework and governance materials.

· Provide acquisition support for supplemental solution planning and integration to address DIT risks, limitations, and gaps.

· Create a risk evaluation summary detailing potential impact and likelihood of occurrence.

· Support the development and implementation of an enterprise risk assessment methodology for the CIPEC Program to review requirements with the project teams to assist the IRS in prioritizing work based on risk mitigation, ease of implementation, user impact, etc.

· Support the Government in planning and recommending implementation strategies for existing and new FISMA, OMB, TIGTA, and GAO requirements.

· Prepare and deliver presentations to various stakeholder groups and provide updates as required. Presentations may target all levels of technical and non-technical IRS staff.

· Develop a key message platform (e.g., SharePoint site) to be used for DIT briefings, presentations, and communications to executives, stakeholders, and end-users.

· Conduct organizational readiness and stakeholder management activities to facilitate deployment and use of capabilities. These activities include:

· Development and maintenance of gap analyses of current state compared with the future state.

· Support for capability testing to be conducted by the receiving organizations.

· Support for capability training across both receiving organization and implementation teams.

· Collection and execution of capability training requirements.

· Coordinate Zero Trust maturity assessments, ensuring program alignment with federal mandates and agency priorities.

Deliverables: Governance Model Document ; Risk Evaluation Summary; Organizational Readiness Assessments.

4.1.6. SUBTASK 6 – PROJECT MANAGEMENT SUPPORT

Contractor shall help to develop repeatable and strategic processes to track project activities meeting federal initiatives and governance requirements. In support of contract project management requirements, the Contractor shall:

· Provide support for strategy development and planning of project initiatives and project engagements.

· Provide documentation, reporting, and briefing support as required for project support. Documentation must be thorough, clear, concise, and usable documentation, reporting, and briefing materials, including: tactical and operations level plans for adopted alternative solutions; project plans; training materials; and change management materials.

· Assist the Government in coordinating, facilitating, monitoring, and supporting interfaces with other IRS projects, initiatives, and programs to ensure cohesiveness between all IRS security initiatives.

· Create and track action items including status, owners, and due dates.

· Identify and track issues, actions, risks, constraints, mitigation strategies, and governance reporting.

· Meet as needed with Cybersecurity and Privacy stakeholders to ensure that all task requirements are met.

· Maintain group lists (e.g., email distribution lists) for the project team and report project information and advice to all levels of leadership, as required.

· Assist in writing stakeholder and DIT educational materials, as required (e.g., Frequently Asked Questions, Data Classification Guides, ITM articles, Knowledge Articles, etc.).

· Work with other Integrated Project Teams (IPTs) and executive workstreams to provide responses to questions from end-users.

Deliverables: Stakeholder Coordination Plan; Project Tactical and Operations Plans; Project Training Materials.

4.1.7 SUBTASK 7 – TRANSITION-OUT (OPTIONAL)

Contractor shall provide transition-out support when required by the Government. The transition of contracted activities and services from the incumbent to the incoming Contractor as described in the Government-approved transition-out plan, shall begin 90 calendar days prior to the end of the task order, in accordance with standard workdays. As the outgoing incumbent, Contractor shall develop, document, and provide a transition-out plan no later than 90 calendar days prior to the beginning of the transition-out period or earlier if directed by the COR. The plan shall identity transition activities, schedules, and milestones for the turnover of work (e.g., operations, maintenance, engineering, training, asset management, and logistics functions) and identify how it shall coordinate with the incoming Contractor’s personnel to transfer knowledge.

Deliverable: Transition-Out Plan

4.2 TASK 2 – REQUIREMENTS, ARCHITECTURE AND IMPLEMENTATION SUPPORT

Contractor shall:

· Solicit, organize, and validate DIT requirements from the IRS key stakeholders including Cyber, PGLD, EOPs, and various business units.

· Evaluate and recommend alternative solutions for procurement to the government that can be deployed at the IRS to support an enterprise application of DIT.

· Develop suitable DIT solutions for the IRS within non-Microsoft cloud and on-prem environments.

· Architect and implement existing and alternative solutions complementary to the Microsoft/Azure instance of EDM, while demonstrating expert-level knowledge in the defined core technical competencies.

· Provide timely knowledge transfer to designated IRS CIPEC staff members throughout this engagement.

· Identify, develop, and facilitate use of improved business processes.

· Develop relevant planning documentation for the development, acquisition, configuration, integration testing and implementation in support of all known and new requirements associated with DIT solutions.

4.2.1 SUBTASK 2 – DATA DISCOVERY AND PROTECTION FRAMEWORK

· Expand data discovery, cataloging, tagging, and protection across hybrid and multi-cloud environments.

· Capture and validate data inventory and tagging requirements.

· Conduct analysis and research activities in support of IRS processes, procedures, and associated workflows.

· Provide continuous process improvement support by identifying non-Microsoft cloud business processes that need to be re-engineered to support program effectiveness. This includes:

· Review current state business processes.

· Identify necessary improvements to business processes.

· Document updates or draft new business processes for future use.

· Facilitate use of updated or new processes with CIPEC DIT program personnel, and other identified stakeholders.

Deliverable: Data Management Framework Document.

4.2.2 SUBTASK 2 – ALTERNATIVE AND NATIVE SOLUTION DEVELOPMENT

· Design and implement existing and alternative solutions in alignment with IRS data cataloging and inventory management technique and best practices, IRS Zero Trust Architecture and strategy, and IRS Cybersecurity and Privacy sensitive information policies.

· Develop a viable tactical implementation plan to guide the CIPEC Program in efforts to implement DIT across multiple project phases, IPTs, and environments.

· Coordinate and engage the appropriate IRS technical and business stakeholders as necessary to implement the DIT solution and functional and technical processes.

· Assist the Government in development and deployment of multiple project efforts.

· Participate and assist in the preparation of the full systems development lifecycle (Plan, Design, Development, Testing, Implementation, and Disposition).

· Provide engineering support for development and implementation.

· Submit and track troubleshooting/enhancement tickets, change requests, and help desk tickets. Follow up on tickets till closure and timely report delays in any approvals or ticket closures to the PM.

Deliverable: Alternative Solutions Design Report

4.2.3 SUBTASK 2 – INTEGRATION AND GOVERNANCE

· Assist the Government in establishing DIT governance processes and strategic decisions on architecture, implementation, management, and operations planning with the following core areas of historical knowledge and technical expertise, including:

· CIPEC deployments and capabilities at IRS for systems on premises, in the cloud (Azure, AWS, GCP, Oracle Cloud, etc.), and legacy / mainframe connected systems and Linux hosted applications across DLP, DIT, and CASB/SASE tool suites.

· Federal Zero Trust implementation mandates.

· IRS institutional knowledge of Change Management.

· Engagement with IRS IT & Business functions/stakeholders.

· Business process re-engineering techniques.

· Data classification and sensitivity types with new, NARA-compliant and business unit-specific sensitivity labels.

· Ensure DIT integration with existing CIPEC tools and capabilities.

· Design, test, and integrate new alternative DIT event analysis and management for DLP and DIT reporting in support of CIPEC SIEM dashboards.

Deliverable: Integration and Governance Plan (Section 4.6, Deliverable 2.3).

4.2.4 SUBTASK 4 – POLICY DEVELOPMENT AND TESTING

· Support the development of DIT security policies specific to the use of data marking, tagging, and tracking products and tools for incorporation into new/updated IRM policies based on DIT and data classification best practices.

· Provide additional technical policy development and execution, including test plans and schedules.

· Develop and test DIT policies, ensuring compatibility with CIPEC’s Zero Trust objectives.

· Support revision of cyber-security policy published through Interim Guidance and IRMs.

Deliverable: Policy Development and Testing Report.

4.3 TASK 3 – OPERATIONS AND MAINTENANCE SUPPORT

Support the operations and maintenance of DIT solutions. Provide timely delivery and review of O&M processes and procedures for DIT with designated IRS CIPEC staff. In support of contract operations and maintenance requirements, the Contractor shall:

· Assist in developing Operations and Maintenance (O&M) processes and procedures.

· Provide OneSDLC assessments for stakeholders as required.

· Support program governance activities as required.

· Plan, test, and fine tune DIT policies, ensuring as-intended integration with current CIPEC functionality.

· Support of FISMA Annual Security Compliance Assessments (ASCA), as necessary.

· Support other project documentation, including the development of technical and non-technical documentation (e.g., communication plans, instructions, guidelines, procedures, computer operator’s handbooks, test plans, etc.).

· Conduct system upgrade and testing in DEV, TEST and PROD environments, as applicable.

· Assist in data gathering and metrics reporting.

· Assist in the execution of processes and workflows.

· Provide or support the provision of DIT end user training.

· Support integration of new DIT solutions into CIPEC incident reporting and response workflows, including triage, incident analysis, and remediation of events.

Deliverable: DIT O&M Processes and Procedures Document.

4.4 TASK 4 – STRATEGY AND SOLUTIONS SUPPORT

Contractor shall support required integration and production readiness testing of capabilities and/or solutions which may be required to address functional gaps associated with the current architecture/infrastructure of the IRS CIPEC solutions and DIT capabilities within the IRS environment.

4.4.1 SUBTASK 4.1 – SUPPLEMENTAL SOLUTIONS SUPPORT

· Support supplemental requirements elicitation/documentation, change and risk management and implementation/integration to enhance the established IRS data flows.

· Provide technical consultations with IRS organizational entities which are responsible for architecting, implementing, and maintaining all components of the emerging IRS systems.

· Support supplemental logical and physical design, configuration, and integration of emergent requirements with established IRS infrastructure and solutions.

· Support supplemental solution selection and acquisition to extend existing capabilities inherent with the emerging IRS environment and/or to add new capabilities, in line with emerging capabilities.

· Support testing and production readiness assessment of all DIT solutions and development of reusable integration processes and procedures.

· Interface with CIPEC technical teams to coordinate integrated application testing to ensure viability of all defined/configured DIT solutions.

· Recommend security controls to ensure sensitive data is adequately protected across disparate technologies.

Deliverable: Security Control Recommendations Document

4.4.2 SUBTASK 4.2 – BUSINESS PROCESS ENHANCEMENTS

· Assist in developing DIT business rules, policies, and procedures.

· Assist in defining business unit-specific requirements to establish granular access controls, filters (masked, unmasked), and expected tool response actions (e.g., authenticate permissions, monitor, quarantine, encrypt, label, tag, etc.).

· Assist in defining Enterprise and Business Unit data use cases to establish a baseline of expected/approved user behavior around sensitive data, including:

· Define Enterprise Architecture elements (e.g., SRNVU nomenclature mapping for identifying sources/raw, normalization, virtualization, utilization).

· Model the structures, connections, exchanges, and transformations.

· Develop data flow diagrams and create data models.

· Report gaps and discoveries.

Deliverable: Business Process Redesign Report

4.4.3 SUBTASK 4.3 – DATA LABELING AND DATA FLOW MODELING

· Analyze data flow paths and develop insights to defend against insider data sharing risks (e.g., unauthorized/unintended access, misuse/browsing, malware, encryption key misuse, rogue replication, physical loss of control, device theft, encryption key availability).

· Use current and/or update existing data flows to:

· Define complexities and granularity of user communities and related access levels.

· Implement a data management strategy and framework that supports IRS Cybersecurity objectives and enables IT to control data flows and audit policy violations.

· Assist in creating Data Flow Diagrams and models to identify vulnerable access points.

· Support data labeling techniques to classify and tag data to filter access at scale and track movement of sensitive data across the enterprise.

· Provide data quality metrics and tools to track data integrity and audit trails.

Deliverable: Data Labeling and Flow Model Report

4.5 TASK 5 – CIPEC PROGRAM IT CYBERSECURITY INITIATIVES

Contractor shall support the implementation of the CIPEC Program IT Cybersecurity priority initiatives described in this section.

4.5.1 SUBTASK 5.1 – ENCRYPTION OPTIMIZATION

Streamline and optimize enterprise-wide encryption methodologies to reduce visibility gaps in DLP monitoring across the hybrid multi-cloud ecosystem.

Deliverable: Encryption Optimization Plan

4.5.2 SUBTASK 5.2 – DIT EXPANSION STRATEGY

Develop an DIT strategy and roadmap for expanding Microsoft/Azure DIT capabilities (currently operating within the IRS Microsoft/Azure ecosystem) into non-Microsoft clouds and on-prem environments.

Deliverable: DIT Expansion Strategy (Section 4.6, Deliverable 4.2).

4.5.3 SUBTASK 5.3 – DATA EXFILTRATION MONITORING AND REPORTING

Expand and scale data exfiltration monitoring and reporting for both unencrypted and encrypted data traffic traversing within and across enterprise network boundaries, particularly to include activity around non-Microsoft multi-cloud environments, legacy systems, and mainframe-connected architectures.

Deliverable: Exfiltration Monitoring Dashboard

4.5.4 SUBTASK 4 – INTAKE PROCESS EXTENSION

Extend the CIPEC formal intake (front door service) for pre-acquisition and pre-deployment technology security evaluations and requirements review around DIT protections and best practices in the context of the DIT expansion under this task order, with a goals of (i) minimizing post-acquisition contract scope changes by early identification of proper security requirements; and (ii) streamlining the effective adoption of DIT cyber protection requirements into deployed technologies as a process owner within Cybersecurity during IRS Authorization to Operate (ATO) proceedings.

Deliverable: DIT Intake Process Guide

5. PERIOD OF PERFORMANCE

The period of performance for this contract shall consist of 12 months period of performance: Jan 11, 2026 – Jan 10, 2027

6. TRAVEL

No travel required for the execution of assigned tasks.

7. PERFORMANCE REQUIREMENTS

Performance requirements are defined by the Government. The table above details the desired outcomes successful completion of specified deliverables, work products and support should produce. This definition aligns the Contractor’s objectives with the Government objectives, which are to complete tasks in a manner that delivers value-added products and services to the end users.

7.1 PLACE OF PERFORMANCE

Contractor personnel will execute contract tasks at a location authorized by the Contractor’s corporate authority and approved by the IRS.

Contractor’s site, with authorized access to the IRS network and associated application systems – teleworking via use of the ERAP AnyConnect application installed on all IRS-issued laptops to facilitate wireless access through the IRS VPN to the IRS Network.

Tele-work is authorized for all contractor staff supporting the IRS DLP in the Cloud System 100% of the time and has been approved by both the Program & Contract Manager.

The contractor shall abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at these facilities.

7.2 HOURS OF OPERATION

Normal business hours are considered 7:30 am to 4:30 pm. local time for the location where services are performed.

7.3 SECURITY CLEARANCES

Contractor employees assigned to the contract and granted access to IRS information are subject to investigation by the government. Applicable contractor employees who undergo Minimum Background Investigation (MBI) checks which reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay Federal income tax. New hires or substitutions of personnel are subject to the MBI requirement.

i. Personnel Security-Personnel Security. All contractor personnel will be required to sign a Non-Disclosure Agreement. All contractor and sub-contractor personnel must undergo a Minimum Background Investigation (MBI) performed by, and at the expense of, Treasury’s Office of Personnel Security. It shall be the contractor’s responsibility and cost to staff the contract with personnel compliant with Treasury personnel and industrial security requirements as defined by Treasury Directives. The contractor shall provide personnel security in accordance with Treasury Department Policy 15-71 Chapter II. At a minimum, personnel will be required to complete SF-85P Public Trust Questionnaire.

ii. Physical Security – Physical Security. Physical security is the action taken to protect Treasury information technology resources (e.g., installations, personnel, equipment, electronic media, documents, etc.) from damage, loss, theft, or unauthorized physical access. The contractor shall be alert for and establish means to mitigate potential unauthorized access to these resources or potential internal or external acts of sabotage on these resources while under the contractor’s custody. The contractor shall:

a) Comply with all pertinent facility regulations and procedures for Federal agencies, unless the Government grants a waiver,

b) Make recommendations for improving protection for contractor staff if there is a security issue.

c) Promptly report unlawful acts committed on or against property under the charge and control of their contract. All such reports should be submitted through the Contracting Officer’s Representative (COR) to Treasury’s Chief Information Security Officer or designee, and

d) Provide planning and training to contractor and sub-contractor personnel on matters relating to protection and emergency response if funded by the Government.

iii. Desktop Security - The contractor shall be responsible for practice, and compliance by its personnel, subcontractors, and representatives regarding the storage and removal of electronic and printed materials considered sensitive in nature (i.e., system password and user identification access codes) from printers, desktops, laptops, furniture, presentation equipment, and any other form of information housing. This is so that the information is not accessible by unauthorized personnel and so that disposal follows Treasury information security practices. The contractor must ensure that contractor, sub-contractor, or business partner personnel protect all sensitive and secure documents to the extent possible from either inadvertent or deliberate compromise.

iv. Solution Information/Data/Content Security and Protection – The contractor shall support the compliance and promotion of standards, guidance, and practices for the protection of those cyber systems, databases, and/or web sites to ensure system content, data, and information repositories developed and maintained. This protection shall include inadvertent events/acts, overt internal and external acts, system failure, cyber-attacks, or acts of nature.

7.4 PERFORMANCE STANDARDS

Performance Standards include two pre-defined standards (i.e., Schedule, and Quality) that can be tailored and weighted for each desired outcome. Performance Standards also include an Acceptable Quality Level (AQL) which has been determined and defined by the Government.

7.5 SURVEILLANCE

The following deliverables are required to successfully meet TechOps labor requirements. Deliverables will be systematically reviewed and measured against objectives, to ensure Contractor performance meets the established contract standard. The suspense for government review and contractor corrections and/or protests are specified in the Quality Assurance Surveillance Plan (QASP).

The surveillance process has two interrelated parts: The Monitoring Method is identified below, and the Quality Assurance Surveillance Plan (QASP) is included.

7.6 REVIEW AND RESPONSE

By default, the Government representative will complete a deliverable review and Contractor response within fifteen (15) business days of receipt. The Contractor will have five (5) business days to contest or correct the Government review. For mission critical deliverables requiring a timely review and response, the Government representative and Contractor will establish ad-hoc review and response schedules.

8. GOVERNMENT FURNISHED PROPERTY / INFORMATION

8.1 GOVERNMENT FURNISHED PROPERTY

Government Furnished Property (GFP) shall be provided in the performance of this contract.

Laptop computer with Local Area Network and limited application access

One (1) each per employee

At the end of this contract, disposition of GFP shall be in accordance with FAR 52.245-1

8.2 GOVERNMENT FURNISHED INFORMATION

Government Furnished Information (GFI) (to include manuals, notes, memos, instruction materials, and other information) may be provided in the performance of this award. The following GFI will be provided to the contractor upon award.

DESCRIPTION OF GOVERNMENT FURNISHED INFORMATION

Project Historical Documentation

Internal Revenue Manual (IRM) Policy and Guidance Documents

Current Document Templates for Enterprise Documentation

At the end of this contract, disposition of GFI shall be in accordance with Federal Acquisition Regulation (FAR) 52.245-1.

9.0 CONTRACTOR EMPLOYEE ON-BOARDING REQUIREMENTS

9.1 Paperwork Completeness and Accuracy

a. The IRS will provide the vendor POC with the Risk Assessment Checklist (RAC), along with other required investigative forms (details in section 1.5 below).

b. All forms must contain the full legal name that matches the applicant's identification (e.g. state issued id, passport, etc.)

c. Vendors should ensure fields requiring social security numbers and phone numbers have the correct number of digits.

d. The IRS will reject forms that are incomplete, illegible, inaccurate, and contradict other forms in the package.

9.2 Contractor Eligibility

All contractor/subcontractor employees submitted for staff-like access approval must be eligible for IRS contract employment to the best of the vendor’s knowledge. In order to be approved for interim staff-like access, IRS will confirm that contractor/subcontractor employees first meet the following initial eligibility requirements:

9.2.1 U.S. Citizenship or Lawful Permanent Resident (LPR) status:

Subjects must be US citizens or LPRs (dependent on position risk level) to be eligible for staff-like access. a. No documentation is required as proof of U.S. citizenship for subjects born in the United States. b. If subjects are foreign-born, vendor POC MUST provide the subjects’ Alien Registration or “A” Number for verification of their status.

9.2.2 Selective Service Registration (for males born after 12/31/59): Vendor POC MUST provide the following documentation to the IRS:

a. Registered applicants: Official letters of verification can be obtained and saved via the Selective Service website at https://www.sss.gov/verify/proof/.

b. Non-registered applicants:

i. If the subject is foreign-born, vendors must provide a letter from the Selective Service stating the subject was not required to register or that the subject was required to register but it is too late.

ii. For US citizens or foreign-born subjects who were required to register but did not, the vendor must provide a written explanation as to why the non-registration was not knowing or willful.

9.2.3 Federal Tax Compliance: Subjects must be tax compliant and must remain compliant while actively working on IRS contracts.

a. IRS will check tax compliance – no documentation is required from the vendor POC.

b. Vendors are responsible for informing their applicants of this requirement.

9.3 Timeliness

a. Delays in any of the actions stated below will result in contractor/subcontractor employee onboarding delays and starting work on the contract.

b. All investigative forms and documentation are due to the IRS within 10 business days of receipt. If IRS approval is required to confirm the qualifications of proposed contractor personnel, i.e. key personnel, documents must be submitted within 10 days of receipt of this approval.

c. All individuals listed on the RAC should be fingerprinted within 5 business days after IRS sponsorship in USAccess. If an individual is not able to make an appointment within this timeframe, the vendor POC will provide documentation that an appointment was not available and provide the date of the scheduled appointment.

d. The contractor/subcontractor employee must accurately complete the eAPP application, if applicable, within 8 calendar days of receipt of the invitation. Failure to complete eAPP will result in not being permitted to work on the contract.

9.4 Investigative Forms/Documentation, Fingerprinting, and eAPP

a. Contract Profile: Following the award of the contract, the COR will need to submit this document to HCO Mailbox to establish the Contract within the Contract Management Module (CMM) system. This creates the record for contract and task order information in the CMM.

b. Master Survey / Position Designation Tool: Following this meeting, the COR will work with the Vendor POC to complete this questionnaire for each unique position type on the contract. This questionnaire asks the vendor POC and COR to identify the duties the subjects will be performing for IRS in order to determine risk level for the position. A separate Master Survey must be completed for each position type on the contract (i.e., Systems Administrator, Programmer, Clerk Typist, etc.). The results must be saved and sent to IRS PS. The Position Designation Tool is listed here- Position Designation System (PDS) and Position Designation Tool (PDT) (dcsa.mil)

c. Investigative Forms/Documentation: The IRS will provide the vendor POC with the following investigative forms for completion by each applicant requiring staff-like access:

i. Risk Assessment Checklist (RAC): The RAC is a summary Excel spreadsheet that captures information related to the subjects for whom the vendor is requesting staff-like access. The vendor POC must ensure that EVERY column in the RAC is completed accurately prior to submitting to the IRS. Failure to do so will result in a rejection of the RAC and a delay in the on-boarding process.

ii. OF-306, Declaration for Federal Employment (version 2023): Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

iii. Non-Disclosure Agreement (NDA): Form must be completed and signed by each contractor/subcontractor employee requiring access to sensitive but unclassified (SBU) data. This form is not required to be submitted to Personnel Security. This form is for the COR records only.

iv. Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA): Form must be completed and signed by each contractor/subcontractor employee requiring staff-like access.

v. Notice 1379, Tax Check Notice: Provide to subjects to inform them…