II_1 Altova MissionKit Solicitation (2032H5-25-R-00014).pdf

SOLICITATION- 2032H5-25-R-00014

The Internal Revenue Service Brand name Altova Support

INTRODUCTION AND INSTRUCTION

Project Title: Brand Name: Altova Software

Office: Internal Revenue Services (IRS) Enterprise Services, Solution Engineering Office (ES)

Period of Performance: The period of performance is a 12-month Base Period Estimated on September 1, 2025, and ending August 31, 2026

Small Business Opportunities: 100% Small Business Set-Aside

Type of Action contemplated: Firm-Fixed Price

Relevant classifications: NAICS Code: 541519

Basis for Award: This will be a lowest priced technical acceptable requirement. Award will be made to one (1) Offeror who is deemed responsible in accordance with the FAR who conforms to the solicitation requirements; and whose proposal, judged by an overall assessment of the evaluation criteria and other considerations specified in this solicitation meets the best value standard for the non-cost factors and provides the lowest evaluated price. The objective of this acquisition is the procurement of brand name: Altova Software.

This RFQ does not commit the Government to pay any costs associated with the preparation and submission of your quote. In addition, the Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds in connection with this proposed acquisition.

The Government intends to evaluate quotes and award a contract without discussions with offerors. However, the Government reserves its rights to conduct discussions if later determined by the Contracting Officer to be necessary.

Brand Name Justification:

The Altova mission kits are a bundle of software applications that enable Data Engineering, Applications Development, Statistics of Income and projects, such as Modernized electronic Filing (MeF) to develop, manage and coordinate IRS Extensible Markup Language (XML) standards and guidelines for the enterprise. This tool provides efficiencies and labor-saving costs in producing the XML linkages for MeF initiatives.

The software is the Altova Mission Kit 2025 Enterprise Edition, and the Support & Maintenance Package (SMP) is needed to receive the upgrades and support required for projects. The Altova software suite will help the IRS accomplish its XML tasks and activities in the framework of enterprise standards and guidelines, especially as it relates to key projects. A controlled vocabulary based on XML standards and guidelines supports a broad portfolio of business applications with a shorter time to market. Altova, Inc. is the proprietary provider of the Mission Kits and XMSpy software technology and associated maintenance and consulting services. Altova is a unique solution and there are no directly comparable technologies. The candidate software is peculiar to the company. The proposed acquisition is for software maintenance of the Altova software products that would benefit the XML and MeF environments in addition to the XMLSpy software. In addition, the Altova Enterprise Edition mission kit supports the following software modules: XMLSpy; MapForce; StyleVision; DiffDog; SchemaAgent;

DatabaseSpy and UModel.

If another maintenance product is purchased by the Solution Engineering (SE) office, it runs the risk that the maintenance would not be compatible, and the SE office would have to spend several months creating a new image and testing the software before the maintenance could be put into service. It would be extremely costly for the Government and time consuming to acquire another brand.

The Altova mission kits are a bundle of software applications that enable Data Engineering, Applications Development, Statistics of Income and other projects, such as Modernized electronic Filing (MeF) to develop, manage and coordinate IRS Extensible Markup Language (XML) standards and guidelines for the enterprise. The IRS uses this product for the XML developers in supporting and completing their work assignments for mission critical systems such as FATCA, CADE2, AMS, MeF, and ACA, PBBA, Digitalization, IRA etc., that are developed using XML.

The Altova MissionKit software application package is a mature product specializing in XML development and validation that has been utilized by the IRS for a number of years. Enterprise Architecture (EA) recommends Altova Enterprise Mission Kit as an Approved-Verified product utilized by multiple groups in the IRS.

If another product/maintenance is purchased by the Solution Engineering (SE) office, it runs the risk that the maintenance would not be compatible, and the SE office would potentially have to spend several months creating a new image and testing the software before the maintenance could be put into service. This product is in use by various other organization within the IRS so switching products would impact the IRS. It would be extremely costly for the Government and time consuming to acquire another brand since purchasing another product and maintenance would incur more total cost upfront for the new product (the Government is only renewing existing license and will not incur product cost).

GENERAL INFORMATION

This is a Request for Quote (RFQ) to establish a firm-fixed-price order to support the Enterprise Services, Solution Engineering (ES) branch.

This requirement will be competed as a 100% small business set-aside. The applicable North American Industry Classification System (NAICS) code for this acquisition is 541519 “Other Computer Related Services”.

Award will be made based on a Lowest Price Technically Acceptable (LPTA).

The Government anticipates awarding a contract to the offeror whose quote is the most advantageous to the Government, price and other factors considered.

QUOTATION PREPARATION INSTRUCTIONS

1. All required information shall be electronically submitted in the format specified in this solicitation.

2. All supplies and/or services provided must be in compliance with Section 508 of the Rehabilitation Act and provisions and requirements for accessibility contained in this solicitation (and resulting award).

3. Offers must be authorized sellers/resellers of the required supplies and/or services.

4. The following must be completed and returned with your quote in order for your quote to be considered for award:

a) RFP number

b) Complete company name (as represented in SAM.gov)

c) Tax identification number (TIN)

d) Dun & Bradstreet Number (DUNS)

e) Unique Entity Identifier (UEI)

f) Cage Code

g) The company’s business size

h) Complete Business Mailing Address

i) Contact Name

j) Contact Phone Number

k) Contact email addressed.

l) Completed Provisions/Clauses

• 1052.232-9001 Electronic Invoicing and Payment Requirements for the Invoice Processing Platform (IPP) (July 2019) must be completed, signed and returned with your quote in order for the quote to be considered for award.

• IR1052.209-9002 Notice and Consent to Disclose and Use of Taxpayer Return Information (May 2018).

5. Questions about the RFQ must be submitted before 12:00pm EST August 20, 2025. Questions received may or may not be answered, and if answered will be answered through an amendment to the solicitation. The government reserves the right not to answer questions received past the date specified.

Offeror(s) shall provide responses to this RFQ in accordance with the instructions in this section. Failure to furnish the required information and representations, or those who reject the terms and conditions may be excluded from consideration.

Proposal Due Date/Time: Responses to this RFQ shall be made electronically to the Contracting Officer Gregory F. Kaiser Jr. at Gregory.f.kaiserjr@irs.gov and the Contract Specialist Kris Dowdell at Kristofer.S.Dowdell2@irs.gov no later than August 22, 2025, at 12:00pm EST.

QUOTE PREPARATION COSTS

This RFQ does not commit the Government to pay any cost for the preparation and submission of the quote in response to this RFQ.

Section B - Supplies or Services and Prices/Costs

To be considered for award, the Contractor must provide a firm fixed price quote for the following CLIN(s):

CLIN # Description Part # Qty Unit Price Total Price

0001 Altova MissionKit 2025 Enterprise Edition - 20 users - 1-year SMP

KE+M1-I020-0P 2 $ $

Description/Specs./Work Statement

Statement of Work Altova Support & Maintenance Package

1. INTRODUCTION

The IRS, Office of Enterprise Services, Solution Engineering Office, is currently using the Support & Maintenance Package (SMP) for the Altova software.

Altova software helps provide version control and impact analysis as part of a governance piece which can be extended to integrate with external Registry, Repository and Policy validation suites.

The Altova mission kits are a bundle of software applications that enable Data Engineering, Applications Development, Statistics of Income and projects to develop, manage and coordinate IRS XML standards and guidelines for the enterprise. This tool provides efficiencies and labor saving costs in producing the XML linkages for Modernized Electronic Filing (MeF) initiatives. The software is the Altova MissionKit 2025 Enterprise Edition and the maintenance is needed in order to receive the upgrades and support required for projects.

The software increases staff productivity in support of XML standards and modernization projects across all tiers, especially MeF. However, the importance of XML within the IRS processing environment means that a tool as integral as Altova should not be allowed to terminate in the out years.

2. OBJECTIVE

The purpose of this requisition is to purchase the Support & Maintenance Package (SMP) for the Altova software.

3. SCOPE

The scope of work includes procuring the following products:

Cost Item Quantity Notes KE+M1-I020-0P 2 SMP for Altova® MissionKit® 2025 Enterprise Edition - Installed 1 yr

SMP # of USER(S) 20

The offeror shall provide software license annual subscription renewal services for the part numbers listed above. This includes but is not limited to updates, patches, fixes, bugs and any documentation. The software subscription provided by the offeror shall identify if any of the following apply:

• Up-front fees

• Yearly fees

• Discounts (e.g., continuous improvement, volume, bundling)

• Other terms (e.g., payment, contract duration and cancellation)

• Other services and benefits.

This standard COTS software maintenance support will include:

• 24x7 Telephone Support

• Product Upgrades - available upon release

• Email Support

• Emergency Bug Fixes

• Support Account Manager

• Priority queueing

4. PERIOD OF PERFORMANCE

One year from final award date

5. Shipping/Delivery Address

The vendor shall deliver and coordinate the installation and configuration of major and minor software releases based on delivery protocol and the shipping instructions of the purchase order. The vendor shall deliver the software releases via email to Jackie Stein. Jackie’s email address and phone number are listed below under Technical Points of Contact.

The site addess is:

IRS

NCFB

5000 Ellin Road Lanham, MD 20706

The Technical Points of Contact (TPOC) will be the contacts for software deliveries and support:

TPOC: Andrew Sooley, Andrew.G.Sooley@irs.gov, 713-898-8120

Backup TPOC: Jackie Stein, Jacqueline.A.Stein@irs.gov, 240-613-2020

Contracting Officer (CO) mailto:Andrew.G.Sooley@irs.gov mailto:Jacqueline.A.Stein@irs.gov

The CO for this order is listed below:

Internal Reveue Service Office of ES Solution Engineering Office Name: Gregory F. Kaiser Jr.

Address: IRS

NCFB

5000 Ellin Road Lanham, MD 20706 Voice: TBD Email: TBD

6 IR1052.239-9000 Section 508 Information, Documentation and Support

(DEC 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work, performance work statement or statement of objectives (select one). The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services _X__ 601 General _X__ 601.1 _X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4 _X__ 603 Support Services _X__ 603.1 _X__ 603.2 _X__ 603.3

(End of clause)

IR1052.239-9001 Section 508 Conformance (NOV 2020)

Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachments referenced below. Altova MissionKit 2025 product consists of the following VPATs (to be attached with this SOW – can also be found at www.altova.com):

• AltovaXMLSpy2025VPAT.pdf https://www.section508.gov/content/glossary/#sectionI

• AltovaDatabaseSpy2025VPAT.pdf

• AltovaAuthentic2025VPAT.pdf

• AltovaDiffDog2025VPAT.pdf

• AltovaMapForce2025VPAT.pdf

• AltovaSchemaAgent2025VPAT.pdf

• AltovaStyleVision2025VPAT.pdf

• AltovaStyleVision2025VPAT.pdf

The following technical standards have been determined to be applicable to this contract:

___ Chapter 4: Hardware ___ 401 General ___ 401.1

___ 402 Closed Functionality ___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5 ___ 403 Biometrics ___ 403.1

___ 404 Preservation of Information Provided for Accessibility ___ 404.1 ___ 405 Privacy ___ 405.1

___ 406 Standard Connections ___ 406.1 ___ 407 Operable Parts

___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8

___ 408 Display Screens ___ 408.1 ___ 408.2 ___ 408.3 ___ 409 Status Indictors ___ 409.1 ___ 410 Color Coding ___ 410.1 ___ 411 Audible Signals ___ 411.1 ___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8

___ 413 Closed Caption Processing Technologies

___ 413.1 ___ 414 Audio Description Processing Technologies ___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions ___ 415.1

_X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___

702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1

_X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9

IR1052.239.9002 Section 508 Services (DEC 2019)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

___ Chapter 4: Hardware ___ 401 General ___ 401.1

___ 402 Closed Functionality ___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5 ___ 403 Biometrics ___ 403.1

___ 404 Preservation of Information Provided for Accessibility ___ 404.1 ___ 405 Privacy ___ 405.1

___ 406 Standard Connections ___ 406.1 ___ 407 Operable Parts

___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8

___ 408 Display Screens ___ 408.1 ___ 408.2 ___ 408.3 ___ 409 Status Indictors ___ 409.1 ___ 410 Color Coding ___ 410.1 ___ 411 Audible Signals ___ 411.1 ___ 412 ICT with Two-Way Communication

___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8

___ 413 Closed Caption Processing Technologies ___ 413.1 https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

___ 414 Audio Description Processing Technologies ___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions ___ 415.1

_X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4

_X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference

_X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___

702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1

_X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9

(End of clause)

6 IR1052.239-9000 Section 508 Information, Documentation and Support

(DEC 2019)

The Contractor shall maintain the existing section 508 compliance of all existing equipment associated with the maintenance contract. New EIT products and services must meet the requirements of Section 508 as implemented in the Access Board’s standards and the Federal Acquisition Regulation. Any future upgrades to the software must be accompanied by a test plan from the vendor detailing the compliance level of the product which should not fall below the existing level of 508 compliance.

CLAUSES AND PROVISIONS

FAR 52.252-2 – Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): http://farsite.hill.af.mil/farsite.html

The following clauses are incorporated by reference:

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Nov 2021) 52.204-27 Prohibition on a Bytedance Covered Application (Jun 2023) 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (Nov 2023) 52.224-1 Privacy Act Notification (Apr 1984) 52.224-2 Privacy Act (Apr 1984) 52.227-1: Authorization and Consent (Jun 2020) 52.227-2: Notice and Assistance Regarding Patent and Copyright Infringement (Jun 2020) 52.232-18 Availability of Funds (Apr 1984) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013) 52.243-1 Changes—Fixed-Price Alternate I (Apr 1984) 1052.210-70 Contractor Publicity (Apr 2015)

Full Text Clauses

52.217-8 Option To Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of Clause)

1052.201-70 Contracting Officer's Representative (COR) Appointment and Authority (Apr 2015)

(a) The COR is Ariel Johnson.

(b) Performance of work under this contract is subject to the technical direction of the COR identified above, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, and/or fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the contract specification(s)/work statement. The COR does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the contract specification(s)/work statement;

(2) Constitutes a change as defined in the clause entitled “Changes”;

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR must confirm oral direction in writing within five workdays, with a copy to the Contracting Officer.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR or the designated representative falls within the limitations of (c) above, the Contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(f) Failure of the Contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled “Disputes.”

IR1052.204-9002 IRS Specialized Information Technology (IT) Security Training (Role- Based) Requirements (Jun 2022)

(a) Consistent with the Federal Information Security Modernization Act of 2014 (FISMA), specialized information technology (IT) security training (role-based) shall be completed prior to access to Information Systems and annually thereafter by contractor and subcontractor personnel who have an IT security role or responsibility.

(b) Identifying contractor/subcontractor with a role or responsibility for IT security is completed by the Contractor, and verified by the COR, by completing the Risk Assessment Checklist (RAC). The roles listed in the RAC conform to those roles listed in the Internal Revenue Manual

10.8.1.2 that apply to contractor personnel. This process applies to new contractors/subcontractors, replacement personnel and for existing contractors/subcontractors whose roles change during their work on a contract. This includes, but is not limited to, having an approved elevated privilege to one or more IRS systems through the Business Entitlement Access Request System (BEARS).

(c) Prior to accessing any IT system, all contractor/subcontractor personnel must successfully complete all provisions of IR1052.204-9000 Submission of Security Forms and Related Materials.

(d) In keeping with the Security Orientation outlined in IR1052.224-9001, contractors/subcontractors designated on the Risk Assessment Checklist as performing a role shall complete approved training equal to the assigned hours within 5 business days of receiving the Personnel Security’s memo approving staff-like access.

(e) Annual Requirements: Thereafter, on an annual basis within a FISMA year cycle beginning July 1st of each year, contractor/subcontractor personnel performing under this contract in the role identified herein is required to complete specialized IT security, role-based training by June 1st of the following year.

(f) Training Certificate/Notice: The contractor shall use the Government system identified by Cybersecurity to annually complete specialized IT security training (role-based). The COR will track the courses, hours completed and the adhere to the established due dates for each contractor/subcontractor personnel. Alternatively, courses may be completed outside of the Government system. Any courses taken outside of the Government system must be pre- approved by IRS Cybersecurity’s FISMA Training Compliance team via the COR. Adequate information such as course outline/syllabus must be provided for evaluation. Once a course is approved, certificates of completion provided for each contractor/subcontractor shall be provided to COR in order to receive credit toward the required hours for the contractor/subcontractor personnel. Copies of completion certificates for externally completed course must be shared with the Contracting Officer upon request.

(g) Administrative Remedies: A contractor/subcontractor who fails to complete the specialized IT security training (role-based) requirements, within the timeframe specified, may be subject to suspension, revocation, or termination (temporarily or permanently) of staff-like access to IRS IT systems.

(h) Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.

IR1052.209-9001 Organizational Conflicts of Interest (May 2018)

(a) Purpose: The purpose of this clause is (1) to ensure that the contractor is not biased because of conflicting roles in financial, contractual, organizational, or other interests which relate to the work to be performed under this contract, and (2) to ensure the contractor does not obtain any unfair competitive advantage over other parties as a result of its work under this contract.

(b) Scope: The restrictions described herein shall apply to performance or participation by the contractor and any of its affiliates or their successors in interest (hereinafter collectively referred to as the "contractor") in any activities related to this contract.

The term contractor includes the prime contractor, subcontractors, mentors, joint ventures, consultants, or any others acting in a similar capacity.

(c) Reporting: The contractor shall immediately report to the CO any conflicts or potential conflicts that arise during the performance of work under this contract, including those that may surface at the subcontract level. Once reported, the CO may terminate the contract for convenience if such an action is in the best interest of the Government. However, should there be any misrepresentation of facts in reporting an OCI or a potential OCI, at the prime or subcontract level, or a complete failure to report such, the CO may impose the remedies provided in subparagraph (f) of this clause.

(d) Restrictions: (The CO shall list appropriate restrictions for the particular acquisition.

Listed below are three sample restrictions.)

(1) The contractor shall not be eligible to participate in Internal Revenue Service contracts, subcontracts, or proposals which stem directly from the contractor's performance of work under this contract, for a period of years after the completion of this contract.

(2) The contractor shall not perform any advisory or assistance services work under this contract for a period of years, unless directed to do so by the CO, if the contractor has been or is substantially involved in the developing or marketing of its products or services or the products or services of another firm.

(3) If, under this contract, the contractor prepares a statement of work or specifications to be used in competitive acquisitions, the contractor shall be ineligible to perform or participate, in any capacity, in any acquisition which is based on said statement of work or specification for a period of years.

(e) Subcontracts: The contractor shall include a clause, substantially similar to this clause, including this subparagraph, in all subcontracts (including purchase/delivery orders), teaming arrangements, and/or other agreements calling for the performance of work related to this contract unless exempted in writing by the CO.

(f) Remedies: For breach of any of the above restrictions or for nondisclosure or misrepresentation of any facts required to be disclosed concerning this contract, including the existence of an actual or potential organizational conflict at the time of or after award, the IRS may terminate the contract for default, disqualify the contractor from subsequent related efforts, and pursue such other administrative remedies as may be permitted by law or other terms and conditions of this contract.

1052.224-70 Contract Publication (Oct 2018)

(a) The Department of the Treasury (Treasury) may, at its sole discretion, publish this contract or portions thereof, including orders issued under the contract when deemed in the best interest of the Government.

(b) To afford the Contractor an opportunity to review and propose redactions for any information contained in the Treasury contract that may be subject to a FOIA exemption, the Contractor may submit, within ten business (10) days from the date of award of this contract or any order issued under the contract—

(1) A pdf file of the fully executed contract or order that is suitable for publication and which includes all Contractor proposed redactions (e.g, trade secrets or any commercial or financial information that the Contractor believes to be privileged or confidential business information) and.

(2) A written statement identifying the portions of each proposed redactions, including the applicable exemption under the Freedom of Information Act (FOIA), 5 U.S.C. 552, and, in the case of FOIA Exemption 4, 5 U.S.C. 552(b)(4), shall demonstrate why the information is considered to be a trade secret or commercial or financial information that is privileged or confidential.

(c) Treasury will consider the Contractor’s proposed redactions and associated grounds for nondisclosure prior to making a determination as to what information may be properly withheld for purposes of publishing this contract or portions thereof.

(d) The Contractor may submit a request to the CO for additional time to complete the action prescribed by paragraph (b) of this clause. The lack of action by the Contractor will be deemed by the Government as there being no information in the Treasury contract subject to a FOIA exemption.

(e) Information provided by the Contractor in response to this clause may itself be subject to disclosure under the FOIA.

IR1052.224-9000 Safeguards Against Unauthorized Disclosure of Sensitive But Unclassified Information (Apr 2024)

1. Treasury Directive Publication 15-71 (TD P 15-71), Chapter III – Information Security, Section 24 – Sensitive But Unclassified Information defines SBU information as ‘any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.’ SBU may be categorized in one or more of the following groups—

• Federal Tax Information (FTI), including any information on or related to a tax return

• Returns and Return Information

• Sensitive Law Enforcement Information

• Employee and Personnel Information

• Personally Identifiable Information (PII)

• Information Collected or Created from Surveys

• Other Protected Information

2. Tax return or tax return information disclosed to the contractor can be used only for a purpose and to the extent authorized herein, and willful disclosure of any such tax return or tax return information for a purpose and to the extent unauthorized for provision of appraisal services to assist with the valuation of conservation easements constitutes a felony, punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as five (5) years, or both, together with the costs of prosecution. Any such knowing or negligent unauthorized disclosure of tax return or tax return information may also result in an award of civil damages in an amount not less than $1,000 plus costs with respect to each instance of unauthorized disclosure. These penalties are prescribed by the Internal Revenue Code, Sections 7213 and 7431; see also 26 CFR § 301.6103(n)-1.

3. Contractors who perform work at contractor (including subcontractor) managed sites using contractor or subcontractor managed IT resources shall adhere to the general guidance and specific privacy and security control requirements contained in Publication 4812, Contractor Security & Privacy Controls, IRM 10.23.2 - Personnel Security, Contractor Investigations, IRM 10.5.1 Privacy Policy, and IRM 10.8.1 - Information Technology (IT) Security, Policy and Guidance. Publication 4812 and IRM 10.5.1,

10.8.1 and 10.23.2 provide comprehensive lists of all security, privacy, information protection and disclosure controls and guidance.

4. Eligibility, Fitness and Suitability. Contractor (including subcontractor) personnel hired for work within the United States or its territories and possessions and who require staff-like access, wherever the location, to IRS-owned or controlled facilities or work on contracts that involve the design, operation, repair, or maintenance of information systems, and/or require staff-like access to SBU information, must meet the eligibility requirements under IRM 10.23.2, Personnel Security, Contractor Investigations, and shall be subject to security screening and investigative processing, commensurate with the position sensitivity level, and in accordance with IRM 10.23.2, and TD P 15-71.

Contractor (including subcontractor) personnel must be found both eligible and suitable, and approved for staff-like access (interim or final) by IRS Personnel Security prior to starting work on the contract/order, and before being granted access to IRS information systems or SBU information.

5. General Conditions for Allowed Disclosure. Any SBU information, in any format, made available to or created by the contractor (including subcontractor) personnel shall be treated as confidential information and shall be used only for the purposes of carrying out the requirements of this contract. Inspection by or disclosure to anyone other than duly authorized officer or personnel of the contractor (including subcontractor) shall require prior written approval of the IRS. Requests to make such inspections or disclosures shall be addressed to the CO. Access to SBU information shall be provided on a “need to know” basis. SBU information shall never be indiscriminately disseminated, and no person shall be given access to (or allowed to retain) more SBU information than is needed for performance of their duties, and for which that individual has been authorized to receive as a result of having been successfully investigated, adjudicated, trained to receive, and what is strictly necessary to accomplish the intended business purpose and mission.

6. Nondisclosure Agreement. Consistent with TD P 15-71, Chapter II, Section 2, and IRM 10.23.2.15 - Nondisclosure Agreement for Sensitive but Unclassified Information, each contractor (including subcontractor) personnel who requires staff-like access to

SBU information shall complete, sign, and submit to Personnel Security – through the CO (or COR, if assigned) — an approved Nondisclosure Agreement prior to being granted staff-like access to SBU information under any IRS contract or order.

7. Training. All Contractor personnel assigned to this contract with staff-like access to SBU information must complete IRS-provided privacy and security awareness training, including the Privacy, Information Protection, and Disclosure training, as outlined in IR1052.224-9001 Mandatory IRS Security Training for Information Systems, Information Protection and Facilities Physical Access. Contractor personnel required to take the Unauthorized Access to Taxpayer Data training must attest to understanding the penalties for unauthorized access, as instructed by the COR.

8. Encryption. All SBU information must be protected at rest, in transit, and in exchanges (i.e., internal and external communications). The contractor (including subcontractor) shall employ encryption methods and tools to ensure the confidentiality, integrity, and availability of SBU information.

9. Particularly relevant to this clause are the updated sections to IRM 10.8.1 and Publication 4812 regarding email and text messages, alternative work sites, and incident management:

• For email and text messaging, the contractor shall abide by IRM 10.8.1.4.17.2.2 “Electronic Mail (Email) Security”, IRM 10.5.1.6.8 “Email” plus all subsections, and IRM

10.8.2.2.1.18 “Contractor”; or Pub. 4812 section 28.3.1 “Electronic Mail (Email) Security,”. Included are requirements on encryption, subject line content, and restrictions on personal email accounts.

• For alternate work sites the contractor shall abide by IRM 10.8.1.4.11.16 “PE-17 Alternate Work Site” or Publication 4812 section 21.16 “PE-17 Alternate Work Site,”.

Included are requirements for incident reporting, encryption, and secure access.

10. Incident and Situation Reporting. Contractors and subcontractors are required to report a suspected or confirmed breach in any medium or form, electronically, verbally or in hardcopy form immediately upon discovery. All incidents related to IRS processing, information or information systems shall be reported immediately upon discovery to the CO, COR, and CSIRC. Contact the CSIRC through any of the following methods:

CSIRC Contacts:

Telephone: 240.613.3606 E-mail to csirc@irs.gov

In addition, if the SBU information is or involves a loss or theft of an IRS IT asset, e.g., computer, laptop, router, printer, removable media (CD/DVD, flash drive, floppy, etc.), or non-IRS IT asset (BYOD device), or a loss or theft of hardcopy records/documents containing SBU data, including PII and tax information, the contractor shall report the incident/situation to the Treasury Inspector General for Tax Administration (TIGTA) hotline at (800) 366-4484.

11. Staff-Like Access to, Processing and Storage of Sensitive but Unclassified (SBU) Information. The contractor (including subcontractor) shall not allow contractor or subcontractor personnel to access, process, or store SBU on Information Technology (IT) systems or assets located outside the continental United States and its outlying territories.

Contractors (including subcontractors) utilizing their own IT systems or assets to receive or handle IRS SBU data shall not commingle IRS and non-IRS data.

12. Disposition of SBU Information. All SBU information processed during the performance of this contract, or to which the contractor (or subcontractor) was given staff-like access (as well as all related output, deliverables, or secondary or incidental by-products, information or data generated by the contractor or others directly or indirectly from the source material), regardless of form or format, shall be completely purged from all data storage components of the contractor’s or subcontractor facilities and computer systems, and no SBU/Personally Identifiable Information (PII) information will be retained by the contractor either--

• When it has served its useful, contractual purpose, and is no longer needed to meet the contractor’s (including subcontractor) other, continuing contractual obligations to the IRS or

• When the contract expires, or is terminated by the IRS (for convenience, default, or cause).

The contractor (including subcontractor) shall completely purge from its systems and any other storage, all SBU data, including PII and tax information (originals, copies, and derivative works) within 30 days of the point at which it has served its useful contractual purpose, or the contract expires or is terminated by the IRS (unless, the CO determines, and establishes, in writing, a longer period to complete the disposition of SBU data including PII and tax information).

The contractor shall provide to the IRS a written and signed certification to the COR that all SBU materials/information (i.e., case files, receipt books, PII and material, tax information, removable media (disks, CDs, thumb drives)) collected by, or provided to, the contractor have been purged, destroyed, or returned.

13. Records Management.

A. Applicability This language applies to all Contractors whose personnel create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists. Contractor/subcontractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

B. Definitions "Federal record" as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes IRS records;

2. does not include personal materials;

3. applies to records created, received, or maintained by Contractors pursuant to their IRS contract; and

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chapters 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Contractors shall ensure that all IRS data and IRS-derived data are in commercially available or open and non-proprietary format for transition (back to IRS) in accordance with the National Archives and Records Administration (NARA) disposition guidance.

4. IRS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of IRS or destroyed except for in accordance with the provisions of IRM 1.15.5, Relocating/Removing Records, the agency records schedules and with the written concurrence of the CO. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C.

2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must immediately notify the appropriate CO. The CO must report the loss using the PII Breach Reporting Form. Privacy, Governmental Liaison and Disclosure (PGLD, Incident Management) will review the PII Breach Reporting Form and alert the Records and Information Management (RIM) Program Office that a suspected records loss has occurred. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate CO immediately upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to IRS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand-carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the contract.

Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the approval of the CO prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and IRS guidance for protecting sensitive, proprietary information, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with IRS policy.

8. The Contractor shall not create or maintain any records containing any non-public IRS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974, Internal Revenue Code section 6103, or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. IRS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which IRS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor personnel assigned to this contract who create, work with, or otherwise handle records are required to take IRS-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flow down of requirements to subcontractors

1. The Contractor shall incorporate the substance of this language, its terms, and requirements including this paragraph, in all subcontracts under this contract, and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this language will be attributed to the Contractor.

IR1052.224-9001 Mandatory IRS Security & Privacy Training for Information Systems, Information Protection and Facilities Physical Access (Nov 2022)

The Federal Information Security Modernization Act of 2014 (FISMA) requires each federal agency to provide periodic information security and privacy awareness training to all contractors/subcontractors involved in the management, use, or operation of Federal information and information systems. In addition, contractor/subcontractor personnel are subject to the Taxpayer Browsing Protection Act of 1997, which prohibits willful unauthorized inspection of returns and return information as defined in IRC 6103(b)(2) and details that any violation of the Act could result in civil and criminal penalties under IRC sections 7213, 7213A, and 7431.

Contractor/subcontractor personnel are subject to the Privacy Act of 1974 (5 U.S.C.

552a; Pub. L. No. 93-579), December 1974. Contractor/subcontractor personnel are bound by the Records Management by Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

1. The contractor must ensure all new contractor/subcontractor personnel complete all assigned briefings which are based on the responses provided on the Risk

Assessment Checklist Form 14606. These responses pertaining to access to any IRS system, including basic LAN, email, and internet; access to any Sensitive but Unclassified (SBU) data; and access to any IRS…