Draft IRS IEP 2.0 PWS.pdf

IEP 2.0 Performance Work Statement

Contents

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 INTRODUCTION

C.1.1BACKGROUND

C.2 IEP 2.0 OBJECTIVES

C.2.1 Contract Assumptions

C.2.2 Contract Constraints

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

C.3.1 IEP Service and Program Integration Services

C.3.1.1 Program Management

C.3.1.2 Service Delivery

C.3.1.3 Service Integration Work Request Support

C.3.1.4 Support for IRS Enhanced Activities

C.3.2 IEP Infrastructure Services

C.3.2.1 Foundation

C.3.2.2 Reliability

C.3.2.3 Operation

C.3.2.4 Performance

C.3.2.5 Infrastructure Work Request Support

C.3.3 IEP Application Hosting Services

C.3.3.1 Application Hosting Support

C.3.3.2 Capacity Management

C.3.3.3 Incident Management

C.3.3.4 Problem Management

C.3.3.5 Monitoring

C.3.3.6 Application Infrastructure Integration Services (AIIS)

C.3.3.7 Configuration and Change Management

C.3.3.8 Service Catalog

C.3.3.9 Service Desk

C.3.3.10 Hosting Work Request Support

C.3.4 IEP Security Services

C.3.4.1 Security Risk Management Framework

C.3.4.2 Patch and Vulnerability Management

C.3.4.2.1 Vulnerability Management

C.3.4.2.2 Patch Management

C.3.4.2.3 Cloud Security Management

C.3.4.2.4 Reporting and Visibility

C.3.4.3 Plan of Action and Milestones (POA&M)

C.3.4.4 Security Continuous Monitoring

C.3.4.4.1 Continuous Monitoring

C.3.4.4.2 Asset Management

C.3.4.5 Security Configuration and Change Management

C.3.4.6 Security Audit

C.3.4.7 Incident Handling

C.3.4.8 Business Continuity

C.3.4.9 Security Control Assessment (SCA) and Contractor Security Assessment (CSA)

C.3.4.10 Defensive Cyber Operations

C.3.4.11 Portal Applications Security

C.3.4.12 Security Policy

C.3.4.12.1 Protecting Taxpayer Data

C.3.4.12.2 Access Management

C.3.4.12.3 Authority to Operate (ATO) Management

C.3.4.12.4 Conformance

C.3.4.13 Security Work Request Support

C.3.5 IEP Application Services

C.3.5.1 Application Engineering Support Services

C.3.5.2 Web User Analysis Data Collection and Analytics

C.3.5.3 Application Infrastructure Services

C.3.5.4 Application Work Request Support

C.3.6 Government Furnished Equipment (GFE) Cloud Services

C.3.7 IEP Transition Services

C.3.7.1 IEP 2.0 Operational Transition

C.3.7.2 Transition from IEP 2.0 Operations

C.3.7.3 Transition Work Request Support

C.4 PERFORMANCE REQUIREMENTS, STANDARDS AND SURVEILLANCE

C.4.1 Performance Requirements

C.4.2 Performance Standards

C.4.3 Surveillance

C.5 GOVERNMENT- FURNISHED PROPERTY

C.6 GOVERNMENT - FURNISHED INFORMATION

APPENDICES

TABLE OF FIGURES

Figure 1: IEP 1.5 High-Level Architecture

Figure 2: IRS Cloud Workload High-Level Architecture

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK

STATEMENT

C.1 INTRODUCTION

The Internal Revenue Service (IRS), Web Infrastructure Services (WISD), has embarked on a transformation for its web portals referred to as the Integrated Enterprise Portals (IEP). The IRS seeks a qualified Managed Service Provider (MSP) to deliver, operate, and manage the IEP services and to evolve IEP services as needed to support the changing dynamics of the many requirements due to Congressional mandates placed on the IRS.

The IEP MSP provides the IRS with secure application hosting services, allowing it to deliver business functionality to its various stakeholders, including taxpayers, tax preparers, and employees. The IEP MSP delivers these services through fully scalable, virtualized environments and cloud services that are dedicated to the IRS. The IEP provides fully integrated core services, including IT infrastructure, operations, security, application, integration and support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles.

(Refer to the Solicitation Section J, Attachment X.X, Current State of the IEP Systems and Services, for details of the existing landscape).

The Government is seeking MSP support to provide fully managed, scalable hosting services for applications that are accessed by IRS’ external stakeholders and its internal customers. The selected Contractor will be responsible for providing all labor, hardware, software, equipment, materials, communications, facilities, and other necessary IT infrastructure to implement, deploy, operate, manage, and support the IEP-hosted applications and services in a Federal Information Security Management Act (FISMA) moderate secure environment, as well as its underlying technology infrastructure.

C.1.1BACKGROUND

According to the Internal Revenue Manual (IRM) Part 2.25.2, the IRS standards dictate that “…interactive and batch electronic connections are organized through as few portals as feasible and that the use of those portals is appropriate to the IRS’ mission.” The current IEP has evolved into primary gateway for external users – including taxpayers, third-party tax preparers, and other business partners – and internal users – IRS employees and contractors with staff-like access – to access IRS business services.

The current IEP vendor provides a range of application development, hosting, security, and operations services for over 90 IRS business applications. Some of the IEP-hosted application suites, such as Modernized eFile (MeF) and Integrated Customer Communications Environment (ICCE), include multiple applications that are critical to the IRS’ core mission:

delivering a successful Filing Season annually.

The IEP 1.5 vendor delivers IEP capabilities through managed services. Table 1: IEP 1.5 Contract Service Areas provides a brief overview of the IEP contract service areas.

Table 1: IEP 1.5 Contract Service Areas

IEP 1.5 Service Area Description Portal Service and Program Integration Services

Provide IEP program and contract management to ensure quality service delivery.

Portal Infrastructure Services Provide and manage a cloud-like, private, virtualized infrastructure to host the IEP environment and services.

Portal Web Hosting Services

Provide comprehensive hosting support for applications accessed by external users and organizations. Services include IEP monitoring, incident management and application infrastructure Integration.

Portal Security Services Deliver IEP Active/Edge Cyber defense and analytics.

Services include security compliance and ATO maintenance.

Portal Application Services

Provide full life-cycle engineering support for IEP-hosted applications, including operations and maintenance.

Services include IRS.gov content management hosting.

Portal Website Help Desk Services Provide the IRS.gov Help Desk for taxpayers, including IEP website questions and navigation. (Help Desk services are not included in IEP 2.0)

Transition of Portal Operations Services Provide IEP services operations transition to other IRS designated service provider(s).

The IEP 1.5 is designed and implemented to modernize the IRS technology platform with a fully scalable, managed private cloud capability to provide a consistent, unified customer experience in a cost-effective manner. Figure 1: IEP 1.5 High-Level Architecture provides a brief illustration of the system.

IRS Protected Zone:

Enterprise Computing Center (IRS Managed)

IRS Integrated Enterprise Portal 1.5 (IEP MSP Managed)

External Entities

(Agencies, Trading

Partners, etc.)

ECC

ECC

Content Delivery Network

Drupal PaaS (IEP MSP provided) Web Content Management

System – IRS.gov

CSP GovCloud (IEP MSP provided)

IEP Service Offering

PaaS

Other IEP Service Catalog Services

MSP Provided Infrastructure

Affordable Care Act (ACA) Apps

Employee User Portal (EUP) Apps

Registered User Portal (RUP) Apps

Public User Portal (PUP) Apps

Legacy & Modern Applications

Data Storage

Networks

IAM

Legacy & Modern Applications

Data Storage

Networks

IAM

Internal IRS Users

(Employees)

External Users

(Tax Payers)

Registered User Portal (RUP) Apps

Public User Portal (PUP) Apps CSP Services

IAM

IEP Service Offering

PaaS

Other IEP Service Catalog Services

Data StorageNetworks IAM

Figure 1: IEP 1.5 High-Level Architecture

The IEP vendor delivers web-based services for internal and external users through multiple integrated sub-components. These components are described below.

Table 2: IEP 1.5 Components

IEP Component Description Public User Portal (PUP) • Consists primarily of the www.irs.gov website and was created to be the online presence of the IRS

• Disseminates tax news and information

• Intended to store non-Sensitive But Unclassified (SBU) information that pertains to Treasury Department Publication (TDP) 85-01 regulations

Registered User Portal (RUP) • Provides the essential security and technology components required for web access to modernized IRS business applications

• Comprised of a web-enabled, electronic commerce infrastructure that provides secure browser-based application services for tax practitioners and taxpayers

Employee User Portal (EUP) • Provides IRS employees and registered users with web-enabled access to conduct tax administration transactions through both the portal and Enterprise Application Integration Broker (EAIB) systems

Transactional Portal Environment

(TPE)

• Provides the essential security and technology components required for secure structure data exchange between the IRS and the Centers for Medicare and Medicaid Services (CMMS) and other agencies external to the IRS

In addition to the components described above, the IEP vendor has been tasked to implement and support additional hosting solutions that enable the IRS mission, including establishment of common services to support Treasury Cloud integration. Figure 2: IRS Cloud Workload High- Level Architecture depicts the cloud integration.

ATT

Netbond

Treasury Cloud (GFE)

IRS Hosted Applications (IEP MSP Integration/O&M)

Application Service

Database Service

IRS NetHub (IEP MSP Integration/O&M)

Trusted Gateway

IRS Protected Zone:

Enterprise Computing Center (IRS Managed)

ECC

ECC

Legacy & Modern Applications

Data Storage

Networks

IAM

Legacy & Modern Applications

Data Storage

Networks

IAM

Internal IRS Users

(Employees)

Figure 2: IRS Cloud Workload High-Level Architecture

C.2 IEP 2.0 OBJECTIVES

The IEP vendor provides services that support the IRS core mission, annual delivery of Filing Season. Continuity of IEP services to support current and future services and technologies is key to supporting the IRS mission.

The IEP 2.0 Acquisition has the following objectives:

• Ensure continuity for IEP services and provide access to IRS business systems and services and Taxpayer Transmission capabilities.

• Provide IEP services that efficiently leverage technology over the project's life cycle and accommodate service changes driven by IRS policies and business mandates.

• Complete transition of all IEP services to approved IEP 2.0 operations prior to the end of IEP 1.5 contract period of performance.

• Enhance IRS oversight and accountability for IEP services by using efficient IT service management processes to continually improve taxpayer experience and enhance customer service.

The IRS requires vendor support to provide expertise in program and project management, technical solutions and analysis, and system integration support to integrate modernized business solutions into the IRS. The support is required in all dimensions of the IEP 2.0 Program, including developing and supporting the deployment of new applications to meet IRS future business needs.

C.2.1 Contract Assumptions The below section describes the contractual assumptions.

Table 3: Contract Assumptions

C.2.2 Contract Constraints The below section describes the constraints associated with the contract.

Assumption Description IEP will continue to be the primary means for the IRS to provide business services to external stakeholders (e.g., taxpayers). based on current IRS policy (primary purpose of the portal is to support external interactions, not internal) The portal will be required to support currently undefined/unknown future IRS business requirements and needs based upon previous historical precedence (e.g., ACA, FATCA, ECM) Enterprise Operations (EOps) will be the organization responsible for the oversight and management of the IEP services (run by the Director of WISD) The solution/alternative will minimize unplanned organizational change impacts to business processes and roles/responsibilities IEP services will support cloud-based application and data hosting solutions IEP services will support legacy hosting environments IEP services will be able to scale up and scale down according to demand Current/modern technology will be leveraged and inserted as it becomes available and driven by business requirements IEP services will provide users with the ability to monitor application performance in IEP environments The solution will provide an integrated view of portal services.

The solution/alternative will provide additional visibility into service costs (e.g., O&M costs by application).

Service levels will be optimized to meet IRS requirements IEP service management processes will be able to integrate with IRS processes.

IEP services will support migration of at least 20 IEP legacy applications to the cloud per year.

IEP services will integrate with other IRS MSPs.

IEP services will be capable of supporting emerging IRS application and common services standards.

IEP services may be utilized to modernize applications.

IEP services will comply with applicable IRS common services and standards.

ELM ID IEP 2.0 Req ID Constraint Description 1364803 PLS-PLC-400 Constraint: Delivery of the proposed solution must comply with all applicable Internal Revenue Manuals (IRMs) - refer to the Solicitation Section C, Appendix B - References.

1364804 PLS-PLC-500 Constraint: In the absence of IRS policy, delivery of the proposed solution must comply with all applicable National Institute of Standards and Technology (NIST) Special Publications and manuals, Current Version.

1364805 PLS-PLC-600 Constraint: The proposed solution must provide an IT infrastructure where all facilities, hardware, software, network, and network connections are located in the United States of America.

1364807 PLS-PLC-800 Constraint: The proposed solution must deliver an infrastructure, including the operation of all devices, in a dual stack (IPv4/IPv6) environment in compliance with FAR requirement on Internet Protocol Version 6 (IPv6) -refer to FAR Section 511.170 Information Technology Coordination and Standards.

1364808 PLS-PLC-900 Constraint: All items delivered in the proposed solution and throughout the lifecycle of this contract must function and transmit, receive, and process data by using the IPv6 in compliance with current USGv6 Profile - refer to NIST SP 500-267B Revision 1.

1364907 PLS-PLC-1200 Constraint: All solutions must comply with the IRS One System Development Lifecycle processes, where applicable.

Pending PLS-PLC-1210 Constraint: IEP services must align to key IRS strategic initiatives (e.g., Modernization Plan, Technical Roadmap)

Pending PLS-PLC-1220 Constraint: IEP services must comply with Government security, privacy, and regulatory requirements (e.g., FedRAMP security controls, NIST SP 800-53, HIPAA, NARA)

Pending PLS-PLC-1230 Constraint: The ability of IRS IT organization to hire additional staff with appropriate skillsets will be limited.

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

This Performance Work Statement (PWS) describes the scope and expectations for a Performance-Based Acquisition with mission-oriented, outcome-driven performance measures and incentives. The scope of work to be performed is envisioned to include the following distinct operational areas:

Table 4: IEP 2.0 Contract Service Areas

IEP 2.0 Service Area Description IEP Service and Program Integration Services

Provide IEP program and contract management to ensure delivery of high-quality integrated services.

IEP Infrastructure Services Provide and manage an infrastructure to deliver the IEP environments and services.

IEP Application Hosting Services Provide comprehensive hosting support for applications accessed by external users and organizations. Services include IEP monitoring, service management, and application infrastructure integration.

IEP Security Services Provide secure IEP environments to minimize risk to IRS data, applications, services, and users. Deliver IEP Active/Edge Cyber defense and analytics. Services include security compliance and ATO maintenance.

IEP Application Services Provide full life-cycle engineering support for IEP-hosted applications, including operations and maintenance.

GFE Cloud Services Provide IEP services needed to support application hosting, integration, and operations for IRS workloads provisioned and deployed in IRS provided cloud environments.

IEP Transition Services Provide IEP services operations transition to and from other IRS designated service provider(s) while minimizing risks to IEP service continuity and operations.

C.3.1 IEP Service and Program Integration Services The objective of the IEP Service and Program Integration Services is for the vendor to provide the management necessary to deliver IEP services at the quality levels defined by the applicable service level objectives (SLOs). The requirements in this section are intended to request solutions from the vendor regarding how it will ensure quality service delivery.

C.3.1.1 Program Management ELM ID IEP 2.0 Req ID Contents

1369972 PSPIS-FR-100 The Contractor shall document and maintain a Program Management Plan that describes management processes, risk management (including supply chain risks), organizations, and tools that will be used to ensure timely delivery of quality products and services. The Contractor shall define the Program and Project Management approach to integrate program management activities and effective service delivery across all task orders issued for IEP services.

1369974 PSPIS-FR-1100 The Contractor shall provide a Program Manager who will be responsible for all IEP 2.0 contract service delivery and work performance. The position of Program Manager is considered to be a Key Personnel. The Program Manager shall ensure that the Contractor satisfies all requirements.

ELM ID IEP 2.0 Req ID Contents

1369975 PSPIS-FR-1200 The Program Manager will serve as the primary focal point for communication with the IRS IEP Program Manager, IRS Executive and Senior leadership, the Contracting Officer (CO), and the CO's Representative (COR). The Program Manager shall act as the central point of contact with the Government for all program-wide technical issues, and provide Program Management and Control to manage all IEP services performed under this contract within specified scope, quality, time, and cost objectives.

1369977 PSPIS-FR-1400 The Contractor shall identify subordinate functional and/or technical Project Managers to lead all IRS Integrated Enterprise Portal (IEP) key processes and ongoing project work. .

1369978 PSPIS-FR-1500 The Contractor shall participate in periodic and ad hoc meetings with the Government, as defined by the Task Orders awarded under this contract.

1369979 PSPIS-FR-1600 The Contractor shall support meetings with the Government, including:

agendas, meeting materials (as required), meeting minutes, and action items.

1369989 PSPIS-FR-2500 The Contractor shall collect and report Earned Value Management (EVM) data for work designated as Development Modernization or Enhancement (DME) in compliance with the provisions of the latest Treasury Acquisition Bulletin and the Treasury Earned Value Management Guide. EVM reporting will only by required for those projects which are within the thresholds established in the Treasury EVM Acquisition Bulletin.

1369971 PSPIS-FR-3090 The Contractor shall: include all budget amounts in the reported EVM data, whether allocated or not, load such data into all required formats of the Contract Performance Report (CPR) and ensure validity before transmitting to IRS. The calculation of EVM metrics (e.g., BCWS, BCWP and ACWP) shall comply with the guidelines and rule sets established in the Treasury EVM policy. Undistributed Budget (UB) will only be reported at the WBS level associated with the appropriate contract, task order or interagency agreement.

1369948 PSPIS-FR-3120 The IRS requires CPR formats 1, 3 and 5 to be provided on a monthly basis.

1369994 PSPIS-FR-300 The Contractor shall document a staffing plan in its Program Management Plan that details how it will ensure that it can effectively staff new projects.

1369946 PSPIS-FR-3010 The Contractor shall deliver a Project Management Plan (PMP) to document its processes and procedures to manage and control project execution. The PMP shall include a scope statement, including project deliverables, Work Breakdown Structure (WBS), project schedule, project organization including roles and responsibilities, and the results of an initial risk assessment of the project. The PMP shall also document the Contractor’s approach to performing change management and version control for contract deliverables and work products, quality management, and risk management.

1369957 PSPIS-FR-3020 The Contractor shall document an Operations Management Framework that clearly delineates their managed service lifecycle approach including, at a minimum, the equivalent of the most current version of ITIL practices.

1369969 PSPIS-FR-3070 The Contractor is required to maintain and report detailed information about project performance, schedule and cost, as well as activity progress, on a monthly basis for project control.

1369970 PSPIS-FR-3080 The Contractor shall prepare and submit a Contract Performance Report (CPR) each month describing the amount of work scheduled and achieved to date and the actual costs associated with that work (Format 1), baseline (Format 3), and variance analysis and explanations (Format 5). The Contractor shall prepare and submit the IRS Contract Performance Reports. All tasks supporting a single deliverable or work product, regardless of the owner/supplier of each task, shall be organized together and roll up to a single CWBS element and summary level task in the project schedule.

1369996 PSPIS-FR-3100 The Contractor shall develop a detailed project schedule that provides sufficient detail to effectively manage the project and minimize delivery risk.

1369949 PSPIS-FR-3130 The Contractor shall establish an overall framework for planning and executing continuous improvement for IEP. Contractor shall reserve 1% of the awarded contract value for innovation activities. The management and spending of innovation funding and its associated innovation activities shall follow IRS Innovation governance process.

1369950 PSPIS-FR-3140 The Contractor shall support all changes as needed by the IRS to the underlying SLO for Performance Targets around Requests, Changes and Releases on the IEP. The Contractor shall routinely report Service Level Objectives metrics.

1369951 PSPIS-FR-3150 The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 and any related IRS guidelines.

Pending PSPIS-FR-3210 The Contractor shall deliver all formal and work products by following IRM

2.150.2.3 Configuration Identification Index and Document Versioning Guidelines.

C.3.1.2 Service Delivery ELM ID IEP 2.0 Req ID Contents

1369981 PSPIS-FR-1800 The Contractor shall provide support to IEP stakeholders for IRS governance boards, as required.

1369983 PSPIS-FR-200 The Contractor shall document, execute and maintain a Service Delivery Framework that follows the IRS enterprise processes and incorporates industry best practices (e.g., ITIL). The Contractor shall obtain IRS permission prior to deviation from any IRS enterprise process.

1370005 PSPIS-FR-400 The Contractor shall provide a Communications Plan that describes its stakeholder engagement approach to ensure customer satisfaction.

1408937 PSPIS-FR-430 The Contractor shall provide an integrated service dashboard view across all service areas for near-real time visibility of critical service metrics and status conditions.

1375393 PSPIS-FR-410 The Contractor shall provide an integrated service dashboard with the capability to show service consumption information necessary to reflect service unit consumption and cost over specified time periods. The service consumption information should include granularity necessary to understand IEP hosting costs per hosted IRS application ecosystem (i.e.: at the IRS business service level).

Pending PSPIS-FR-415 The Contractor shall provide all data/information generated under this contract to the IRS when requested. This includes all data generated by Contractor solutions (e.g., log files, system configuration), as well as information generated through support services (e.g., OEM ticket information, slides, capacity reports).

1375394 PSPIS-FR-420 The Contractor shall perform continuous process improvement for IEP processes across all IEP services. The objective for IEP process improvements should focus on improving the service delivery quality and reflect improvements considered beneficial to the IRS The Contractor will work with IEP staff and stakeholders to identify beneficial targets for improvement.

1408933 PSPIS-FR-110 The Contractor shall comply with the IRS delivery model process for new projects, as required in accordance with IRM 2.16.1.

1408934 PSPIS-FR-1110 The Contractor shall allocate Program Management costs to a single active task order.

1408935 PSPIS-FR-1410 The Contractor shall empower Project Managers to coordinate with IRS stakeholders and make decisions to facilitate task delivery

1408932 PSPIS-FR-1810 The Contractor shall be capable of providing administration support for the operation of an IEP Technical Review Board (Solicitation Section J, Attachment, EOps TRB SOP).

1408938 PSPIS-FR-440 The Contractor shall provide an integrated service dashboard with the capability to display any operational data reporting elements specified in IEP service area requirements.

1408939 PSPIS-FR-450 The Contractor shall provide an integrated service dashboard capable of tracking service request status from service initiation through service fulfilment. Once the service is operational, the dashboard should display the critical service metrics along with actionable insights and drilldown capability to the lowest service component supporting the service delivery.

1369965 PSPIS-FR-3030 The ITIL Operations Management Framework shall establish a sound Operations program that maintains the integrity of the IRS Integrated Enterprise Portal Program systems and provides operational continuity for activities performed in the environment. It shall enable repeatable service management of Information Technology (IT) components as they evolve in all stages of portal development and transition, and into operations. Any updates to this framework will be provided on a semi-annual basis.

1369966 PSPIS-FR-3040 The Contractor shall propose an ITIL-based Service Strategy process in partnership with the IRS to seek new solutions and initiatives for business problems, and provide proactive recommendations and assessment.

1369967 PSPIS-FR-3050 The Contractor shall develop and maintain an Integrated Master Schedule which incorporates the Contractor, sub-contractor and IRS stakeholder detailed tasks necessary to ensure successful project execution.

1369968 PSPIS-FR-3060 The Contractor shall propose a methodology for program measurement in the Quality Assurance Program, including a process for developing, implementing, and monitoring a set of performance measures to ensure that program activities are effectively and efficiently supporting both business and IT strategies. This includes implementing program-wide measures, quantifiable outcomes, and providing an approach for monitoring actual-versus-expected performance.

Pending PSPIS-FR-3220 The Contractor will develop solutions that utilize enterprise common services and standards.

C.3.1.3 Service Integration Work Request Support The objective of Service Integration Work Request Support is for the contractor to be capable of providing additional services to meet work request requirements.

The Contractor, at the option of the IRS, may be tasked to deliver additional IEP services to support new capabilities in response to evolving IRS business requirements and legislative mandates. When required, the Government will issue Work Requests (WRs) for the Contractor to perform this work. These work requests are intended to be in addition to forecasted IEP service demand and capacity flexibility as required by IEP capacity, scalability, and performance management requirements.

ELM ID IEP 2.0 Req ID Contents

2559808 PSPIS-FR-3160 The Contractor shall be capable of supporting IRS issued work requests (WR) to support new IRS capability requirements.

2559809 PSPIS-FR-3170 The Contractor shall integrate the IEP WR process with the service catalog and IEP governance processes (e.g., Technical Review Board, Solicitation Section J, Attachment, EOps TRB SOP).

2559810 PSPIS-FR-3180 The Contractor shall develop a WR process to include developing a Very Rough Order of Magnitude (VROM) estimates to support the approval process for draft WRs in accordance with IRM 2.22.1 Unified Work Request (UWR) Process.

2559811 PSPIS-FR-3190 The Contractor shall provide VROM estimates and WR responses that include the following:

a. Description of the technical work to be accomplished to deliver WR requirements

b. Planned schedule to support the WR and meet the WR objectives

c. Level of Effort estimates based on IEP services required to support the

WR

d. Assumptions and Constraints associated with the proposed technical solution, cost and schedule

C.3.1.4 Support for IRS Enhanced Activities

The objective of Support for IRS Enhanced Activities is for the Contractor to be capable of supporting IRS activities and support requirements for enhanced activities such as Filing Season and Affordable Care Act (ACA) Open Enrollment. Support includes accommodating increased traffic volume for business systems, enforcing more stringent deployment guidelines, and enabling enhanced service management requirements (e.g., Incident Management, Problem Management, and Capacity Management). During readiness activities, there is a specific escalation of approval levels defined in the IRS Production Environment Control Process for business services and applications impacting production environments.

IRS conducts Filing Season every year, usually extending from January 1st through April 30th.

During the Filing Season, IRS expects increased traffic volume for business systems.

Accordingly, IRS usually performs readiness activities prior to the Filing Season and implements enhanced Filing Season support activities during the Filing Season.

IRS ACA Open Enrollment periods are defined as periods when a large number of citizens are expected to enroll in the ACA via a healthcare exchange and when information verification will be required with IRS via the IEP ACA TPE and ISS. A large number of transactions on the IEP ACA TPE and ISS are expected during this period. This period has generally occurred during the following months:

1. Annual Exchange Enrollment Period: January – April – 1095B/C Submission Period

2. Exchange Enrollment Period: November – January

Accordingly, IRS usually performs readiness activities prior to Open Enrollment period and enables enhanced support activities during the Open Enrollment period.

1369984 PSPIS-FR-2000 The Contractor shall ensure IEP services meets IRS business demands during IRS enhanced readiness activities (e.g., Filing Season and ACA Open Enrollment).

2559813 PSPIS-FR-2010 The Contractor shall ensure IEP service management meets IRS business demands during enhanced IRS readiness activities (e.g., Filing Season and ACA Open Enrollment).

1369985 PSPIS-FR-2100 During enhanced IRS readiness activities, the Contractor shall comply with the more stringent IRS deployment control and approval processes (i.e., Production Environment Control Process).

C.3.2 IEP Infrastructure Services The objective of the IEP Infrastructure Services is for the vendor to provide the infrastructure necessary to deliver IEP services. Infrastructure includes facilities, hardware, software, middleware, network connectivity, operating system, compute resources, storage, and peripherals. The requirements in this section are intended to request solutions from the vendor regarding how it will deliver infrastructure services to support existing and future IEP service needs.

C.3.2.1 Foundation ELM ID IEP 2.0 Req ID Contents

1382587 PIS-FR-100 The Contractor shall document the IEP infrastructure, including the physical facilities, system architecture, components, and services necessary to establish this infrastructure; and all IRS applications' workloads hosted in this infrastructure.

1382594 PIS-FR-200 The Contractor shall design the IEP infrastructure to host all current IRS IEP applications' workloads, development workflow, and development dependencies.

1385041 PIS-FR-210 The Contractor shall design the IEP infrastructure to host new IRS applications' workloads and development dependencies.

1382596 PIS-FR-400 The Contractor shall design the IEP infrastructure to enable access to all IRS applications' workloads, which are hosted in this infrastructure, over secure communications network.

1385028 PIS-FR-410 The Contractor shall design the IEP infrastructure to handle changes in demands or requirements of all IRS applications' workloads hosted in this infrastructure.

1382600 PIS-FR-800 The Contractor shall design the IEP infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized external users (users from IP addresses outside of IRS enclave) to access these IRS applications.

1385029 PIS-FR-810 The Contractor shall design the IEP infrastructure and the IRS applications' workloads hosted in this infrastructure to allow authorized internal IRS users to access these IRS applications.

1385030 PIS-FR-820 The Contractor shall design the IEP infrastructure to allow authorized IEP applications to interface with systems and application components hosted in IRS Enterprise Computing Centers (ECCs). The workloads of all such IEP applications also shall be designed to enable this interface.

1385031 PIS-FR-830 The Contractor shall design the IEP infrastructure to allow authorized IEP applications to interface with systems and application components hosted in IRS Enterprise Cloud ecosystem. The workloads of all such IEP applications also shall be designed to enable this interface.

1385026 PIS-FR-1310 The Contractor shall design the IEP infrastructure to be able to control service request rates on API Gateways and web traffic to protect them from abuse.

2457775 PIS-FR-1800 The Contractor shall avoid the use of custom solutions in the IEP infrastructure and all IRS applications' workloads hosted in this infrastructure.

The Contractor shall obtain the IRS concurrence on the need to use a custom solution.

1364768 PIS-FR-1810 The Contractor shall design and implement all IT infrastructure platforms by utilizing and meeting the accepted industry and Federal government interoperability requirements, standards, and best practices that minimize the dependence on custom or proprietary solutions.

C.3.2.2 Reliability

1383166 PIS-FR-1510 The Contractor shall design the IRS application's workload to scale to meet the workload demands. The term "application workload" is intended to indicate the underlying IEP services and resources allocated to the application necessary to support the application's execution and required performance across all IEP environments and development tool dependencies.

1383190 PIS-FR-1520 The Contractor shall design the IEP infrastructure to meet IRS availability and performance standards for all IRS applications’ workloads hosted in IEP infrastructure.

1383198 PIS-FR-1530 The Contractor shall design the IEP infrastructure with sufficient redundancies to support to all hosted applications' production availability requirements up to 24x7.

1383221 PIS-FR-1540 The Contractor shall design the IEP infrastructure with sufficient redundancies to support to all hosted applications' non-production availability requirements up to 24x7.

1383224 PIS-FR-1500 The Contractor shall maintain the IEP infrastructure in compliance with N/N-1 versions/standards allowable within IRS enterprise guidelines, unless exempted by IRS, and patch or replace them in accordance with IRM 2.17.1, Infrastructure Currency, Infrastructure Currency Policy for Software.

1382592 PIS-FR-1400 The Contractor shall support applications owners to ensure that applications will operate in IEP infrastructure refreshes.

C.3.2.3 Operation

1385019 PIS-FR-1600 The Contractor shall evolve the IEP infrastructure to support improved operations and cost savings.

1385020 PIS-FR-1610 The Contractor shall design the IEP infrastructure to be capable of integrating with IRS enterprise systems and processes.

1385021 PIS-FR-1620 The Contractor shall design the IEP infrastructure to be capable of being decoupled from IRS enterprise systems and processes.

1385022 PIS-FR-1630 The Contractor shall design the IEP infrastructure to be capable of supporting automated provisioning.

1385023 PIS-FR-1640 The Contractor shall schedule joint exercises (e.g., game days) to test the IEP infrastructure; all IRS applications' workloads hosted in this infrastructure; the associated processes, procedures, and alarm solution; and verify that alarm solution recognizes issues correctly.

1385025 PIS-FR-1650 The Contractor shall work with IRS to establish metrics baselines for operational improvement, investigation, and intervention; collect and analyze metrics, and validate and report operations success and how the success changes over time.

C.3.2.4 Performance

ELM ID IEP 2.0 Req ID Contents

2457772 PIS-FR-1700 The Contractor shall design the IEP infrastructure to enable provisioning of reliable, scalable, and secure storage to all IEP hosted IRS applications' workloads.

2457774 PIS-FR-1710 The Contractor shall design and provision network solutions to satisfy application requirements.

C.3.2.5 Infrastructure Work Request Support The objective of Infrastructure Work Request Support is for the contractor to be capable of providing additional services to meet work request requirements, only as directed.

ELM ID IEP 2.0 Req ID Contents

2556243 PIS-FR-1720 The Contractor shall provide IEP Infrastructure services necessary to meet specific work request objectives and requirements.

C.3.3 IEP Application Hosting Services The objective of the IEP Application Hosting Services is for the vendor to provide comprehensive hosting support for applications accessed by external users and organizations.

Areas covered by these requirements include IEP environment creation and maintenance, service management (e.g., incident management, service catalog), and monitoring. The requirements in this section are intended to request solutions from the vendor regarding how it will deliver application hosting services to support existing and future IEP service needs.

C.3.3.1 Application Hosting Support ELM ID IEP 2.0 Req ID Contents

1385707 PWHS-FR-100 The IRS is seeking to obtain IEP Application Hosting services. The Contractor shall define and document, in an Application Hosting Concept of Operations (CONOPS), its solution to provide application hosting support for development, testing, integration and production, including provisions for capacity management, incident management, performance monitoring, and infrastructure integration support.

1385709 PWHS-FR-300 The Contractor shall provision application development/testing/production environments according to the current AS-IS IEP specifications and IRS Enterprise standards, to include virtualized servers, containers, API gateways, Low Code Development Platform (LCDP), and security standards (Solicitation Section J, Attachment, Current State of the IEP Systems and Services).

1385710 PWHS-FR-400 The Contractor shall support release management for each application.

Normally each application will have multiple releases and each release needs certain types of IEP application hosting environments. The Contractor shall provide lower-level (non-production) environments and production environments, as requested by each application team. IEP environments interfacing with IRS backend environments should align with the Enterprise-defined environment and security requirements. All IEP provisioned environments shall support flexible configuration options needed to support customer requirements.

1369876 PWHS-FR-600 IEP non-production environments shall be capable of being configured for IRS third-party (i.e., contractors other than IEP contractor) application developers' access as needed to support external system integration testing.

1368144 PWHS-FR-700 The Contractor shall ensure all IEP non-production environments are synchronized with the corresponding IEP production environment.

1385713 PWHS-FR-1000 The Contractor shall demonstrate the accuracy, validity, effectiveness and maturity of the backup and restore capability, including, but not limited to, satisfying IRS authorized third party auditing needs with contractor's backup and restore parameters.

1385714 PWHS-FR-1100 The Contractor shall provide IEP Application Hosting Operations and Maintenance services in accordance with industry-leading practices for IT service delivery frameworks. The IT service delivery processes should align with IRS service delivery processes.

1385716 PWHS-FR-1300 The Contractor shall ensure IEP services satisfy availability SLOs, regardless of contractor routine maintenance activities.

C.3.3.2 Capacity Management

1385718 PWHS-FR-1400 The Contractor shall provide sufficient capacity to meet IRS business requirements at the applicable service levels (utilization, performance) in accordance with IRM 2.144 Capacity Management.

1385719 PWHS-FR-1500 The Contractor shall develop a Capacity Management Plan that details how its solution will comply with all applicable SLOs. This Capacity Management Plan will address all components necessary for IEP services (e.g.: systems processing, memory, storage, staffing and licensing for IEP).

1385723 PWHS-FR-1510 The Contractor shall have the ability to scale capacity to meet additional IEP service demand while still satisfying applicable SLOs (e.g., timeliness, utilization, performance).

1385724 PWHS-FR-1520 The Contractor shall have the ability to track and report capacity metrics for discrete components of the IEP environment (e.g., application servers, virtual machines).

1385725 PWHS-FR-1600 The Contractor shall develop Capacity Management plans and processes informed by industry best practices for service management (e.g., ITIL).

1385726 PWHS-FR-1700 The Contractor shall plan for future capacity demand changes by collecting inputs and requirements from available sources (e.g., historical demand change data and projections, stakeholder requirements).

1369918 PWHS-FR-2300 The Contractor shall provide a Capacity Management Plan which describes their process for capacity management to ensure that all current and future capacity and performance aspects of the IEP services are provided to meet business requirements.

1369917 PWHS-FR-2400 The Contractor shall provide the capability to access and view capacity information on-demand. The capacity information available should include real-time, historical, and predictive data and enable views by hosted application services.

Pending PWHS-FR-2410 The Contractor shall provide "right-sizing" recommendations based on IEP applications resource usage and service consumption.

Pending PWHS-FR-2420 The Contractor shall provide Capacity Optimization reports summarizing IEP services consumptions and recommendations for IEP applications service consumption/recommendations for capacity optimization for both production and non-production environments.

Pending PWHS-FR-2430 The Contractor shall provide designated IRS personnel access to CSP-native cost, utilization data and optimization reports for all IRS IEP cloud-hosted applications.

1369916 PWHS-FR-2500 The Contractor shall provide the capability to generate reports on-demand.

The reports should allow analysis of real-time, historical, and predictive data and enable views by services (e.g., application).

C.3.3.3 Incident Management

1369914 PWHS-FR-2700 The Contractor shall establish and operate Incident Management processes that incorporate industry best practices and align with IRS policies in accordance with IRM 2.148.2, Incident Management Process and Solicitation Section J, Attachment, ITOCC Incident Management Section SOP.

1369922 PWHS-FR-3200 The Contractor shall develop an IEP Incident Management Standard Operating Procedure (SOP) prior to the IEP operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1385734 PWHS-FR-3210 The Contractor shall prioritize incidents in accordance with the IRS EOps Incident Management SOP priority criteria (Solicitation Section J, Attachment, ITOCC Incident Management Section SOP).

1369919 PWHS-FR-2900 The Contractor shall comply with Incident Management SLOs (Solicitation Section J, Attachment, QASP Performance Standards).

1385736 PWHS-FR-2910 The Contractor shall manage all incidents related to contractor-managed IEP services. For all incidents that impact IRS, the Contractor shall service them and notify IRS in accordance with IRS Incident Management process and incident prioritization designation (Solicitation Section J, Attachment, ITOCC Incident Management Section SOP).

1369920 PWHS-FR-3000 The Contractor shall participate in the IRS Incident Management process, including ticket creation, triage, assignment, resolution, and closure.

1385738 PWHS-FR-3010 The Contractor shall provide the capability for the IRS to generate reports and view incident status on-demand.

1385739 PWHS-FR-3020 The Contractor shall use the IRS ticketing system to support IEP Incident Management processes and track progress towards resolution.

1385740 PWHS-FR-3030 The Contractor shall comply with the IRS EOps Incident Management SOP regarding entry and tracking of incidents in the IRS system (Solicitation Section J, Attachment, ITOCC Incident Management Section SOP).

1369923 PWHS-FR-3300 The Contractor shall provide the capability for the IRS to view and verify compliance with incident management SLOs on demand.

C.3.3.4 Problem Management

1269453 PWHS-FR-3310 The Contractor shall develop an IEP Problem Management Standard Operating Procedure (SOP) prior to the IEP operational phase. The Contractor shall maintain and follow this SOP throughout the contract period of performance.

1369911 PWHS-FR-3320 The Contractor's Problem Management process shall comply with the IRS EOps Problem Management SOP (Solicitation Section J, Attachment, EOps Problem Management Process SOP).

1369912 PWHS-FR-3330 The Contractor shall use the IRS ticketing system to record problems and track progress towards resolution.

C.3.3.5 Monitoring

1269452 PWHS-FR-3400 The Contractor shall provide monitoring services to enable the successful delivery of IEP services

1272856 PWHS-FR-3600 The Contractor shall document its monitoring processes in a Monitoring and Management Plan. This plan should demonstrate how the Contractor's processes, tools, and staffing enable the IRS to have an integrated, timely view into the health of IEP services.

1272857 PWHS-FR-3700 The Contractor shall provide end-to-end monitoring of IEP services. The term "end-to-end” is intended to include the monitoring of IEP services integration with IRS interfaces.

2461811 PWHS-FR-3710 The Contractor shall provide monitoring data in a format that can be used by IRS systems and processes.

1272858 PWHS-FR-3800 The Contractor shall provide IRS users the capability to view monitoring data on demand.

1272865 PWHS-FR-4100 The Contractor shall be capable of supporting the existing IEP applications' built-in monitoring capabilities or equivalent monitoring capabilities available using the IEP monitoring tools.

1272864 PWHS-FR-4200 The Contractor shall provide periodic monitoring reports regarding the health and status of IEP services.

1272900 PWHS-FR-3520 The Contractor shall provide the capability for IRS users to access monitoring data and reports on demand.

1272862 PWHS-FR-4400 The Contractor shall provide the capability to collect, store, archive, and retrieve log files and monitoring event data.

1272861 PWHS-FR-4500 The Contractor shall support IRS-authorized audits, including information requests from third parties.

1272901 PWHS-FR-3530 The Contractor shall comply with IRS data storage and retention policies in accordance with IRM 1.15, Records and Information Management.

1272902 PWHS-FR-3540 The Contractor shall identify and resolve system problems using Application Discovery, Tracing and Diagnostic (ADTD) capabilities.

1272903 PWHS-FR-3550 The Contractor shall use Artificial Intelligence for IT Operations (AIOps) capabilities to automate routine manual processes while continuously improving the ability to autonomously identify and determine root causes.

1272904 PWHS-FR-3560 The Contractor shall provide the capability to use Container Monitoring and Control to monitor and collect metrics to ensure applications running in containers are performing properly.

1272905 PWHS-FR-3570 The Contractor shall provide the capability to use Microservice Monitoring and Logging Control to prevent, predict, and detect microservice anomalies and issues.

1272906 PWHS-FR-3580 The Contractor shall monitor and control the end-user interaction experience with the system/application using digital experience monitoring and control capabilities.

2461835 PWHS-FR-3590 The Contractor shall provide monitoring and control reporting, dashboards, alerts capable of providing summary/detailed information, configured to run per schedule/ad-hoc using context-drive data.

C.3.3.6 Application Infrastructure Integration Services (AIIS)

1369924 PWHS-FR-4600 The Contractor shall provide Application Infrastructure Integration Services (AIIS) to ensure applications are correctly configured in the…