IEP 2.0 Service Initiation O-M TO PWS DRAFT.pdf

IEP Service Initiation and O&M Task Order PWS

Contents

SECTION C - DESCRIPTION/SPECIFICATIONS/ IEP SERVICE INITIATION AND O&M WORK STATEMENT

C.1 PURPOSE

C.2 SCOPE

C.2.1 INITIAL SERVICE DELIVERY

C.2.2 IEP SERVICE DELIVERY OPERATIONS AND MAINTENANCE (O&M)

C.3 OBJECTIVES

C.3.1 IEP TRANSITION SERVICES

C.3.2 IEP SERVICE AND PROGRAM INTEGRATION SERVICES

C.3.2.1 Task Initiation C.3.2.2 Task Order Management

C.3.3 IEP INFRASTRUCTURE SERVICES

C.3.4 IEP APPLICATION HOSTING SERVICES

C.3.5 IEP SECURITY SERVICES

C.3.6 IEP APPLICATION SERVICES

C.3.7 GOVERNMENT FURNISHED EQUIPMENT (GFE) CLOUD SERVICES

C.3.8 IEP OPERATIONS AND MAINTENANCE

C.4 TASK ORDER CONSTRAINTS

C.5 PERIOD OF PERFORMANCE

C.6 SURVEILLANCE METHODS

APPENDIX A – DELIVERABLES

SECTION C.3.1, IEP TRANSITION SERVICES DELIVERABLES:

SECTION C.3.2, IEP SERVICE AND PROGRAM INTEGRATION SERVICES DELIVERABLES:

SECTION C.3.3, IEP INFRASTRUCTURE SERVICES DELIVERABLES:

SECTION C.3.4, IEP APPLICATION HOSTING SERVICES DELIVERABLES:

SECTION C.3.5, IEP SECURITY SERVICES DELIVERABLES

SECTION C.3.6, IEP APPLICATION SERVICES DELIVERABLES:

SECTION C.3.7, GFE CLOUD SERVICES DELIVERABLES:

APPENDIX B – SERVICE LEVEL OBJECTIVES

SECTION C.3.1, IEP TRANSITION SERVICES SLOS:

SECTION C.3.8, IEP OPERATIONS AND MAINTENANCE SLOS:

Section C - DESCRIPTION/SPECIFICATIONS/ IEP

SERVICE INITIATION AND O&M WORK STATEMENT

C.1 Purpose

The purpose of this task order is to establish Integrated Enterprise Portals 2.0 (IEP 2.0) services with initial service delivery and transitioning of current portal services and IEP hosted applications to IEP 2.0 portal services from the existing IEP 1.5 Portal Services environments.

This effort is intended to transition services for the IEP fully integrated core services, including

IT infrastructure, operations, security, application, integration and support, and program management services under Contract number TIRNO-XX-X-XXXXX for IEP 2.0 through initial IEP 2.0 Operations and Maintenance (O&M).

In order to ensure continuity of IEP operations, the IRS requires the IEP 2.0 Managed Service

Provider (MSP) to seamlessly transition all applicable services from the IEP 1.5 MSP to the IEP

2.0 environments and hosting solutions.

C.2 Scope

This work includes contractor support services necessary to provide all labor, hardware, software, equipment, materials, communications, facilities, and other necessary IT infrastructure to implement and deploy, the existing IEP websites in a Federal Information

Security Management Act (FISMA) moderate secure environment, as well as its underlying technology infrastructure.

The IEP 2.0 transition includes migrating and deploying all IRS created or acquired applications supported by IEP 1.5 MSP to IEP 2.0 hosting environments. This includes, but is not limited to, appropriate operating systems, databases, middleware, software tools, and managed services for application development, testing, and production operations.

During this transition time period, the Contractor shall coordinate with IEP application owners, the incumbent Contractor and other IRS stakeholders to migrate all applications (including applications managed by the incumbent Contractor.

C.2.1 Initial Service Delivery

The activities addressed by this scope of work includes support for establishing all IEP 2.0 services to provide IEP 2.0 PWS requirements for the IEP service areas:

• IEP Service and Program Integration Services

• IEP Infrastructure Services

• IEP Application Hosting Services

• IEP Security Services

• IEP Application Services

• Government Furnished Equipment (GFE) Cloud Services

These services shall be initiated for the IEP workloads as described in the Current State of the

IEP Systems and Services document.

C.2.2 IEP Service Delivery Operations and Maintenance (O&M)

The task work scope includes assuming IEP 2.0 O&M as each services becomes available for use and approved for operations.

C.3 Objectives

The IEP Service initiation and O&M task order objectives include preparing for, testing, and successfully demonstrating the production readiness of all in-scope services including the infrastructure services, the Application Hosting and Operations environments, the integration of current applications and systems, the Web Content Management and Search solutions, and compliance with all the Security and Privacy requirements listed in the contract PWS. The objectives outcomes include the following:

• Operational transition to the IEP 2.0 services from the current IEP 1.5 services with no service interruptions.

• IEP 2.0 Infrastructure provisioning as necessary to support the IEP 2.0 service levels for all IEP 2.0 services.

• Successful migration of IRS selected IEP hosted applications and services to the IEP 2.0 environment.

• Initial start of IEP 2.0 O&M with the successful application production deployments and

IEP 2.0 O&M services delivery.

• Ensure timely issuance of an Authority to Operate (ATO) for IEP environments that will enable low-risk transition of IEP services from the incumbent to the new vendor environments.

The deliverables for this Task Order are identified in Appendix A.

C.3.1 IEP Transition Services

The objective of the IEP Transition Services is to minimize risk to the continuity of IEP operations associated with contract and MSP transitions. The scope of work for transition is to perform all activities necessary to assume full responsibility for the operation of IEP services with IEP-hosted applications fully operational and the new IEP services are approved for operations by the IRS. Dependent on IEP 1.5 contract status as of when the IEP 2.0 contract is awarded and filing season related constraints, the IRS plans to accommodate a transition duration for up to 18 months.

ELM ID IEP 2.0 Req ID Contents

Pending IEPTSTO01-FR-

The Contractor shall deliver IEP Transition services to meet IEP requirements in accordance with IEP PWS IEP Transition Services area.

Pending IEPTSTO01FR-

The Contractor shall provide detailed definitions for how each SLOs will be measured for IRS concurrence to update the QASP for approval.

Pending IEPTSTO01-FR-

The Contractor shall establish baseline control for all IEP service areas as each is delivered and approved for use throughout the period of performance.

ELM ID IEP 2.0 Req ID Contents

Pending IEPTSTO01-FR-

The Contractor shall develop and maintain the applications’ current state inventory baseline and continue to update it (as needed) as applications are deployed to IEP 2.0.

C.3.2 IEP Service and Program Integration Services

The objective of the IEP Service and Program Integration Services is for the vendor to provide the management necessary to deliver IEP services to enable operational transition to the IEP 2.0 services from the current IEP 1.5 services with no service interruptions.

C.3.2.1 Task Initiation

Within two weeks of task order award, the Contractor shall conduct an orientation briefing for the Government to initiate the communication process between the Government and Contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held at the Government's facility and both parties shall mutually agree upon the date and time. The completion of this briefing shall result in the following:

• A mutual understanding and confirmation of the desired relationship between the government and the Contractor, more specifically directed at a mutual exchange of knowledge and a sharing of responsibilities as the IRS determines appropriate.

• A discussion regarding the IEP 2.0 Quality Assurance Surveillance Plan (QASP) in order to answer any questions and concerns of the Contractor.

• A discussion of the draft IEP 2.0 Transition Plan and confirmation of the Contractor’s and Government’s mutual understanding of the plan..

• The identification of Contractor and government personnel who will perform work under this task order will be introduced, if needed.

• The Government will show the applicable facilities to the Contractor, if the Contractor will be performing work at the Government site, if needed.

o The Government will facilitate a tour of the applicable Government facilities to the Contractor, if the Contractor will be performing work at the Government site.

• The government may provide Government Furnished Property (GFP) to the Contractor at this time.

• The resolution of any issues concerning the Minimum Background Investigation on contractor personnel will be discussed. The Contractor shall confirm their understanding of the work to be accomplished under this task order.

• The government will provide the Contractor with report formats and delivery schedules for each report.

• The Contractor shall provide the accounting period end dates.

C.3.2.2 Task Order Management

The Contractor shall deliver IEP Service and Program Integration services to meet IEP requirements in accordance with IEP PWS IEP Service and Program Integration Services area.

C.3.3 IEP Infrastructure Services

The objective of the IEP Infrastructure Services is to provision IEP 2.0 Infrastructure as necessary to support the IEP 2.0 service levels for all IEP 2.0 services. Infrastructure includes facilities, hardware, software, cloud services, middleware, network connectivity, operating system, compute resources, storage, and peripherals.

ELM ID IEP 2.0 Req ID Contents

Pending PISTO01-FR-

The Contractor shall deliver IEP Infrastructure services to meet IEP requirements in accordance with IEP PWS IEP Infrastructure Services area.

C.3.4 IEP Application Hosting Services

The objective of the IEP Application Hosting Services is for the vendor to provide comprehensive hosting support for applications accessed by external users and organizations.

This includes the successful migration of all IEP hosted applications and services to the IEP 2.0 environment and the initial start of IEP 2.0 O&M with the successful application production deployments and IEP 2.0 O&M services delivery. Areas covered by these requirements include

IEP environment creation and maintenance, service management (e.g., incident management, service catalog), and monitoring. As application hosting services are approved for operational use, they will be operated and maintained in accordance with IEP O&M services delivery requirements.

ELM ID IEP 2.0 Req ID Contents

Pending PWHSTO01-FR-

The Contractor shall deliver IEP Application Hosting services to meet IEP requirements in accordance with IEP PWS IEP Application Hosting Services area.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Application Hosting Support services to meet IEP requirements in accordance with IEP PWS Application Hosting Support section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Capacity Management services to meet IEP requirements in accordance with IEP PWS Capacity Management section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Incident Management services to meet IEP requirements in accordance with IEP PWS Incident Management section.

Pending PWHS TO01-

FR-500

The Contractor shall establish initial delivery of Problem Management services to meet IEP requirements in accordance with IEP PWS Problem Management section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Monitoring services to meet IEP requirements in accordance with IEP Monitoring section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Application Infrastructure Integration Services (AIIS) to meet IEP requirements in accordance with IEP Application Infrastructure Integration Services section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Configuration Management and Change Management services to meet IEP requirements in accordance with IEP PWS Configuration Management and Change Management section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Service Catalog services to meet IEP requirements in accordance with IEP PWS Service Catalog section.

Pending PWHSTO01-FR-

The Contractor shall establish initial delivery of Service Desk services to meet IEP requirements in accordance with IEP PWS Service Desk section.

C.3.5 IEP Security Services

The objective of the IEP Security Services to ensure timely issuance of an Authority to Operate for IEP environments that will enable low-risk transition of IEP services from the incumbent to the new vendor environments. The IEP MSP will minimize risk to the IRS by effectively securing IEP environments, applications, and services. Services in this area include delivering

IEP Active/Edge Cyber defense, security compliance, and obtaining the initial ATO approval from the IRS.

ELM ID IEP 2.0 Req ID Contents

Pending PSSTO01-FR-

The Contractor shall deliver IEP Security services to meet IEP requirements in accordance with IEP PWS IEP Security Services area.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Risk Management Framework services to meet IEP requirements in accordance with IEP PWS Security Risk Management Framework section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Patch and Vulnerability Management services to meet IEP requirements in accordance with IEP PWS Patch and Vulnerability Management section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Plan of Action and Milestones (POA&M) services to meet IEP requirements in accordance with IEP PWS Plan of Action and Milestones (POA&M) section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Continuous Monitoring services to meet IEP requirements in accordance with IEP PWS Security Continuous Monitoring section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Configuration and Change Management services to meet IEP requirements in accordance with IEP PWS Security Configuration and Change Management section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Audit services to meet IEP requirements in accordance with IEP PWS Security Audit section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Incident Handling services to meet IEP requirements in accordance with IEP PWS Incident Handling section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Business Continuity services to meet IEP requirements in accordance with IEP PWS Business Continuity section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Control Assessment (SCA) and Contractor Security Assessment (CSA) services to meet IEP requirements in accordance with IEP PWS SCA and CSA section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Defensive Cyber Operations services to meet IEP requirements in accordance with IEP PWS Defensive Cyber Operations section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Portal Applications Security services to meet IEP requirements in accordance with IEP PWS Portal Applications Security section.

Pending PSSTO01-FR-

The Contractor shall establish initial delivery of Security Policy services to meet IEP requirements in accordance with IEP PWS Security Policy section.

Pending PSSTO01-FR-

The Contractor shall obtain and maintain the initial Authority to Operate (ATO) approval from the IRS.

C.3.6 IEP Application Services

The objective of IEP Applications Services is to provide full life-cycle engineering support for

IEP MSPmanaged applications, including the initial O&M for MSP-managed applications.

Services include IRS.gov content management hosting. The requirements in this section are intended to request solutions from the vendor regarding how it will deliver services to existing and future IRS applications and initiatives.

The government desires a digital Web User Analytics Data Collection and Analytics Solution that is end-to-end, scalable for future growth, meets changing legislative demands, and is aligned to the mission of the IRS to better serve the American Taxpayer.

ELM ID IEP 2.0 Req ID Contents

Pending PASTO01-FR-

The Contractor shall deliver IEP Application services to meet IEP requirements in accordance with IEP PWS IEP Application Services area.

Pending PASTO01-FR-

The Contractor shall establish initial delivery of IEP Application Engineering Support services to meet IEP requirements in accordance with IEP PWS IEP Application Engineering Support Services section.

Pending PASTO01-FR-

The Contractor shall migrate MSP managed IEP applications into IEP 2.0 environments and services. Initial application migration includes any engineering changes as needed for IEP hosting or as directed by the IRS.

Pending PASTO01-FR-

The Contractor shall establish initial delivery of Web User Analysis Data Collection and Analytics services to meet IEP requirements in accordance with IEP PWS Web User Analysis Data Collection and Analytics section.

Pending PASTO01-FR-

The Contractor shall establish initial delivery of Application Infrastructure services to meet IEP PWS requirements in accordance with IEP Application Infrastructure Services section.

C.3.7 Government Furnished Equipment (GFE) Cloud Services

The objective of the GFE Cloud Services is for the contractor to be capable of providing IEP

MSP services needed to support application hosting, integration and operations for IRS workloads provisioned and deployed in IRS-provided cloud environments. The IRS cloud environments will be available to the IEP MSP as Government Furnished Equipment (GFE).

The IRS intends to have these services available to be tasked by work requests if needed to support IRS applications being migrated (or developed) to be hosted and operated in the IRS

Cloud environments. Additionally, these services could be tasked to support operations and maintenance of common services for IRS cloud applications and secure connections to the IRS

Enterprise Computing Center (ECC) (e.g., NetHub).

Pending CWISTO01-FR-

The Contractor shall deliver Government Furnished Equipment (GFE) Cloud services to meet IEP requirements in accordance with IEP PWS GFE Cloud Services area.

Pending CWISTO01-FR-

The Contractor shall establish initial delivery of Government Furnished Equipment (GFE) Cloud services to meet IEP requirements in accordance with IEP PWS GFE Cloud services section.

C.3.8 IEP Operations and Maintenance

The objective of IEP Operations and Maintenance services in this task order is to cover transition to ongoing operations and maintenance as each IEP service area delivery is approved by the IRS for operations. The Contractor will deliver O&M for IEP Infrastructure, IEP Application

Hosting, IEP Security, IEP Applications and IEP Services and Program Integration services under BPA number TIRNO-XX-D-XXXXX for IEP 2.0 in accordance with the IEP PWS requirements. The government intends to partition O&M services as separate core IEP services work requests and distinct application hosting services work requests for applications grouped according to common application characteristics (e.g, business functional area, deployment architecture, etc.) as recommended and approved by the IRS.

ELM ID IEP 2.0 Req ID Contents

1385714 PWHS-FR-1100 The Contractor shall provide IEP Application Hosting Operations and Maintenance services in accordance with industry-leading practices for IT service delivery frameworks. The IT service delivery processes should align with IRS service delivery processes.

1406554 PAS-FR-210 The Contractor shall provide application operations and maintenance (O&M) services in accordance with the IRS delivery model process guidelines (IRM 2.16.1).

1390477 PAS-FR-700 The Contractor shall provide the O&M services for all IEP-hosted applications (contractor- and third party- developed), including:

i. Incident management process

ii. Problem management process

iii. Change management process

iv. Deployment process

v. Capacity management process

vi. Patching management process

vii. Technical Review Board process

C.4 Task Order Constraints

The following additional information is provided for task order clarification. Do not address this information in the response SOW:

a) The Government Furnished Property (GFP) will only consist of Contractor identification badge, building access/ proximity card office space, laptop computer with area network access, and standard software configuration including, Microsoft Office (Word, Excel, PowerPoint), and telephone with voice messaging system.

b) Government Furnished information (GFI) as needed to perform the work (which must be dispositioned at the end of the contract in accordance with FAR 52.245.5).

c) The Government intent is for Program Management Control (PMC) support for all active task orders to be delivered under a single active task order.

d) The Government requests the proposal for application family migration be provided in a format that facilitates the award of separate Work Requests under this Task Order.

e) The Government requests the proposal for IEP 2.0 O&M services be provided in a format that facilitates the award of separate Work Requests under this Task Order.

f) All responses must be in accordance with the Request for Technical and Cost Proposal and contract TIRNO-xx-xxxx IEP 2.0 terms and conditions.

C.5 Period of Performance

The task order period of performance will be three (3) years. The base period will be 12 months from Task Order Award date.

• Option period 1 will be 12 months from after end of Base Period.

• Option period 2 will be 12 months from after end of Option Period 1.

C.6 Surveillance Methods

The IEP 2.0 Quality Assurance Surveillance Plan (QASP) activity is a critical component for

Contractor performance measurement. The attached QASP Service Level Objectives (SLOs) will be implemented by the Web Infrastructure Services (WISD) Quality Management (QM) function.

The overall goal of the QASP activity is to confirm that the IEP 2.0 Contractor’s delivery and execution of products or services meets the technical performance measures, or SLOs, included in this task order and documented in the QASP.

• For each applicable SLO/performance metric, WISD QM will determine whether the associated Acceptable Quality Level (AQL) has been met. WISD QM will base this determination on SLO data contained in Contractor deliverables, as validated by the respective SLO owner, using the specification in Appendix B as the baseline definition of the SLO, as well as any additional data gathered by Government personnel. The Met —

Not Met determination will be captured in the Surveillance Activities Workbook (SAW).

In addition, any quality issues or questions noted for the reporting period will be captured as comments in the SAW.

• Based on the evaluation results, the IRS may determine that additional review of

Contractor performance is warranted.

APPENDIX A – DELIVERABLES

Section C.3.1, IEP Transition Services Deliverables:

The Contractor shall propose the delivery period/date and the contents for each of the deliverables designated “Contractor Proposed” required for IEP Service and Program

Integration Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

TBD TBD

Deliverable: Orientation Briefing & Meeting

Period: Within 2 weeks of Task Order Award

2498735 IEPTS-DI-100

Deliverable: IEP Services Transition Plan

Period: Draft with proposal

Final after contract award and IBR

Updates as needed

Content: Contractor proposed, to include MSP and IRS stakeholder roles and responsibilities, staffing, transition processes, IEP services deliverables schedule, application transition approach, operational security plans, stakeholder training, communications plans, and risk management approach.

2498736 IEPTS-DI-200

Deliverable: Transition Status Report

Period: As scheduled per transition plan, but a least monthly

Content: Contractor proposed, to include summary of transition activities, Project progress and schedule update with upcoming milestones

- Risks and Issues encountered with associated mitigation strategies

- Action item assignments and status.

- All requests and status for information from the incumbent contractor and IRS stakeholders.

2498737 IEPTS-DI-300

Deliverable: IEP Stakeholder Training Plan

Period: As schedule per transition plan

Content: Contractor proposed, plan to train IEP stakeholders on IEP services and operations during and after transition

2498738 IEPTS-DI-400

Deliverable: IEP Transition Integrated Master Schedule

Period: Include with final Transition Plan

Updated weekly or as required

Content: Contractor proposed, to include critical paths and IRS delivery model process and major milestones for successful transition in accordance with IRM 2.16.1

2498739 IEPTS-DI-500

Deliverable: IEP Transition Technical Artifacts

Period: As scheduled

Content: Contractor proposed to include application family transition plans, System Test Cases and Results, IRS delivery model process artifacts as tailored, integration and regression test results, IEP service area deliverables, UAT demonstrations and material, knowledge transfer materials in accordance with IRM 2.16.1

Section C.3.2, IEP Service and Program Integration Services Deliverables:

The Contractor shall propose the delivery period/date and the contents for each of the deliverables designated “Contractor Proposed” required for IEP Service and Program

Integration Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

1369952 PSPIS-DI-1500 Deliverable: Program Management Plan including all Sections Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PSPIS-FR-100

1369953 PSPIS-DI-1600 Deliverable: Operations Management Framework Period: Contractor Proposed, and updates at as needed for process change or update Content: Contractor Proposed, in accordance with requirements, PSPIS-FR- 3020 and PSPIS-FR-3030

1369954 PSPIS-DI-1700 Deliverable: Integrated Master Schedule Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PSPIS-FR-

Pending PSPIS-DI-1810 Deliverable: Customer Satisfaction Results Period: Annual Content: Customer feedback from IEP stakeholders (internal and external to IRS IEP Operations), in accordance with PSPIS-FR-400

1369955 PSPIS-DI-1800 Deliverable: QA Measurement Methodology Period: Contractor Proposed Content: Contractor Proposed, to include how the contractor will manage their contract quality assurance throughout the period of performance

1369956 PSPIS-DI-1900 Deliverable: Earned Value Management System (EVMS) Reports Period: Monthly Content: Contractor Proposed, in accordance with requirements, PSPIS-FR- 2500 and PSPIS-FR-3090

1369958 PSPIS-DI-2000 Deliverable: Innovation Plan Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PSPIS-FR-

Pending PSPIS-DI-2010 Deliverable: IEP Process Improvement Report Period: Annual Content: Report of improvements and efficiencies in provisioned services and operations that directly benefit IRS applications and IRS IEP Operations teams, in accordance with requirement, PSPIS-FR-420

Pending PSPIS-DI-2020 Deliverable: IEP EOL and Tech Refresh Report Period: Annual Content: Projected End-of-Life and Technical Refresh alternatives report, in accordance with requirements PSPIS-FR-1500 and PSPIS-FR-1600

1369959 PSPIS-DI-2100 Deliverable: Service Level Objectives (SLO) Report Period: Monthly Content: Contractor Proposed, in accordance with requirement, PSPIS-FR-

1369960 PSPIS-DI-2200 Deliverable: Privacy/Civil Liberties Impact Assessment (PCLIA) Period: Applicable IRS delivery model process in accordance with IRM 2.16.1 Content: PCLIA shall demonstrate that program managers, system owners, and developers have consciously incorporated privacy and civil liberties protections throughout the entire lifecycle of the system (IRM 10.5.2.2).

1369961 PSPIS-DI-2300 Deliverable: Section 508 Compliance Update Test Plan Period: Transition Content: Provide an updated test plan that outlines products and/or services that are tested for compliance with Section 508 and how the test will be conducted.

1369962 PSPIS-DI-2400 Deliverable: Section 508 Compliance Test Report Period: Prior to Production Content: Provide a test report that reflects the results of the Section 508 test plan that was conducted prior to production

1369963 PSPIS-DI-2500 Deliverable: Accessibility Risk Information Period: Prior to Production Content: Provide the risk impact for any unresolved Section 508 provisional failures

1369964 PSPIS-DI-2600 Deliverable: Accessibility Compliance Approach Period: Prior to Production Content: Explain how the contractor or business owner will address Section 508 issues

Section C.3.3, IEP Infrastructure Services Deliverables:

The Contractor shall propose the delivery period/date and the contents for each of the deliverables designated “Contractor Proposed” required for IEP Infrastructure Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

2457848 PIS-DI-300

Deliverable: IEP Infrastructure Services Documentation Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PIS-FR-100

Section C.3.4, IEP Application Hosting Services Deliverables:

The Contractor will propose the delivery period/date, and the contents for each of the deliverables designated “Contractor Proposed” required for IEP Application Hosting Services.

These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

1370056 PWHS-DI-200

Deliverable: IEP Application Hosting Concept of Operations (CONOPS), Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1370057 PWHS-DI-300

Deliverable: IEP Application Hosting Services Status Report Period: Monthly Content: Contractor Proposed; Capacity Management Status Report;

Incident/Problem Status Updates; Monitoring Status Reports; Change Management Status Reports; Patch Management Status, and Process Improvement activities.

1385717 PWHS-DI-400

Deliverable: IEP Technical Framework Period: Contractor Proposed Content:

- Significant Application Design Choices in IEP

- Commonly used configuration patterns

- Technologies used to deliver the configuration patterns

- Core roles and responsibilities for groups leveraging the IEP service offerings

1408900 PWHS-DI-600

Deliverable: Capacity Management Plan Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirements, PWHS-FR- 1500, PWHS-FR-1600, and PWHS-FR-2300

Pending PWHS-DI-610

Deliverable: Capacity Optimization Report Period: Contractor Proposed Content: Contractor proposed, in accordance with requirement, PWHS-FR- 2420; to include

- candidate applications and resources identified to be optimized

- identify potential cost avoidance for the optimized application

- financial impact of not optimizing the application

- information on the operational risk of not optimizing the application

- side-by-side comparison of resources used before and after optimization for the application

- record of changes made for the optimized applications for the month that is being reported

- long-term historical record of optimizations (quarterly, yearly)

Pending PWHS-DI-620

Deliverable: IEP Capacity Growth Projection Period: Annual Content: IEP capacity growth projections for all IEP applications and services year over year, in accordance with requirements, PWHS-FR-2300

1408899 PWHS-DI-500

Deliverable: Incident Management SOP Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirements, PWHS-FR- 2700, PWHS-FR-2900, PWHS-FR-3200, and PWHS-FR-3210

1408902 PWHS-DI-700

Deliverable: Problem Management SOP Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirements, PWHS-FR- 3310 and PWHS-FR-3320

1408903 PWHS-DI-800

Deliverable: Monitoring and Performance Management Plan Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408904 PWHS-DI-900

Deliverable: Guide for Application Developers Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408905 PWHS-DI-1000

Deliverable: IEP Engineering Services overview Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408906 PWHS-DI-1100

Deliverable: IEP Services Primer Period: Semi-annual Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408907 PWHS-DI-1200

Deliverable: IEP Engineering Services Strategic Vision and Goals Period: Initial delivery semi-annual; subsequent annually Content: Identifies the guiding principles that are leveraged during the creation and management of the Tactical Roadmap and supplementing artifacts, in accordance with requirement, PWHS-FR-6500

Pending PWHS-DI-1210

Deliverable: IEP Service Management Platform Operating Framework Period: Annual, As Needed Content: Defines the flow of services from when a user submits a request through the service catalog through to delivery and tracking of services by the IEP in accordance with requirement, PWHS-FR-6500

Pending PWHS-DI-1220

Deliverable: IEP Service Management Reference Capabilities Period: Annual, As Needed Content: This list outlines the capabilities that each component of the Service Management Platform that the organization hopes to provide to end users, in accordance with requirement, PWHS-FR-6500

Pending PWHS-DI-1230

Deliverable: IEP Engineering Services (IES) Governance and Operating Process Period: Annual, As Needed Content: Defines how the workstream will operate as well as identifies the processes and control gates to gain approval from IRS IEP Operations, in accordance with requirement, PWHS-FR-6500

Pending PWHS-DI-1240

Deliverable: IEP Engineering Services Potential Projects Period: Annual, As Needed Content: Backlog list of all project ideas collected over the course of the stakeholder interviews. This list contains high-level information around project description, alignment to IRS and legislative requirements, risk profile, etc., in accordance with requirement, PWHS-FR-6500

1408908 PWHS-DI-1300

Deliverable: IEP Tactical Roadmap Period: Initial delivery semi-annual; subsequent annually Content: Contractor Proposed, to include the roadmap for enhancements to the technical solution to continuously improve IEP services

1408909 PWHS-DI-1400

Deliverable: IEP Application Integration Overview Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirements, PWHS-FR- 4600, PWHS-FR-4900, and PWHS-FR-6300

1408910 PWHS-DI-1500

Deliverable: Change Management SOP Period: Initial delivery is contractor proposed; Then annually or upon changes to the Change Management process Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408911 PWHS-DI-1600

Deliverable: Deployment Management SOP Period: Contractor Proposed Content: Contractor Proposed including Deployment Checklist, in accordance with requirement, PWHS-FR-7700

1408912 PWHS-DI-1700

Deliverable: Configuration Management Plan Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

Pending PWHS-DI-1710

Deliverable: IEP Control Document (IEP-CD) Period: Annually, or As Needed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408913 PWHS-DI-1800

Deliverable: Patch Management Plan Period: Contractor Proposed Content: Contractor Proposed, in accordance with IRS IRM 10.8.50 (Information Security, Service-wide Security Patch Management), NIST SP 800-40 (Enterprise Patch Management Technologies) and requirement, PWHS-FR-8500

1408914 PWHS-DI-1900

Deliverable: IEP Hosted Application Portfolio configuration report Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408915 PWHS-DI-2000

Deliverable: IEP On-Boarding SOP Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirements, PWHS-FR- 8900, PWHS-FR-9100, and PWHS-FR-9200

1408916 PWHS-DI-2100

Deliverable: IEP On-Boarding Metrics Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

1408917 PWHS-DI-2200

Deliverable: IEP Service Desk SOP Period: Contractor Proposed Content: Contractor Proposed, in accordance with requirement, PWHS-FR-

Pending

PWHS- DI-2300 Deliverable: IEP Cloud Roadmap Period: Initial delivery semi-annual; subsequent annually Content: Contractor Proposed based on IRS Enterprise Cloud Strategy, to include the roadmap for enhancements needed to continuously improve IEP services

Section C.3.4, IEP Application Hosting Services Information Available to IRS:

The Contractor will propose the delivery period/date, and the contents for each of deliverables designated “Contractor Proposed” required for IEP Application Hosting Services Information

Available to IRS. These deliverables include the following:

1408901 PWHS-WP-1800 Throughput Report, in accordance with requirement, PWHS-FR-4200

Section C.3.5, IEP Security Services Deliverables deliverables designated “Contractor Proposed” required for IEP Security Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

1387425 PSS-DI-2200

Deliverable: Security Impact Assessment (SIA) Period: Contractor Proposed Content: The Contractor shall develop a Security Impact Assessment (SIA) process that complies with current and future revisions of NIST SP 800-30 (Guide for Conducting Risk Assessments). This process shall be documented in the Security Configuration and Change Management Plan.

1386177 PSS-DI-200

Deliverable: Updated Security Process Plans Period: At least annually Content: The Contractor shall update security process plans when changes occur and ensure there is a review on at least annually. Examples of scenarios that would prompt updates to security plans include security control assessments, changes in policy or procedure, changes in requirements, process or technology improvements and changes in laws or NIST guidance.

1386104 PSS-DI-500

Deliverable: IEP Continuous Monitoring Plan Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-3000

1386152 PSS-DI-600

Deliverable: IEP Security Configuration and Change Management Plan Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-4600

1386171 PSS-DI-800

Deliverable: IEP Security Patch and Vulnerability Management Plan Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-1700

1386157 PSS-DI-900

Deliverable: IEP Security Incident Handling, Monitoring and Response Plan Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-6300

1386212 PSS-DI-1000

Deliverable: IEP Information System Contingency Plan (ISCP) Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-6500

1386134 PSS-DI-1100

Deliverable: IEP Security Concept of Operations (Security CONOPS) Period: At least annually Content: Contractor Proposed, in accordance with requirement, PSS-FR-800

1386109 PSS-DI-1200

Deliverable: IEP Access Management Plan (AMP) Period: At least annually or as needed Content: Contractor Proposed, in accordance with requirement, PSS-FR- 10900

1386233 PSS-DI-1300

Deliverable: IEP System Security Plan (SSP) Period: Contractor Proposed Content: The contractor will utilize a Government Furnished System to document the SSP. Instructions on access and use will be provided after contract award, in accordance with requirement, PSS-FR-9300

1386092 PSS-DI-1400

Deliverable: IEP Authorization Boundary Memorandum Period: At least annually Content: Contractor Proposed; normally part of the SSP, but usually updated prior to the full SSP, in accordance with requirement, PSS-FR-9400

1386150 PSS-DI-1500

Deliverable: IEP Interconnection Security Agreements (ISA) Period: At least annually or as required Content: The ISA defines the security controls between interconnected systems and authorizes the connection from one information system to other systems outside of the IRS.

1386164 PSS-DI-1600

Deliverable: IEP Security Control Assessment (SCA) Test Plan Period: At least annually Content: Contractor proposed, per requirements in C.3.4.9 Security Control Assessment (SCA) and Contractor Security Assessment (CSA), in accordance with IRM 2.16.1.

1386214 PSS-DI-1700

Deliverable: IEP Security Assessment Report (SAR) Mitigation Plan Period: Annual (prior to ASCA closeout) Content: This deliverable is dependent on the completion of the SAR document with findings from SCA Testing and Cyber Assessments. The SAR documents are developed by the IRS Cybersecurity FISMA Certification Program Office and the IRS Cloud Security Assessment Team, in accordance with requirement, PSS-FR-1510

1386191 PSS-DI-1800

Deliverable: IEP Privacy/Civil Liberties Impact Assessment (PCLIA) Period: When changes are required or every 3 years Content: Contractor proposed, in accordance with requirements, PSS-FR-9400 and PSS-FR-10100

1386193 PSS-DI-1900

Deliverable: IEP State of Security (SoS) Package Period: Annually Content: Contractor proposed, in accordance with requirement, PSS-FR-8700.

1386172 PSS-DI-2000

Deliverable: FISMA Compliance Reports including, but not limited to, inventory, inventory change log, security configuration compliance reports, personal security, and POA&Ms.

Period: Monthly Content: Contractor proposed, in accordance with requirement, PSS-FR-3800

1386192 PSS-DI-2100

Deliverable: IEP Information Security Status Package Period: Monthly Content: Includes validation of timely delivery and acceptance of FISMA Compliance Reports, Summary of incidents and actions from Weekly Status Report and POA&M status. Under separate cover: Executive Summary

1387417 PSS-DI-2300

Deliverable: IEP Alternate Site Processing Environment (ASPE) Plan Period: Annual Content: Contractor will provide plan to move operations to alternate site. This will include annual test plan, in accordance with requirements, PSS-FR-6800 and PSS-FR-6900

1387419 PSS-DI-2500

Deliverable: Executive Summary of Analytical Results and Recommendations Period: Contractor Proposed Content: Contractor Proposed, to include analysis information on new or emerging threats and recommendations for executive level consideration

1387420 PSS-DI-2600

Deliverable: Key Management Practices Statement Period: Annual Content: Plan will document processes, key POC's for management of security keys and systems used to implement processes

1387421 PSS-DI-2700

Deliverable: IEP Contractor Security Assessments (CSA) Test Plan Period: Annual Content: Plan will be in accordance with IRS Publication 4812 and requirement, PSS-FR-8600

Security Reports deliverables designated “Contractor Proposed” required for IEP Security Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

1386128 PSS-WP-300

Deliverable: Weekly IEP Security Status Report Period: Weekly during contract period of performance Content: The Contractor shall summarize how they followed up on potential incidents and suspicious activity to mitigate risks and prevent breaches. The Contractor shall submit detailed evidence along with the report that shows the steps they performed to follow-up with each potential incident and suspicious activity. This evidence includes the details of all analysis performed to close SIEM tickets, even if those tickets were not communicated to CSIRC.

Examples of the Weekly Security Status reports include: Status of ongoing Security Operation and planned activities, schedule for FISMA Compliance Reports, actions resulting from analytic results, and POA&M status.

1387424 PSS-WP-1200

Deliverable: Monthly IEP Security Status Report Period: Monthly during contract period of performance Content: The Contractor shall summarize how they followed up on potential incidents and suspicious activity to mitigate risks and prevent breaches. The Contractor shall submit detailed evidence along with the report that shows the steps they performed to follow-up with each potential incident and suspicious activity. This evidence includes the details of all analysis performed to close SIEM tickets, even if those tickets were not communicated to CSIRC.

Examples of the Weekly Security Status reports include: Status of ongoing Security Operation and planned activities, schedule for FISMA Compliance Reports, actions resulting from analytic results, and POA&M status.

1386167 PSS-WP-400

Deliverable: Vulnerability Assessment and Configuration (Analysis) Summary Period: Contractor Proposed Content: The Vulnerability Assessment and Configuration (Analysis) Summary contains the status of vulnerabilities and Contractor's effort to remediate them through patches or secure configurations. This report will also provide information regarding policy settings in cloud services used to provide IEP services

1386123 PSS-WP-500

Deliverable: IEP Configuration Compliance Summary Report Period: Contractor Proposed Content: Contains the NIST compliance summary and details for all the servers and devices in the IEP 2.0 environment. It should be easy for the recipient of this report to identify the configuration weaknesses in the environment, particularly critical and high-risk weaknesses. Weaknesses should be tracked in the Mitigation Report and mitigated in the same manner as other findings from SCA tests, etc.

1386090 PSS-WP-600

Deliverable: Security Incident Report Period: As required Content: Contains the detailed investigation documentation for each potential/suspected incidents detected and investigated by the Contractor security operations team. This includes the details of the analysis performed to close the SIEM ticket escalated from a third-party subcontractor to Contractor.

1386163 PSS-WP-700

Deliverable: Mitigation Report Period: Contractor Proposed Content: Contains the details of open and closed security findings and mitigations taken to close them.

1386102 PSS-WP-800

Deliverable: IEP 1.5 Security Risk Assessment (SRA) Mitigation Report Period: Contractor Proposed Content: Provides planned mitigation actions necessary to address findings in the Security Risk Assessment (SRA). This deliverable is dependent on the completion of the SRA document. The SRA document is developed by the IRS Security Assessment Services (SAS) team. (per description in IEP 2.0 Req PSS-FR-1500) and it is an ad-hoc report. This document is related to Risk Management Framework (RMF) (refer to C.3.4.1 Security Risk Management Framework) and Cybersecurity's Security Change request process (Managed Service Security Impact Assessment) (in accordance with requirement, PSS-

FR-9600).

1386217 PSS-WP-900

Deliverable: IEP 1.5 Incident Response Test Report Period: Contractor Proposed Content: Details results of the quarterly incident response simulation provided following quarterly test (per description in requirement, PSS-FR-6300).

Section C.3.6, IEP Application Services Deliverables:

deliverables designated “Contractor Proposed” required for IEP Application Services. These deliverables include the following:

ELM ID IEP 2.0 Req ID Contents

1390505 PAS-DI-400

Deliverable: Application Test Plans Period: As scheduled Content: Contractor Proposed, in accordance with IRM 2.16.1 and requirement, PAS-FR-120

1390532 PAS-DI-300

Deliverable: Integration Test Results Period: As scheduled Content: Contractor Proposed, in accordance with IRM 2.16.1

1390475 PAS-DI-200

Deliverable: Application Migration Plan and Strategy Period: Contractor Proposed and as updated Content: Contractor Proposed, in accordance requirements, IEPTS-FR-700 and IEPTS-FR-800

Section C.3.7, GFE Cloud Services Deliverables:

deliverables designated “Contractor Proposed” required for GFE Cloud Services. These deliverables include the following:

2497114 CWIS-DI-100

Deliverable: GFE Cloud Services status report Period: Monthly Content: Summary of cloud services activities to include dated accomplishments and quantified accomplishments and IRS milestones met.

2497115 CWIS-DI-200

Deliverable: Work Request Technical Artifacts Period: As scheduled Content: Per work request requirements and Contractor Proposed, to include System Test Cases and Results, IRS delivery model process artifacts as tailored, regression test results, UAT demonstrations and material, knowledge transfer materials in accordance with IRM 2.16.1

APPENDIX B – SERVICE LEVEL OBJECTIVES

The applicable TO SLOs are listed below for reference to the contract PWS agreed QASP SLOs.

Section C.3.1, IEP Transition Services SLOs:

SLO # SLO Name

PAS-SLO-S.3.5.25

Application Development: All Managed Service Provider developed applications are available for use after completion of the deployment and there is no outage attributed to the application development.

PAS-SLO-S.3.5.26

For applications developed and hosted by MSP, full compliance with the

Section 508 and resolution of all Section 508-related issues prior to deployment in Production in accordance with IRS policies and Legislative mandates.

IEPTS-SLO-S.3.7.1

The final, IRS-approved IEP Services Transition Plan (TP) is delivered within 2 months of IEP 2.0 contract award, and its status is provided monthly.

IEPTS-SLO-S.3.7.2

A plan to achieve Authority to Operate (ATO) for IEP 2.0 infrastructure is delivered within 2 months of IEP 2.0 contract award, and its status is provided monthly.

IEPTS-SLO-S.3.7.3

All milestones established in the final, IRS-approved IEP Services Transition

Plan (TP) are delivered by the planned completion dates.

IEPTS-SLO-S.3.7.4

All applications and platforms hosted previously in IEP 1.5 infrastructure are transitioned and operational completely and successfully to IEP 2.0 infrastructure by the planned completion date.

IEPTS-SLO-S.3.7.5

All incidents and problems opened during the transition period and assigned to the IEP 2.0 Contractor are resolved completely and approved for closure by

IRS by the planned cutover date.

Section C.3.8, IEP Operations and Maintenance SLOs:

PSPIS-SLO-S.3.1.30 Successful publication of stakeholder satisfaction survey.

PSPIS-SLO-S.3.1.31

Inclusion of all stakeholders (identified and approved by IRS) in…