IRWorks Sole Source Draft PWS for posting.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

Internal Revenue Workflow Optimization, Request, and Knowledge System (IRWorks) ServiceNow ESM

Table of Contents

1. Introduction - Description of Services

2. Background

3. General Requirements

3.1. Contract Type

3.2. Hours of Work

4. Transition Out Period

5. Applicable Documents

6. Definitions

7. Objectives

8. Scope

9.0. Planning:

10.0. Organizational Readiness & Communications:

10.2. Migration:

10.3. Operations and Management (O&M):

10.4. Ongoing Configuration, Development, and Integration:

10.5. Training

10.6 Surge Support

10.7 Service Integration Work Request Support

11. Project Descriptions

11.1. IT Transformation Portfolio Transition

11.2. IT O&M Transition

11.3. Cyber Supply Chain Risk Management

11.4. Integrated Workplace Management System Integration

11.5. GitLab Integration

11.6. Enterprise Demand Management Transition

11.7. Legislative Provisions Transition

11.8. Enterprise Process Initiative (EPI)

11.9. Enterprise Software Asset Management (SAM)

12. Deliverables and Deliverable Schedule

13. Place(s) of Performance

14. Period of Performance

15. Operational Hours

16. Gov. Furnished Equipment, Information Badge, Keys and/or Facilities Provided

17. Other Direct Costs (ODCs)

Table of Contents

18. Contract Management

18.1 Contracting Officer’s Representative

18.2 Contracting Program Management

18.3 Key Personne

19. Non-Personal Services Statement

20. Organizational Conflict of Interest 21 Quality Assurance

21.1 Quality Assurance Surveillance Plan

21.2. Performance Based Service Assessment (PBSA)

21.3. Performance Requirements Summary

21.4. Contractor Performance

22. Independent Quality Assurance and Monitoring (QA&M)

23. Enterprise and IT Framework

23.1. Federal Identity, Credential, and Access Management (FICAM)

23.2. Authority to Operate (ATO) / Interim Authority to Operate IATO)

23.3. Section 508 Compliance

23.4. IRS Enterprise Architecture Compliance

23.5. Information and Personal Security

23.5.1. Federal Information Security Modernization Act (FISMA)

23.5.2. The National Institute of Standards and Technology (NIST) Guidance for Information Security

23.5.3. Cybersecurity Supply Chain Risk Management (C-SCRM)

23.5.3.1. Cybersecurity Supply Chain Risk Management (C-SCRM) Strategy

23.5.3.2. Cybersecurity Supply Chain Risk Management (C-SCRM) Plan

23.5.3.3. Cybersecurity Supply Chain Risk Assessment (C-SCRA)

23.5.4. Self-Attestation

23.5.5. Malicious Code Detection and Protection

23.5.6. Vulnerability Monitoring and Scanning

23.5.7. Software Development

23.5.8. Provenance

23.5.9. Safety Issues

23.5.10. Employee Identification

24. Data/Intellectual Property Rights

25. Disaster Recovery (DR) and Continuity of Operations (COOP) Acronyms ……………………………………………………………………………………….46

Page Purposely Left Blank

1. Introduction - Description of Services

This is a services contract to provide Managed Services of the ServiceNow Platform. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

The contractor shall provide all personnel, supervision, other items, and non-personal services necessary to perform the integration of ServiceNow, which is the platform for the IRWorks program, as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property/equipment and services. The contractor shall perform to the standards in this task order, as specified in sections 10, 20 and 21.

The contractor shall support the IRWorks Program Manager in the areas of architecture, design support, technical governance, evaluation, scope estimation, levels of effort, impact analysis, communication, and reporting as required. The contractor shall support the identification and capture of quick win opportunities and associated governance, training, and organizational change management initiatives.

2. Background

The Internal Revenue Service (IRS) has deployed a new Enterprise Service Management (ESM) platform to simplify and consolidate systems, while simultaneously improving the user experience for IRS employees and contractors. This platform is a Software-as-a-Service (SaaS) solution with extensive capabilities for use by the IRS. This PWS outlines the contractor support needed for ongoing migration, integration, improvements to the ServiceNow ESM platform capabilities.

The IRS is seeking a contractor with expertise and technical understanding of its current ESM systems, the processes they support, and the underlying workflows that have been established or are under development. The IRS requires subject matter expertise and experience to support the streamlined use and adoption of the new platform and actively lead the transformation. The contractor shall have expertise with in-depth experience implementing the IRWorks platform and has provided strategic guidance and design support aligned with the IRS requests and the platform capabilities.

3. General Requirements

This is a services contract to provide support to the IRWorks Program Management Office (IRWorks PMO). The effort shall supplement the Program Manager Team for Platform Support with completion of additional technical and planning assistance for the use, expansion, and ongoing oversight of the IRWorks Platform.

The list of modules/capabilities to be delivered are listed below and detailed in section 9.

Information Technology (IT) Transformation Portfolio Transition (9.1) IT O&M Transition to SPM (9.2) Cyber Supply Chain Risk Management (C-SCRM) (9.3) Graphic Database Interface (GDI) Replacement (9.4) GitLab Integration (9.5) Enterprise and IT Demand Management Transition (Optional) (9.6) Legislative Provisions Transition (Optional) (9.7) Enterprise Process Initiative (EPI) Minimum Viable Product (MVP) (Optional)

(9.8)

3.1. Contract Type: The government will award a Firm Fixed Price (FFP) Contract.

3.2. Hours of Work:

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). The Contractor may also be required to support 24/7 operations 365 days per year.

There are 10 Federal holidays set by law (USC Title 5 Section 6103) that the Internal Review Service (IRS) follows: Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 (Friday June 18 or Monday June 20 when June 19 falls on a Saturday or Sunday) Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4. Transition Out Period

4.1 The Government estimates that the outgoing transition period from the incumbent to successor(s) will be a minimum of forty-five (45) days and a maximum of ninety (90) days.

4.2 The Contractor shall, as appropriate:

1. Provide management, direction, administration, quality assurance, and leadership for all outgoing transition activities.

2. Assess the current state of each project underway or being supported to help ensure the Contractor team is appropriately staffed with the right skills and numbers to support outgoing transition activities.

3. Provide an Outgoing Transition Plan that is synchronized with the successor Contractor-developed Incoming Transition Plan(s), with schedules of activities and milestones including times involving parallel operations, incoming and outgoing contractor and/or Government personnel responsibilities, and risk mitigations.

4. Implement the Outgoing Transition Plan upon request of the Government.

5. Conduct weekly transition status meetings to report progress, issues, and planned resolutions during the transition.

6. Collaborate with the successor contractor(s) during a transition-out period to perform all required activities and maintain acceptable performance according to the Government’s Quality Assurance Surveillance Plan.

7. Facilitate enabling all required and authorized Government system accesses, accounts, etc. to the successor contractor(s) to ensure that there will be no disruption in the ability of the team to continue activities.

8. Transfer system documentation to the successor(s), identify gaps in infrastructure documentation, prepare and implement a plan for remediation of the gaps, and request any other needed documentation prior to the end of the transition period.

9. Transfer statistics and data associated with performance and service-level agreements to the successor(s).

10. Transfer information to include but not limited to configuration management, user stories, data mappings, API documentation, and integration documentation information to the successor(s).

11. Transfer licensing and warranty information for all Government-owned IT assets to the successor(s). The Contractor shall ensure that licenses and warranties for all Government-owned IT assets are registered to the Government, not a contractor.

12. Transfer all Government-owned application and database software tools, documentation, and training materials from the incumbent to the successor(s).

13. Transfer responsibilities for Government-owned IT assets (including but not limited to: application software, data sets, scripts, configurations, logs, files, and folders) responsibilities at all locations from the incumbent to the successor contractor(s), per the Outgoing Transition Plan.

14. Transfer archives of software and data to the successor(s) for applications and users preserved after termination of their use on the IRS network.

15. Attend and respond to Government questions during an operational readiness review conducted by the successor contractor(s) when outgoing transition activities are complete to assist the Government in determining that the incumbent contractor is no longer required to provide required services.

16. During transition, ensure that there will be no service interruption to mission users and activities identified by the Government.

5. Applicable Documents: The Contractor shall comply with the documents listed below:

1. 44 U.S.C. § 3551-3558, “Federal Information Security Modernization Act (FISMA) of 2014”

2. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

3. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

4. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

5. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

6. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

7. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

8. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

9. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”vFIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

10. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

11. FIPS Publication 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

12. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards”

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

14. OMB Memorandum, “Transition to Internet Protocol version 6 (IPv6),” September 28, 2010

15. OMB Memorandum M-04-04, “E-Authentication Guidance for Federal Agencies,” December 16, 2003

16. OMB Memorandum M-05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

17. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3,

18. OMB Memorandum for Chief Information Officers, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

19. “Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance,” December 2, 2011

20. NIST SP 800-116 Rev. 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 29, 2018

21. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” December 1, 2017

22. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 19,

23. “Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication,” March 2014

24. “Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security,” June 19, 2017

25. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC),” November 20, 2007

26. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

6. Definitions: This section includes all appropriate terms and phrases for this PWS. The definitions in the table below are clear and concise, and not ambiguous. The definitions are binding for the duration of this Contract, unless modified.

Table 1 - DEFINITIONS

Term/Phrase Definition

ALTERNATE

CONTRACTING OFFICER'S

REPRESENTATIVE (ACOR)

An employee of the U.S. Government appointed by the Contracting Officer to administer the contract as an alternate to the COR. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

CONTRACTOR A supplier or contractor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

CONTRACTING OFFICER A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

CONTRACTING OFFICER'S

REPRESENTATIVE (COR)

An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

PHYSICAL SECURITY Actions that prevent the loss or damage of Government property.

QUALITY ASSURANCE The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

QUALITY ASSURANCE

AND MONITORING

An organized written document and/or strategic process to determine appropriate policies and procedures for accountability and monitoring.

QUALITY ASSURANCE

SURVEILLANCE PLAN

(QASP)

An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

QUALITY CONTROL All necessary measures taken by the Contractor to assure that the quality of a product or service shall meet contract requirements.

7. Objectives:

The objective of the IRWorks ESM contract is to enable and facilitate internal operations and services to taxpayers.

7.1 Specific Performance Objectives: The following are the overarching performance objectives for this PWS:

Technical Performance:

o Meet or exceed technical, staffing, and management requirements;

o Acceptable deliverables submitted per timetable in Section 9 Deliverable; and o Contractor implementation of mitigation actions per dates in the Project

Integrated Master Schedule.

Schedule Performance:

o Upon learning of issue, no longer than 2 business days, notification of scheduling issues accompanied by recommendation of corrective action, together with task and milestone Schedule Compliances.

Communication Performance:

o Contractor participation in task-related meetings, conferences, technical exchanges, and working groups; situational knowledge and awareness of task-related topics; and contractor performance status reporting in near real-time.

Customer Satisfaction:

o Contractor will address all customer questions and concerns throughout the period of performance.

Enterprise Service Management:

o Support the existing service delivery process framework;

o Support applicable IT and enterprise government structures and processes;

o Promote consistent delivery and management of IRS services to end users, o Consistently support process implementation and continuous improvement initiatives.

8. Scope

The IRS mission is to provide top quality service by simplifying execution of their tax responsibilities and enforcement of associated laws.

The Inflation Reduction Act (IRA) changed multiple tax laws and provided funds to improve IRS services and technology in order to simplify tax filing for their taxpayers.

In support of this contract, the contractor shall perform the following tasks, which are outlined in subsections 8.1 through 8.9:

Task Project Management (8.1) Planning (8.2) Organizational Readiness and Communications (8.3) Migration (8.4) Operations and Maintenance (8.5) Ongoing Configuration, Development, and Integration (8.6) Training (8.7) Surge Support (8.8) Service Integration Work Request Support (8.9)

The IRWorks ServiceNow platform has numerous capabilities that multiple IRS businesses and support areas will use. To support these requests and streamline the adoption of these new capabilities in a way that is quick and sustainable, the Agency is requesting subject matter expertise to support the planning, management, and oversight of several concurrent initiatives.

8.1 The MSP (Managed Service Provider) shall:

Update sets we will call “new code” will come from IRS contracted vendors or staff. Each sprint, typically two to three weeks, the Managed Service Provider (MSP) shall:

• Ingest the “new code” code into a dev Instance. Perform all merging of code: Collaborate with IRS contracted vendors or staff to investigate and resolve issues/defects/conflicts.

Perform “Smoke testing and validation of the code or configurations received.” IRS contracted vendors or staff will provide validation documentation that comes from the IRS 508 office ensuring 508 compliancy.MSP will validate with the 508 office the sprint has their approval as provided by IRS contracted vendors or staff.MSP will work with IRWorks, as necessary, perform a security assessment and provide the documented approval from Cyber. Execute and report on the ServiceNow Automated Test Framework (ATF) results. Promote the code to IRWorks UAT.

8.2 UAT Environment

• Load, validate and smoke-test the code.

• Execute and report on the ServiceNow Automated Test Framework (ATF) results.

• Support IRS UAT processes for this third-party code. This includes providing “hands-on keys” support to the IRS contracted vendors or staff during UAT (User Acceptance Testing).

8.3 Deploy and Release

• Include the approved code into the IRS IRWorks release management process.

• Represent the releases in the IRS change/release management process.

• Provide the status of the build and release processes.

• Support this third-party code in the IRWorks release calendar.

8.4 Ongoing Support and Management of the solutions

• Facilitate knowledge transfer (sessions, articles, etc.) to the IRS

• Provide Level One and Two support for these workflows at a platform and

• ServiceNow application or module level.

• Provide support and “hands-on keys” assistance to the level three support (code level

• support) and engage the IRS contracted vendors or staff team when necessary.

• Configure and provide incident/problem reports and agreed upon Service Level

• Agreements (SLA) in the IRWorks system.

The complex and transformative IRWorks program changes the way each IRS employee interface executes core job responsibilities, manages their workload responsibly. Tasks include, but are not limited to:

8.5 Task Project Management: The contractor shall manage all staff efforts and provide timely reports regarding the status of the projects. To this end the contractor shall:

8.5.1. Submit a Project Management Plan (PMP) to the CO and COR. The plan shall include but is not limited to information on how the contract will be executed; by whom; and risk and proposed mitigations to the successful execution for the coming year. PMP will require an Integrated Master Schedule (IMS) to include an update to be submitted to the program office every 60 calendar days.

8.5.2. Submit a Monthly Status Report (MSR) to the COR. The MSR will include monthly expenses to the Government that will follow a government-provided template or other acceptable template, as approved by the COR. The report shall include but is not limited to: invoice details by contract line item number; hours worked in the reported month; artifacts related to any Other Direct Costs (ODCs) or travel expenses; and any other information the COR requires to provide proper oversight of the contract. The report shall be submitted by the tenth calendar day following the close of each calendar month.

8.5.3. Submit a Weekly Activity Report (WAR) that addresses the key activities undertaken during the previous week. This report shall identify actions pending decisions and recommendations for improvement.

8.5.4. Maintain a Staffing Plan updated at least monthly to provide the Government a plan to track the status of personnel planned and onboard, access requests, access removal, and travel documents, and other actions as required by the COR.

8.5.5. Conduct a Project Management Review (PMR) on a quarterly basis, as requested by the COR, which entails information regarding cost, schedule, performance, and risk following the Government-provided template.

8.5.6. Submit an Incoming Transition Plan / Outgoing Transition Plan to the

Government upon notification from the Contracting Officer in the event the contract is terminated, expires, or awarded, which identifies transition support activities and efforts for follow-on requirements to minimize disruption of services.

8.5.7. Submit a task order Close-out and Transition Report. Upon expiration of the contract, the Close-out report shall include all up-to-date critical information needed to sustain operations after this contract expires. As applicable, the report shall include at a minimum:

1) Historical metrics data provided for the Quality Assurance Surveillance Plan

(QASP) (as applicable);

2) All Standard Operating Procedures (SOPs), instruction manuals, training materials, etc., developed with funding of task order;

3) An after-action report that provides the status of the deliverables; clearance report of Government-Furnished Equipment (GFE)/Government-Furnished Property (GFP), to include software licenses; names of personnel who worked on the task order and written confirmation that they have been read off in accordance with IRS security policies.

Final invoices shall be submitted no later than 90 calendar days after the end of the performance period.

All deliverables identified in this section are delivered in electronic formats provided by or approved by the Government and are distributed to personnel identified by the CO and COR. All deliverables are also delivered in a paper form to the CO and COR, if requested. All regular (non-software) deliverables are also posted to the program website in original office automation tool formats and also Portable Document Format (PDF).

All software deliverables are required to be in the original software development lifecycle formats, e.g., source code, data models, scripts, executables, object libraries, installers, etc., and posted in the COR-directed repository.

All deliverables shall become the property of the Government. The Contractor shall not provide deliverables labeled as proprietary information, unless the Contractor provides justification and receives CO or COR approval.

All deliverables are subject to tailoring per the Program OneSDLC Tailoring Plan and prepared according to the current Agile Development and Delivery for Information Technology IIRMs.

9.0 Planning: The contractor shall support stakeholder engagement. The contract team shall support adaptive strategic planning efforts, so that all stakeholders are informed and involved in the projects with a mutual understanding of project lifecycles, outcomes, and benefit achievement.

The contractor shall:

9.1. Initiate, manage, coordinate, and collaborate with stakeholders by holding focus groups and other teaming meetings related to strategy, business process improvement and impact to the successful delivery of the requested services.

9.2. Communicate to critical program and project stakeholders across defined channels to support project decision-making processes, align project governance and organizational strategy, and ensure project success while meeting deliverable acceptance criteria.

9.3 Communicate all issues related to the alignment of multiple stakeholder expectations to common agreed outcomes and obtain Program Office authorization prior to taking any action throughout the contract.

9.4 Provide recommendations to the Program Office to support identification of meaningful success metrics while establishing baselines, reporting program or project risk, expectation mismatches, and course remediation options based upon project performance variances.

9.5. Apply innovative and collaborative methods, both virtual and physical, to ensure collaboration across multiple locations and user groups.

9.6. Desired Outcome: A concise, consistent understanding across the organization to enable stakeholder engagement and align expectations.

9.4.1.1 Develop or update Implementation Plans

10.0 Organizational Readiness & Communications: Prepare communication plans, marketing, training, enablement, policies, and procedures to prepare the organization to adopt the new solution. The contractor shall:

10.1 Develop and deliver comprehensive, timely, effective, and creative communications to the various stakeholders and communities to keep them apprised of activities that impact them, utilizing multiple media types and delivery methods.

10.1.1 Encourage user adoption of the capabilities and features available within the new and evolving SaaS solution.

10.1.2 Train users to maximize the capabilities of the tool based upon IRS policies, process, and documented workflows to minimize impact to daily operations and improve performance and delivery of agreed business outcomes.

10.1.3 Track customer satisfaction and platform adoption metrics throughout the project lifecycle.

10.1.4 Desired Outcome: Dynamic, creative, full-scale communications, marketing and outreach planning and execution to drive alignment, awareness, buy-in and excitement to increase adoption momentum and implementation success.

10.2 Migration: All current system capabilities and associated integrations, as applicable, shall be migrated to the ServiceNow platform utilizing the OOB capability with no-code where possible and with coding only when approved by the IRWorks technical governance team. To support that goal, the contractor shall support the migration and deployment of the following support functions and platform capabilities when applicable:

10.2.1 Integrate all current integrations, as applicable, to ServiceNow to support the existing functional capabilities.

10.2.2 The contractor shall configure the target SaaS platform as per the approved architecture and technical governance directives.

10.2.3 The contractor shall integrate and subsequently migrate the applicable data sources to the new SaaS solution.

10.2.4 The contractor shall identify and define applicable Operational Key

Performance Indicators (KPIs) and Metric Definitions and Targets for the new SaaS solution.

Mitchener Shayla M State what the contractor shall do.

Jacobson Carrie L done

10.2.5 The contractor shall capture Customer Satisfaction Metrics after application is implemented to the new SaaS solution.

10.2.6 Desired Outcome: Effective integration and use of system functionality within a new ServiceNow SaaS solution. Optimized processes and workflows for enhanced user experiences and demonstrated improvements in customer satisfaction. The platform itself should have minimal (none if possible) customizations.

10.3 Operations and Management (O&M): The contractor shall manage and administer the chosen SaaS platform and all related modules and integrations. To support that the contractor shall:

10.3.1 Perform day-to-day administration of ServiceNow and its modules to support basic end-user requests within defined Service Level Agreements (SLAs)

10.3.2 Manage Access Controls

10.3.3 Support disaster recovery plan

10.3.4 Perform upgrade analysis and recommendations, present to IRWorks PMO to support planning.

10.3.5 Participate in IRWorks planning and status meetings.

10.3.6 Maintain configuration documentation.

10.3.7 Review and manage user entitlements for the SaaS solution.

10.3.8 Review and provide quarterly recommendations on ServiceNow license usage and optimization.

10.3.9 Support all ServiceNow incidents per established IRS policies and procedures.

10.3.10 Provide support maintenance for the following applications/initiatives: ITRAC;

STRAWS; EAM; and TFIMS.

10.3.11 Represent and advocate for the IRS with ServiceNow.

10.3.12 Track all enhancement requests with ServiceNow and report on status.

10.3.13 Coordinate and support an annual filing season readiness health check with ServiceNow.

10.3.14 Initiate and represent ServiceNow changes per established IRS policies and procedures.

10.3.15 Perform code migration and updates.

10.3.16 Create and maintain knowledge articles and support institution of a formal knowledge management repository.

10.3.17 Monitor availability, performance, and data quality of ServiceNow to per agreed SLA targets.

10.3.18 Participate in DR strategy and planning and testing for IRWorks.

10.3.19 Provide live reporting within ServiceNow that includes tasks, incidents, upcoming changes.

10.3.20 Produce a monthly status report with accomplishments, SLA performance, and known risks.

10.3.21 Support IRS Section508 testing process for the ServiceNow platform.

10.3.22 Provide how-to support to end users via phone, chat, or self-service ticket.

10.3.23 Create knowledge articles to enable end users .

10.3.24 Create how-to and FAQ videos.

10.3.25 Communicate quick wins and key accomplishments to end user community and critical stakeholders per an agreed communication management process.

10.3.26 Communicate enhancements in a release note style timed to the agile sprints.

10.3.27 Work with IRS to define and report on Service Level Agreements (SLA) with penalties.

10.3.28 Desired Outcomes: A stable and flexible ITSM platform with proactive support and quick responses for our user community.

10.4 Ongoing Configuration, Development, and Integration: Post Implementation the new SaaS solution will need support to continue to make needed improvements and adjustments to align with organizational goals and priorities. To support that ongoing enhancement activity the contractor shall:

10.4.1 Create a roadmap post-implementation for continuous roll out of new capabilities and scope expansion of ServiceNow. This roadmap must be maintained and updated as the IRS matures and align to overarching IRS strategic plans.

10.4.2 Create and maintain a prioritized Agile product backlog of IRS selected enhancements and deliverables.

10.4.3 Create a yearly enhancement plan for the next 12 to 18 months.

10.4.4 Organize and review the enhancement plan quarterly.

10.4.5 Provide the flexibility and capacity to deploy and configure new capabilities on demand to continuously enhance ServiceNow platform and its solution.

10.4.6 Provide Fixed priced standard services for the most common requests.

10.4.7 Provide capability to add resources during periods of heavy demand.

10.4.8 Provide a method for rapid deployment of additional modules as requested.

10.4.9 Provide one upgrade per year and maintain n-2 currency for the ServiceNow platform.

10.4.10 Desired Outcomes: Ongoing enhancements to keep the new SaaS solution aligned with evolving IRS needs and priorities.

10.4.11 Deliverables:

10.4.11.1 Three-year IRWorks strategic roadmap delivered 90 calendar days after initial Go Live of application and updated annually.

10.4.11.2 Yearly enhancement plan delivered 90 calendar days after initial Go Live of application and updated quarterly.

10.4.11.3 Updates to the current service catalog with standardized no-code offerings for common enhancements delivered 90 calendar days after initial Go Live of application.

10.4.11.4 Updates to the current upgrade plan and recommendations delivered 90 calendar days after initial Go Live of application.

10.5 Training: The Contractor shall develop, implement, and execute processes for initial training for use of all services. The Contractor shall develop and submit to the Government for review training plans, manuals and other training documentation or training aids. Electronic training tools such as video teleconferencing and computer-based training shall be employed to enhance the effectiveness of training materials and courses. Training delivery may be recorded during live delivery to IRS staff and contractors; pre-recorded initial training is not acceptable. The Contractor shall submit a detailed training plan with timelines and schedules, sufficiently detailed to identify user training plans.

The Contractor shall develop accompanying electronic user manuals that IRS will subsequently make available to new users. The electronic user manuals shall be delivered along with the training manuals. The Contractor shall revise all user manuals as substantial changes are made to the service.

10.6 Surge Support: The Contractor shall be capable of providing surge support during the base, for unplanned, in-scope work. In the event the Government determines that an increased quantity of support is required for the task areas defined in the PWS, the Government reserves the right to exercise the Surge Option unilaterally.

The Government may require surge support during the base or any option period to support enablement of rapid response to legislations, mandates, and executive orders. The Inflation Reduction Act is an example as to how quickly legislation can be enacted. On July 27, 2022, the Senate announced an updated Reconciliation Bill, called the Inflation Reduction Act (IRA) of 2022. The bill took the place of the Build Back Better Act (BBBA) smaller in scope no less impactful to the IRS. In less than one month, the bill was signed into law (August 16,2022), requiring rapid implementation services to meet the provisions of the bill. This task provides rapid response capabilities for unexpected legislation, priorities, and mandates. The contractor shall provide subject matter expertise in legislative analysis.

Provide increased support to analyze and develop action plans to manage emerging priorities such as legislation, executive mandates, and special projects (legislative and non-legislative) proactively and strategically. Due to the dynamic nature of the congressional landscape, this task option ensures preparedness and enablement of rapid response to legislations, mandates, and executive orders. The contractor shall provide subject matter expertise in legislative analysis and shall be able to clearly articulate impacts of pending and enacted legislative changes on existing IRS systems and applications.

Optional modifications will be in-scope to provide increased support for the defined task areas of this PWS. Optional support is not a guarantee. If the Government determines that an increased quantity of support is required for the task areas defined in this PWS, the Government reserves the right to exercise the Surge Support unilaterally. The Contracting

Officer will provide written notice to the Contractor at least 30 calendar days prior to any unilateral exercise of the Optional Support. Optional support will be provided at the same labor rates proposed and found fair and reasonable at time of award for the applicable ordering period.

Desired Outcome: The contractor will be able to rapidly respond to Government requirements of unplanned, in-scope work with the appropriate teams & qualified resources capable of delivering capabilities across all task areas. The contractor must have experience with implementation of the following modules: ITSM, ITOM, ITAM, SPM, DevOps, Security Operations, GRC, HRSD, WSD, CSM, App Engine and Integration Hub.

10.7 Service Integration Work Request Support: The objective of Service Integration Work Request Support is for the Contractor to be capable of providing additional services to meet work request requirements.

The Contractor, at the option of the IRS, may be tasked to deliver additional IRWorks ServiceNow ESM services to support new capabilities in response to evolving IRS business requirements and legislative mandates. When required, the Government will issue Work Requests (WRs) for the Contractor to perform this work. These work requests are intended to be in addition to forecasted IRWorks ServiceNow ESM service demand and capacity flexibility as required by IRWorks ServiceNow ESM capacity, scalability, and performance management requirements.

The Contractor shall be capable of supporting IRS issued work requests (WR) to support new IRS capability requirements.

The Contractor shall develop a WR process to include developing a Very Rough Order of Magnitude (VROM) estimates to support the approval process for draft WRs in accordance with IRWorks ServiceNow Enterprise Service Management (ESM).

The Contractor shall provide VROM estimates and WR responses that include the following:

Description of the technical work to be accomplished to deliver WR requirements.

Planned schedule to support the WR and meet the WR objectives.

Level of Effort estimates based on IRWorks ServiceNow ESM services required to support the WR.

Assumptions and Constraints associated with the proposed technical solution, cost, and schedule.

11 Project Descriptions

Each project is detailed in the subsections below. Projects may be identified as “Optional”.

Such projects are identified as such in the paragraph headers below.

11.1 IT Transformation Portfolio Transition: 10-month LOE; required implementation by 1/2025. The Oracle Primavera Portfolio Management (ProSight) workstream and associated functionality is maintained by the IRS IT Strategy and Planning (S&P) Investment and Portfolio Control and Oversight (SP:IPCO) division. The ProSight solution is used by 250- 500 program leads, program managers, and PMO support staff. It is maintained by up to three people. The solution provides planning, scheduling, and control of large programs as well as individual projects and secures multiuser access to schedules with cost coordination across teams. Quick views into project data could be improved and risks are not centrally tracked. Reporting is manually produced and potential addition of ~50 programs pose challenges and reputational risk.

The contractor shall implement the SPM module to provide a modernized solution to replace the existing project reporting data from ProSight and enhance existing Technical Services Operation (TSO)solution to meet IT-specific requirements and processes (e.g., fields and processes to support Omnibus reports, Treasury reporting, CIO / ACIO reporting, etc.). The contractor shall fully transition the IT transformation portfolio to ServiceNow using the Strategic Portfolio Management (SPM) module to automate the entering of reporting data to meet the separate needs of TSO and IT, to reduce the need burden to IT employees and expense to contractor support.

The contractor shall use other ServiceNow modules as needed to implement this set of capabilities.

11.2 IT O&M Transition: 6-month LOE; required implementation by 3/2025. The Contractor shall build out the SPM module to support the IT O&M Portfolio. The contractor shall provide a standardized, holistic view of all project work managed within IT, including filing season preparation and O&M. The contractor shall provide project tracking and readiness status for the entire IT portfolio, including the capability for IT to onboard all filing season and O&M project efforts not covered within the transformation or legislative implementation portfolios to SPM. This will standardize reporting and project tracking (including dependencies and integration) for all remaining IT development and/or operational work.

The contractor shall use other ServiceNow modules as needed to implement this set of capabilities.

11.3 Cyber Supply Chain Risk Management (C-SCRM): 9-month LOE; required implementation by 1/2025. The Contractor shall build out the Integrated Risk Mgmt./ Vulnerability Response Mgmt. module and capabilities to support the Cybersecurity Supply Chain Risk Management (C-SCRM) to ServiceNow to support the Cybersecurity Supply Chain Risk Assessment (C-SCRA) process. The risk assessment will include a questionnaire to be completed by the contractors/suppliers using excel and transmitted via email. The contractor shall build the questionnaire in the ServiceNow Contractor Risk Module (VRM) module to automate the process. And replace the current manual process which includes exchanging an excel questionnaire document between the IRS and our Information Communication and Technology (ICT) products/services.

The contractor shall streamline our communication with contractor/suppliers and provide reporting on their responses by automating the current manual process.

The contractor shall integrate information from other C-SCRM tools like Bitsight and Exiger which have available APIs with ServiceNow. The contractor shall integrate Vulnerability data from Qualys and software related data available in IRS ServiceNow asset management that are relevant to the contractor/supplier software being evaluated.

The contractor shall use other ServiceNow modules as needed to implement this set of capabilities.

11.4 Integrated Workplace Management System Integration: 9-month LOE;

required implementation by 12/2024 The Contractor shall implement the functionality of sending data directly to the Facilities Management and Security Services (FMSS)Integrated Workplace Management System (IWMS), a SaaS, FedRamp, Cloud-based system. The contractor shall add new capability system to share data between ServiceNow and new IWMS. Capability is an Integration and data mapping for the Workplace Service Delivery Module

The contractor shall ensure the management process implemented includes buildings, space, and services provided by FMSS. This includes employee location (office/desk number) by POD, FMSS assets that include furniture types and sizes, financial management for real estate (rent) and other assets.

The contractor shall include the following critical functionality:

- Space Box Move - Employee moving from one location to another starts in ServiceNow and must be manually entered into the IWMS system. This includes space for new hires.

- Building Maintenance ticket – starts in ServiceNow and must be manually entered into IWMS system.

- Ticket Data – ServiceNow WSD ticket status and information

11.5 GitLab Integration: 9-month LOE; required implementation by 3/2025. The Contractor shall integrate the GitLab CDSO system with the ServiceNow ITSM Module to support a development operations service for automating application deployments for IRS customers. The contractor shall implement DevOps Management and DevOps Change Velocity capabilities. The contractor shall develop the capability to provide Change Management information maintained in ServiceNow’s CMDB to Gitlab via the developed integration. Capability is an Integration and data mapping for the Service Catalog, Employee Center, ITSM Module and CMDB

11.6 Enterprise Demand Management Transition : 12-month effort; required implementation by 3/2025. The Contractor shall establish a new Enterprise Demand Management process using the ServiceNow Strategic Portfolio Management (SPM) module.

The contractor shall establish an easier, more transparent, centralized way to capture and assess all Enterprise support needs (demand), including ideas, enhancements, defects, changes, software and equipment requests, or entire projects. The contractor shall implement a new demand intake and management process and capability for use across the Enterprise, to facilitate the flow of business needs for Enterprise products and services from identification through implementation. This will provide a modern and accessible tool for the identification, gathering, evaluation, prioritization, promotion, and status reporting of all Enterprise demand from identification through evaluation for development.

The contractor shall ensure that demands in ServiceNow can be converted to projects or other work types to be managed in SPM through the existing project and portfolio management capabilities providing end to end view of all projects within one tool.

The contractor shall use other ServiceNow modules as needed to implement this set of capabilities.

11.7 Legislative Provisions Transition : 6-month LOE; required implementation by 3/2025.

The Contractor shall build out the SPM module to support the Legislative Project Tracking.

The contractor shall standardize reporting for legislative implementation and showcase tradeoffs, dependencies, and integration with modernization projects. The contractor shall build upon the SPM dashboards, fields, and processes built for modernization programs and stand up a legislative implementation portfolio. This will standardize reporting and project tracking (including dependencies and integration) for the vast majority of all IT development work and will reduce manual reporting effort to track each provision and statute and provide more transparency to all stakeholders.

11.8 Enterprise Process Initiative (EPI) 9-month LOE; required implementation by

3/2025. The contractor shall implement a new single point of entry front door for IT and shall build out the SPM and APM modules to support the Enterprise Standards Profile (ESP) functionality and data using the Application Portfolio Management (APM) and Technology Readiness Module (TRM) modules. Capabilities found in APM Module and SPM Module, Demand Management and Resource Allocation.

The contractor shall implement the solution to meet the following requirements:

- Ensure proper approval is obtained before purchasing and installing new software applications which will stop the upsurge in maintenance costs and the inefficient use of resources.

- Enable the consolidation of both blacklists and whitelists.

- Enable the removal of all unauthorized software applications.

The contractor shall implement all integrations as identified by the government as necessary to meet the requirements issued for this effort.

11.9 Enterprise Software Asset Management (SAM): 6-month LOE; required implementation to continue the SAM build the full lifecycle of a Software Asset from procurement to decommissioning. The Contractor shall build ITAM module to support the modernization and automation of the SAM process, standardize reporting for TIGTA and GAO audits and showcase tradeoffs, dependencies, and integration with the necessary data sources. The contractor shall build upon the SAM dashboards, fields, and processes built for modernization of the SAM process. This will standardize reporting and project tracking (including dependencies and integration) for the vast majority of all SAM work and will reduce manual reporting effort to track each provision and statute and provide more transparency to all stakeholders. We expect ITAM to provide the 360-degree view of all our assets.

12 Deliverables and Deliverable Schedule

Outputs and outcomes, along with specific deliverables, their due dates and timeframes are delineated below.

Upon the Vendor completing the deliverable and submitting it timely, the timeline starts as follows:

1). The Vendor shall submit the initial deliverable – Specified in the Table below.

2). The Program Office (PM)/COR will review the deliverable and provide feedback the vendor with either requesting clarification, changes to deliverable per PM/COR, and/or deliverable is approved – 10 business days.

3). Vendor shall receive deliverables from PM/COR to start the document review iterations and version control process.

3a). The vendor will reply to the comments, make the…