Performance Work Statement (PWS)

Enterprise Data Platform (EDP) - Platform Architecture and Engineering

Implementation Services

1.0 Introduction And Background

The Enterprise Data Platform (EDP) integrates enterprise data into a centralized data lake and provides platform services to ensure secure and efficient data accessibility across the organization.

The EDP supports digitalization, enables self-service reporting, and access to legacy system data, establishing automated capture of metadata and data governance capabilities and improving data quality, data security and data lineage. It consists of:

• Application Programming Interface (API) enabled data access and integration services, data fabric services to connect data from multiple sources, automated metadata capture and data catalogs, tools to enable data governance.

• Universal Data Hub (UDH) to house common enterprise data in different formats

• Analytical tools and services to provide users with tools for self-service reporting and analytics.

EDP is a next-generation data integration, management, and access solution providing a secure transactional and analytical infrastructure. It enables the Internal Revenue Service (IRS) to transform tax processing, improve compliance, support modernization goals, and provide a single source of trusted data to internal and external stakeholders.

EDP will improve taxpayer, employee, business, and technology objectives at the IRS by modernizing the way data is utilized by providing a single source for data for internal and external stakeholders. EDP will enable IRS to effectively leverage centralized secure storage and access to data to enable transformation and modernization efforts and meet legislative mandates. EDP will:

• Transform tax processing by providing near real-time access to data.

• Inform data-driven decision making by providing secure, trusted access to data.

• Improve compliance and fraud detection by providing analytical data and services.

• Support Inflation Reduction Act (IRA) and modernization goals by providing foundational data services and data products

2.0 Scope and Description of Tasks

The Contractor shall perform all platform development, engineering, Operations and

Maintenance (O&M) tasks to support mission-critical IRS applications. Services include:

• Platform engineering, upgrades, and sustainment

• Cloud infrastructure management - Monitoring, backup, and disaster recovery

• Data integration and access management

• Cost optimization and performance tuning

• Compliance with Treasury and IRS Information Technology (IT) security policies

The objective of this requirement is to deliver integrated, secure, and scalable technology capabilities that advance the IRS’s modernization priorities and enable faster, more reliable, and more secure delivery of digital services.

2.1 Platform Development, Modernization, and Enhancement (DME)

• Design and maintain AWS account structures, organizational units, and landing zones that provide the backbone for multi-tenant operations.

• Build and operate shared services such as VPCs, Transit Gateways, PrivateLink, and DNS to enable secure connectivity across environments.

• Provision and manage compute and data services including EKS, Databricks, RDS, Redshift, and S3 at enterprise scale.

• Implement CI/CD pipelines and Infrastructure-as-Code modules to ensure consistent, repeatable provisioning of resources.

• Deliver observability frameworks for logging, monitoring, metrics, and tracing to give full visibility into platform health.

• Maintain and enforce secure baseline configurations for operating systems, containers, and middleware across all environments.

• Enable cross-environment integrations and routing so tenants and services can operate securely and reliably.

• Provide standardized APIs and SDKs to tenants so they can consume platform services efficiently.

• Architect and validate high-availability and disaster recovery patterns that protect workloads against outages.

• Continuously upgrade, tune, and evolve the platform to keep pace with performance, security, and feature needs.

Desired Outcome

Establish a modern, secure, and enterprise-scale technology foundation that enables the IRS to deliver faster, more reliable, and more secure data services in alignment with its mission and the priorities of the administration. Specifically, the initiative aims to:

• Integrate cybersecurity automation, least-privilege access controls, and centralized secrets management into enterprise workflows.

• Ensure all delivered capabilities comply with IRS enterprise security standards, federal regulations, and audit requirements.

• Provide the agility needed to adapt to evolving taxpayer needs, emerging technologies, and future policy requirements.

• Enhance monitoring, observability, and cost transparency to optimize platform performance and resource utilization.

• Provide a scalable, observable, and resilient cloud platform to support the deployment of mission-critical workloads across hybrid and multi-cloud environments.

2.2 Platform Operations and Maintenance (O&M)

• Monitor the health of infrastructure, clusters, jobs, and APIs on a continuous basis and respond quickly to issues.

• Manage incident response, conduct root-cause analysis, and coordinate escalations across teams when outages occur.

• Perform deployments, upgrades, patches, and hotfixes to limit downtime and proper change control.

• Maintain backup strategies, perform restore tests, and validate disaster recovery readiness.

• Tune performance of compute clusters, databases, and queries to ensure reliable operations under heavy load.

• Provide 24/7 operational coverage and surge support during critical filing seasons or high-demand periods.

• Automate repetitive operational tasks to reduce manual overhead and improve system reliability.

• Track and report Service Level Agreement (SLA) performance, uptime, and availability metrics for leadership visibility.

• Maintain detailed runbooks, SOPs, and operational playbooks to support consistent execution across the team.

Desired Outcome

Establish a secure, resilient, and scalable network infrastructure that enables the IRS to deploy and operate mission-critical applications and services across hybrid and multi-cloud environments with precision. The solution will standardize connectivity patterns, enforce enterprise security policies, and provide reliable traffic management to ensure availability, compliance, and performance across all IRS workloads. Specifically, the initiative aims to

• Provide high-throughput, encrypted connections between IRS on-premises systems and cloud platforms, as well as between cloud platforms, ensuring seamless hybrid and multi-cloud operations.

• Enforce Zero Trust networking principles by applying macro- and micro-level security controls, including ACLs, firewalls, and security groups, to ensure least-privilege access and compliance with IRS cybersecurity standards.

• Deliver fault-tolerant, highly available network architectures that support disaster recovery, redundancy, and performance at scale, enabling IRS workloads to maintain ≥ 99.9% availability.

• Provide standardized network patterns and External Partner Zone (EPZ) onboarding processes to streamline and secure the migration of projects and workloads to the cloud.

• Implement observability and monitoring capabilities for real-time visibility into network performance, coupled with automated alerts, runbooks, and incident response workflows to reduce Mean Time to Detection (MTTD) and Mean Time to Recovery (MTTR).

3.0 CLIN Structure

The below table is the CLIN structure including the anticipated labor categories (LCATs) and hours by the Government for the Contractor to complete PWS work as described at Section 2.0.

CLIN

Number Description of Items or Services Labor Category Hours

Platform Development, Modernization, and

Enhancement (DME)

Infrastructure Architect II 2,880

Cloud Architect III 5,760

Cloud Administrator III 7,680

Cloud Administrator II 7,680

Platform Engineer III 9,600

Database Administrator III 5,760

DevOps Engineer III 7,680

Site Reliability Engineer III 5,760

Cloud FinOps Analyst 1,920

Platform Support Analyst 1,920

IT Project Manager III 1,920

Systems Engineer III 1,920

Data Engineer II 1,920

Data Analyst III 1,920

Business Analyst III 1,920

Subtotal for CLIN 0001 66,240

0002 Platform Operations and Maintenance (O&M)

Site Reliability Engineer III 1,920

DevOps Engineer III 3,840

Database Administrator III 3,840

Platform Engineer III 3,840

Cloud Administrator III 3,840

SubTotal for CLIN 0002 17,280

Base Total (CLIN 0001 & CLIN 0002) - 12 months from date of award 83,520

Enhancement (DME)

Infrastructure Architect II 2,880

Cloud Architect III 5,760

Cloud Administrator III 7,680

Cloud Administrator II 7,680

Platform Engineer III 9,600

Database Administrator III 5,760

DevOps Engineer III 7,680

Site Reliability Engineer III 5,760

Cloud FinOps Analyst 1,920

Platform Support Analyst 1,920

IT Project Manager III 1,920

Systems Engineer III 1,920

Data Engineer II 1,920

Data Analyst III 1,920

Business Analyst III 1,920

Subtotal for CLIN 1001 66,240

1002 Platform Operations and Maintenance (O&M)

Site Reliability Engineer III 1,920

DevOps Engineer III 3,840

Database Administrator III 3,840

Platform Engineer III 3,840

Cloud Administrator III 3,840

SubTotal for CLIN 1002 17,280

Option 1 Total (CLIN 1001 & CLIN 1002) - 12 months after base period 83,520

Enhancement (DME)

Infrastructure Architect II 2,880

Cloud Architect III 5,760

Cloud Administrator III 7,680

Cloud Administrator II 7,680

Platform Engineer III 9,600

Database Administrator III 5,760

DevOps Engineer III 7,680

Site Reliability Engineer III 5,760

Cloud FinOps Analyst 1,920

Platform Support Analyst 1,920

IT Project Manager III 1,920

Systems Engineer III 1,920

Data Engineer II 1,920

Data Analyst III 1,920

Business Analyst III 1,920

Subtotal for CLIN 2001 66,240

2002 Platform Operations and Maintenance (O&M)

Site Reliability Engineer III 1,920

DevOps Engineer III 3,840

Database Administrator III 3,840

Platform Engineer III 3,840

Cloud Administrator III 3,840

SubTotal for CLIN 2002 17,280

Option 2 Total (CLIN 2001 & CLIN 2002) - 12 months after option 1 period 83,520

Grand Total (Base Period + All Options) 250,560

4.0 Key Personnel

The Offeror shall identify, (in their proposal based on information provided in the table below), certain positions or roles and associated labor categories considered to be Key Positions. The

Contractor shall submit the name and resume of the Contractor employee proposed in each Key

Position.

Contractor employees identified as Key Personnel shall be dedicated to this project. If any changes in proposed Key Personnel become necessary during actual performance, the

Contractor shall provide written notification sixty (60) days in advance. In the event of a sudden change in Key Personnel (death, incapacitation, immediate termination, etc.), the Contractor shall provide written notice to the Contracting Officer (CO) within three (3) calendar days of the event. For any substitution, the Contractor shall submit justification with a proposed substitute whose qualifications are equal to or greater than the person being replaced, along with a one (1) to 2 (two)-page introductory summary, in sufficient detail to permit evaluation within

10 calendar days of notification of a substitution.

Number of Key

Personnel Role

Key Personnel Minimum

Experience and Skill

Requirements

Program Manager PMP certified; 10+ years leading federal IT programs

Cloud Architect AWS Certified Solutions

Architect; 8+ years in enterprise-scale cloud systems

DevOps Engineer Expertise in CI/CD and

Infrastructure-as-Code (Terraform, Jenkins, GitLab)

Security Engineer CISSP or equivalent; experience in

FedRAMP and NIST 800-53 compliance

Operations Lead 7+ years managing 24/7 enterprise environments

5.0 Government Furnished Property (GFP) And Government Furnished Information

(GFI)

Government furnished property (to include material, equipment, and/or information) shall be provided in the performance of this Task Order. The IRS will provide the following property:

ITEMS QUANTITY

Contractor Identification Badge TBD

Contractor Building Access/Proximity Card TBD

Desktop/Laptop Computer with Local Area Network Access TBD

Microsoft Office TBD

Office Space (Desk, Chair, Standard Office Equipment) As Needed TBD

Desktop telephone TBD

Government furnished information (to include manuals, notes, memos, instruction materials, and other information) shall be provided during the performance of this agreement. The IRS will provide the following information:

ITEMS QUANTITY

TBD TBD

Access to standards and guidelines and any other documentation that is required for the satisfactory performance of this requirement will be made available to the Contractor no later than five (5) business days after request.

The issuance, handling and disposition of GFP shall be conducted in accordance with FAR

52.245-1, Government Property, Alternate I, 52.245-9, Use and Charges and the requirements set forth in Section 11, Security Requirements. All GFP/GFI shall be returned to the

Government upon contract completion, as appropriate.

The Government will provide: - Access to IRS systems, cloud environments, and development tools.

The contractor shall safeguard all GFP/GFI per IRS security policy.

6.0 Packaging and Marking

Delivered documents may be sent electronically using Microsoft Office 365, or other as approved, to IRS email address accounts only. Attachments shall use Secure ZIP when appropriate, such as documents larger than 3MB.

The Contractor shall ensure that all deliverables are clearly marked with the contract number/

Task Order numbers and visible on all shipping/service documents, containers, and invoices.

7.0 Inspection And Acceptance

7.1 Inspection

Inspection will be at the same place as performance and delivery, unless otherwise specified.

7.2 General Acceptance Criteria

The general quality measures as set forth below will be applied to each work product received from the Contractor under this Task Order.

• Accuracy – work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – work products shall be clear and concise; engineering terms shall be used, as appropriate. All diagrams shall be easy to understand and relevant to the supporting narrative.

• Specifications Validity – All work products shall satisfy the requirements of the

Government as specified herein.

• Format – work products shall be submitted in hard copy (where applicable) and in media defined in the PWS. The work product format is defined in this PWS. Hard copy formats shall follow Department of the Treasury and IRS Directives and shall be consistent with other similar efforts. All text and diagrammatic files shall be editable by the Government.

• Timeliness – work products shall be submitted on or before the due date specified in this

Task Order, or submitted in accordance with a later, scheduled date determined by the

CO.

7.3 Review of Deliverables/Work Products

• The Government will perform an initial review of deliverables, and if problems are encountered during the review, the Contractor must correct them. If necessary, a meeting may be convened to resolve any differences. The Contractor shall make all required changes to achieve an acceptable deliverable. The Government will perform its review within approximately ten (10) calendar days from receipt of the deliverable or as otherwise specified in each Task Order.

• When the review of a deliverable results in necessary modifications, the Government will, in accordance with the approved Task Order schedule, provide the necessary documentation to state why the deliverable is unacceptable. It will then be the responsibility of the Contractor to properly and consistently incorporate the comments in the final product.

• These procedures shall not be construed to constitute a waiver on the part of the

Government of its rights under FAR Subpart 49.4, entitled “Termination for Default”, nor of any other rights or remedies provided by law or under this contract.

• All deliverables considered “Unacceptable” and not in accordance with the elements of

Documentation Quality as stated below will be returned to the Contractor for rework, correction, and updates. The Contractor shall re-submit the deliverables to the

Government within five (5) business days at no additional charge to the Government.

Documentation Quality:

The Contractor shall provide all information in accordance with the required IRS standards and guidelines as stated in Sections 2.0 and 3.0 of this PWS.

All deliverables, documents, and services shall satisfy program and project requirements, and comply with IRS Capability Maturity Model Integration (CMMI) standards, existing IRS policies, standards, and guidelines, and compliant with IRS security and section 508 requirements.

The Government will have the right to request suppression of hard copy deliverables in cases where security and privacy concerns are a factor, or to reduce paperwork burden. All deliverables resulting from work executed under this contract shall convey to the Government. In addition to the requirements set forth in the Quality Assurance Surveillance Plan (QASP), all documentation shall be provided in accordance with the criteria set forth below:

• Completeness – The document demonstrates sufficient level of detail to show understanding of the requirements, technology and design, customers and operating environment.

• Feasibility - The document defines information which is formatted properly, contains valid information in support of this task order and provides a deliverable within time constraints.

• Accuracy – The document is accurate in presentation exhibiting clear and concise information, technical content, and adherence to accepted elements of style, operational content, and consistent within itself and with other documents.

• Practicality - The document provides information and guidance that is practical for implementation within the IRS environment and appropriate given the subject organization’s level of maturity.

8.0 Quality Control

The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement a Quality Control Plan (QCP) to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which he/she assures himself/herself that his/her work complies with the requirements of the contract. The

Contractor shall provide the associated QCP to the Government as directed.

8.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document QCP. The QCP shall ensure the

Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor’s methodology for identifying and recruiting personnel.

The QCP shall also provide the Contractor’s methodology for resolving problems identified by the Government during reviews and conducted in accordance with its Quality Assurance QASP.

The QCP shall also provide the Contractor’s methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system.

The QCP shall demonstrate and validate that the services or deliverables to be provided under this contract are completed with a level of quality that meets the minimum performance threshold established in the Government’s QASP. The QCP shall address Quality Management

Approach, Quality Assurance, Quality Control, and Quality Standards. The QCP shall be submitted within thirty (30) days after award. Three copies of a comprehensive written QCP shall be submitted to the COR and CO within five (5) business days when changes are made thereafter. After acceptance of the QCP, the Contractor shall receive the CO’s acceptance in writing of any proposed change to the QC system.

9.0 Deliveries of Performance

9.1 Period of Performance

The period of performance of this requirement will be a 12-month base period plus two (2) 12-month options. The base period will end 12-month from Date of Award.

9.2 Place of Performance

The Contractor shall perform work under this contract remotely, or at various IRS facilities located in (though not exclusively): Lanham, MD; Martinsburg, WV; Memphis, TN;

Washington, D.C.; Austin, TX; Dallas, TX.

• Core Hours: 0800–1700 ET, Monday–Friday (excluding Federal holidays)

9.3 Ship To

• Unless otherwise specified, all deliverables/work products shall be provided no later than

4:00 P.M. EST local time on the date(s) specified in the Task Order.

9.4 Deliverables

Unless otherwise requested in writing by the Contracting Officer’s Representative (COR), deliverables/work products shall be produced using standard issued Microsoft Office products, as approved by the IRS.

All deliverables shall be delivered as specified in the following deliverable schedule.

All deliverables shall be subject to review and acceptance by the IRS Project Manager (PM) and designated technical leads. The COR shall provide final approval. Deliverables will be accepted when they meet IRS technical, functional, and compliance standards, as outlined below.

The schedule listed in this PWS shall apply for all deliverables unless changed in writing by the

CO. Final acceptance of each deliverable by the COR shall be made in writing only after each deliverable has been corrected and conforms to the requirements contained herein.

9.4.1 Delivery Schedules

The Contractor shall be responsible for completing contract deliverables and their submission to the Government in accordance with the contract specification. The Government will review and approve or disapprove all contract deliverables. The deliverable items are categorized in the table below.

Table 1: Schedule of Deliverables The deliverables/work products and schedules that are required for this requirement are as follows:

Deliverable

No.

Deliverable Frequency Delivery POC

1 Provide build specification for

TCloud to Provision VMs on the cloud

Monthly

2 Provide build specifications for

TCloud to Provision Cloud

Environments

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

3 Provide build specifications for

TCloud to provision Cloud

Storage buckets with data organization

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

4 Provide build specifications for

TCloud to provision Network configurations including subnets, security groups, and load balancers

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

5 Provide build specifications for

TCloud to provision Database instances on the cloud

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

6 List of current containerized applications supported on EDP

Weekly Assigned Govt.

Technical Point of Contact and

Project Manager

7 List of tenant software deployments to EDP

Weekly Assigned Govt.

Technical Point of Contact and

Project Manager

8 Architecture Diagrams for API

Integration with third-party services via APIs exposed by EDP platform tools

As Needed/ 10 business days after requirements are

Assigned Govt.

Technical Point of Contact and

Project Manager

Federally approved

9 Design cloud architecture for EDP

Platform

As Needed/ 10 business days after changes are

Federally approved

Assigned Govt.

Technical Point of Contact and

Project Manager

10 Review and analyze cloud cost optimization reports provided by

TCloud

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

11 Provide and Maintain EDP

Platform performance monitoring dashboards

Weekly Assigned Govt.

Technical Point of Contact and

Project Manager

12 Provide and Maintain EDP

Platform Disaster recovery plan and coordination with EDP tenants on testing documentation

Quarterly Assigned Govt.

Technical Point of Contact and

Project Manager

13 Cloud architecture diagrams and documentation for EDP Platform

As Needed/ 10 business days after changes are

Federally approved

Assigned Govt.

Technical Point of Contact and

Project Manager

14 Provide Data Flow Diagrams and

DB Schema Diagrams

Annually

(Collecting from

Tenants and archiving on

EDP Sharepoint)

Assigned Govt.

Technical Point of Contact and

Project Manager

15 Provide build specifications for

TCloud to provision access control policies for users and groups

Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

16 Transition Out Plan 10 days after the exercising of the

Transition Out

(optional)

Contract Line

Item Number

(CLIN).

Assigned Govt.

Technical Point of Contact and

Project Manager

17 Monthly Workplan Monthly Assigned Govt.

Technical Point

18 Monthly Accomplishments Monthly Assigned Govt.

Technical Point of Contact and

Project Manager

19 EDP Bi-Weekly Platform Status

Updates

Bi-weekly Assigned Govt.

Technical Point of Contact and

Project Manager

20 Databricks E2 in EDP 2.0 Project

Schedule

Initial: Within

30 business days

Updates:

Weekly

Assigned Govt.

Technical Point of Contact and

Project Manager

21 EDP 2.0 Target State

Architecture Diagram

Initial: Within

30 business days

Updates: As

Needed

Assigned Govt.

Technical Point of Contact and

Project Manager

22 EDP 2.0 Tenant Onboarding

Guide Initial Draft

Initial: Within

60 business days

Updates: As needed

Assigned Govt.

Technical Point of Contact and

Project Manager

23 EDP 2.0 Vision Working Session Once within 60 days

Assigned Govt.

Technical Point of Contact and

Project Manager

24 EDP 2.0 E2 Dev, Test, PreProd, and Prod environment set-up

Within 60 business days

Assigned Govt.

Technical Point of Contact and

Project Manager

25 Provide Databricks Unity Catalog enabled E2 workspace that integrates with EDP 2.0

Within 60 business days

Assigned Govt.

Technical Point of Contact and

Project Manager

26 Develop initial list of EDP 2.0 tenants and data pipelines for support

Within 30 business days

Assigned Govt.

Technical Point of Contact and

Project Manager

27 Document draft identity and access management configurations

Ongoing Assigned Govt.

Technical Point

9.4.2 Transition In Plan

The Contractor shall provide a Transition-In Plan within ten (10) business days of award.

Transition-In:

The Transition-In task permits for an effective transition from incumbent(s) Contractor to a new

Contractor. This process shall take no more than thirty 90 calendar days to complete from the award date. Successful transition shall be defined by its capacity to maintain full continuity of operations, high productivity, and exemplary service quality. To ensure a successful, low-risk transition, the Contractor shall follow the approved Transition-In Plan submitted as part of their proposal and keep the Government fully informed of status throughout the Transition-In period.

During the Transition-In period, the incumbent(s) is responsible for performance.

9.4.3 Transition Out Plan

28 Document security monitoring and logging setup

Ongoing Assigned Govt.

Technical Point of Contact and

Project Manager

29 Draft ATO paperwork for E2 Within 60 business days

Assigned Govt.

Technical Point of Contact and

Project Manager

30 Maintenance schedules No later than the

7th of each month

Assigned Govt.

Technical Point of Contact and

Project Manager

31 EDP CI/CD architecture documentation

As Needed/ 10 business days after changes are

Federally approved

Assigned Govt.

Technical Point of Contact and

32 Runbook creations and reviews

Weekly/twice in a week

Assigned Govt.

Technical Point of Contact and

Project Manager

33 Playbook creation Weekly/twice in a week

Assigned Govt.

Technical Point of Contact and

34 Backup and restore procedures

Quarterly Assigned Govt.

Technical Point

The Contractor shall provide the vision and planning for the proposed transition efforts toward uses to meet mission requirements (operation, application, commercialization, other uses).

The Contractor shall develop, document, and provide a Transition-Out Plan no later than ninety

(90) calendar days after the date of award, or earlier if directed by the Contracting Officer, and shall be updated annually. The Contractor’s Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent(s) to the incoming Contractor and

Cybersecurity personnel. The Contractor shall identify transition activities, schedules, and milestones for the turnover of work (e.g., operations, maintenance, engineering, training, asset management, and logistics functions) and identify how it will coordinate with the incoming

Contractor(s) and Cybersecurity personnel to transfer knowledge.

Deliverable Purpose

Transition-Out Plan The Contractor shall develop, document, and provide a Transition-Out Plan no later than ninety (90) calendar days after the date of award, or earlier if directed by the Contracting Officer, and shall be updated annually.

10.0 Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal

Travel Regulation and in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode of transportation commensurate with mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class, or similar lodging accommodations to the extent they are available and commensurate with mission requirements.

IRS will not reimburse Contractor’s local travel. Local travel is defined as travel within fifty

(50) miles of the Contractor’s facility. All other approved travel will be reimbursed on a cost reimbursable basis; no profit or fee will be paid.

11.0 Performance Requirements Summary (PRS)

The summary chart below lists the contract's primary requirements, the associated performance standards, the expected target performance, and the process of surveillance. While some contract requirements may not be listed in the chart below, requirements not appearing on the

PRS chart do not negate the Contractor's obligation to perform all requirements as specified in the contract. Additionally, IRS reserves all rights and remedies under the provisions and clauses of the contract when performance of any contract requirement, whether or not listed below, is unacceptable.

IRS will provide a QASP to be used to provide contract oversight. In conjunction with the

Contractor's QCP and various other processes of assessing performance, the COR may perform on-site reviews and/or other types of verification to determine that the specified target performance requirements have been met. Regular review of Contractor performance is critical to the overall success of the contract. On a monthly basis, the COR will evaluate the quality of the product or services.

Performance Requirement Summary

Performance

Objective Performance Standard

Acceptable

Quality Level

(AQL)

Surveillance

Method

Platform

Availability

Maintain ≥99.5% uptime

(excluding planned maintenance)

99.5% Automated monitoring

Incident

Response

Critical incidents resolved within 2 hours

95% Monthly performance report

Patch

Management

Apply security patches within 30 days

100% Quarterly audit

DR Testing Perform recovery validation quarterly

100% Test results review

Report

Submission

Deliver reports by due dates 95% COR review

12.0 Contractor Employee On-Boarding Requirement

12.1 Paperwork Completeness and Accuracy

a. The IRS will provide the vendor point of contact (POC) with the Risk Assessment Checklist

(RAC), along with other required investigative forms (details in section 1.5 below).

b. All forms must contain the full legal name that matches the applicant's identification (e.g.

state issued id, passport, etc.)

c. Vendors should ensure fields requiring social security numbers and phone numbers have the correct number of digits.

d. The IRS will reject forms that are incomplete, illegible, inaccurate, and contradict other forms in the package.

12.2 Contractor Eligibility

All Contractor / Subcontractor employees submitted for staff - like access approval must be eligible for IRS contract employment to the best of the vendor’s knowledge. In order to be approved for interim staff - like access, IRS will confirm that Contractor / Subcontractor employees first meet the following initial eligibility requirements:

12.2.1 U.S. Citizenship or Lawful Permanent Resident (LPR) status: Subjects must be US citizens or LPRs (dependent on position risk level) to be eligible for staff-like access. a. No documentation is required as proof of U.S. citizenship for subjects born in the United States. b.

If subjects are foreign-born, vendor POC MUST provide the subjects’ Alien Registration or “A”

Number for verification of their status.

12.2.2 Selective Service Registration (for males born after 12/31/59): Vendor POC MUST provide the following documentation to the IRS:

a. Registered applicants: Official letters of verification can be obtained and saved via the

Selective Service website at https://www.sss.gov/verify/proof/.

b. Non-registered applicants:

i. If the subject is foreign - born, vendors must provide a letter from the Selective Service stating the subject was not required to register or that the subject was required to register but it is too late.

ii. For US citizens or foreign - born subjects who were required to register but did not, the vendor must provide a written explanation as to why the non - registration was not knowing or willful.

12.2.3 Federal Tax Compliance: Subjects must be tax compliant and must remain compliant while actively working on IRS contracts.

a. IRS will check tax compliance – no documentation is required from the vendor POC.

b. Vendors are responsible for informing their applicants of this requirement.

12.3 Timeliness

a. Delays in any of the actions stated below will result in Contractor / Subcontractor employee onboarding delays and starting work on the contract.

b. All investigative forms and documentation are due to the IRS within 10 business days of receipt. If IRS approval is required to confirm the qualifications of proposed Contractor personnel, i.e. key personnel, documents must be submitted within 10 days of receipt of this approval.

c. All individuals listed on the RAC should be fingerprinted within 5 business days after IRS sponsorship in USAccess. If an individual is not able to make an appointment within this timeframe, the vendor POC will provide documentation that an appointment was not available and provide the date of the scheduled appointment.

d. The Contractor / Subcontractor employee must accurately complete the eAPP application, if applicable, within 8 calendar days of receipt of the invitation. Failure to complete eAPP will result in not being permitted to work on the contract.

12.4 Investigative Forms / Documentation, Fingerprinting, and eAPP

a. Contract Profile: Following the award of the contract, the COR will need to submit this document to HCO Mailbox to establish the Contract within the Contract Management Module

(CMM) system. This creates the record for contract and Task Order information in the CMM.

b. Master Survey / Position Designation Tool: Following this meeting, the COR will work with the Vendor POC to complete this questionnaire for each unique position type on the contract.

This questionnaire asks the vendor POC and COR to identify the duties the subjects will be performing for IRS in order to determine risk level for the position. A separate Master Survey must be completed for each position type on the contract (i.e., Systems Administrator, Programmer, Clerk Typist, etc.). The results must be saved and sent to IRS PS. The Position

Designation Tool is listed here- Position Designation System (PDS) and Position Designation

Tool (PDT) (dcsa.mil)

c. Investigative Forms / Documentation: The IRS will provide the vendor POC with the following investigative forms for completion by each applicant requiring staff-like access:

i. Risk Assessment Checklist (RAC): The RAC is a summary Excel spreadsheet that captures information related to the subjects for whom the vendor is requesting staff-like access. The vendor POC must ensure that EVERY column in the RAC is completed accurately prior to submitting to the IRS. Failure to do so will result in a rejection of the RAC and a delay in the on

- boarding process.

ii. OF-306, Declaration for Federal Employment (version 2023): Form must be completed and signed by each Contractor / Subcontractor employee requiring staff - like access.

iii. Non-Disclosure Agreement (NDA): Form must be completed and signed by each Contractor

/ Subcontractor employee requiring access to sensitive but unclassified (SBU) data. This form is not required to be submitted to Personnel Security. This form is for the COR records only.

iv. Form 13340, Information Provided Concerning the Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act (FCRA): Form must be completed and signed by each Contractor / Subcontractor employee requiring staff - like access.

v. Notice 1379, Tax Check Notice: Provide to subjects to inform them of IRS’ intent to check their federal tax compliance at onboarding and annually thereafter while continuing to actively work on IRS contracts.

d. Fingerprinting and eAPP

IRS will enroll each subject in USAccess based on the information provided on the RAC. The

USAccess system will send an email invitation to schedule a fingerprinting appointment.

Individuals should be fingerprinted within 5 business days of receipt of the sponsorship email.

Note that the USAccess email may sometimes be marked as SPAM. Subjects are asked to check their SPAM folders for the email.

Electronic Questionnaires for Investigations (eAPP): If Contractor / Subcontractor employees do not have a current federal background investigation already completed and favorably adjudicated at the appropriate risk level, they will receive an email with a link to complete the eAPP form online. The email will contain instructions for accessing the system, and guidance to assist if issues are encountered. Contractors and Subcontractor personnel must complete eAPP within 8 calendar days of receipt of the email.

12.5 Contractor Training Requirements

a. Contractor / Subcontractor employees must complete Security Awareness Training (SAT) within 10 business days of receiving approval of interim staff - like access.

b. Contractor / Subcontractor employees must certify completion using the Form 14616, Contractor SAT Certification, and the Form 11370, Certification of Annual UNAX Awareness

Briefing and provide these forms to the COR.

12.6 Security Badges

a. Contractor / Subcontractor employees must accurately complete Form 13716A, Request for

ID Media / Access Card for Contract Employee, and submit as a PDF document (no photocopies or pictures).

b. Contractor / Subcontractor employees are responsible for:

i. Safeguarding their ID / access card.

ii. Wearing ID cards / security badges at or above the waist with photo facing out in an approved cover with no obstructions to the card.

iii. Reporting lost / stolen cards immediately to their COR, the local Facilities Management &

Security Services (FMSS) physical security office, the Situational Awareness Management

Center (SAMC), Treasury Inspector General for Tax Administration (TIGTA), and completing

Form 4589, Lost or Forgotten ID Card Record.

12.7 Contractor Separation

a. The vendor POC is responsible for notifying the COR no later than one business day of a

Contractor / Subcontractor employee separating (notification may also occur prior to separation).

b. If the Contractor / Subcontractor employee works more than one contract or Task Order, notification to multiple CORs may be combined.

c. The Contractor / Subcontractor employee is responsible for returning the following to the

COR on or before their last day of work on the contract. Note that laptops and equipment are assigned to the individual, not the vendor and therefore must be returned upon separation:

i. IRS - issued badge and/or proxy card

ii. IRS keys

iii. IRS - issued laptop

iv. IRS furnished documents

v. IRS passports

vi. Any and all IRS data

vii. Any other items furnished or identified by the IRS

viii. Any other items or materials issued by the Agency for the contract.

Note:

IRM 10.23.2: “Staff - like Access” is authority granted to perform one or more of the following:

• Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

• Possess login credentials to information systems (IRS or vendor - owned systems that store, collect, and / or process IRS information);

• Possess physical and / or logical access to (including the opportunity to see, read, transcribe, and / or interpret) Sensitive but Unclassified (SBU) data, wherever the location (See IRM 10.5.1 for examples of SBU data);

• Possess physical access to (including the opportunity to see, read, transcribe, and / or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room, wherever the location). These items include, but are not limited to, security devices / records, computer equipment, Identification media. For details and further security requirements, see IRM 1.4.6.5.1, Minimum Protection Standards); or,

• Enter physical areas, wherever the location, that store / process SBU information (unescorted).

Staff - Like Access is granted to an individual who is not an IRS employee (and includes, but is not limited to: Contractor / Subcontractor employees, whether procured by IRS or another federal agency, vendors, delivery persons, experts, consultants, paid / unpaid interns, other federal employees, cleaning / maintenance employees, etc.), and is approved upon required completion of a favorable suitability / fitness determination conducted by IRS Personnel

Security.

IRSAP Requirements - Submission of Security Forms and Related Materials (APR 2024) requires Contractor/Subcontractor employees needing staff-like access to IRS equities to be investigated by IRS Personnel Security (PS).

End of Contractor on - boarding requirements language

The provisions are subject to change and further requirements may be added. If these requirements are revised, the IRS will issue a modification to the Task Order.

13.0 Applicable Documents

• OMB M-22-09 – Zero Trust Strategy

• NIST SP 800-53 Rev. 5 – Security and Privacy Controls

• Treasury/IRS IT Security Policy

• DOE Performance Measurement Guidance (for performance metrics alignment)

14.0 Security

14.1 Key Control

The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the

Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by

Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

In this regard, Contractor shall furnish the following electronic documents to Contractor

Security Management (CSM) at CSM@irs.gov within 10 business days (or shorter period) of assigning (or reassigning) an employee to this contract/order/agreement and prior to the contractor (including subcontractor) employee performing any work or being granted staff-like access to IRS SBU or IRS/contractor (including subcontractor) facilities, information systems/assets that process/store SBU information thereunder:

• IRS-provided Risk Assessment Checklist (RAC) Form 14606;

• Non-Disclosure Agreement (if contract terms grant SBU access); and,

• Any additional required security forms, which will be made available through CSM and the

COR.

Contract Duration:

a. Contractors (including subcontractors) whose duration of employment exceeds 180 days must meet the eligibility/suitability requirements for staff-like access and shall undergo a background investigation based on the assigned position risk designation as a condition of work under the

Government contract/order/agreement.

b. If the duration of employment is less than 180 days, or access is infrequent (i.e. 2 -3 days per month), but the contractor requires staff-like access, the contractor (including subcontractor) employee must meet the eligibility requirements for staff-like access (federal tax compliance, Selective Service Registration, and US Citizenship or Lawful Permanent Residency), as well as a FBI Fingerprint result screening.

c. For contractor (including subcontractor) employees not requiring staff-like access to IT systems or SBU data, a background investigation is not needed and will not be requested if a qualified escort, defined as an IRS employee or as a contractor who has been granted staff-like access, escorts a contractor at all times while the escorted contractor accesses IRS facilities, or vendor facilities where IRS IT systems hardware or SBU data is stored. As prescribed in IRM

10.23.2, escorting in lieu of staff-like access for IT systems and access to SBU data (escorted or unescorted) will not be allowed.

The contractor (including subcontractor) employee will be permitted to perform under the contract/order/agreement and have staff-like access to IRS facilities, IT systems, and/or SBU data only upon notice of an interim or final staff-like approval from IRS Personnel Security, as defined in IRM 10.23.2 – Contractor Investigations, and is otherwise consistent with IRS security practices and related IRMs, to include, but not limited to:

IRM 1.4.6 – Managers Security Handbook;

IRM10.2.14 – Methods of Providing Protection; and, IRM 10.8.1 - Policy and Guidance.

Current Investigation Reciprocity: Individuals who possess a prior favorably adjudicated

Government background investigation that meets the scope and criteria required for their position may be granted interim staff-like access approval upon verification of the prior investigation, receipt of all required contractor security forms, and favorable adjudication of

IRS pre-screening eligibility/suitability checks. If their current investigation meets IRS established criteria for investigative reciprocity, individuals will not be required to undergo a new investigation beyond an approved pre-screening determination.

Flow down of clauses: The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails access to SBU information by a subcontractor, at any tier, the substantially same Federal Acquisition Regulation (FAR) and local security or safeguard clauses or provisions for protecting SBU information or information systems that apply to and are incorporated in its prime contract with IRS.