PWS PGLD IDENTITY ASSURANCE CONTRACTOR SUPPORT 20241202.pdf

PERFORMANCE WORK STATEMENT (PWS)

IRS PGLD IDENTITY ASSURANCE CONTRACTOR SUPPORT

1.0 INTRODUCTION / BACKGROUND

Identity Assurance (IA) establishes Internal Revenue Service (IRS) Authentication, Authorization, and Access (A3), policy, identifies capabilities, and propels business solutions to enable secure services and reduce customer burden across contact channels.

IA provides oversight and strategic direction for customer-facing processes and capabilities, including:

• IRS A3 North Star: IA is leading the IRS A3 North Star, a single enterprise product containing long-term enterprise A3 goals such as an integrated, A3 omni-channel experience for taxpayers. The completed product will include a multi-year roadmap, aligned to enterprise modernization efforts (e.g., Inflation Reduction Act (IRA) Strategic Operating Plan (SOP)) and IA’s mission and goals, for achieving the target state. The Roadmap will document the risks, policies, capabilities, and processes needed to achieve the future state. The IRS A3 North Star consists of three Focus Areas – Policy and Compliance, Technology and Data, and People – to organize enterprise efforts to strengthen and mature the IRS’s A3 posture. This work will be aligned to the IRA SOP and IA work will be managed in the IA Business Plan.

• Secure Access Digital Identity (SADI): IA is the business owner for Secure Access Digital Identity, an IT platform that serves as the Service’s front door for customers looking to access online services. Through this platform, the IRS identity proofs individuals to ensure they are who they claim to be, registers them for an account where they can access services online, and authenticates registered users when they access their account to ensure it is their own.

• Entity Authorization: IA is also at the forefront of establishing online access for business, government, and tax-exempt entities. By identity proofing, authenticating, and authorizing individuals associated with these entities, the IRS has established an online Business Tax Account (BTA) that uses SADI to identity proof and authenticate the individual and IA-developed policies and requirements linking this individual to the entity they wish to represent. Several other initiatives are underway that will allow the IRS to validate that the requesting individual is authorized to access online information on behalf of the business or entity.

• A3 Strategies: In a 2016 GAO-18-418 Audit “Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts”, GAO recommended that the IRS create a repeatable process to identify and evaluate alternative options for improving taxpayer authentication. As a result, IRS identified a need to consistently develop and refresh the A3 Strategies to ensure taxpayer authentication and authorization is continuously improved. These A3 Strategies are a guide for the IRS to improve and strengthen authentication and authorization across the IRS, including across customer contact channels - such as online, correspondence and telephone.

• Electronic Signature: IA is the program office responsible for oversight, policies, and procedures for electronic signatures, as known as e-Signatures, used by taxpayers and tax practitioners to complete online IRS forms, documents, and web applications that require a legally binding signature. The five core components come directly from the three e-Transaction laws and National Institute of Standards and Technology (NIST) 800-63 Digital Identity Guidelines that federal agencies must meet to be compliant with all relevant electronic signature laws and guidance.

• A3 Innovations Studies Program: IA collaborates with Business Owners and IT Identity and Access Management (IAM) to identify and research emerging technologies, policies, and practices that enhance identity proofing, authentication, and authorization capabilities to support omni-channel orchestration.

• Fraud and Analytics Monitoring: Multiple organizations within the Service coordinate to provide data analytics and monitoring of the SADI ecosystem. IA provides analytics and monitoring for A3 processes, such as user identity proofing and authenticating for IRS’s modernized digital identity platform, which provides access to online applications and services. Associated analytics serve fraud detection, system performance, business planning and user experience and behavior functions.

2.0 SCOPE

IA requires contractor support with expertise in analytics, monitoring, and reporting for systems and business processes related to identity assurance and authorization as well as expertise in project management to develop action plans, strategies, and roadmaps related to identity verification and authentication. The addition of the IRA and its requirements for both domestic and international taxpayers to be provided compliant digital services has resulted in requirements for development and enhancement of services to meet the needs of the represented taxpayers.

IA’s organizational priorities focus primarily on:

• IA Strategic Planning: The IRS A3 North Star will be a single enterprise product containing long-term enterprise A3 strategic goals such as an integrated, A3 omni-channel experience for taxpayers. The completed product will include a multi-year roadmap, aligned to enterprise modernization efforts (e.g., IRA SOP) and IRS’s mission and goals, for achieving the target state. The Roadmap will document the risks, policies, capabilities, and processes needed to achieve the future state. Benefits to having the IRS A3 North Star include more efficient content development and maintenance across IA, products and policy that is more easily consumed by end users (IA staff and IRS stakeholders), and a single cohesive future state without duplication or inconsistencies.

• The IRS A3 North Star consists of four Focus Areas – Policy and Compliance, Technology and Data, and People – to organize enterprise efforts to strengthen and mature the IRS’s A3 posture. This work will be aligned to the IRA SOP.

o Policy and Compliance - IA will collaborate with key A3 sponsors and stakeholders to align policies and compliance with the IRS A3 North Star’s desired target state. Objectives include developing, implementing, and maintaining robust A3 and fraud policies. These policies will not only ensure a user-friendly customer experience but also safeguard sensitive customer data, address, and mitigate fraud risks, and establish processes for compliance with standard identity protocols throughout IRS operations.

o Technology and Data - IA will collaborate with key A3 sponsors and stakeholders to align technology and data with the IRS A3 North Star’s desired target state. Objectives include providing tools and technologies to bolster the security and user-friendliness of A3 processes, providing secure identity-proofing options and broadening user access across service channels, while maintaining A3 data to drive informed decisions and safeguarding IRS systems against fraudulent activities.

o People - IA will collaborate with key A3 sponsors and stakeholders to align IRS employees and customers with the IRS A3 North Star’s desired target state. Objectives include equipping employees with essential A3 knowledge and tools to access and manage customer interaction data seamlessly in real-time, resulting in enhanced overall customer experience and strengthening public trust and perception.

o Organizational Transformation - IA will work to implement a comprehensive change management plan, implement a hiring strategy and skilling up with a robust training program, implement the IA Concept of Operations (CONOPS) Plan, establish the IA Portfolio Management Board, focus on analyzing, and discussing and acting on Federal Employee Viewpoint Survey (FEVS) results, resulting in an empowered staff.

IA is responsible for integrating the National Institute of Standards and Technology (NIST) requirements into the authentication and authorization initiatives to prevent online identity theft and refund fraud while improving the taxpayer experience. IA must incorporate meeting NIST requirements and other federal mandates into their authentication and authorization initiatives to prevent identity theft and refund fraud while improving the taxpayer experience. Any contractor working with IA must have an in-depth understanding of NIST Special Publication (SP) 800-63-3, Digital Identity Guidelines, (and subsequent) federal standards and requirements, OMB Memo 19-17, IRC 6103(c) and IRC 6103(e), and federal laws and mandates cited in IRM 10.10.1, and IRM 11.3.2. All of these documents can be accessed by the general public online.

3.0 TECHNICAL REQUIREMENTS

3.1 TASK 1 – ANALYTICS AND MONITORING SUPPORT

The contractor shall provide analytical support such as generating insights into user activity, access characteristics, authentication outcomes, filing behaviors and associated taxpayer activities related to identity assurance and authorization digital and non-digital channels. Historically, this task has required a level of effort (LOE) of one (1) full time equivalent (FTE) Senior Statistician; one (1) FTE Journeyman Statistician; one (1) FTE Junior Statistician; and 0.4 FTE SME Junior Business and Financial Operations Specialist Group 2. Assume one (1) FTE is 1920 hours. Contractor analytic support will include:

3.1.1 Data Preparation and Maintenance of the A3 Database

The contractor shall build and refresh the datasets necessary for IA analytics using data from multiple sources (examples: vendor data, Compliance Data Warehouse, log files, phone call data, walk-in data, correspondence data, EDP, Splunk logs, ESSAR extracts, AZF extracts, etc.). This task includes parsing, cleaning, and combining data from various data sources into analysis ready formats.

The contractor shall maintain a data dictionary to include variable names, descriptions, data source, and cleaning methods. In addition, the contractor will maintain all data, filters, and scoring models for identity proofing and authentication related to IT processes, phones, walk-in centers, and mailed correspondence, and assist in answering data controls and inquiries.

The contractor shall manage data storage solutions for the IA data, including testing data access and converting code, when necessary. When appropriate, the contractor will make recommendations to IA for potential future data storage solutions.

3.1.2 Develop and Generate Regular Statistical Monitoring and Reporting

Contract shall develop and generate reports to assist IA and its stakeholders in identifying potential issues, quantifying transactions, monitoring identity proofing, authentication, and authorization amongst various demographic groups, and to answer key questions needed by IA and its stakeholders.

Regular reports include:

• Weekly SADI Metrics and Monitoring Report, which shall include:

• Relevant information about verification rates for target online applications

• Profile creation counts

• Analysis of low verification rates for any given population, online application, or verification method

• Comparison by year of verification rates

• Logon verification rates

• Weekly active users

• Standard deviation (where appropriate)

• Documented methodology for each type of calculation

• Statistical analysis to investigate results that could indicate a potential issue, and recommended actions based on analysis

• Other A3 data analysis and reports as needed

• Monthly Metrics and Monitoring Report, which shall include:

• Overall authentication attempts, total profiles created, and verification rates by Identity Assurance Level (IAL) for each month of the calendar year (year-to-date)

• Assessment of each stage of the identity proofing process to determine the percentage of attempts that pass or fail each step of the process

• SADI error code analysis to determine volume, percent of stage failures, and percent of overall attempts for each error code

• Analysis of error codes, verification rates, failure codes, active users, target application metric comparisons, webpage technical errors, and registration attempt data to identify any potential issues and dig deeper into both known and unknown events that affected or could have affected identity proofing and authentication in SADI

• E-Services Exception Process and SADI monitoring, and

• Recommended actions based on analysis

• Bi-Weekly Dashboard and Report, which shall include:

• Information about notice volumes (IA to define which notices), metrics, potential issues, and recommendations for resolving any potential issues

• Analysis of pressing issues or potential problems experienced during the two-week timeframe, such as EPSS postal activations over the phone and SADI issue monitoring and data analysis related to issue resolution

• Deeper analysis of any issues found in weekly reports, and

• Recommendations for analysis or actions related to known issues and potential issues

• Other A3 data analysis and reports as needed

• Authorization Reporting: Coordinate with IA in the review of authorization data, and design and develop associated reports.

• E-signature Reporting: Coordinate with IA in the review of e-signature data, and design and develop associated reports.

• Innovation Studies: Coordinate with IA in the review of innovation studies data, and design and develop associated reports.

• Taxpayer/Employee 360/90: Coordinate with IA in the review of Taxpayer/Employee 360/90 A3 data, and design and develop associated reports.

• Channel Orchestration: Coordinate with IA in the review of channel orchestration A3 data, and design and develop associated reports.

• A3 North Star: Coordinate with IA in the review of A3 North Star data, and design and develop associated reports.

• A3 Fraud: Coordinate with IA in the review of A3 fraud data, and design and develop associated reports.

• A3 Ad Hoc Data Analysis Requests: Coordinate with IA in the review of A3 ad hoc data analysis requests, and design and develop associated reports.

• Weekly Transaction Count (for invoicing), which must include:

• the number of transactions for each vendor that IA contracts with for identity proofing and authentication services.

3.1.3 Design and Conduct Research Studies

The contractor shall track and maintain information about research study ideas from data analysis, IA feedback, and IA strategies and programs. Every six (6) months, the contractor shall propose research studies to advance A3 strategic direction, inform IA programs, and address potential or known issues with authentication and identity proofing. These research studies must be approved by the IA Director.

For approved research studies, the contractor will complete an average of 1-2 medium-sized research studies per month. A medium-sized research study should be assumed to include a briefing deck with approximately 10-12 slides.

3.1.4 Solution Configuration Support

The contractor shall support solution configuration of IA’s identity proofing solutions.

Examples of support activities are:

• Conduct analysis and activities for SADI configuration changes. Examples:

o Actively participate in daily/weekly calls with vendors to discuss and report out analysis and findings related to scoring and configuration.

o Review solution documentation.

o Provide questions, input, and topics for working sessions related to vendor’s proposed solution.

o Conduct analysis for configuration changes.

o Provide guidance on investigations to increase user coverage while maintaining security.

• Develop decision documents.

• Prepare pre-UWR content.

• Conduct activities related to current and future vendors that support SADI.

3.1.5 Modeling

The contractor shall provide forecasting/projections related to usage, volumes, and other metrics for IA-owned systems and projects. Examples include:

• Contingency planning

• Online application projections

• Credential Service Provider (CSP) vendor performance for potential future state solutions

• Provide forecasting/projections related to usage, volumes, and other metrics for IA-owned systems and projects.

3.1.6 Develop Metrics and Dashboards

• Support the implementation of a data-driven decision-making framework that incorporates data available from improved reporting to assess risk, cost, and benefits of authentication-related and authorization decisions, processes, capabilities, and policies.

• Develop briefings and support the communication to stakeholders, as needed.

3.1.7 Develop Performance Measurement Framework

The contractor shall complete a Performance Measurement Framework of IA strategic initiatives, goals and objectives, and other IRS data to:

• Identify the set of measures that would best inform IRS executive decisions and tie back to IA strategic initiatives, goals, and objectives.

• Determine which, if any, of those measures currently exist and determine how best to report (e.g., dashboard or monthly, quarterly, etc.).

• Identify those measures that do not exist and prioritize those for future collection/ development.

• Expand the framework to include both outcome, key results, and operational level measures for a balanced and detailed understanding of how things are going.

• Identify the intended users of and uses for each measure in decision-making.

• Complete a measure definition template for each measure.

3.1.8 Support Executive Communication, Fraud Working Groups, Executive Governance Board

The contractor shall:

• Support requested analysis in response to identification of potential risk or unusual activity in coordination with other stakeholders.

• Coordinate with Cybersecurity Fraud Analytics and Monitoring (CFAM), Research, Applied Analytics and Statistics (RAAS), and Privacy Policy and Compliance (PPC) on analytics related to suspicious activities online and/or in legacy programs, and analytical support for response and recovery, as needed.

• Participate with other IRS offices and support requested analysis in response to identification of potential risk or unusual activity.

3.1.9 Knowledge and Risk Management

Maintaining analytics process documentation and risk information in the designated IA SharePoint site. Must contain:

• Document code, approach, methodology and steps to pull data, reports, and executive briefings, and maintain an inventory of knowledge artifact including standard operating procedures

• Documentation of risks, mitigations, status, and file

• Analytics process documentation and risk information

3.1.10 Internal Transition Activities

The contractor shall document processes and perform training to transition and operationalize work to IA analysts and programs, including document code, approach/process, methodology and steps to pull data for reports.

3.1.11 IA Data Gap Analysis

The contractor shall complete a gap analysis of IA and other IRS data to determine what data is available for assessment of IA strategies related to IRS service channels, such as online, mail, phone, walk-in centers, and to support innovation studies.

The gap analysis report must include information about:

• What specific types of data would be useful for assessing IA current state and future state strategic direction.

• Data sources currently owned by IA

• Additional data sources IA currently has access

• Additional information for online, mail, in-person, and phone identity proofing and authentication that would be useful for assessing and planning IA programs

• List of IRS data sources that could assist IA in assessing its strategies and fiscal year project-level goals for legacy channels, online identity proofing and authentication, authorization, innovation studies, electronic signature, and other key programs within IA

• Data owners for each IRS data source; and recommendations for next steps.

3.1.12 Business Unit Support

• Support business units in the design, implementation, and reporting of any new initiatives or pilots for detection or treatment of identity theft, fraud, and / or non-compliance inventory.

• Support business units in the continuous improvement of the identity theft and fraud treatment process to improve taxpayer experience.

• Support the potential integration of IRS online services datasets into business unit’s fraud detection and scheme development processes.

• Support in the continued development of CSPs, including building requirements, providing documentation, and supporting all testing, and defect resolution activities.

• Support business units in monitoring of activity in SADI-protected online applications and identifying potential areas of improvement to improve the identity proofing and tax return verification process.

• Coordinate the integration of CSP into current IRS treatment procedures, including building requirements for data integration with the identity theft inventory.

3.2 TASK 2 – PROFESSIONAL SUPPORT SERVICES

IA requires contractor support with an in-depth understanding of the current challenges, opportunities, and components of the Service’s authentication and authorization capabilities to drive changes based on the IA Authentication, Authorization, IRA Initiative and Project implementation support, SADI, Omni-Channel and e-Signature Strategies, IRS A3 North Star, Entity Authorization .

IA is tasked with a portfolio of high priority initiatives central to IRS’s efforts to combat identity theft and refund fraud while improving the taxpayer experience. These efforts require significant matter expertise in authentication and authorization, IRA outcomes and key deliverables, new legislation relating to other IA programs, IRS domain knowledge, and project management skills.

The contractor support will primarily be focused on using data analytics, knowledge of both industry standards and federal government standards and mandates (i.e., NIST guidelines, OMB memos, relevant laws, etc.), subject matter expertise in authentication and authorization, and both project management and communication skills to assist IA in carrying out its strategies and key programs. Historically, this task has required a level of effort (LOE) of one (1) FTE Senior Business and Financial Operations Specialist Group 2;

two (2) FTE Junior Business and Financial Operations Specialist Group 2; two (2) FTE Journeyman Operations Research Analyst; two (2) FTE Junior Operations Research Analyst; and 0.4 FTE SME Junior Business and Financial Operations Specialist Group 2.

Assume one (1) FTE is 1920 hours.

Contractor support shall include:

3.2.1 Strategic Planning

The contractor shall provide project management support including the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS). This management is the leadership and assignment of all contract employees. The senior manager will be expected to have knowledge and participate in all aspects of the requirements of the PWS ensuring the completion of all assigned tasks to contract personnel to meet the expectations and deliverables of the contract. Specifically, the contractor will assist IA Leadership and the IA Branches with the following work activities:

• Conduct and present strategic reviews of IA IRA initiatives and new legislation relating to other IA programs.

• Provide thought leadership, research, and recommendations to support strategic planning, change management, and execution of plans in IA.

• Make recommendations to plan and implement IA IRA outcomes, key results, and deliverables for the current and out-years.

• Perform analyses of relevant legislation, IRS priorities, stakeholder input, and status of the organizational priorities, capabilities, and IA programs.

• Develop documentation to support all analyses and recommendations.

• Develop recommendations through evidence-based research for key policy issues that will drive the development of IA IRA and new legislative initiatives.

• Monitor the status of other supporting projects.

• Track risks, actions, and deliverables.

• Manage complex projects using project management techniques involving multiple stakeholders with IRS-wide impact.

• Support the engagement and management of stakeholders and support collaboration by leading facilitations.

• Research laws, regulations, and IRS processes.

• Provide a weekly report on work accomplished during the week and next steps.

• Provide a monthly report summarizing all worked performed.

• Provide ad-hoc reports on contractor work assignments.

3.2.2 Support for IRS A3 North Star Focus Areas and IRA SOP

The IRS A3 North Star consists of three Focus Areas – Policy and Compliance, Technology and Data, and People – to organize enterprise efforts to strengthen and mature the IRS’s A3 posture. All of this work will be aligned to the IRA SOP.

The contractor shall work with IA on these initiatives related to the implementation of the A3 strategic direction. Specifically, the contractor will assist IA Leadership and the IA branches with the following work activities:

• Conduct and present strategic reviews of IA IRA outcomes and key results and new legislation relating to other IA programs.

• Make recommendations to plan and implement IA IRA outcomes and key results for the current and out-years.

• Make recommendations for solutions to identified gaps in the IRS A3 North Star desired future state.

• Perform analyses of relevant legislation, IRS priorities, stakeholder input, and status of the organizational priorities, capabilities, and IA programs.

• Develop documentation to support all analyses and recommendations.

• Develop recommendations through evidence-based research for key policy issues that will drive the development of IA IRA or other legislative initiatives.

• Monitor the status of other supporting projects.

• Track risks, actions, and deliverables.

• Support and assist in the planning and development of materials for business partner engagement as directed in the business plans.

• Support the management of complex projects using project management techniques involving multiple stakeholders with IRS-wide impact.

• Support the engagement and management of stakeholders, support collaborations, and leading facilitations of all ongoing plans and projects.

• Research laws, regulations, and IRS processes.

• Assist with short-term and long-term assigned program solutions.

• Develop approaches and processes to prioritize and update assigned projects.

• Identify and disposition risks, mitigations, and status for all project work.

• Assist with the review of current processes and procedures and recommend areas to enhance the strengthening of A3

• Analyze effectiveness and efficiency of project; develop recommendations to improve program operations.

• Assist in answering data analytics controls and inquiries.

• Participate in requirements development process.

• Interpret project related laws, regulations, and directives to determine impact on projects.

• Assist in recommendations of the allocation of resources based on project requirements.

• Support the development of goals and objectives to accomplish mission of government counterparts to ensure execution of projects in accordance to plans.

• Access and review opportunities for streamlining A3 processes.

• Create and assist with the review of current processes and procedures and recommend areas to enhance the strengthening of authentication and authorization for various service channels.

• Develop recommendations through evidence-based research for key policy issues that will drive the development of the Business Authorization and Omni-Channel programs, and IA Inflation Reduction Act outcomes and key results.

• Develop communication materials and supporting documents.

• Monitor the status of other supporting projects – including IRS Inflation

Reduction Act outcomes and key deliverables– and track progress of implementing Authentication and Authorization Strategies’ capabilities.

• Provide project management and business partner engagement support to A3 programs. Specifically, IA requires support to:

o Assist with building and maintaining Project Schedules.

o Track risks, actions, and deliverables.

o Plan and develop materials for business partner engagement as directed in the business plans.

o Manage complex projects using project management techniques involving multiple stakeholders with IRS-wide impact.

o Engage/manage stakeholders and support collaboration and leading facilitations.

o Assist with integrating IA-owned applications (e.g., Authorization

Framework, Electronic Signature Storage and Retrieval system) from a business perspective such as developing integration checklists, updating process and procedural documents, etc.

o Attend the Project Schedule meeting to provide biweekly updates for deliverables and timelines.

• Provide support for Secure Access Digital Identity (SADI) related to the Inflation Reduction Act o Government and private sector knowledge on identity proofing methods to develop new solutions as well as enhancements to SADI.

o Support developing business requirements for onboarding future CSPs into SADI.

o Developing a process for gathering programming requirements, CLM stories, based on new business needs and requirements.

o Use of Google Analytics, Splunk, and SADI console to troubleshoot user issues.

o Communication experience to assist in developing content for webinars, talking points, external presentations, and public facing content.

o Coordination with impacted stakeholders on SADI communications o Coordination with IT on SADI requirements which include but not limited to:

• Backlog grooming.

• Release planning.

• Story refinement.

• Ongoing updates.

o Support for additional CSP integrations into SADI.

3.2.3 A3 Program Support

The contractor shall work with IA to design and implement action plans, timelines, schedules, work products and approach to finalize and implement of IA A3 Programs (e.g., SADI, Business & Entity Authorization, e-Signature, Innovations, Omni-Channel)

Specifically, the contractor will assist with the following work activities:

• Develop recommendations for key policy issues that will drive the development of future state A3 capabilities.

• Track legislative activities impacting A3 policy and implementation and provide essential information to the team.

• Support the management by maintaining complex projects schedules using project management techniques involving multiple stakeholders with IRS-wide impact.

• Conduct strategic reviews of IA IRA initiatives relating to other IA (IA) project schedules.

• Support the engagement and management of stakeholders, support collaboration, and facilitates updating schedules for all ongoing plans and projects.

• Identify and assist with management of risks, mitigations, and status for all project work.

• Analyze effectiveness and efficiency of project; develop recommendations to improve project operations.

• Assist in answering data analytics calls and inquiries.

• Participate in requirements development process.

• Conduct research to inform Innovation studies

• Assist with updating all procedures, policies, templates, and communication

Responsible for creating and writing various types of user documentation, including requirements, job-aides, standard operating procedures, etc.

• Responsible for editing, proofreading, and providing writing support on non-technical and/or technical documents or sections of documents prepared by team members.

• Ensure documents meet editorial and government specifications and adhere to standards for quality, graphics, coverage, format, and style.

• Display excellent grammar, spelling, syntax, and punctuation skills.

• Participate and attend project meetings.

• Contribute to the establishment of improved documentation processes and deliverables.

• Acquire an overall knowledge for the product(s) responsible for documenting, and an understanding of how they relate to the entire organization.

• Provide support for expanded use of the digital and non-digital identity as part of delivery of the Servicewide IRA outcomes and key deliverables.

• Support the implementation of a data-driven decision-making framework that incorporates data available from improved reporting to assess risk, cost, business impacts, customer impacts, and benefits of A3-related decisions, processes, capabilities, and policies.

• Set up templates, mechanisms, and processes to work with stakeholders in applying the framework to specific decisions.

• Assist with the review of current processes and procedures and recommend areas to enhance the strengthening of authentication and authorization for various service channels.

• Review opportunities for streamlining A3 processes.

• Identify and pursue concepts and capabilities to enhance authentication at the point of filing.

• Assess A3 processes and procedures related to federation, SADI implementation, innovations, and traditional service channels.

• Assist in developing executive briefings and supporting the communication to stakeholders as needed.

• Manage, analyze, and review the current processes and procedures and recommend areas to enhance the strengthening of authentication and authorization for various service channels.

• Conduct knowledge transfer as needed and requested.

• Assist in determining requirements; develop goals and objectives to accomplish mission of government counterparts to ensure execution of projects in accordance to plans.

• Assist with identification and management of risks, mitigations, and status for all project work.

• Assist with the review of current processes and procedures and recommend areas to enhance the strengthening of A3.

• Analyze effectiveness and efficiency of project; develop recommendations to improve project operations.

• Participate in requirements development process.

3.2.4 Propose, Draft and Execute Action Plans

• Assist in the development of action plans for accomplishing key IA authentication and authorization initiatives including CSP implementation, innovation studies, other digital and non-digital A3 solutions, and the A3 inputs along with associated business requirements.

• Assist with short-term and long-term authentication and authorization solutions for SADI, traditional service channels, innovation studies, and other digital and non-digital solutions.

• Assist in defining access, authentication, and authorization requirements and ensuring projects are consistent with enterprise solutions.

• Develop executive briefings and support the communication to stakeholders as needed.

3.2.5 Support Executive Communication, Federation, and Partnerships

• Security Summit Support - Work with stakeholders to implement Security Summit recommendations for establishing a level of confidence in a taxpayer’s identity at the point of filing, leveraging data gathered by third parties (Trusted Taxpayer).

• Third Party Partnership - Review third party data services opportunities to meet the authentication and authorization needs of the Service. Provide recommendations for leveraging public/private partnerships for authentication (e.g., leveraging third party credentials for federation)

• Develop executive briefings and support the communication to internal and external stakeholders, as needed.

3.3 TASK 3 – TRANSITION

3.3.1 Transition-In Plan (Sub-Task) (Non-Incumbent Contractors Only)

In preparation for assuming operations, the contractor shall cooperate and work in good faith with incumbent contractor and shall coordinate and negotiate with the government differences between the incumbent’s Phase-Out Plan and the Contractor’s Phase-In Plans. During the phase-in period, the contractor shall become familiar with performance requirements in order to commence full performance of services expeditiously after the start date.

The Contractor’s Transition Plan shall describe the approach to be utilized in transitioning work from existing sources, to include government and/or contractor, as applicable, to meet performance requirements of this PWS. Appropriate planning should allow transition to be accomplished without disruption of on-going work and without compromising the IA mission and program objectives. At a minimum, the Transition Plan shall identify the start and end period and transition approach

(including work effort, workforce, procurement strategies, and milestones). The transition-in plan will span 60 days and be included in the hours under Task 1 & 2.

3.3.2 Transition-Out Plan (OPTIONAL SUB-TASK)

At the end of the contract, the contractor may be required to provide phase-out support for up to 90 days pursuant to the applicable continuity of services contract clause to include all government furnished property and data created or produced for this effort. The contractor shall, upon the CO's written notice, (1) initiate phase-out services and (2) negotiate in good faith with a successor to determine the nature and extent of the transition services required. The phase-out plan shall be subject to the CO's approval, specify a training process and a date for transferring responsibilities for each task described in the PWS to the follow-own contract awardee. The contractor shall provide sufficient experienced personnel during the phase-out period to ensure that the services called for by the resulting contract are maintained at the required level of performance and proficiency. The contractor shall work cooperatively and in good faith with the follow-on contract awardee and provide information and data in a timely and professional manner to ensure a smooth and effective transition of operations from the incumbent to the follow-on contractor. The contractor shall ensure that all services/activities, for which the contractor is responsible, shall be completed before the end of the period of performance of the resulting contract.

The final Transition Plan shall be presented after first kick-off meeting. The government will notify the contractor three (3) months prior to the end of the contract and the contractor shall provide an updated Phase-Out Plan to the government within 90 (ninety) calendar days after notification.

4.0 DELIVERABLES

The contractor shall provide the deliverables described below in Section 508 compliant format. All informal work products and analyses used to prepare the deliverables resulting from work executed under this contract shall be provided to the government. Specific format and content requirements for the deliverables defined below will be mutually developed and agreed upon among the Identity Assurance, the contractor, and the COR subsequent to contract award.

Deliverable Description Due Date Business & Entity

Authorization, Omni-Channel, and

Communication documents, tracking documents, decision documents, presentations/briefings, talking points, and

An agreed upon date from the

Deliverable Description Due Date Inflation Reduction Act Outcomes and Key Deliverables

Process Documents action plans related to the Business & Entity Authorization Program, Omni-Channel, updated environmental scan recommendations, authentication and authorization business requirements, and other IA initiatives related to IRA (See Task 3.2.2) vendor and government

SADI Materials

Executive Communications and briefing materials, Contingency Plan refresh, CSP Future State roadmap refresh, ITIN Strategy, Equity, Accessibility and Underserved Communities Strategy

An agreed upon date from the vendor and government

Data Dictionary The contractor will maintain a data dictionary to include variable names, descriptions, data source, and cleaning methods. (See Task 3.2.2)

An agreed upon date from the vendor and government

Potential Research Study List

The contractor will keep a spreadsheet with information about research study ideas from data analysis, IA feedback, and IA strategies and programs. (See Task 3.2.1)

An agreed upon date from the vendor and government

Research Study Reports

The contractor will complete an average of one to two medium-sized research studies per month. A medium-sized research study should be assumed to include a briefing deck with approximately 10-12 slides. (See Task 3.1.3) The contractor will provide recommendations on potential research studies to IA Leadership every six months.

An agreed upon date from the vendor and government

Knowledge Management Documents

Documentation of work plans and methodology

An agreed upon date from the vendor and government

Metrics and Dashboard Documents

Briefing decks and documents with data analysis to support the implementation of data-driven decision-making (See Task 3.2.4)

An agreed upon date from the vendor and government

Executive Briefings Draft and review briefing documents for internal and external stakeholder communication

An agreed upon date from the vendor and government

Transition Out Plan Plan for phase-out support (See Task 3) Last 3 months before contract expiration

Monthly Status Report Monthly Update / Status Report

Delivered on last business day of each month to the IA Project Manager and COR along with invoices

Weekly Status Report

Includes week’s accomplishments and next week’s priorities

Delivered on Fridays to the IA Project Manager

Weekly Reports

Secure Access Analytics, Metrics, and Monitoring SMS Report Financial and Phone Verification Usage Report

Delivered by Wednesday for prior week figures

Bi-Weekly Reports Bi-weekly Dashboard and Report

Delivered by Wednesday for prior period figures

Monthly Reports Secure Access Analytics, Metrics, and Monitoring eA3 Metrics e-Signature activity status

Delivered by the 15th of the following month

Quarterly Reports eA3 Metrics Slides for PGLD Operational Review

Delivered by the 15th of the following month

Annual Report Fiscal Year End Summary Delivered by October 31

Integration Business Plan

Integration Business Plan related to SADI.

(See Task 3.2.4) and IRA Implementation (See Task 3.2.2)

An agreed upon date from the vendor and government

Business Partner Engagement

Materials

Stakeholder engagement materials related to SADI. (See Task 3.2.4 and Inflation Reduction Act Implementation (See Task 3.2.2)

As outlined in the Integration Business Plan

Business Plan Risk Register

Business plan risk register for SADI (See Task 3.2.4) and Inflation Reduction Act Implementation (See Task 3.2.2)

An agreed upon date from the vendor and government

Business Plan Action Log

Business plan action log for SADI. (See Task 3.2.4) and Inflation Reduction Act Implementation (See Task 3.2.2)

An agreed upon date from the vendor and government

Integration Briefing

Materials Integration briefing materials for SADI. (See Task 3.2.4) and Inflation Reduction Act Implementation (See Task 3.2.2)

As outlined in the Integration Business Plan

Quality Control Plan

Correlates to the Performance Requirements Summary and Quality Assurance Surveillance Plan (QASP) throughout the life of the contract. See Section 7.0

30 Days from Contract Award.

Updates as agreed upon between vendor and government.

The specific quality measures as set forth below will be applied to each deliverable received from the contractor under this contract. Any perceived conflict with the quality measures listed below should be immediately reported to the Contracting Officer.

• Accuracy – Deliverables shall be accurate in presentation, technical content and specifications, and adherence to accepted elements of style.

• Clarity – Deliverables shall be clear and concise. All diagrams shall be easy to understand and relevant to the supporting narrative.

• Specifications Validity – All deliverables must satisfy the requirements of the government as specified herein.

• File Editing - All text and diagrammatic files shall be editable by the government.

• Format – Deliverables shall be submitted electronically as defined in the PWS.

Deliverables shall be produced using Microsoft Office 2000 Professional.

• Timeliness – Deliverables shall be submitted in accordance with the days identified in the chart above.

5.0 KEY PERSONNEL

The contractor shall provide key personnel that demonstrate in-depth knowledge and expertise in data analytics, monitoring, and IRS systems reporting. The positions listed below are designated as Key Personnel.

Title Count Key Personnel Senior Statistician 1 Journeyman Statistician 1 Junior Statistician 1 Junior Business and Financial Operations Specialist Group 2

.4

Senior Business and Financial Operations Specialist Group 2

Junior Business and Financial Operations Specialist Group 2

Journeyman Operations Research Analyst

Junior Operations Research Analyst

SME Junior Business and Financial Operations Specialist Group 2

.4

The contractor shall use the key personnel set forth in its proposal for performance of the effort set forth under this resultant task order. If one or more of the personnel are not available, or become unavailable, the contractor shall furnish substitute personnel of equal skills, which substitutions shall be subject to approval of the Contracting Officer.

All requests for substitutions must include a detailed explanation of the circumstances necessitating the proposed substitutions, a complete resume for the proposed substitute, and any other information requested by the Contracting Officer needed to approve or disapprove the proposed substitution. All proposed substitutions must have qualifications that are equal to or higher than the qualifications of the person(s) to be replaced. The Contracting Officer or the COR will evaluate such requests and promptly notify the contractor of approval or disapproval within five (5) workdays of receipt of the substitution request.

6.0 KNOWLEDGE AND QUALIFICATIONS REQUIREMENTS

ANALYTICS AND MONITORING SUPPORT

Senior Statistician:

Knowledge Requirements-

• Minimum 10 years’ experience in proven execution of data analytics and analyses.

• Master’s degree in data science, Market Research, Statistics, Math, or other applicable major highly desired.

• Knowledge of Government guidelines, mandates, and compliance policies (i.e., NIST Digital Identity Guidelines (SP 800-63)).

• Knowledge of methods and techniques of fact-finding, analysis and resolution of complex project problems, and the ability to develop concrete action plans to solve problems.

• Working knowledge of the project management process.

• Knowledge of business practices and market conditions.

• Ability to establish performance goals and assess progress toward their achievement.

• Ability to adjust work operations and project objectives based on their ability to staff the contract to meet emergencies, changing projects or production requirements with minimum sacrifice of quality or quantity of work.

• Knowledge in Inflation Reduction Act and similar legislations impacting identity proofing desired.

• Demonstrate excellent interpersonal and communication skills, including the ability to communicate information and ideas verbally and in writing and communicate across various levels of management.

• Capacity to work both independently and in a team.

• Skill in researching, organizing, and presenting information.

• Ability to adapt to a rapidly changing environment, to meet deadlines, and to effectively collaborate with peers within the organization.

• Ability to multitask.

• Expert in planning and prioritization.

• Expert in strategic planning and strategic thinking

• Able to create meaningful data visuals for presentations.

Qualification Requirements-

• Programing in R, Python, Splunk, and other related analytics software

• Risk Management experience highly desired

• Lean Six Sigma experience (green belt or black belt)

• IRC 6103(c), IRC 6103(e) and IRM 11.3.2 knowledge highly desired

• PMP Certification, equivalent certification, or experience highly desired

Journeyman Statistician:

Knowledge Requirements-

• Minimum 8 years’ experience in proven execution of data analytics and analyses.

• Bachelor’s degree in data science, Market Research, Statistics, Math, or other applicable major highly desired.

• Knowledge of Government guidelines, mandates, and compliance policies (i.e., NIST Digital Identity Guidelines (SP 800-63)).

• Knowledge of methods and techniques of fact-finding, analysis and resolution of complex project problems, and the ability to develop concrete action plans to solve problems.

• Working knowledge of the project management process.

• Knowledge of business practices and market conditions.

• Ability to establish performance goals and assess progress toward their achievement.

• Ability to adjust work operations and project objectives based on their ability to staff the contract to meet emergencies, changing projects or production requirements with minimum sacrifice of quality or quantity of work.

• Knowledge in Inflation Reduction Act and similar legislations impacting identity proofing desired.

• Demonstrate excellent interpersonal and communication skills, including the ability to communicate information and ideas verbally and in writing and communicate across various levels of management.

• Capacity to work both independently and in a team.

• Skill in researching, organizing, and presenting information.

• Ability to adapt to a rapidly changing environment, to meet deadlines, and to effectively collaborate with peers within the organization.

• Ability to multitask.

• Proficient in planning and prioritization.

• Proficient in strategic planning and strategic thinking

• Risk Management experience highly desired

• Lean Six Sigma experience (green belt or black belt) highly desired

Junior Statistician:

• Minimum 5 years’ experience in proven execution of data analytics and analyses.

• Bachelor’s degree in data science, Market Research, Statistics, Math, or other applicable major highly desired.

• Knowledge of Government guidelines, mandates, and compliance policies (i.e., NIST Digital Identity Guidelines (SP 800-63)).

• Knowledge of methods and techniques of fact-finding, analysis and resolution of complex project problems, and the ability to develop concrete action plans to solve problems.

• Working knowledge of the project management process.

• Knowledge of business practices and market conditions.

• Ability to establish performance goals and assess progress toward their achievement.

• Ability to adjust work operations and project objectives based on their ability to staff the contract to meet…