RFI 26-03-CI Draft SOW.pdf

STATEMENT OF WORK

INTERNAL REVENUE SERVICE CRIMINAL INVESTIGATION (IRS-CI)

MOBILITY E-DISCOVERY AND ARCHIVAL SOLUTION

This procurement is in support of Law Enforcement

Introduction/Background

The Internal Revenue Service (IRS), Criminal Investigation (CI), must modernize its mobility (cell phone) environment and infrastructure. The modernization of the infrastructure includes using multiple platforms which include Android operating system devices - specifically Samsung S-series smartphones, iPhone devices and BYOD. CI’s mobility infrastructure “is unique to IRS” and follows Federal Information Security Modernization Act (FISMA) and Federal Risk and Authorization Management Program (FedRAMP) High security mobility implementations. CI has been mandated to replace its existing Blackberry Unified Enterprise Management (UEM) with Microsoft Intune Mobile Device Management (MDM). Currently, Blackberry UEM provides eDiscovery and data archival services that allow CI to retrieve and archive Short Message Services (SMS) texts, call logs, and voice mail logs from mobile devices. When Blackberry UEM is decommissioned, CI will not have the ability to retrieve and archive texts, call logs, and voice mail logs (used to support and supplement case evidence). Microsoft Intune does not capture or archive texts, call logs, or voice mail logs and requires a third-party solution to perform this service.

The objective is for IRS Criminal Investigation (IRS-CI) Technical Operations Center (TOC) to obtain a FISMA/FedRAMP High (or equivalent with mitigating controls) third-party mobile integration solution that supports data archival and eDiscovery of CI’s mobile communications devices. The solution must be a forensically defensible, eDiscovery and data archival platform enabling IRS Criminal Investigation (CI) to lawfully acquire, preserve, search, and produce mobile device data from CI issued devices enrolled and managed through Microsoft Intune.

The solution must include support and methods of data retrieval and archival for messenger apps (like WhatsApp and Signal), native device messaging, and application-level artifacts frequently encountered in CI investigations. The capability must also support:

• Litigation-hold obligations under CI investigative and case file retention frameworks.

• CI’s digital forensics workflows aligned with MSAB/XRY requirements (MSAB is a mobile forensic solution designed for law enforcement and forensic investigators. XRY is the extraction tool that acts on mobile devices and smart devices.)

• CI privacy and cybersecurity review processes, including PCLIA (Privacy and Civil Liberties Impact Assessments) and federal DMZ (demilitarized zone - buffer between public and private network) requirements for new technology deployments.

Scope/Technical Requirements

The scope of this contract requires the vendor to deliver mobile data archival and eDiscovery solutions for 3150 mobile devices that include (but not limited to):

• Full ingestion, indexing, secure storage, legal hold management, and production of mobile device ESI (electronically stored information).

• Support for encrypted messaging content where legally authorized (WhatsApp, Signal).

• Integration with Intune managed IRS CI Samsung devices, considering current constraints with certificates, derived credentials, and device profile stability in the Intune deployment environment

• Ability to interface with or complement existing CI digital forensics toolkits, such as

MSAB/XRY.

• Compliance with CI investigative processes, records management, and chain of custody controls described in CI’s Investigative Resources/Manager Desk Reference Guide.

• Provide a forensically sound, consistent mobile device eDiscovery and archival system in support of criminal investigations, FOIA, TIGTA requests, civil discovery, and other official inquiries.

• Preserve electronically stored information (ESI) under litigation hold, including automated Intune driven device constraints to prevent data loss during investigations.

• Provide technical support to the IRS CI-Mobility Operations team in support of the deployment, operations, and maintenance of the application to secure the mobile network and associated mobile devices (Android and iOS).

• Ensure all ESI is stored and processed on premises and/or a CI-managed FISMA/FedRAMP High (or equivalent with mitigating controls) environment, meeting CI cybersecurity controls, DMZ requirements, STIG (Security Technical Implementation Guide), and PCLIA (Privacy and Civil Liberties Impact Assessment) expectations.

• Integrate with Intune workflows, enabling device inventory sync, remote acquisition initiation, legal hold tagging, and compliance state alignment.

• Produce evidentiary grade exports with metadata, hashes, and audit logs suitable for investigative or prosecutorial use.

• Provide a solution capable of logical and, where legally authorized, full file system extraction of iOS and Android devices.

• Provide, maintain, and update documentation within CI-Mobility SharePoint library. Provide documentation and reports which depict statistics and project progression. Draft diagrams of data flows, process flows, and interconnecting systems.

• Provide acquisition and parsing of WhatsApp message databases or encrypted/decrypted backup artifacts.

• Provide acquisition, capture, and parsing of Signal application data (within technical and legal limits).

• Provide acquisition, capture, and parsing of SMS/MMS, call logs, contacts, device media including pictures and videos within the messages.

• Provide acquisition and parsing of all application artifacts relevant to CI’s investigations.

• Be compatible with CI’s forensic ecosystem (MSAB/XRY) to maintain workflow continuity for field agents.

• Provide hash verified data preservation, audit logs, and chain of custody metadata compliant with investigative file retention processes.

• Provide on-premises methods and access for indexing content search, metadata search, tagging, review, and production.

• Integrate with CI’s Microsoft Intune mobile device management environment which includes derived credential authentication, S/MIME certificate complexities, mixed certificate profiles, evolving configurations, and STIG (Security Technical Implementation Guide) compliancy.

• Provide API level automation with Microsoft Intune to initiate data collection or device event logging. System must also provide device inventory synchronization based on Intune compliance states and profiles.

• Provide logging events aligned to CI access, entitlements, and administrative controls (e.g., PAM (Privileged Access System) permissions issues highlighted in mobility testing)

• Assist with endpoint integration by providing device-level configuration and policy enforcement settings required to capture, obtain and archive data from SMS, WhatsApp, Signal, etc.

• Support multi factor authentication and least privilege access required under CI’s entitlement and investigative data access practices.

• Produce full audit trails, including downloads, exports, reviewer actions, and access events.

• Comply with FISMA High (or equivalent with mitigating controls) impact categorization requirements ensuring all confidentiality, integrity, and availability controls meet NIST SP (National Institute of Standards and Technology Special Publications) 800-53 High baseline.

• Meet FedRAMP High equivalent security controls, including encryption at rest (FIPS 140-2), encryption in transit, privileged access management, multifactor authentication, and logging requirements.

• Support IRS audit readiness, security assessment, and authorization processes with sufficient documentation for System Security Plans (SSP), Security Controls Traceability Matrices (SCTM), and ongoing authority to operate requirements. Ensure Support Services’ resources meet IRS and IRS/CI requirements.

• Ensure all data handling, storage, processing, and access procedures adhere to IRS High-value Asset (HVA) handling requirements where applicable.

• Deliver, install, configure, and secure all required servers, storage, and application components (if applicable).

• Support CI’s privacy impact assessment (PIA) and enterprise standards profile (ESP) documentation, consistent with CI’s ongoing eDiscovery/archiving implementations

• Provide validated workflows that avoid ongoing Intune related pain points (e.g., certificate conflicts, DMZ routing).

• Provide monthly status updates to the TPM and other TPOCs highlighting achievements, planned activities, outage status information, and any risks, issues, or concerns.

• Support CI’s investigative case lifecycle requirements for maintaining records across OCDETF (Organized Crime and Drug Enforcement Task Force), international, and complex financial cases.

• Provide forensic integrity (as required by data and security compliance) verification on all exports.

• Meet search indexing requirements to support CI large scale case volumes and mobile-device data diversity.

• Provide litigation hold enforcement that is Intune-Aware and prevents data loss or overwrites.

• Provide recommendations for annual support to help IRS identify follow-on contract requirements.

• Support issue resolution and troubleshooting for CI's customers and advanced notices for outages and application/system maintenance.

• Support of new mobile technology and planning to ensure new technologies can integrate and operate with eDiscovery and archival solution.

• Coordinate, participate, and provide a liaison between CI and outreach services to (include but not limited to) technical teams, stakeholders, help desk personnel, other CI-organizations, and other internal and external agencies required to support and complete the terms of this contract.

• Deliver IRS-CI Architecture package which includes network diagrams, DMZ placement plan, Intune integration architecture, security controls mapping.

• Provide installation and configuration documentation which includes hardening checklists, STIG mapping, backup configurations, and PCLIA/ESP support documents.

• Provide Standard Operation Procedures that include mobile acquisition workflow for CI agents, litigation-hold and Intune tagging, chain-of-custody procedures aligned with CI Investigative File expectations.

• Provide validation & test report demonstrating WhatsApp, Signal, SMS/MMS extraction, search performance, and legal hold preservation.

• Deliver training which includes Administrator training for IRS CI TechOps, investigative training for field agents, and reviewer training for legal and security personnel.

• Provide sustainment plan for patch management, vulnerability updates, license renewal paths, and technical support escalation.

• Deliver fully functioning streamlined, secure, and manageable CI eDiscovery and data archival environment based on the tasks provided. Infrastructure support, cell phone and mobile device support, technical expertise, guidance, configuration, maintenance, and management of the mobility eDiscovery and data archival environment.

Period of Performance Base Period: 12 months from Date of Award Option Period 1: 12 months after Base Period Option Period 2: 12 months after Option Period 1 Option Period 3: 12 months after Option Period 2 Option Period 4: 12 months after Option Period 3

Contract Type

The government contemplates award of a firm-fixed-price (FFP) contract.

Inspection and Acceptance:

The Delivery POC is responsible for inspection and acceptance of all items, incoming shipments, documents, and services.

Acceptance Criteria:

Certification by the Government of satisfactory goods or services provided is contingent upon the vendor performing in accordance with the terms and conditions of the referenced agreement, this order, and all amendments.