RFQ 8212 eA3 PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

eA3 (Authentication, Authorization, Access) Architect and Development Support

Section C PERFORMANCE WORK STATEMENT

C.1 INTRODUCTION AND BACKGROUND

This requirement is to provide e-A3 (Authentication, Authorization, Access) Architect and Development Support for all operations and maintenance (O&M) activities to sustain the eAuth project at current operating levels and to perform all approved enhancements. This is a non-personal services contract. The Government shall not exercise any supervision or control over the contract service providers performing the services herein.

The eAuthentication, Authorization & Access (eA3) program is an Internal Revenue Service (IRS) enterprise solution, serving as the secure front door for IRS’s external internet facing applications. eA3 provides Identify Proofing services to Taxpayers and entities that wish to access their IRS information and confirms that the individual requesting access is who they say they are, protecting the Taxpayer’s information and privacy. eA3 protects taxpayer data from cyber-attacks and fraud by identity proofing and authenticating online users and performing data and fraud analytics. eA3 supports the IRS Strategic Plan objectives to Empower and Enable all Taxpayers, Drive Increased Agility, Efficiency, Effectiveness and Security, Collaborate with External Partners, and Advance Data Access, Usability and Analytics.

Current major initiatives under the eA3 Program are:

Modernized Secure Access Infrastructure which supports on demand features, automated deployments and builds, robust monitoring, data analytics, cloud transition and scaling technology to increase system availability. Secure Access Authentication (eAuth) a NIST 800- 63-2 compliant identity proofing solution.

Secure Access Digital Identity (SADI) a NIST 800-63-3 compliant solution to replace Secure Access Authentication (eAuth). SADI will continue to integrate taxpayer facing applications, deploy a modernized infrastructure, employ Federation, work towards integrating Omni-Channel support, deploy advanced fraud detection and prevention and automate incident response.

SADI will also implement a standardized integration, constantly enhance security, and deploy improvements to the taxpayer experience while researching innovative solutions to strengthen fraud detection and identity authentication. SADI is currently supported by 2-3 full time Agile Delivery teams, with shared support teams for infrastructure configurations and buildouts, deployments, and technical product SMEs supporting Identity as a Service (IDaas) products.

SADI’s support needs change based on Legislation and advances in Digital Identity. The number of teams needed could vary from 1 to 4 and would be covered under the surge support task.

Authorization (Az) provides shared enterprise services and platforms to provide taxpayer authorization and electronically captures signatures. Az Framework is an enterprise shared service that provides fine-grained centralized authorization services to IRS applications, aligning with IRS modernization initiatives and is developed with a Commercial Off the Shelf (COTS) authorization solution and is integrated with other internal IRS applications such as eServices, Terms of Service, Web Apps, TaxPro & IVES. Az will simplify the authorization process, modernize, and integrate technologies that support secure, flexible, and accurate work, coordinate with the tax community to facilitate service and outreach to taxpayers. Az Framework is currently supported by an Agile Delivery Team that includes deployment and shared infrastructure support. This demand may increase and would be covered under the potential surge support.

Authorization, eSignature (eSign) project (based on Electronic Signature Storage and Retrieval (ESSAR)) integrates with applications such as Tax Pro to provide storing and retrieval of electronic signatures. eSignature will provide additional agility and increased security of the integrating systems, advanced data access, usability, and analytics, and will provide protected services for external IRS Taxpayers empowering and enabling efficient interactions. eSignature will continue to explore and evaluate innovative solutions and increased measures to prevent and detect unauthorized intrusions and actions. eSignature is currently supported by an Agile Delivery Team that includes deployment and shared infrastructure support. This demand may increase to 2 teams and would be covered under the potential surge support.

C.2 TASK ORDER OBJECTIVES

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Architecture and Development Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

This is a hybrid Firm Fixed Price (FFP) and Labor Hour (LH) performance work statement to provide all operations and maintenance (O&M) activities to sustain the eA3 project at current operating levels and to perform all approved enhancements.

O&M activities include:

• Addressing all defects, production code issues, legislative mandates, or security weakness.

• Update the application or system to apply any mandated upgrades, patches and corrections.

• Update the application to maintain conformance with IRS and Federal Security or

Accessibility Standards, as well as all new laws, executive orders or Tax Code changes.

• Address any identified Treasury Inspector General for Tax Administration (TIGTA) and

Government Accountability Office (GAO) findings.

• Support Identity Management COTs.

Enhancement activities include:

• Modifying the application to fulfill approved requirements.

• Add new functionality based on prioritized Agile Backlog.

• Improve application performance.

• Updating the application to comply with National Institute of Standards Technology (NIST) revised guidelines.

• Integrate new applications with eA3 applications.

• Infrastructure Modernization and Cloud migration.

C.3 SCOPE OF WORK AND TASK DESCRIPTION

IRS Business Units and Information Technology (IT) organizations rely on the Project Office

(PMO) for Subject Matter Experts (SMEs) support relating to identity proofing, authentication, authorization, credential management and 3rd party data management. Outlined in this PWS is a detailed description of the professional services that the Contractor shall provide to the IRS Project Office (PMO), to support the IRS eA3 projects, systems and support the integration of new applications with the eA3 applications and other related work. The following tasks comprise the scope of work:

• TASK 1: Ramp-Up (LH) (Optional)

• TASK 2: Contract Program Management (FFP)

• TASK 3: Common Infrastructure and Engineering (FFP)

• TASK 4: Development, Modernization and Enhancement (LH)

• TASK 5: Development Operations & Maintenance Support (FFP)

• TASK 6: Transition (LH) (Optional)

• TASK 7: Surge (LH) (Optional)

C.3.1 TASK 1: Ramp-Up (LH) (Optional)

Ramp-Up Knowledge Transfer is defined as the Contractor acquiring and understanding the necessary documentation, information, and processes related to any work in progress. This task includes meeting with the IRS Subject Matter Experts frequently to gather any tacit knowledge related to the eAuthentication application and eA3 Program tasks or programs in development.

The Government estimates this task will take approximately four to six months to complete after award.

The Contractor shall appoint a knowledge transfer manager to oversee the transfer of knowledge and ensure all areas are accounted for. If desired, this can be the Project Manager (PM) or Project Scheduler. Prior to the transfer of knowledge, the Contractor shall develop a draft Knowledge Transfer Plan (KTP) and present it to the Government within the first 15 business days after award. The KTP shall identify the Contractor resources and roles involved in the transfer process, provide a list of risks and mitigation strategies for the transfer, and contain a detailed resource balanced project schedule developed with Microsoft Project. The project schedule shall identify tasks, dependencies, deliverables and milestones. The project schedule shall be at a sufficient level of detail to track progress on a bi-weekly basis, (i.e., all tasks will be detailed to a level such that no task has duration of more than ten work days).

The Government shall have 10 business days to review the draft KTP plan and provide comments to the Contractor. Government and Contractor representatives will then meet to discuss the comments after which the Contractor shall incorporate the agreed-upon changes and deliver a final KTP within five working days of the Government’s feedback.

The contractor shall meet with the IRS bi-weekly (twice a month) to discuss the progress of the knowledge transfer. The Contractor shall show an updated MS Project Schedule and discuss any risks or concerns at this time.

Staffing Plan - Work under this PWS may require a ramp-up period at the initial start of the period of performance for the Contractor to recruit and hire personnel specifically for this PWS.

Ramp-up period specifics shall be identified in a Staffing Plan as part of the Contractor’s Management Approach portion of their Technical Quote. The Contractor shall assume a 90-day ramp up period for those resources that do not have current IRS Minimum Background Investigation security clearances.

The Staffing Plan shall describe and outline how the Contractor will immediately ramp up staffing and how they will accomplish the process to ensure clearances are submitted for all proposed Contractor/Subcontractor staff within 90-days of award. This Plan shall also provide a detailed walkthrough of the Contractor’s process for submitting accurate, complete security clearance applications on all proposed Contractor/Subcontractor staff to the Government, assuming 90-day processing timelines and milestones. Staffing Plan pages do not count toward Technical Quote page limits.

DESIRED OUTCOME – The Contractor shall provide a Knowledge Transfer Plan that is accepted by the Government and successfully completes knowledge transfer in accordance with the plan. Contractor provides Staffing Plan that effectively describes and outlines how they will immediately ramp up staffing and how they will accomplish the process to ensure clearances are obtained for all proposed Contractor/Subcontractor staff within 90-days of award.

C.3.2 TASK 2: Contract Program Management (FFP)

• The Contractor shall perform Project Management of Contractor resources, including Agile and Waterfall process support.

• The Contractor shall support Program control, billing functions, scheduling, contracts, and quality management necessary to assure successful management of all PWS related activities.

• The Contractor shall perform related financial reports, presentations, and other reports in support of the program on an estimated weekly of frequency.

• Perform ad-hoc requests related to financial reports, contract management presentations, and other contract related reports in support of the program not to exceed 3 a month.

• The Contractor shall respond to requests for impacts, estimates and actual work performed including:

o Demand Process assessments for IRS IT Work Requests (WRs) process for application changes from the Work Request Management System (WRMS) and provide Project Impact Assessments (PIA) within one week of request.

o Actual reports in the PIA form for work performed and delivered as part of the Demand process within two weeks of request.

• The Contractor shall provide team-based leads to coordinate resources and manage work in an efficient manner. The Contractor shall obtain IRS approval and follow IRS PMO’s guidance, via Contractor appointed team leads to, successfully coordinate the use of resources for managing and performing tasks.

• The team-based leads will be SMEs in their area and perform expert levels of support for those activities, performing the task as well as managing personnel. The Contractor shall make recommendations to improve efficiency and propose additional or combined leads if appropriate.

o Operations Lead to coordinate patching and deployments, as well as Enterprise

Operations (EOPs) and User and Network Services (UNS) coordination.

o Engineering Lead to coordinate infrastructure upgrades, Integrated Enterprise Portal (IEP), engineering design, performance, and specifications.

o Development Lead to coordinate design, analysis and development testing.

• Team leads shall interface with the IRS Team Leads and Project Managers to:

o Provide weekly status reports input for project schedule updates.

o Participate in agile planning and resource allocation.

o Escalate any anticipated risks or issues to senior management.

o Provide input to presentations and other requested project management artifacts.

o Ensure adherence to the IRS Enterprise Lifecycle (ELC) and all IRS guidelines and directives.

o Attend and actively participate in stakeholder meetings, as needed.

• The Contractor shall participate in the Integrated Project Team (IPT):

o Code reviews, security reviews, document reviews, test case and result reviews, sprint grooming & planning, schedule and status updates, deployment package and document reviews.

• The Contractor shall provide earned value management (EVM) schedule reporting through weekly schedule updates and detailed Monthly status reports in Excel to include a summary of the reporting and any tasks and accomplishments that were not specifically called out in the schedule by the 5th of the month (no more than 3 out of cycle); to include at a minimum:

o Resource name and title.

o Detailed work performed and deliverables.

o The Contract Task, backlog and/or UWR item (as applicable) the work addressed.

o Hours of effort spent on the work item and contract line-item number (CLIN) work charged to by resource.

• Deliver monthly status and invoice reports using format provided by IRS, showing resource name, task, project and CLIN work performed against. Reports can be combined with EVM reports.

• Ensure all staff meets all Moderate Risk Background Investigation (MBI), on-boarding documentation and security requests timely and correctly.

The Contractor shall adhere to all required guidelines defined in the IRS Internal Revenue Manuals (IRMs) 2.16 Enterprise Life Cycle, 2.22 Business Planning & Risk Management, 2.22.1 Unified Work Request (UWR) Process, 2.100 Integrated Process Management, 2.110 Requirements Engineering and 10 Security, Privacy & Assurance which will be provided after contract award.

DESIRED OUTCOME – Successful project management practices that result in positive project performance outcomes, increases customer satisfaction, meets eA3 PM, Security, and Testing Service Level Agreement (SLA) standards (attached) on schedule and in accordance with the business requirement needs and goals.

C.3.3 TASK 3: Common Infrastructure and Engineering (FFP)

Architects and Subject Matter Experts (SME) are expected to provide the technical guidance required to ensure the eA3 project system is maintained at the current or improved level of performance. These resources will be shared across all eA3 projects to provide support for shared infrastructure and to make the best use of knowledge and skills across the projects.

Responsibilities include ensuring the project system is operating correctly, engineered to handle capacity increases and potential performance enhancements, and troubleshooting defects in all environments. Architects and SMEs will work closely with testers, developers, configuration management personnel, security experts, deployment engineers, and IRS personnel. They need to be knowledgeable in network, hardware, and software architecture to support the overall infrastructure and software operations with both Commercial Off the Shelf (COTS) products and custom code. Infrastructure is both the hardware and the supporting software (OS and supporting COTS). This will require monitoring the health of the environments, patch management, managing security posture, working with testers, developers, configuration management, and deployment personnel, and ensuring all documentation is up to date.

Focusing on hardware is not enough, as all aspects above must be considered.

The Contractor shall provide the following:

• Technical inputs on development activities for ensuring high quality products through the implementation of COTS hardware and software in addition to custom software code.

• Enterprise, system architecture, and engineering support for the operational life cycle of a system in support of performance improvements, major changes and integrations.

• Troubleshoot eA3 applications to discover the root cause of issues and provide an analysis report on findings as needed.

• Recommend and implement corrections or mitigations based on IRS standard procedures.

• Support for all infrastructure updates, upgrades, migrations, and architecture changes.

• Off-hour support when it is required (situational necessity).

• Support in implementing new or updating existing infrastructure or software in the areas of DevSecOPs, Continuous Integration and Continuous Delivery (CI/CD), automated testing, containerization, identity management, ICAM (Identity Credential & Access Management), Federation, OIDC (OpenID Connect), and cloud according to industry best practices.

• Coordination and support for daily operations, infrastructure updates, upgrades, architecture changes, OS upgrades, COTSs packages (e.g. JBoss, M-Queue), patches, outages and deployments.

• Review security findings and recommend solutions.

• Logical data flow diagrams for all Identity & Access Management (IAM) Applications in all environments (development, test and production)

• Update Logic diagrams for all IAM Applications infrastructure components.

• A comprehensive technology plan, with scheduled reviews, for future upgrades, migrations, and architecture changes.

• Support continuous integration and automated testing

The Contractor shall adhere to all required guidelines defined in the eA3 project’s Service Level Agreements (SLAs), IRS IRMs 2.15 Enterprise Architecture, 2.16 Enterprise Life Cycle, 2.120 Engineering which will be provided after contract award. IRS Incident Management System Ticket guidelines are defined in IRM 2.148.2.5.3 which will be provided electronically after contract award.

DESIRED OUTCOME - IRS receives successful architect, engineer, and SME support that meets all project schedule timelines and IRS mandated standards. IRS receives infrastructure design criteria and documentation necessary to consume and translate to business units for the decision-making processes. This shall also include documentation necessary to provide sufficient support to show compliance with applicable IRM guidance.

C.3.4 TASK 4: Development, Modernization and Enhancement (DME) Support (LH)

Development, Modernization and Enhancement (DME) support contains all aspects of developing or enhancing software in a Test-Driven Development, Agile environment. This includes engineering and architecture design and documentation, high quality coding, unit testing development, documentation, and the ability to troubleshoot defects are requirements.

Teams will contain Software Engineers, Configuration Management, Deployment engineers, and Developers, and will work closely with Testers, SMEs and IRS personnel. Architects and Subject Matter Experts (SME) are expected to provide the technical guidance required to ensure the eA3 project system is built on a strong foundation for executing the project’s future capabilities and recommend how to implement new requested capabilities.

The Contractor shall provide support for:

Architecture & Engineering:

• Enterprise, system architecture, and engineering support for the enhancement life cycle of a system in support of major changes, enhancements, requested new functionality, and integrations.

• Creation of new Logical data flow diagrams for new or major enhancements to eA3 Applications in all environments (development, test and production).

• Creation of new Logic diagrams for new or major enhancements to eA3 Applications infrastructure components.

• Create for new applications, otherwise, update and maintain existing project engineering related documentation as required by IRS SDLC; to include: Engineering Plan (EP), Government Equipment List (GEL), Vision, Scope and Architecture (VSA), Simplified Design Specifications Report (SDSR), Interface Control Document (ICD), and User Guide (UG).

• Specifications of all new infrastructure components to include physical servers, virtual servers, operating systems, COTS and middleware following IRS standards and ELC requirements.

• Support teams in an agile development environment.

• Support Performance Testing.

Development:

• Develop using Java/JEE, Spring Boot, JavaScript, shell scripting.

• Knowledge of and implementation of Red hat OpenShift Container

• Use test driven development methodology for enhancement development activities.

• Leverage defensive secure coding practices and techniques.

• Knowledge of and implementation of microservices.

• Analyze & Develop enhancements and maintenance changes based on direction, priorities, and specifications from IRS technical leads and project managers, including:

o Create/Enhance User Interface (UI) ensuring 508 compliance.

o Create/Enhance Service Oriented Architecture (SOA) compliant services.

o Create/Enhance interfaces with COTS products.

o Create/Enhance Unified Modeling Language (UML)/Technical Design diagrams.

• Integrate all work with current automated testing infrastructure.

• Support continuous integration, continuous delivery and automated testing.

• Adhere to the eA3 Development SLA.

• Perform all software development lifecycle tasks as they relate to system development including:

o Unit Testing.

o Documentation.

o Security scans.

o Code Peer reviews.

o Requirements and design meetings.

o Test support.

• Assist with testing and troubleshooting in test environments and/or production.

Deployment and configuration support requires personnel who will be able to work with Rational CLM, Jenkins CI, automated testing frameworks, create different deployment packages for each environment, create/modify both CM and deployment documents.

Deployments:

• Create/Update code packages to prepare for DME deployments.

• Create/Update documents describing each deployment package, including version of each component, work task accomplished, and sprint number.

• Coordinate peer reviews of code packages and documentation for all stages of promotion.

Lead peer review sessions, document discussions, update package as necessary and store review documentation in the approved document repository.

• Coordinate and document all approvals required for deployments.

• Promote code packages.

• Verify and troubleshoot deployments to lower environments.

• Coordination of Production implementation and approvals.

• Production Package development, deployment & management.

• Monitor and troubleshoot Production deployments & installations.

• Verify Production package and installations and perform any coordination required.

• Promote IAM Application configuration changes.

• Perform all ELC and Capability Maturity Model Integration (CMMI) tasks as they relate to

DME Deployments.

• Provide support for development and testing.

• Software configuration management to include:

o Software version control.

o Branching and merging source code.

o Java and JavaScript library versions.

o Create release document with version information for each production deployment

• Create System Deployment Plans (SDP) as directed by the IRS PM.

• Create/Update the project Computer Operator Handbook (COH).

• Create/Update the project Desk Guides (DG) to assist with Operations.

• Support continuous integration and automated testing.

The Contractor shall adhere to all required guidelines defined in the eA3 Development SLA, IRS IRMs 2.5 Systems Development, 2.16 Enterprise Life Cycle (ELC), Requirements Engineering

2.110 and 2.100 Integrated Process Management which will be provided electronically after contract award.

DESIRED OUTCOME – The Contractor shall maintain and support successful software development within the eA3 portfolio of software system applications and services. Technical debt and maintenance overhead of the products are minimal. The Contractor shall successfully deploy application packages through the development, test and production environments and ensures the integrity of builds and software version control is performed and documented.

C.3.5 TASK 5: Development Operations & Maintenance (FFP)

Operations & Maintenance support contains all aspects of developing and deploying the software in a Test-Driven Development, Agile environment to maintain an application in an operational state. This involves defect correction, efficiencies to existing code, updating documentation, and the ability to troubleshoot defects are requirements. Teams will contain Configuration Management, Deployment engineers, and Developers, and will work closely with Testers, SMEs, Engineers and IRS personnel. This also includes the support required to deploy the code through the development and test environments and into production for O&M releases.

The Contractor shall provide software developers to:

• Develop using Java, JavaScript, shell scripting.

• Use test driven development methodology for O&M development activities.

• Leverage defensive secure coding practices and techniques.

• Knowledge of and implementation of microservices.

• Analyze & Develop maintenance changes based on direction, priorities, and specifications from IRS technical leads and project managers, including:

o Modify User Interface (UI) ensuring 508 compliance.

o Modify Service Oriented Architecture (SOA) compliant services.

o Modify interfaces with COTS products.

o Modify Unified Modeling Language (UML)/Technical Design diagrams.

• Integrate all work with current automated testing infrastructure.

• Support continuous integration and automated testing.

• Adhere to the eA3 Development SLA.

• Perform all software development lifecycle tasks as they relate to system development including:

o Unit Testing.

o Documentation.

o Security scans.

o Code Peer reviews.

o Requirements and design meetings.

o Test support.

• Assist with testing and troubleshooting in test environments and/or production.

• Perform code improvements as directed by the IRS technical leads and project managers according to the products' backlogs and prioritization, to include:

o Refactoring code that does not adhere to the Development SLA.

o Refactoring code in response to bug fixes, or maintenance patches.

o Refactoring code to address technical debt within the software products in the eA3 portfolio.

Deployments:

• Create/Update code packages to prepare for O&M deployments.

• Create/Update documents describing each deployment package, including: version of each component, work task accomplished, and sprint number.

• Coordinate peer reviews of code packages and documentation for all stages of promotion.

Lead peer review sessions, document discussions, update package as necessary and store review documentation in the approved document repository.

• Coordinate and document all approvals required for deployments.

• Promote code packages.

• Verify and troubleshoot deployments to lower environments.

• Coordination of Production implementation and approvals.

• Production Package development, deployment & management.

• Monitor and troubleshoot Production deployments & installations.

• Verify Production package and installations and perform any coordination required.

• Promote IAM Application configuration changes.

• Perform all ELC and Capability Maturity Model Integration (CMMI) tasks as they relate to

System Deployments.

• Provide support for development and testing.

• Software configuration management to include:

o Software version control.

o Branching and merging source code.

o Java and JavaScript library versions.

o Create release document with version information for each production deployment

• Update System Deployment Plans (SDP) as directed by the IRS PM.

• Maintain the project Computer Operator Handbook (COH).

• Maintain the project Desk Guides (DG) to assist with Operations.

• Support continuous integration and automated testing.

DESIRED OUTCOME – The Contractor shall maintain and support successful software development within the eA3 portfolio of software system applications and services to provide keep the lights on and operational improvements. The Contractor shall successfully development and deploy operations and maintenance packages through the development, test and production environments and ensures the integrity of builds and software version control is performed and documented.

C.3.6 TASK 6: Transition (LH) (Optional)

When requested by the Government, the Contractor shall provide support to transition operation and maintenance of the eA3 Project systems, all or in part, to the Government and/or a new Contractor. The objective of this optional task is for the Contractor to completely turn over all documentation, information, and transfer knowledge to the Government and/or new contractor for assuming all or partial roles related to the eA3 application, software, and its associated systems. The Government estimates this Sub-Task shall take three months and must be completed 14 business days prior to the end of the Task Order period of performance. All Transition activities must follow IRM 2.126 Transition Management, which IRM will be provided by the Contracting Officer Representative (COR) to the Contractor if this Sub-Task is ordered.

If this optional task is exercised the Contractor shall develop a draft Transition Management Plan (TMP) that describes the management of the transition activities and present it to the Government within 15 business days after the Government has requested transition performance. The Government will have 5 business days to review the TMP Transition Plan and provide comments to the Contractor.

The Government and Contractor representatives will then meet to discuss the comments after which the Contractor shall incorporate the agreed-upon changes and deliver a final TMP within 5 business days of the meeting.

The Contractor shall begin executing against the TMP and its schedule, upon agreement by the Government. On a weekly basis, the Contractor shall provide a status report to the Government that shall include, at a minimum:

1) Updated project schedule with the following information:

• Actual start

• Percent complete

• Actual finish

2) Issues encountered and associated mitigation strategies.

3) Identify risks and associated mitigation strategies.

4) Update action items assigned.

The Contractor’s key representatives shall attend weekly stakeholder meetings to discuss the status of the transition.

DESIRED OUTCOMES – The Contractor shall successfully create and implement a TMP to transition knowledge and documentation to enable the Government to continue operation and maintenance support. At the conclusion of the transition, the Government will have a clear understanding of how to effectively maintain the operation and maintenance of the eA3 Project systems with no interruption to or degradation in service.

C.3.7 TASK 7: Surge (LH) (Optional)

When requested by the Government, in the event of a Legislative, Chief Information Officer (CIO) mandate or similar request, that requires acceleration of the delivery called for under this contract, additional hours may be required. In support of that, an optional ‘Surge CLIN’ with additional support hours will be established, which can be activated whole, or in part in the event of executive direction.

DESIRED OUTCOMES – The Contractor responds timely to surge tasks when requested by Government.

C.4 SKILLS REQUIREMENTS

Skills Requirements:

The Contractor shall work with IRS resources utilizing the following products and services including:

• Microsoft Office products (Project, Visio, Word, Excel, PowerPoint, Outlook)

Specialized experience shall also include expertise in these areas:

• ICAM concepts (including OpenID Connect, OAuth, SAML, JWT, Federation, SSO, PIV, RBAC/ABAC, etc)

• Security concepts (including Zero Trust, PKI, FIPS 140-2 & 140-3, Encryption, Entropy, etc)

• PingIdentity products (e.g. PingIdentity, PingAccess, PingDirectory, etc)

• Web/HTTP concepts (Cookies, sessions, TLS, response codes, HTTP verbs, etc)

• LDAP & X.500

• Axiomatics

• Java

• Spring Framework (Spring Boot, Spring Data, Spring Security, Spring LDAP, Spring

MongoDB, Spring MVC, etc)

• Maven

• JavaScript

• XML & JSON

• Shell scripting

• RESTful Web Services

• Batch/Bulk processing

• Cloud concepts (including AWS)

• Containers (including OpenShift)

• DevSecOps

• Blue/Green Deployment Model

• MongoDB

• Oracle

• JBoss

• Linux/RedHat & general Unix platform architecture

• Apache

• Continuous Integration/Continuous Delivery (CICD)

• Test Driven Development

• Agile Development

• 508 compliant UI development

• Microservice based software design

• SOA based enterprise software design

• SOA based software development

• IBM Collaborative Lifecycle Management (CLM) o Rational Team Concert (RTC) o Doors Next Generation (DNG) o Rational Quality Manager (RQM)

• BigFix

• Control-M

• Infrastructure as Code (including Ansible) o Application Programming Interface (API) Gateways

C.5 GOVERNMENT-FURNISHED PROPERTY (GFP)

The Government may provide any GFP to the contractor during the orientation briefing. GFP (to include material, equipment, and/or information) may be provided in the performance of this task order:

ITEMS QUANTITY

Contractor Identification Badge TBD Contractor Building Access/Proximity Card TBD Desktop/Laptop Computer with Local Area Network Access TBD Microsoft Office TBD Office Space (Desk, Chair, Standard Office Equipment) TBD Desktop telephone device with VMS TBD

C.6 GOVERNMENT-FURNISHED INFORMATION (GFI)

The following GFI will be provided to the contractor upon task order award.

INFORMATION ITEMS

Presentations/Documents that provide background knowledge on the development or status of the effort.

Access to the centralized Incident Tracking System Access to the team SharePoint Site Information for fact-gathering will be provided upon request, if available At the end of this task order, disposition of GFI shall be in accordance with FAR 52.245.5.

C.7 ACCESS TO GOVERNMENT PROPERTY AND FACILITIES

The Contractor will be allowed limited access to the government's property and facilities, as specified below:

Internal Revenue Service (IRS) New Carrollton Federal Building (NCFB)

5000 Ellin Road Lanham, MD 20706

SECTION D PACKAGING AND MARKING:

All deliverables and work products that are required to be submitted to the Government shall include the following markings (as applicable):

Contract No. 2032H5-xx-x-00xxx (TBD)

CLIN

Project Name Description of document or item Document or Item No. and version no., if applicable Document or Item date An email notification to the COR shall accompany the submission of the deliverables/work products identified in this section or (as required in the contract) that the deliverables/work products are available for Government review. The email notification shall include the following:

1. Date the work product is submitted or otherwise available for Government review.

2. Line-Item Number, Title of Document, PWS Section reference or any other contract section, as applicable.

SECTION E INSPECTION AND ACCEPTANCE

E.1 INSPECTION

Inspection will be at the same place as performance and delivery, unless otherwise specified.

E.2 GENERAL ACCEPTANCE CRITERIA

The general quality measures as set forth below will be applied to each work product received from the contractor under this contract (to include SOPs) and any resulting task orders awarded.

• Accuracy – work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – work products shall be clear and concise; project management and terms shall be used, as appropriate. All diagrams shall be easy to understand and be relevant to the supporting narrative.

• Specification Validity - All work products must satisfy the requirements of the U.S.

Government as specified herein.

• File Editing - All documents will be provided in electronic format to the IRS using Microsoft Word, Excel, PowerPoint and/or Visio. All text and diagrammatic files shall be editable by the Government.

• Format – work products shall be submitted electronically whenever possible. Hardcopies shall be provided upon request. Hard copy formats shall follow Department of the Treasury and IRS Directives and shall be consistent with other similar efforts. All text diagrammatic files shall be editable by the Government. The documents format may change from Subtask to Subtask.

• Timeliness – work products shall be submitted on or before the due dates specified in the task order, or submitted in accordance with a later, scheduled date determined by the CO.

E.3 REVIEW OF DELIVERABLES

a) The Government will perform an initial review of deliverables, and if problems are encountered during the review, the contractor must correct them. If necessary, a meeting may be convened to resolve any differences. The contractor shall make all required changes to achieve an acceptable deliverable. The Government will perform its review within approximately 15 calendar days from receipt of the deliverable or as otherwise specified in each task order.

b) When the review of a deliverable results in necessary modifications, the Government will, in accordance with the approved task order schedule, provide the necessary documentation to correct the deliverable. It will then be the responsibility of the contractor to properly and consistently incorporate the comments in the final product.

c) These procedures shall not be construed to constitute a waiver on the part of the Government of its rights under FAR Subpart 49.4, entitled “Termination for Default,” nor of any other rights or remedies provided by law or under this contract.

SECTION F DELIVERABLES AND SCHEDULE

The required work products and schedule are listed below:

Task Deliverable Description Due Date

3.1 Task 1 Ramp-Up Delivered within first 2 weeks of award Within 2 weeks of contract award.

3.2 Task 2 Contract

Program Management

Program Status Reports;

Resource Monitoring;

Meeting Facilitation;

Communication Plan;

Project Stakeholder List Maintenance

TBD As Needed

3.3 Task 3 Common

Infrastructure and Engineering

Updated System Architecture & Engineering Documentations;

Performance and platform engineering recommendations documentations;

Troubleshooting documentations and After-Action Reports;

Root Cause Analysis Reports;

Project Engineering Reports Infrastructure Specifications Report;

Infrastructure outages and deployments Reports;

Logical data flow diagrams;

TDB/ As Needed

Technology Plan

3.4 Task 4 Development, Modernization and Enhancement

ELC and CMMI Documentations;

Code Packages;

Deployments Approvals Documents;

Productions Development Package;

System Deployments Plans;

Logical data flow diagrams;

Enhancements and Integrations Documentations;

System Architecture & Engineering Documentations;

Logical data flow diagrams;

3.5 Task 5 Development

Operations & Maintenance

ELC and CMMI Documentations;

Code Packages;

Deployments Approvals Documents;

Productions Development Package;

System Deployments Plans Project Computer Operator Handbook;

Project Desk Guides

TDB/ As Needed

3.7 Task 6 Transition

(Optional)

Transition Management Plan

3.8 Task 7 Surge

(Optional)

As Required to support specific Task assignments.

F.1 TASK ORDER PERIOD OF PERFORMANCE

The period of performance shall be for one Base Year of 12 months and four 12-month option years. The Periods of Performance reads as follows:

Base Year: February 2, 2023 – February 1, 2024 Option Year 1: February 2, 2024 – February 1, 2025 Option Year 2: February 2, 2025 – February 1, 2026 Option Year 3: February 2, 2026 – February 1, 2027 Option Year 4: February 2, 2027 – February 1, 2028

F.2 PLACE OF PERFORMANCE

The government is currently operating under a maximum telework directive and access to Government offices is limited. Unless otherwise stated, performance under the awarded Task Order will take place at the Contractor’s site or remotely during this maximum telework directive.

Program control will be at:

New Carrollton Federal Building (NCFB) 5000 Ellin Rd Lanham-Seabrook, MD 20706-1348

Contractor personnel must be able to travel to a government site at the government’s discretion without incurring billable travel costs.

F.3 SHIP TO

Unless otherwise specified, all deliverables/work products shall be provided to the COR no later than 4:00 p.m. local time on the date(s) specified in the task order.

F.4 DELIVERABLES

Unless otherwise requested in writing by the COR, work products shall be produced using Microsoft Office 2010 Professional products. If it is required that deliverable(s) be submitted in media storage form all devices must be scanned and certified as virus free.

The contractor will deliver all products concurrently to the IRS Government Technical Monitor (GTM) and the Contracting Officer’s Representative (COR). The COR will notify the contractor whether the formal deliverable has been accepted or provide written comments within ten (10) government workdays of receipt. Contractor shall then resubmit the final deliverable within ten

(10) government workdays to the IRS GTM and the COR, if necessary.

SECTION G TASK ORDER ADMINISTRATION DATA

G.1 IDENTIFICATION OF GOVERNMENT TASK ORDER PERSONNEL

The COR designation will be identified by the CO’s written designation memo. The CO will identify the COR via e-mail to the contractor.

SECTION H SPECIAL TASK ORDER REQUIREMENTS

H.1 KEY PERSONNEL

The offeror shall identify, (in their proposal based on the information provided in the table below), certain positions or roles considered to be Key Positions. The contractor shall submit the labor category, name, resume and commitment letter agreeing to accept the position if the vendor is selected for each of the contractor employees proposed for each Key Position identified. Substitutions before or after award will require submittal of a resume and approval by the Contracting Officer.

Name Labor Category Key Position Project Manager Lead Architect Senior Architect Infrastructure SME Automation SME Middleware SME

ICAM SME

Web Architect Development Lead

The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30p.m. EST, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed in the Skills Requirement section.

H.2 PERFORMANCE REQUIRED BEYOND STANDARD WORKDAY

If needed, performance shall be required beyond the standard workday. A standard workday is defined as any eight hours of productive labor during the core business hours of 7:00 AM through 5:00 PM, Monday through Friday.

Observance of Legal Holidays and Excused Absence

(a) Government personnel observe the following holidays:

New Year's Day Inauguration Day (when applicable) Martin Luther King Day Presidents’ Day Memorial Day Juneteenth Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

(b) In addition to the days designated as holidays, the Government observes the following days:

Any day designated by Federal Statue, Any day designated by Executive Order, and Any day designated by the President's Proclamation.

(c) It is understood and agreed between the Government and the contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the contractor's personnel work during the holiday, they may be reimbursed by the contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked. This provision does not preclude reimbursement for authorized overtime work if applicable to this contract.

(d) When the Government grants excused absence to its employees, assigned contractor personnel may also be dismissed. The contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled and shall be guided by the instructions issued by the Contracting Officer or the Contracting Officer’s Representative.

H.3 SECURITY

The COR will ensure contractor personnel compliance in accordance with IRS HSPD-12 PIV Procedures Manual.

H.3.1 PERFORMANCE AT GOVERNMENT SITES

The government is currently working under a maximum telework directive due to COVID-19. If any of this task order effort is performed at specified government facilities, the contractor shall abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at these facilities.

H.3.2 IDENTIFICATION/ BADGES

The applicable contractor employees shall not begin working under this task order until all security forms have been properly completed and submitted. All contractor employees shall be required to wear identification badges when working in government facilities.

H.3.3 PERSONNEL REMOVAL AND REPLACEMENT

The applicable contractor employees are subject to investigation by the government.

Applicable contractor employees who undergo contractor clearances that reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay federal income tax. The government reserves the right to determine if a contractor employee assigned to a task shall continue with the task. The contractor shall agree to remove the person assigned within one day of official notification by the government and provide a replacement within five days. New hires or substitutions of personnel are subject to the contractor clearance requirement.

H.3.4 DELIVERABLES/ WORK PRODUCTS

All Vendor deliverables or work products shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the government.

“The Vendor shall adhere to Section 508 of the Rehabilitation Act of 1973, which requires access to the Federal Government electronic and information technology. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Federal agencies must ensure that this technology is accessible to employees and members of the public with disabilities http://www.section508.gov/ Each Electronic and Information technology product or service furnished under this contract shall comply with the Electronic and Information Technology (EIT) Accessibility Standards (29 U.S.C. *&794(d)) this includes all task/delivery orders and product support services furnished in the performance of this contract.

For every EIT product or service accepted under this contract by the Government that does not comply with (29 U.S.C.*&794(d)), the Vendor shall at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either the planned refresh cycle of the product or service, or on the order renewal date, whichever shall occur first.”

H.4 On-Boarding Requirements

1.0 Contractor Employee On-Boarding Requirements

http://www.section508.gov/

1.1 Staff-Like Access Definition and Requirements

Only those contractors/subcontractors who require staff-like access to IRS systems, data, or facilities will follow the outlined process below. Those whose access is infrequent, or will not need staff-like access, and will be 100% escorted while in IRS space, will be managed by the Contracting Officer’s Representative (COR). Escort access is only permitted for infrequent access to IRS facilities and is NOT permitted if subjects require sensitive but unclassified (SBU) data access or systems access.

Contractors/subcontractors are not permitted to have “staff-like access” to IRS facilities, systems, or SBU data until they are determined to be both eligible and suitable to perform work as an IRS contractor by IRS Personnel Security (PS). Each contractor/subcontractor assigned to work under an IRS contract shall undergo investigative processing commensurate with the risk level designation associated with the work to be performed, and comparable to that required for Federal employees who occupy the same positions and who have the same position sensitivity designation.

“Staff-like Access” is authority granted to perform one or more of the following:

• Enter IRS facilities or space (owned or leased) unescorted (when properly badged);

• Possess login credentials to information systems (IRS or Vendor-owned systems that store, collect, and /or process IRS information);

• Possess physical and/or logical access to (including the opportunity to see, read, transcribe, and/or interpret) Sensitive but Unclassified (SBU) data, wherever the location; (See IRM

10.5.1 for examples of SBU data);

• Possess physical access to (including the opportunity to see, read, transcribe, and/or interpret) security items and products (e.g., items that must be stored in a locked container, security container, or a secure room, wherever the location.