TIRNO09R00017-A0002 1 1 .rtf

OMB Control No. 1505-0081

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

PAGE OF PAGES

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

4. REQUISITION/PURCHASE REQ. NO.

5. PROJECT NO. (If applicable) See Block 16C

Q-9-QS-33-SP-P00 000

6. ISSUED BY

CODE

IRS0088

7. ADMINISTERED BY (If other than Item 6)

CODE

Internal Revenue Service 6009 Oxon Hill Road, Suite 500

Oxon Hill, MD 20745

YELDELL, TONYA H 202-283-1168

See Item 6

8. NAME AND ADDRESS OF CONTRACTOR (No. Street, county, State and ZIP: Code)

Vendor ID: 00055905

TO ALL OFFERORS

BECKLEY FINANCE CENTER

PO BOX 9002

.BECKLEY, WV 25801

(x)

9A. AMENDMENT OF SOLICITATION NO.

TIRNO-09-R-00017

x

9B. DATED (SEE ITEM 11)

06/05/2009

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE

FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X X

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning ___1__ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATA SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and data specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

(x) A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return ____ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to:

1. Publicize answers/clarifications to questions received concerning Request For Proposal TIRNO-09-R-00017.

2. Provide a revised Request For Proposal document

3. To extend the date of receipt of proposals from June 11, 2009 at 10:00 a.m. EST to June 25, 2009 at 10:00 a.m. EST.

Except at provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

15C. DATE SIGNED

16B. UNITED STATES OF AMERICA

16C. DATE SIGNED

(Signature of person authorized to sign)

BY _____________________________________________

(Signature of Contracting Officer)

TIRNO-09-R-00017 AMEND# 0002

Page B - Section B

SUPPLIES OR SERVICES AND PRICES/COSTS

Line Item No.

Description of Supplies/Services Qty U/I Unit Price Total

Base Period

Sub-Task 1 Orientation Briefing 1.00

EA

Sub-Task 2 Project Management and Control 1.00

EA

Sub-Task 3 Pre-Implementation Planning 1.00

EA

Sub-Task 4 Solution Implementation 1.00

EA

0004A Sub-Task 4.1 Infrastructure Implementation 1.00

EA

0004B Sub-Task 4.2 Process Engineering 1.00

EA

0004C Sub-Task 4.3 Training and Documentation 1.00

EA

0004D Sub-Task 4.3.a Activity 1 - Custom Training Development 1.00

EA

0004E Sub-Task 4.3.b Activity 2 - IRS Standard Operating Procedures Development 1.00

EA

0004F Sub-Task 4.3.c Activity 3 - Knowledge Transfer 1.00

EA

Sub-Task 5 - Integration with Existing Investments 1.00

EA

Perpetual Software Licenses for Servers and Workstations 1.00

EA

Direct Labor Hours Not To Exceed (NTE)

0.00

HR

0007A Project Manager (NTE)

2,920.00

0007B Functional Expert (NTE) 5,120.00

HR

0007C Senior Information Technology Specialist (NTE) 5,120.00

HR

Sub-Task 7 Other Direct Costs (Travel) (NTE) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 1

Sub-Task 2 - Project Management and Control 1.00

EA

Sub-Task 3 Pre-Implementation Planning 1.00

EA

Sub-Task 4 Solution Implementation 0.00

EA

1002A Sub-Task 4.1 Infrastructure Implementation 1.00

EA

1002B Sub-Task 4.2 Process Engineering 1.00

EA

1002C Sub-Task 4.3 Training and Documentation 1.00

EA

1002D Sub-Task 4.3.a Activity 1 - Custom Training 1.00

EA

1002E Sub-Task 4.3.b Activity 2 - IRS Standard Operating Procedures Development 1.00

EA

1002F Sub-Task 4.3.c Activity 3- Knowledge Transfer 1.00

EA

Sub-Task 5 - Integration with Existing Investments 1.00

EA

Sub-Task 6 Maintenance for Deployed Solutions 1.00

EA

Direct Labor Hours (NTE)

1005A Project Manager (NTE) 2,920.00

HR

1005B Functional Expert (NTE) 5,120.00

HR

1005C Senior Information Technology Specialist (NTE) 5,120.00

HR

Option Year 2

Sub-Task 2 - Project Management and Control 1.00

EA

Sub-Task 3 Pre-Implementation Planning 1.00

EA

Sub-Task 4 Solution Implementation 1.00

EA

2002A Sub-Task 4.1 Infrastructure Implementation 1.00

EA

2002B Sub-Task 4.2 Process Engineering 1.00

EA

2002C Sub-Task 4.3 Training and Documentation 1.00

EA

2002D Sub-Task 4.3.a - Activity 1 - Custom Training Development 1.00

EA

2002E Sub-Task 4.3.b Activity 2 - IRS Standard Operating Procedures Development 1.00

EA

2002F Sub-Task 4.3.c Activity 3 - Knowledge Transfer 1.00

EA

Sub-Task 5 - Integration with Existing Investments 1.00

EA

Subtask 6 - Maintenance for Deployed Solutions 1.00

EA

Option Year 3

Subtask 2 - Project Management and Control 1.00

EA

Sub-Task 3 Pre-Implementation Planning 1.00

EA

Sub-Task 4 Solution Implementation 1.00

EA

3002A Sub-Task 4.1 Infrastructure Implementation 1.00

EA

3002B Subtask 4.2 Process Engineering 1.00

EA

3002C Subtask 4.3 - Training and Documentation 1.00

EA

3002D Sub-Task 4.3.a Activity 1 - Custom Training Development

1.00

EA

3002E Sub-Task 4.3.a Activity 2 - IRS Standard Operating Procedures 1.00

EA

3002F Sub-Task 4.3.c Activity 3 - Knowledge Transfer 1.00

EA

Subtask 5 - Integration with Existing Investments 1.00

EA

Sub-Task 6 Maintenance for Deployed Solutions 1.00

EA

3005A Project Manager (NTE) 2,920.00

HR

3005B Functional Expert (NTE) 5,120.00

EA

3005C Senior Information Technology Specialist (NTE) 5,120.00

EA

Sub-Task 7 Other Direct Costs (Travel) (NTE) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 4

Subtask 2 - Project Management and Control 1.00

EA

Sub-Task 3 Pre-Implementation Planning 1.00

EA

Sub-Task 4 Solution Implementation 1.00

EA

4002A Sub-Task 4.1 Infrastructure Implementation 1.00

EA

4002B Subtask 4.2 Process Engineering 1.00

EA

4002C Subtask 4.3 - Training and Documentation 1.00

EA

4002D Sub-Task 4.3.a Activity 1 - Custom Training Development

1.00

EA

4002E Sub-Task 4.3.a Activity 2 - IRS Standard Operating Procedures 1.00

EA

4002F Sub-Task 4.3.c Activity 3 - Knowledge Transfer 1.00

EA

Subtask 5 - Integration with Existing Investments 1.00

EA

Sub-Task 6 Maintenance for Deployed Solutions 1.00

EA

4005A Project Manager (NTE) 2,920.00

HR

4005B Functional Expert (NTE) 5,120.00

EA

4005C Senior Information Technology Specialist (NTE) 5,120.00

EA

Sub-Task 7 Other Direct Costs (Travel) (NTE) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

TIRNO-09-R-00017 AMEND# 0002

Page C - Section C file_0.png file_1.wmf

FINAL

Performance Work Statement For Internal Revenue Service / Cybersecurity Security Posture Monitoring and Reporting (SCPMaR) Solution

Background Since 2006, IRS has urgently sought an alternative solution to a GOTS product – Policy Checkers. Utilization of this tool is labor intensive (MITS organizations spend thousands of man-hours to operate) and it costs MITS Cybersecurity an average of $2 million per year to maintain. Therefore, as a part of a Security Summit 2006 action item, MITS Cybersecurity needs to develop an enterprise phased approach to secure and monitor IT assets, where:

It increases visibility into the security posture of the enterprise, Provide a method to organize accountability for securing computing assets, Monitor all assets for security compliance, and Establish process to address compliance issues.

Hence, IRS seeks a capability to assess, monitor, and report effectiveness of its implemented technical security controls in accordance to policies and standards mandated by OMB and NIST. Therefore, the product must be validated by NIST Security Content Automation Protocol (SCAP) Validation Program (http://nvd.nist.gov/validation.cfm) and meet polices mandated by OMB M-07-11 Implementation of Commonly Accepted Security Configurations for Windows Operating Systems, OMB M-7-18 Ensuring New Acquisitions Include Common Security Configurations, and Treasury Memo: Enhanced Cyber Security Controls, December 20, 2007.

Scope The work to be performed under this PWS is to design, develop, implement and maintain an integrated enterprise compliance posture monitoring and reporting solution, which will enable the IRS to:

Monitor, measure, and report on policy compliance and security vulnerabilities across the infrastructure using SCAP–based benchmarks.

Facilitate resolution of repeat audit findings for system mis-configurations and position the IRS to respond timely and consistently to evolving security standards and controls mandated by Treasury and OMB.

Provide role-based integrated security compliance reports.

Facilitate interoperability with existing IRS investments (i.e. ISS Internet Scanner (Proventia), Tenable Nessus, Tivoli Configuration Manager) (TCM), Arcsight Security Information Manager (SIM), Peregrine Asset Management (ITAMS), NetIQ Group Policy Administrator, and NetIQ AppManager Suite, and Altiris Patch Manager.

Description of Sub-Tasks and Deliverables The IRS requires a software solution that meets all requirements identified in the attached Business System Requirements Report (BSRR). In addition to the delivery of the requirements in the attached, the IRS requires professional services support to complete the following tasks:

Sub-Task 1 – Orientation This activity includes reviewing IRS's PWS, business and technical requirements; understanding the critical success factors; review of the IRS Enterprise Life Cycle (ELC) methodology, IT security policies and other relevant government furnished information.

Deliverable Within two weeks of award, the Contractor shall conduct an orientation briefing for the IRS. The IRS does not desire an elaborate orientation briefing nor does it expect the Contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to ensure the Contractor and IRS are in agreement of PWS requirements and schedule.

The Orientation Briefing shall be held at the IRS facility located at 5000 Ellin Road – Lanham, MD 20706; both parties shall mutually agree upon the date and time.

The completion of this briefing shall result in the following:

The Contractor and IRS personnel who shall perform work under this PWS shall be introduced.

The IRS will show the applicable facilities to the Contractor, if Contractor shall be performing work at this site.

The IRS will provide the Contractor with Government Furnished Information and/or Property.

Any issues concerning Contractor security clearances or personnel shall be discussed.

The Contractor will demonstrate their understanding of the work to be accomplished under this PWS.

Sub-Task 2 – Project Management and Control The Contractor shall assist the SCPMaR Project Office (PO) with the following project management tasks, all of which must follow the Enterprise Life Cycle (ELC) methodology and processes:

Development and maintenance of the SCPMaR project plan/WBS

Development and maintenance of a change request process Development and maintenance of a risk management plan Conducting project kickoff meeting with key stakeholders to outline objectives, success factors, and approach Development of weekly status reports, to include:

Accomplishments Issues Risks Dependencies Next Steps (Key Milestones) Conducting weekly status meetings to discuss content of status reports Coordinating all scheduled activities and changes with the IRS PM Bringing the project to completion. Includes Final Project Closeout Report.

Deliverables The Contractor shall provide input to project management documents required by SCPMaR tailoring plans including, but not limited to the following:

Project Management Plans

Security Certification & Accreditation Package 508 Accessibility and Mitigation Package Security Engineering Package Lessons Learned Report Business System Requirements documents System Validation & Verification Plan System Deployment Plan Transition Management Plan Design Specification Report Test Plans Computer Operator's Handbook (COH)

Sub-Task 3 – Pre Implementation Planning The Contractor shall complete a detailed assessment of IRS's requirements and subsequent implementation plans. This includes but is not limited to the following:

Review the PWS with the IRS.

Confirm IRS’s expectations for the project and work with the SCPMaR PO to establish project success criteria.

Review IRS responses to pre-engagement questionnaires and requests for information in order to recommend and confirm final architecture Review Implementation methodologies with the IRS.

Become familiarized with IRS’s Enterprise Software Lifecycle process.

Discuss and respond to technical and project-related inquiries for IRS management and change control Develop a project schedule and finalize the schedule with the SCPMaR PO.

Verify the availability and readiness of IRS’s logistics (facilities, equipment, and personnel) prior to commencing the implementation of the solution’s infrastructure.

Confirm logistics for on-site visit, including location and points of contact.

Deliverables

A solution design document that includes recommended architecture and hardware/software specifications Project schedule

Sub-Task 4 – Solution Implementation This task is focused on the implementation of the SCPMaR solution at IRS determined locations.

The Contractor shall:

Conduct on-site kickoff meeting with key IRS personnel.

Perform Infrastructure Assessment – The purpose of this assessment is for the vendor to become familiar with the current network topology and auditing requirements, so as to satisfy the business requirements for the implementation.

Perform Deployment Assessment – The Infrastructure Assessment will be used in conjunction with the business requirements to determine the most appropriate architecture and supporting infrastructure to use.

Perform Configuration Assessment – Review configuration options to be set during the implementation, including database configuration, infrastructure, user permission, and console options. Determine whether configuration options should be changed to enhance performance or to meet business requirements that are not currently met.

Deliverables

A system design document that describes:

Deployed infrastructure SCPMaR solution configuration, including database configuration, infrastructure, user permissions, and console options

Sub-Task 4.1 – Infrastructure Implementation The purpose of this subtask is to install and configure the infrastructure at locations determined by the IRS. The Contractor shall:

Validate system architecture Define and document user community, using formal security models (i.e., Role-based Access Control with Access Capability Matrix) including:

Users (including privileged users) Roles User permissions

Server subsystems (e.g., web, database, configuration management, report server, etc.)

System interfaces (e.g., API, client program (“agent”), TCP/IP ports and protocols) (i.e., interface control documents (ICD))

Server subsystems (e.g., web, database, configuration management, report server, etc.)

System interfaces (e.g., API, client program (“agent”), TCP/IP ports and protocols) (i.e., interface control documents (ICD)) Install components in IRS’s test or pre-production environment Test and validate system components and functionality Review results with SCPMaR PO Provide knowledge transfer to SCPMaR PO through shadowing and collaboration

Deliverables

Updated system design document, including server component test deployment summary Deployed SCPMaR system infrastructure

Sub-Task 4.2 – Process Engineering The Contractor shall design automated workflow to support the following processes (as described in SCPMaR Concept of Operations) see Attachment J-4:

Security Posture Assessment

Security Posture Reporting Security Configuration and Deviation Management Risk Management

Deliverables Security posture assessment processes and workflows (i.e., Automated and On-Demand Security Assessment processes); design and document Security posture reporting processes and workflows; design and document Security configuration and deviation management processes and workflows; design and document Risk management processes and workflows; design and document

Sub-Task 4.3 – Training and Documentation

4.3.a Activity 1: Custom Training Development The purpose of this activity is to develop custom training curriculum for IRS staff specific to the requirements for the IRS and its individual sites. In support of this task, the Contractor shall:

Review IRS training requirements. Requirements to be provided by the SCPMaR PO.

Leveraging existing materials and training classes; customize material for IRS personnel.

Review training materials with IRS key stakeholders Deliver electronic training materials to IRS personnel.

Provide training for up to twelve (12) students each at ten (10) IRS locations. Locations to be determined by SCPMaR PO.

Deliverables

Student Guide Instructor PowerPoint

4.3.b Activity 2: IRS Standard Operating Procedures (SOP) Development This activity consists of documenting SCPMaR Standard Operating Procedures (SOP) for the operation and administration of the IRS solution. In support of this task, the Contractor shall:

Operation and Maintenance Change Control Procedures Disaster Recovery

Deliverable

IRS Standard Operating Procedures document

4.3.c Activity 3: Knowledge Transfer This activity includes the review of key components with SCPMaR PO. The Contractor shall:

Review general architecture, including recommended maintenance Conduct training sessions with the SCPMaR user community to include:

How to modify and update system configurations to meet/enhance operational needs How to modify, update and architect automated operational processes How to import/integrate data from sources (as stated in the Business System Requirements Report) How to troubleshoot system problems How to modify or update system controls (i.e., user roles, privileges, and system operations) How to manage and apply system updates (i.e., patches or upgrades)

Deliverables Product documentation (e.g., administrator manual, user guide, etc.)

User trainings

Sub-Task 5.0 – Integration with Existing Investments The Contractor shall design, develop, test and deploy interfaces with critical IRS systems/applications to ensure delivered solution provides Enterprise compliance, posture monitoring and reporting capability. At a minimum, the deployed solution shall be able to integrate with the following software:

ISS Internet Scanner (Proventia)

Tenable Nessus Tivoli Configuration Manager (TCM) Arcsight Security Information Manager (SIM) Peregrine Asset Management (ITAMS) NetIQ Group Policy Administrator NetIQ AppManager OPNET NetDoctor Relational Database Management Systems (RDBMS) (e.g., Oracle, MS SQL) Microsoft Active Directory CA SiteMinder SunN1 Patch Manager Altiris Patch Manager

Deliverables Integrated reports which leverage data ingested from the following solutions:

ISS Internet Scanner, Tenable Nessus, SunN1 Patch Manager, Altiris Patch Manager Tivoli Configuration Manager, Arcsight SIM, ITAMS (Peregrine Asset Management System) , NetIQ Group Policy Administrator, NetIQ AppManager and OPNET NetDoctor.

Sub-Task 6.0 – Maintenance for Deployed Solutions The Contractor shall provide professional services for, but not limited to, support of the deployed solution, upgrade services, remote and/or on-site deployment engineering services, installation services, and consulting services, at the request of the IRS.

The Contractor shall provide all software release patches/bug fixes for purchased software covered and maintained under the contract at no additional charge to the IRS. The Contractor shall notify the IRS and receive approval before implementing any software releases or patches. All software releases and patches must be provided with appropriate supporting documentation in electronic or soft format. Software releases and patches to which the IRS agrees shall be installed in strict accordance with an IRS approved Contractor provided project plan on all applicable equipment items at all IRS sites. Additionally, all large software updates or releases must be tested in a non-production test environment to ensure stability before being introduced into the IRS production environment.

The Contractor shall provide to the IRS a quarterly report (due at the end of each quarter of the Government’s fiscal year) listing all new software release patches/bug fixes released during the quarter, and software release patches/bug fixes that have been installed on the applicable IRS equipment items (itemized by site, equipment item and the date of installation) during the quarter.

The Contractor shall provide a single point of contact, (project manager) for all issues relating to support of the deployed solution. Such person shall be available during Normal Business Hours (Monday - Friday 7:00am - 5:30pm EST, except holidays).

The Contractor shall provide a back up point of contact when the project manager is not available.

The Contractor shall provide a dedicated upgrade engineer(s) at the beginning of each software upgrade or modification.

If required, the Contractor shall report to the IRS’ site representative at each site upon arrival and completion of each on-site software maintenance and on-site software support service call. The IRS site representative or a designated alternate will be available upon arrival and completion of each type of maintenance call.

The Contractor shall contact the SCPMaR PO to coordinate with IRS site representatives before the start and completion of software maintenance and remote software support service call. The IRS site representative or a designated alternate will be available for the start and completion of each type of maintenance call.

The Contractor will not make any changes to the software environment without first obtaining approval of the IRS or its authorized agencies.

Deliverables Quarterly Report listing all new software release patches/bug fixes released during the quarter Sub-Task 6.1 – Software Maintenance Response Time Response time is the period between the time the Contractor receives notification from the IRS, and the time a service technician arrives at the site requiring repair or the Contractor begins repair remotely. The Contractor shall identify the method of response for each notification.

IRS does not require a separate Contractor service desk for Level 1 support. Rather, in the proposed concept of operation, the Contractor is expected to act as the level 2 and 3 escalation points. Level 1 function will be performed by the existing IRS personnel.

Sub-Task 6.2 – Repair Time The Contractor shall inform the IRS immediately upon diagnosis of any SW failure. The Contractor shall complete repairs of all software failures (major or minor) within a time frame that will guarantee maintenance of the SCPMaR solution at ninety (90%) uptime required by this contract.

Sub-Task 6.3 – Software Downtime Software downtime is that period of time when the software is entirely inoperable, or degraded (partially inoperable) to the point that it cannot be used, due to a malfunction in the Contractor maintained software. If a malfunction or failure of a software application causes other devices or software programs to be inoperable, these other programs/devices will also be considered down. This provision does not apply to software, which becomes inoperable due to the fault or negligence of the IRS.

Sub-Task 6.4 – Period of Downtime Downtime for each incident shall start at the first bona fide attempt by the IRS to notify the Contractor that software maintenance is required and continues until the software is returned to the IRS in proper operating condition. Each incident of downtime shall be rounded to the nearest whole tenth of an hour.

In the event that the IRS defers the Contractor’s arrival or denies the Contractor access to the inoperable software after the Contractor’s arrival, the deferred and/or denied time will be deducted when calculating the downtime.

Sub-Task 6.5 – Escalation Procedures The Contractor shall escalate software malfunction problems to ensure a timely repair. Escalation procedures shall facilitate the availability of the technical support required to diagnose and repair failing software. The IRS will not attempt to specifically define the escalation procedures the Contractor uses to satisfy this requirement; however, the IRS will protect its interests by providing the minimum escalation procedures described below. The Contractor shall propose escalation procedures that, at a minimum, escalate software malfunction problems in accordance with the following time frames and support levels:

If the first level maintenance personnel cannot achieve maintenance repair within two hours of arrival at the site, the Contractor shall provide higher-level maintenance support. The Contractor’s first level maintenance personnel shall request higher level support from the Contractor as soon as it is determined that the two hour repair time will not be met, and shall advise the IRS representative of the situation. Higher-level support personnel shall respond to the site within two hours of notification.

If the second level maintenance personnel cannot achieve maintenance repair within two hours of arrival at the site, the Contractor shall escalate to their next level. Response at the next level must occur within two hours of notification.

If the escalation process is executed, it should not result in any additional cost to the IRS and shall not constitute a waiver of any other remedies.

Sub-Task 6.6 – Security Requirements The Contractor must comply with the following:

New system installations must be compliant with IRS requirements, including NIST, OMB and IRM policies.

All services provided by the Contractor must meet NIST, OMB and IRM standards The Contractor shall support continuing monitoring and testing efforts (both quarterly and annually) specified in the NIST, OMB and IRM standards The Contractor shall support Certification & Accreditation activities including development and documentation updates to the Security, Testing & Evaluation process.

Sub-Task 7 - Travel All travel shall be in accordance with the Federal Travel Regulations (for travel in 48 contiguous states), the Joint Travel Regulations, DoD Civilian Personnel, and Volume 2, Appendix A (for travel to Alaska, Hawaii, Puerto Rico, and U.S. territories and possessions).

Sub-Task 8 - Reports All reports prepared by the Contractor under this PWS will be delivered to the COTR electronically and in Microsoft Office 2003 format.

Government Furnished Property Government Furnished Material and Information may be provided in conjunction with required performance under this PWS. Disposition at the end of the task shall be in accordance with FAR clause 52.245.5.

Upon commencement of the PWS, unless otherwise indicated, the Government will provide the following property to the Contractor:

Enterprise Service Delivery Processes (e.g. Change Management, Risk Management, etc.)

IT Security IRMs Training Requirements Employee User Portal Standards and Guidelines 508 Standards

Access to Government Property and Facilities The Contractors will be provided with "staff like access" at NCFB and the SCPMaR host site (to be determined) upon successful completion of the minimal background investigation process. The Contractor will be allowed limited access to all other Government's facilities. When visiting a Government facility (outside of NCFB), the Contractor will be escorted at all times. The Contractor may be subjected to search by Security personnel when visiting a Government facility unless it has documented (1) that it has performed due diligence in seeking accessible alternative COTS or ASP Software, offering equivalent features and functionality to the inaccessible COTS or ASP Software, for which The Contractor is or can readily become a licensed distributor; and (2) the cost of developing substitute accessible software under this Agreement. (Such documentation need not include reference to any specific competing COTS or ASP Software and its level of accessibility). COTS or ASP Software delivered under this Agreement that does not meet the Section 508 Standards shall be acceptable only if the software vendor provides a roadmap for meeting such standards.

Any maintenance agreement entered by the Contractor and the IRS in connection with the system delivered under this Agreement shall require the Contractor to cooperate with the IRS in its efforts to resolve interoperability problems that arise during the term of the maintenance agreement related to the use of such system with specific Assistive Technology in a specific IT environment.

Security Performance at Government Sites Should any effort required by this task be performed at specified Government facilities, the Contractor shall abide by Department of Treasury Directive P 71‑10 regarding provisions for authorized entrance and exit at these facilities.

FISMA / IT SECURITY

Information Security / Federal Information Security Management Act (FISMA) Pursuant to the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002, P.L. 107-347, the contractor shall provide minimum security controls required to protect Federal information and information systems. The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data.

An IRS information or information system are defined as a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

Treasury / IRS Policies for Information Technology (IT) Security The contractor shall comply with Department of Treasury Security Manual TDP 15-71, and Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance. The contractor shall comply with IRS Internal Revenue Manuals (IRM) and Law Enforcement Manuals (LEM) when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

IRM 10.8.1 require IRS' sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearances required; receive security awareness and training required for contractor activities or facilities; and any facility physical security requirements. Most IRS information is categorized as SBU. This includes:

a.) taxpayer information, b.) employee data - such as evaluations, c.) personnel and payroll records, d.) financial and statistical information on agency operations not normally available for public disclosure, and e.) proprietary information provided to the government by third parties.

Oversight of Contractor Systems Based on the Scope of Work (PWS) for this contract, the contractor system is considered a major IT services / system; and subject to an annual FISMA Contractor Review / site visit. All contractors that manage, operate or program an IRS Information or Information system are subject to IRS oversight to conduct a FISMA Contractor site review of the contractor’s IT operation and physical environment / facilities. At the discretion of IRS MITS Cybersecurity and the owning Business Unit, a FISMA Contractor review shall be determined based on a risk-based decision and whether it is cost effective to conduct such a review.

Certification and Accreditation Process Contractors systems that collect, maintain, operate or use agency information or an information system on behalf of the agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews, risk assessments, security plans, control testing, a Privacy Impact Assessment (PIA), contingency planning, and certification and accreditation, at a minimum meet NIST guidance, if required by the IRS.

Contractor System Review / Site Visit The contractor shall be subject to at the option / discretion of the agency, to periodically test, (but no less than annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

Information Security Awareness and Training The contractor shall comply with IRS mandatory annual Computer Security Awareness briefings, UNAX briefings and receive an initial orientation before access to IRS Information Systems. Perform HSPD-12 Personal Identify Verification, physical and personnel security screening / background investigation for approval of a contractor badge for staff like access; then obtain 5081 approval to IRS information systems.

All contractors and contractor employees who are involved with the management, use, programming or maintenance of IRS information systems must complete the IRS mandatory Computer Security briefing. All contractors and contractor employees who could have access to return information must complete the mandatory UNAX briefing. Contractors shall certify the completion of training by their employees annually. The certification shall be submitted to the contracting officer, with a copy to the COTR and IRS Cybersecurity Awareness and Training Team.

(i) Contractors shall verify completion of the briefing by their employees within 30 days of award. For contractor employees who are assigned to a contract or task/delivery order during the period of performance, verification will be submitted within 30 days of their start work date.

(ii) Annually thereafter, contractor employees shall complete the briefing during the 2nd Quarter of the fiscal year, and contractors shall verify such completion by no later than March 31, in accordance IRS Procurement Policy and Procedures Memo 39-1c.

(iii) The verification requirement must be included as a deliverable in the contract, task/delivery order or interagency agreement with specified due dates. Failure to comply with this requirement may result in remedies up to and including termination for default.

(iv) Currently, the contractor provides a list of names to the COTR after award to initiate the background investigation process for contractor employees who require staff-like access. The COTR will use this list to identify contractor employees who require IT security training.

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources The contractor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The contractor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information.

Safeguarding / Protecting Sensitive Personally Identifiable Information (PII) Sensitive PII is defined by OMB as “any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” Information systems can be either electronic or manual.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Management Act (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information, such as the following guidance from OMB Policy M-06-16:

1. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing;

2. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining agency access;

3. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and

4. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

OMB Policy M-07-18 Ensuring New Acquisitions Include Common Security Configurations The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC). This includes Internet Explorer 7 configured to operate on Windows http://csrc.nist.gov/itsec/guidance_WinXP.html Windows XP and Vista (in Protected Mode on Vista). For the Windows XP settings, see: html, and for the Windows Vista settings, see: http://csrc.nist.gov/itsec/guidance_vista.html.

In accordance with OMB issued policy memorandum M-07-11, “Implementation of Commonly Accepted Security Configurations for Windows Operating Systems: “operating systems [Windows XP and VISTA] and/or plans to upgrade to these operating systems must adopt these standard security configurations by February 1, 2008.”

The National Institute of Standards and Technology (NIST) Guidance for Information Security The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum security controls identified in NIST Special Publication 800-53 Recommended Security Controls for Federal Information / NIST 800-53A and Revision 1, and FIPS 200 Minimum Security Requirements for Federal Information and Information Systems. The contractor shall follow the best practices and guidance established by NIST special publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

Handling Information Security Incidents The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

The contractor shall maintain procedures for detecting, reporting, and responding to security incidents, and mitigating risks associated with such incidents before substantial damage is done to federal information or information systems. The contractor shall immediately report all computer security incidents that involve IRS information systems to the IRS Computer Security Incident Response Center (CSIRC). Any theft or loss of IT equipment with federal information / data must be reported within one hour of the incident to CSIRC. Those incidents involving the loss or theft of sensitive but unclassified (SBU) data (i.e. taxpayer, PII) shall be reported to CSIRC, first-line manager, and Treasury Inspector General for Tax Administration (TIGTA). Based on the computer security incident type, CSIRC may further notify the Treasury Computer Security Incident Response Capability (TCSIRC) in accordance with TCSIRC procedures.

REPORT INCIDENTS TO IRS CSIRC:

Web Site http://www.csirc.web.irs.gov/incident/ Email csirc@csirc.irs.gov Phone (202) 283-4809 Toll-Free (866) 216-4809, Fax (202) 283-0345

Identification Badges

The applicable Contractor employee shall not begin working under this contract until all security forms have been properly completed and submitted. All Contractor employees shall be required to wear identification badges when working in Government facilities.

Personnel Removal and Replacement The applicable Contractor employees are subject to investigation by the Government. Applicable Contractor employees who undergo Contractor Clearances which reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay Federal income tax. The Government reserves the right to determine if a Contractor employee assigned to a task shall continue with the task. The Contractor shall agree to remove the person assigned within one day of official notification by the Government and provide a replacement within five days. New hires or substitutions of personnel are subject to the Contractor Clearance requirement.

Deliverables All Deliverables of the Contractor shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government.

Disclosure of Information Access to taxpayer account information, if any, will be subject to IRS’ unauthorized access provisions (UNAX). The Contractor is not being permitted to access any taxpayer account information without prior approval from the COTR. The Contractor shall keep taxpayer account information confidential and will not disclose such information to anyone except IRS personnel who have been identified by the COTR as having a need to know.

Exception to Rights in Data Clause Blanket permission is not authorized under this PWS for the Contractor to establish claims to copyright for any software first produced in performance of this task. Prior written approval is required from the Contracting Officer to establish claims to copyright for any software first produced in performance of this task.

TIRNO-09-R-00017 AMEND# 0002

Page D - Section D

PACKAGING AND MARKING

D.1 PACKING LIST AND MARKINGS

All deliverables submitted to the Contracting Officer’s Technical Representative (COTR), or Designated Agency Representative shall be accompanied by a packing list or other suitable shipping document that shall clearly indicate the following:

Contract Number

Delivery order/Task order number Name and address of the co-signer Name and address of the co-signee Requisition Number Description of the item/material shipped, including item number, quantity, and number of packages.

TIRNO-09-R-00017 AMEND# 0002

Page E - Section E

Inspection and Acceptance

E.1 52.252-2 CLAUSES INCORPORATED BY REFERENCES (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the following address:

www.acqnet.gov/far/

E.2 FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSES INCORPORATED BY REFERENCE

52.246-6 INSPECTION TIME-AND-MATERIAL AND LABOR HOUR MAY 2001

52.246-16 RESPONSIBILITY FOR SUPPLIES APR 1984

E.3 INSPECTION, ACCEPTANCE, AND RECEIVING CERTIFICATION -

DTAR 1046.672

A statement substantially as follows shall be placed, by the Contractor on each commercial shipping document, packing list for supplies or services, or Contractor's invoice:

INSPECTION, ACCEPTANCE AND RECEIVING CERTIFICATION

DATE:

CONTRACT NUMBER:

DELIVERY ORDER AND MODIFICATION NUMBER:

DATE ITEMS RECEIVED:

LOCATION WHERE ITEMS WERE DELIVERED:

ITEMS:

The listed items have been:__received, __inspected, __accepted by me or under my supervision and they conform to contract requirements, except as noted below.

List the requirements that were not accepted and/or the deductions made and provide the reason:

TOTAL AMOUNT OF DEDUCTIONS:

SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE:

TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE:

DATE SIGNED:

INSPECTION

Inspection shall be at the place of performance and delivery as stated herein.

E.4 GENERAL ACCEPTANCE CRITERIA

The general quality measures as set forth below will be applied to each Deliverable received from the Contractor under this PWS. Any perceived conflict between quality measures referenced in Section C of this PWS and the quality measures listed below should be immediately reported to the Contracting Officer’s Technical Representative.

Accuracy ‑ Deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity ‑ Deliverables shall be clear and concise; engineering terms shall be used, as appropriate. All diagrams shall be easy to understand and relevant to the supporting narrative.

Specifications Validity ‑ All Deliverables must satisfy the requirements of the Government as specified herein.

File Editing ‑ All text and diagrammatic files shall be editable by the Government.

Format ‑ Deliverables shall be submitted in hard copy (where applicable) and in media defined in the PWS. The Deliverable format may change from Sub-task to Sub-task.