TIRNO09R00017v11.rtf

OMB Control No. 1505-0081

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER UNDER DPAS (15 CFR 700)

RATING

2. CONTRACT NUMBER

3. SOLICITATION NUMBER

TIRNO-09-R-00017

X

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

5. DATE ISSUED

05/20/2009

6. REQUISITION/PURCHASE NO.

Q-9-QS-33-SP-P00 000

7. ISSUED BY CODE

IRS0088

8. ADDRESS OFFER TO (If other than Item 7)

CODE 20745001

Internal Revenue Service 6009 Oxon Hill Road, Suite 500

Oxon Hill, MD 20745

IRS Procurement 6009 Oxon Hill Road, 5th Floor Oxon Hill, MD 20745 NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder”

SOLICITATION

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in ________________ until 12:00 PM (Hour) local time 08/30/2009 (Date).

CAUTION LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR

INFORMATION

CALL:

A. NAME

B. TELEPHONE (NO COLLECT CALLS)

C. E-MAIL ADDRESS

YELDELL, TONYA H

AREA CODE

NUMBER

202-283-1168

EXT.

11. TABLE OF CONTENTS

SEC.

DESCRIPTION

PAGE(S)

SEC.

DESCRIPTION

PAGE(S)

PART I - THE SCHEDULE

PART II - CONTRACT CLAUSES

X A

SOLICITATION/CONTRACT FORM

X I

CONTRACT CLAUSES

X B

SUPPLIES OR SERVICES AND PRICE/COST

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C

DESCRIPTION/SPECS./WORK STATEMENT

X J

LIST OF ATTACHMENTS

D

PACKAGING AND MARKING

PART IV - REPRESENTATIONS AND INSTRUCTIONS

X E

INSPECTION AND ACCEPTANCE

X K

REPRESENTATIONS, CERTIFICATIONS

X F

DELIVERIES OR PERFORMANCE

AND OTHER STATEMENTS OF OFFERORS

X G

CONTRACT ADMINISTRATION DATA

X L

INSTRS., CONDS., AND NOTICES TO OFFERORS

X H

SPECIAL CONTRACT REQUIREMENTS

X M

EVALUATION FACTORS FOR AWARD

OFFER (Must be fully completed by offeror) NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____ calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

AMENDMENT NO.

DATE

AMENDMENT NO.

DATE

(The offeror acknowledges receipt of amendments to the

SOLICITATION for offerors and related documents numbered and dated):

15A. NAME

AND

ADDRESS

OF

OFFEROR

CODE

00055905

FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN

OFFER (Type or print)

TO ALL OFFERORS

BECKLEY FINANCE CENTER

.BECKLEY, WV 25801

15B. TELEPHONE NUMBER

15C. CHECK IF REMITTANCE

ADDRESS IS DIFFERENT FROM ABOVE -

ENTER SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AREA CODE

NUMBER

EXT.

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c) ( ) 41 U.S.C. 253(c) ( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN (4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE

25. PAYMENT WILL BE MADE BY CODE

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Page B - Section B

SUPPLIES OR SERVICES AND PRICE/COST

B.1 CONTRACT TYPE – FIRM FIXED PRICE (FFP)

This is an IDIQ, hybrid contract as defined in FAR Section 16.202-1, 16.504(a), 16.601.

Requirements for, software, maintenance, training and professional support services will be issued as Firm Fixed Price (FFP), Labor Hour (LH) and Time-and-Materials (T&M) task orders and will be issued based on Performance Work Statements (PWS). Hourly rates shall be charged in accordance with Section B.5 SUPPLIES OR SERVICES AND PRICES/COSTS..

B.2 MINIMUM DOLLAR GUARANTEE AND MAXIMUM CONTRACT LIMITATION

The contract total estimated ceiling value of this contract is $12,525,920.00. The contract ceiling amount shall be based on pricing for the base contract and four option periods.

The total estimated value of the contract is broken out as follows:

$5,164,720.00 (base) - Date of award through 1 year $1,840,300.00 - Option Year 1 $1,840,300.00 - Option Year 2 $1,840,300.00 - Option Year 3 $1,840,300.00 - Option Year 4

The Government’s minimum dollar obligation, under this contract, inclusive of option years, is $5,164,720.00. The contract minimum shall be obligated by separate delivery/task order(s) issued during the base period of the contract.

There is no limit to the number of delivery orders or task orders that may be executed under this contract. The delivery order(s) /task order(s) executed under this contract shall not exceed the total contract amount.

B.3 PERFORMANCE PERIOD

The contract will have a base performance period of one (1) year plus four (4) option years. The periods of performance are as follows:

Base Period: Date of award through 1 year Option Period 1: 1 year Option Period 2: 1 year Option Period 3: 1 year Option Period 4: 1 year

B.4 SUPPORT SERVICES

Support Services Personnel shall be acquired on an as needed basis via task orders under the contract.

Should it be necessary during the life of the contract to obtain services under a labor category not originally priced, the Government will issue a PWS to obtain pricing in support of the required services. The proposed pricing shall be negotiated at that time and added to the contract by contract modification.

B.5 SUPPLIES OR SERVICES AND PRICES/COSTS

Line Item No.

Description of Supplies/Services Qty U/I Unit Price Total

Base Period

Orientation Briefing 1.00

EA

Project Management and Control 1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 1.00

EA

0004A Infrastructure Implementation 1.00

EA

0004B Process Engineering 1.00

EA

0004C Training and Documentation 1.00

EA

0004D Custom Training Development 1.00

EA

0004E IRS Standard Operating Procedures Development 1.00

EA

0004F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Perpetual Software Licenses for Servers and Workstations 1.00

EA

Direct Labor Hours

HR

0007A Project Manager

2,920.00

0007B Functional Expert 5,120.00

HR

0007C Senior Information Technology Specialist 5,120.00

HR

Other Direct Costs (Travel) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 1

Project Management and Control 1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 0.00

EA

1002A Infrastructure Implementation 1.00

EA

1002B Process Engineering 1.00

EA

1002C Training and Documentation 1.00

EA

1002D Custom Training 1.00

EA

1002E IRS Standard Operating Procedures Development 1.00

EA

1002F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Maintenance for Deployed Solutions 1.00

EA

Other Direct Costs (Travel) 1.00

EA

1007A Project Manager 2,920.00

HR

1007B Functional Expert 5,120.00

HR

1007C Senior Information Technology Specialist 5,120.00

HR

Project Management and Control 1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 1.00

EA

1010A Infrastructure Implementation 1.00

EA

1010B Process Engineering 1.00

EA

1010C Training and Documentation 1.00

EA

1010D Activity 1 - Custom Training Development 1.00

EA

1010E IRS Standard Operating Procedures Development 1.00

EA

1010F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Maintenance for Deployed Solutions 1.00

EA

Direct Labor Hours

Project Manager - 2920 Hours Functional Expert - 5120 Hours Senior Information Technology Specialist - 5120 Hours

HR

Other Direct Costs (Travel) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 2 Project Management and Control 1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 1.00

EA

2002A Infrastructure Implementation 1.00

EA

2002B Process Engineering 1.00

EA

2002C Training and Documentation 1.00

EA

2002D Custom Training Development

1.00

EA

2002E IRS Standard Operating Procedures 1.00

EA

2002F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Maintenance for Deployed Solutions 1.00

EA

2005A Project Manager 2,920.00

HR

2005B Functional Expert 5,120.00

EA

2005C Senior Information Technology Specialist 5,120.00

EA

Other Direct Costs (Travel) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 3

1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 1.00

EA

3002A Infrastructure Implementation 1.00

EA

3002B Process Engineering 1.00

EA

3002C Training and Documentation 1.00

EA

3002D Custom Training Development

1.00

EA

3002E IRS Standard Operating Procedures 1.00

EA

3002F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Maintenance for Deployed Solutions 1.00

EA

3005A Project Manager 2,920.00

HR

3005B Functional Expert 5,120.00

EA

3005C Senior Information Technology Specialist 5,120.00

EA

Other Direct Costs (Travel) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

Option Year 4

1.00

EA

Pre-Implementation Planning 1.00

EA

Solution Implementation 1.00

EA

4002A Infrastructure Implementation 1.00

EA

4002B Process Engineering 1.00

EA

4002C Training and Documentation 1.00

EA

4002D Custom Training Development

1.00

EA

4002E IRS Standard Operating Procedures 1.00

EA

4002F Knowledge Transfer 1.00

EA

Integration with Existing Investments 1.00

EA

Maintenance for Deployed Solutions 1.00

EA

4005A Project Manager 2,920.00

HR

4005B Functional Expert 5,120.00

EA

4005C Senior Information Technology Specialist 5,120.00

EA

Other Direct Costs (Travel) (Travel will be reimbursed at cost in accordance with the Federal Travel Regulation) 1.00

EA

TIRNO-09-R-00017

Page C -

Section C file_0.png file_1.wmf

FINAL

Performance Work Statement For Internal Revenue Service / Cybersecurity Security Posture Monitoring and Reporting (SCPMaR) Solution

Background Since 2006, IRS has urgently sought an alternative solution to a GOTS product – Policy Checkers. Utilization of this tool is labor intensive (MITS organizations spend thousands of man-hours to operate) and it costs MITS Cybersecurity an average of $2 million per year to maintain. Therefore, as a part of a Security Summit 2006 action item, MITS Cybersecurity needs to develop an enterprise phased approach to secure and monitor IT assets, where:

It increases visibility into the security posture of the enterprise, Provide a method to organize accountability for securing computing assets, Monitor all assets for security compliance, and Establish process to address compliance issues.

Hence, IRS seeks a capability to assess, monitor, and report effectiveness of its implemented technical security controls in accordance to policies and standards mandated by OMB and NIST. Therefore, the product must be validated by NIST Security Content Automation Protocol (SCAP) Validation Program (http://nvd.nist.gov/validation.cfm) and meet polices mandated by OMB M-07-11 Implementation of Commonly Accepted Security Configurations for Windows Operating Systems, OMB M-7-18 Ensuring New Acquisitions Include Common Security Configurations, and Treasury Memo: Enhanced Cyber Security Controls, December 20, 2007.

Scope The work to be performed under this PWS is to design, develop, implement and maintain an integrated enterprise compliance posture monitoring and reporting solution, which will enable the IRS to:

Monitor, measure, and report on policy compliance and security vulnerabilities across the infrastructure using SCAP–based benchmarks.

Facilitate resolution of repeat audit findings for system mis-configurations and position the IRS to respond timely and consistently to evolving security standards and controls mandated by Treasury and OMB.

Provide role-based integrated security compliance reports.

Facilitate interoperability with existing IRS investments (i.e. ISS Internet Scanner (Proventia), Tenable Nessus, Tivoli Configuration Manager) (TCM), Arcsight Security Information Manager (SIM), Peregrine Asset Management (ITAMS), NetIQ Group Policy Administrator, and NetIQ AppManager Suite, and Altiris Patch Manager.

Description of Sub-Tasks and Deliverables The IRS requires a software solution that meets all requirements identified in the attached Business System Requirements Report (BSRR). In addition to the delivery of the requirements in the attached, the IRS requires professional services support to complete the following tasks:

Sub-Task 1 – Orientation This activity includes reviewing IRS's PWS, business and technical requirements; understanding the critical success factors; review of the IRS Enterprise Life Cycle (ELC) methodology, IT security policies and other relevant government furnished information.

Deliverable

Within two weeks of award, the Contractor shall conduct an orientation briefing for the IRS. The IRS does not desire an elaborate orientation briefing nor does it expect the Contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to ensure the Contractor and IRS are in agreement of PWS requirements and schedule.

The Orientation Briefing shall be held at the IRS facility located at 5000 Ellin Road – Lanham, MD 20706; both parties shall mutually agree upon the date and time.

The completion of this briefing shall result in the following:

The Contractor and IRS personnel who shall perform work under this PWS shall be introduced.

The IRS will show the applicable facilities to the Contractor, if Contractor shall be performing work at this site.

The IRS will provide the Contractor with Government Furnished Information and/or Property.

Any issues concerning Contractor security clearances or personnel shall be discussed.

The Contractor will demonstrate their understanding of the work to be accomplished under this PWS.

Sub-Task 2 – Project Management and Control The Contractor shall assist the SCPMaR Project Office (PO) with the following project management tasks, all of which must follow the Enterprise Life Cycle (ELC) methodology and processes:

Development and maintenance of the SCPMaR project plan/WBS

Development and maintenance of a change request process Development and maintenance of a risk management plan Conducting project kickoff meeting with key stakeholders to outline objectives, success factors, and approach Development of weekly status reports, to include:

Accomplishments Issues Risks Dependencies Next Steps (Key Milestones) Conducting weekly status meetings to discuss content of status reports Coordinating all scheduled activities and changes with the IRS PM Bringing the project to completion. Includes Final Project Closeout Report.

Deliverables

The Contractor shall provide input to project management documents required by SCPMaR tailoring plans including, but not limited to the following:

Project Management Plans

Security Certification & Accreditation Package 508 Accessibility and Mitigation Package Security Engineering Package Lessons Learned Report Business System Requirements documents System Validation & Verification Plan System Deployment Plan Transition Management Plan Design Specification Report Test Plans Computer Operator's Handbook (COH) Sub-Task 3 – Pre Implementation Planning The Contractor shall complete a detailed assessment of IRS's requirements and subsequent implementation plans. This includes but is not limited to the following:

Review the PWS with the IRS.

Confirm IRS’s expectations for the project and work with the SCPMaR PO to establish project success criteria.

Review IRS responses to pre-engagement questionnaires and requests for information in order to recommend and confirm final architecture Review Implementation methodologies with the IRS.

Become familiarized with IRS’s Enterprise Software Lifecycle process.

Discuss and respond to technical and project-related inquiries for IRS management and change control Develop a project schedule and finalize the schedule with the SCPMaR PO.

Verify the availability and readiness of IRS’s logistics (facilities, equipment, and personnel) prior to commencing the implementation of the solution’s infrastructure.

Confirm logistics for on-site visit, including location and points of contact.

Deliverables

A solution design document that includes recommended architecture and hardware/software specifications Project schedule Sub-Task 4 – Solution Implementation This task is focused on the implementation of the SCPMaR solution at IRS determined locations.

The Contractor shall:

Conduct on-site kickoff meeting with key IRS personnel.

Perform Infrastructure Assessment – The purpose of this assessment is for the vendor to become familiar with the current network topology and auditing requirements, so as to satisfy the business requirements for the implementation.

Perform Deployment Assessment – The Infrastructure Assessment will be used in conjunction with the business requirements to determine the most appropriate architecture and supporting infrastructure to use.

Perform Configuration Assessment – Review configuration options to be set during the implementation, including database configuration, infrastructure, user permission, and console options. Determine whether configuration options should be changed to enhance performance or to meet business requirements that are not currently met.

Deliverables

A system design document that describes:

Deployed infrastructure SCPMaR solution configuration, including database configuration, infrastructure, user permissions, and console options Sub-Task 4.1 – Infrastructure Implementation The purpose of this subtask is to install and configure the infrastructure at locations determined by the IRS. The Contractor shall:

Validate system architecture Define and document user community, using formal security models (i.e., Role-based Access Control with Access Capability Matrix) including:

Users (including privileged users) Roles User permissions

Server subsystems (e.g., web, database, configuration management, report server, etc.)

System interfaces (e.g., API, client program (“agent”), TCP/IP ports and protocols) (i.e., interface control documents (ICD))

Server subsystems (e.g., web, database, configuration management, report server, etc.)

System interfaces (e.g., API, client program (“agent”), TCP/IP ports and protocols) (i.e., interface control documents (ICD))

Install components in IRS’s test or pre-production environment

Test and validate system components and functionality Review results with SCPMaR PO Provide knowledge transfer to SCPMaR PO through shadowing and collaboration

Deliverables

Updated system design document, including server component test deployment summary Deployed SCPMaR system infrastructure Sub-Task 4.2 – Process Engineering The Contractor shall design automated workflow to support the following processes (as described in SCPMaR Concept of Operations) see Attachment J-4:

Security Posture Assessment

Security Posture Reporting Security Configuration and Deviation Management Risk Management

Deliverables

Security posture assessment processes and workflows (i.e., Automated and On-Demand Security Assessment processes); design and document Security posture reporting processes and workflows; design and document Security configuration and deviation management processes and workflows; design and document Risk management processes and workflows; design and document Sub-Task 4.3 – Training and Documentation 4.3.a Activity 1: Custom Training Development

The purpose of this activity is to develop custom training curriculum for IRS staff specific to the requirements for the IRS and its individual sites. In support of this task, the Contractor shall:

Review IRS training requirements. Requirements to be provided by the SCPMaR PO.

Leveraging existing materials and training classes; customize material for IRS personnel.

Review training materials with IRS key stakeholders Deliver electronic training materials to IRS personnel.

Provide training for up to twelve (12) students each at ten (10) IRS locations. Locations to be determined by SCPMaR PO.

Deliverables

Student Guide Instructor PowerPoint

4.3.b Activity 2: IRS Standard Operating Procedures (SOP) Development

This activity consists of documenting SCPMaR Standard Operating Procedures (SOP) for the operation and administration of the IRS solution. In support of this task, the Contractor shall:

Operation and Maintenance Change Control Procedures Disaster Recovery

Deliverable

IRS Standard Operating Procedures document

4.3.c Activity 3: Knowledge Transfer

This activity includes the review of key components with SCPMaR PO. The Contractor shall:

Review general architecture, including recommended maintenance

Conduct training sessions with the SCPMaR user community to include:

How to modify and update system configurations to meet/enhance operational needs How to modify, update and architect automated operational processes How to import/integrate data from sources (as stated in the Business System Requirements Report) How to troubleshoot system problems How to modify or update system controls (i.e., user roles, privileges, and system operations) How to manage and apply system updates (i.e., patches or upgrades)

Deliverables

Product documentation (e.g., administrator manual, user guide, etc.)

User trainings Sub-Task 5.0 – Integration with Existing Investments The Contractor shall design, develop, test and deploy interfaces with critical IRS systems/applications to ensure delivered solution provides Enterprise compliance, posture monitoring and reporting capability. At a minimum, the deployed solution shall be able to integrate with the following software:

ISS Internet Scanner (Proventia)

Tenable Nessus Tivoli Configuration Manager (TCM) Arcsight Security Information Manager (SIM) Peregrine Asset Management (ITAMS) NetIQ Group Policy Administrator NetIQ AppManager OPNET NetDoctor Relational Database Management Systems (RDBMS) (e.g., Oracle, MS SQL) Microsoft Active Directory CA SiteMinder SunN1 Patch Manager Altiris Patch Manager

Integrated reports which leverage data ingested from the following solutions:

ISS Internet Scanner, Tenable Nessus, SunN1 Patch Manager, Altiris Patch Manager Tivoli Configuration Manager, Arcsight SIM, ITAMS (Peregrine Asset Management System) , NetIQ Group Policy Administrator, NetIQ AppManager and OPNET NetDoctor.

Sub-Task 6.0 – Maintenance for Deployed Solutions The Contractor shall provide professional services for, but not limited to, support of the deployed solution, upgrade services, remote and/or on-site deployment engineering services, installation services, and consulting services, at the request of the IRS.

The Contractor shall provide all software release patches/bug fixes for purchased software covered and maintained under the contract at no additional charge to the IRS. The Contractor shall notify the IRS and receive approval before implementing any software releases or patches. All software releases and patches must be provided with appropriate supporting documentation in electronic or soft format. Software releases and patches to which the IRS agrees shall be installed in strict accordance with an IRS approved Contractor provided project plan on all applicable equipment items at all IRS sites. Additionally, all large software updates or releases must be tested in a non-production test environment to ensure stability before being introduced into the IRS production environment.

The Contractor shall provide to the IRS a quarterly report (due at the end of each quarter of the Government’s fiscal year) listing all new software release patches/bug fixes released during the quarter, and software release patches/bug fixes that have been installed on the applicable IRS equipment items (itemized by site, equipment item and the date of installation) during the quarter.

The Contractor shall provide a single point of contact, (project manager) for all issues relating to support of the deployed solution. Such person shall be available during Normal Business Hours (Monday - Friday 7:00am - 5:30pm EST, except holidays).

The Contractor shall provide a back up point of contact when the project manager is not available.

The Contractor shall provide a dedicated upgrade engineer(s) at the beginning of each software upgrade or modification.

If required, the Contractor shall report to the IRS’ site representative at each site upon arrival and completion of each on-site software maintenance and on-site software support service call. The IRS site representative or a designated alternate will be available upon arrival and completion of each type of maintenance call.

The Contractor shall contact the SCPMaR PO to coordinate with IRS site representatives before the start and completion of software maintenance and remote software support service call. The IRS site representative or a designated alternate will be available for the start and completion of each type of maintenance call.

The Contractor will not make any changes to the software environment without first obtaining approval of the IRS or its authorized agencies.

Deliverables Quarterly Report listing all new software release patches/bug fixes released during the quarter Sub-Task 6.1 – Software Maintenance Response Time Response time is the period between the time the Contractor receives notification from the IRS, and the time a service technician arrives at the site requiring repair or the Contractor begins repair remotely. The Contractor shall identify the method of response for each notification.

IRS does not require a separate Contractor service desk for Level 1 support. Rather, in the proposed concept of operation, the Contractor is expected to act as the level 2 and 3 escalation points. Level 1 function will be performed by the existing IRS personnel.

Sub-Task 6.2 – Repair Time The Contractor shall inform the IRS immediately upon diagnosis of any SW failure. The Contractor shall complete repairs of all software failures (major or minor) within a time frame that will guarantee maintenance of the SCPMaR solution at ninety (90%) uptime required by this contract.

Sub-Task 6.3 – Software Downtime Software downtime is that period of time when the software is entirely inoperable, or degraded (partially inoperable) to the point that it cannot be used, due to a malfunction in the Contractor maintained software. If a malfunction or failure of a software application causes other devices or software programs to be inoperable, these other programs/devices will also be considered down. This provision does not apply to software, which becomes inoperable due to the fault or negligence of the IRS.

Sub-Task 6.4 – Period of Downtime Downtime for each incident shall start at the first bona fide attempt by the IRS to notify the Contractor that software maintenance is required and continues until the software is returned to the IRS in proper operating condition. Each incident of downtime shall be rounded to the nearest whole tenth of an hour.

In the event that the IRS defers the Contractor’s arrival or denies the Contractor access to the inoperable software after the Contractor’s arrival, the deferred and/or denied time will be deducted when calculating the downtime.

Sub-Task 6.5 – Escalation Procedures The Contractor shall escalate software malfunction problems to ensure a timely repair. Escalation procedures shall facilitate the availability of the technical support required to diagnose and repair failing software. The IRS will not attempt to specifically define the escalation procedures the Contractor uses to satisfy this requirement; however, the IRS will protect its interests by providing the minimum escalation procedures described below. The Contractor shall propose escalation procedures that, at a minimum, escalate software malfunction problems in accordance with the following time frames and support levels:

If the first level maintenance personnel cannot achieve maintenance repair within two hours of arrival at the site, the Contractor shall provide higher-level maintenance support. The Contractor’s first level maintenance personnel shall request higher level support from the Contractor as soon as it is determined that the two hour repair time will not be met, and shall advise the IRS representative of the situation. Higher-level support personnel shall respond to the site within two hours of notification.

If the second level maintenance personnel cannot achieve maintenance repair within two hours of arrival at the site, the Contractor shall escalate to their next level. Response at the next level must occur within two hours of notification.

If the escalation process is executed, it should not result in any additional cost to the IRS and shall not constitute a waiver of any other remedies.

Sub-Task 6.6 – Security Requirements The Contractor must comply with the following:

New system installations must be compliant with IRS requirements, including NIST, OMB and IRM policies.

All services provided by the Contractor must meet NIST, OMB and IRM standards The Contractor shall support continuing monitoring and testing efforts (both quarterly and annually) specified in the NIST, OMB and IRM standards The Contractor shall support Certification & Accreditation activities including development and documentation updates to the Security, Testing & Evaluation process.

Sub-Task 7 - Travel All travel shall be in accordance with the Federal Travel Regulations (for travel in 48 contiguous states), the Joint Travel Regulations, DoD Civilian Personnel, and Volume 2, Appendix A (for travel to Alaska, Hawaii, Puerto Rico, and U.S. territories and possessions).

Sub-Task 8 - Reports All reports prepared by the Contractor under this PWS will be delivered to the COTR electronically and in Microsoft Office 2003 format.

Government Furnished Property Government Furnished Material and Information may be provided in conjunction with required performance under this PWS. Disposition at the end of the task shall be in accordance with FAR clause 52.245.5.

Upon commencement of the PWS, unless otherwise indicated, the Government will provide the following property to the Contractor:

Enterprise Service Delivery Processes (e.g. Change Management, Risk Management, etc.)

IT Security IRMs Training Requirements Employee User Portal Standards and Guidelines 508 Standards

Access to Government Property and Facilities The Contractors will be provided with "staff like access" at NCFB and the SCPMaR host site (to be determined) upon successful completion of the minimal background investigation process. The Contractor will be allowed limited access to all other Government's facilities. When visiting a Government facility (outside of NCFB), the Contractor will be escorted at all times. The Contractor may be subjected to search by Security personnel when visiting a Government facility unless it has documented (1) that it has performed due diligence in seeking accessible alternative COTS or ASP Software, offering equivalent features and functionality to the inaccessible COTS or ASP Software, for which The Contractor is or can readily become a licensed distributor; and (2) the cost of developing substitute accessible software under this Agreement. (Such documentation need not include reference to any specific competing COTS or ASP Software and its level of accessibility). COTS or ASP Software delivered under this Agreement that does not meet the Section 508 Standards shall be acceptable only if the software vendor provides a roadmap for meeting such standards.

Any maintenance agreement entered by the Contractor and the IRS in connection with the system delivered under this Agreement shall require the Contractor to cooperate with the IRS in its efforts to resolve interoperability problems that arise during the term of the maintenance agreement related to the use of such system with specific Assistive Technology in a specific IT environment.

Security Performance at Government Sites Should any effort required by this task be performed at specified Government facilities, the Contractor shall abide by Department of Treasury Directive P 71‑10 regarding provisions for authorized entrance and exit at these facilities.

FISMA / IT SECURITY

Information Security / Federal Information Security Management Act (FISMA) Pursuant to the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002, P.L. 107-347, the contractor shall provide minimum security controls required to protect Federal information and information systems. The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data.

An IRS information or information system are defined as a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

Treasury / IRS Policies for Information Technology (IT) Security The contractor shall comply with Department of Treasury Security Manual TDP 15-71, and Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance. The contractor shall comply with IRS Internal Revenue Manuals (IRM) and Law Enforcement Manuals (LEM) when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

IRM 10.8.1 require IRS' sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearances required; receive security awareness and training required for contractor activities or facilities; and any facility physical security requirements. Most IRS information is categorized as SBU. This includes:

a.) taxpayer information, b.) employee data - such as evaluations, c.) personnel and payroll records, d.) financial and statistical information on agency operations not normally available for public disclosure, and e.) proprietary information provided to the government by third parties.

Oversight of Contractor Systems Based on the Scope of Work (PWS) for this contract, the contractor system is considered a major IT services / system; and subject to an annual FISMA Contractor Review / site visit. All contractors that manage, operate or program an IRS Information or Information system are subject to IRS oversight to conduct a FISMA Contractor site review of the contractor’s IT operation and physical environment / facilities. At the discretion of IRS MITS Cybersecurity and the owning Business Unit, a FISMA Contractor review shall be determined based on a risk-based decision and whether it is cost effective to conduct such a review.

Certification and Accreditation Process Contractors systems that collect, maintain, operate or use agency information or an information system on behalf of the agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews, risk assessments, security plans, control testing, a Privacy Impact Assessment (PIA), contingency planning, and certification and accreditation, at a minimum meet NIST guidance, if required by the IRS.

Contractor System Review / Site Visit The contractor shall be subject to at the option / discretion of the agency, to periodically test, (but no less than annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

Information Security Awareness and Training The contractor shall comply with IRS mandatory annual Computer Security Awareness briefings, UNAX briefings and receive an initial orientation before access to IRS Information Systems. Perform HSPD-12 Personal Identify Verification, physical and personnel security screening / background investigation for approval of a contractor badge for staff like access; then obtain 5081 approval to IRS information systems.

All contractors and contractor employees who are involved with the management, use, programming or maintenance of IRS information systems must complete the IRS mandatory Computer Security briefing. All contractors and contractor employees who could have access to return information must complete the mandatory UNAX briefing. Contractors shall certify the completion of training by their employees annually. The certification shall be submitted to the contracting officer, with a copy to the COTR and IRS Cybersecurity Awareness and Training Team.

(i) Contractors shall verify completion of the briefing by their employees within 30 days of award. For contractor employees who are assigned to a contract or task/delivery order during the period of performance, verification will be submitted within 30 days of their start work date.

(ii) Annually thereafter, contractor employees shall complete the briefing during the 2nd Quarter of the fiscal year, and contractors shall verify such completion by no later than March 31, in accordance IRS Procurement Policy and Procedures Memo 39-1c.

(iii) The verification requirement must be included as a deliverable in the contract, task/delivery order or interagency agreement with specified due dates. Failure to comply with this requirement may result in remedies up to and including termination for default.

(iv) Currently, the contractor provides a list of names to the COTR after award to initiate the background investigation process for contractor employees who require staff-like access. The COTR will use this list to identify contractor employees who require IT security training.

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources The contractor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The contractor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information.

Safeguarding / Protecting Sensitive Personally Identifiable Information (PII) Sensitive PII is defined by OMB as “any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” Information systems can be either electronic or manual.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Management Act (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information, such as the following guidance from OMB Policy M-06-16:

1. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing;

2. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining agency access;

3. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and

4. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

OMB Policy M-07-18 Ensuring New Acquisitions Include Common Security Configurations The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC). This includes Internet Explorer 7 configured to operate on Windows http://csrc.nist.gov/itsec/guidance_WinXP.html Windows XP and Vista (in Protected Mode on Vista). For the Windows XP settings, see: html, and for the Windows Vista settings, see: http://csrc.nist.gov/itsec/guidance_vista.html.

In accordance with OMB issued policy memorandum M-07-11, “Implementation of Commonly Accepted Security Configurations for Windows Operating Systems: “operating systems [Windows XP and VISTA] and/or plans to upgrade to these operating systems must adopt these standard security configurations by February 1, 2008.”

The National Institute of Standards and Technology (NIST) Guidance for Information Security The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum security controls identified in NIST Special Publication 800-53 Recommended Security Controls for Federal Information / NIST 800-53A and Revision 1, and FIPS 200 Minimum Security Requirements for Federal Information and Information Systems. The contractor shall follow the best practices and guidance established by NIST special publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

Handling Information Security Incidents The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

The contractor shall maintain procedures for detecting, reporting, and responding to security incidents, and mitigating risks associated with such incidents before substantial damage is done to federal information or information systems. The contractor shall immediately report all computer security incidents that involve IRS information systems to the IRS Computer Security Incident Response Center (CSIRC). Any theft or loss of IT equipment with federal information / data must be reported within one hour of the incident to CSIRC. Those incidents involving the loss or theft of sensitive but unclassified (SBU) data (i.e. taxpayer, PII) shall be reported to CSIRC, first-line manager, and Treasury Inspector General for Tax Administration (TIGTA). Based on the computer security incident type, CSIRC may further notify the Treasury Computer Security Incident Response Capability (TCSIRC) in accordance with TCSIRC procedures.

REPORT INCIDENTS TO IRS CSIRC:

Web Site http://www.csirc.web.irs.gov/incident/ Email csirc@csirc.irs.gov Phone (202) 283-4809 Toll-Free (866) 216-4809, Fax (202) 283-0345

Identification Badges

The applicable Contractor employee shall not begin working under this contract until all security forms have been properly completed and submitted. All Contractor employees shall be required to wear identification badges when working in Government facilities.

Personnel Removal and Replacement

The applicable Contractor employees are subject to investigation by the Government. Applicable Contractor employees who undergo Contractor Clearances which reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay Federal income tax. The Government reserves the right to determine if a Contractor employee assigned to a task shall continue with the task. The Contractor shall agree to remove the person assigned within one day of official notification by the Government and provide a replacement within five days. New hires or substitutions of personnel are subject to the Contractor Clearance requirement.

Deliverables

All Deliverables of the Contractor shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government.

Disclosure of Information

Access to taxpayer account information, if any, will be subject to IRS’ unauthorized access provisions (UNAX). The Contractor is not being permitted to access any taxpayer account information without prior approval from the COTR. The Contractor shall keep taxpayer account information confidential and will not disclose such information to anyone except IRS personnel who have been identified by the COTR as having a need to know.

Exception to Rights in Data Clause

Blanket permission is not authorized under this PWS for the Contractor to establish claims to copyright for any software first produced in performance of this task. Prior written approval is required from the Contracting Officer to establish claims to copyright for any software first produced in performance of this task. TIRNO-09-R-00017 Page E -

Section E

Inspection and Acceptance

E.1 52.252-2 CLAUSES INCORPORATED BY REFERENCES (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the following address:

www.acqnet.gov/far/

E.2 FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSES INCORPORATED BY REFERENCE

52.246-6 INSPECTION TIME-AND-MATERIAL AND LABOR HOUR MAY 2001

52.246-16 RESPONSIBILITY FOR SUPPLIES APR 1984

E.3 INSPECTION, ACCEPTANCE, AND RECEIVING CERTIFICATION -

DTAR 1046.672

A statement substantially as follows shall be placed, by the Contractor on each commercial shipping document, packing list for supplies or services, or Contractor's invoice:

INSPECTION, ACCEPTANCE AND RECEIVING CERTIFICATION

DATE:

CONTRACT NUMBER:

DELIVERY ORDER AND MODIFICATION NUMBER:

DATE ITEMS RECEIVED:

LOCATION WHERE ITEMS WERE DELIVERED:

ITEMS:

The listed items have…