Section J - Section L.5 Attachment Program Management Integration Services Task Order Performance Work Statement.rtf

IRS Web Portal Acquisition Request for Proposals 4 January 12, 2010 file_0.emf file_1.wmf

Internal Revenue Service

ATTACHMENT L.5

IRS Web Portal Acquisition Request for Proposals

Program Management and Integration Services

Version 6.0

January 12, 2010

ATTACHMENT L.5 ■ Program Management and Integration Services ■ Version 6.0 Table of Contents HYPERLINK \l "_Toc251066478"

Change History Revision # Date Change Description/Purpose

Introduction The Contractor is requested to provide Program Management and Integration Services for managing Contractor and subcontractor efforts for all program startup, build-out, transition, and ongoing day-to-day operations tasks throughout the contract period of performance. These Program Management and Integration Services include facilitation of effective governance, program management, cross-project integration, performance monitoring, financial management, security and privacy, 508 and the overarching IRS Program Level Requirements implementation, and project management.

Period of Performance The period of performance for this Task Order PWS is for one base year, and two option years for a total of three years. The IRS intends to award four Task Order PWSs at the same time as the contract award. These Task Order PWSs represent the first tasks under the contract. This Task Order PWS is subject to an award fee in accordance with Section G.5.

Scope This Task Order shall deliver Program Management and Integration Services, as described below, across the four IRS.gov Task Order PWSs: 1) Website Help Desk, 2) Web Operations, 3) Web Application Services, and 4) Program Management and Integration Services. Services delivered in this area must be scalable and extensible to the scope and capabilities outlined in the Statement of Objectives. Together the four Task Order PWSs comprise the following services:

file_2.emf file_3.wmf

Figure 1 - Scope of Task Order PWSs The scope of this Program Management and Integration Services Task Order PWS includes four Phases. The Contractor shall ensure their performance work statements and services provided are in alignment with the Overarching IRS Program Level requirements as outlined in Appendix A to this Task Order PWS.

Security and privacy and Section 508 requirements apply throughout the life cycle of all projects and ongoing services provided under this RFP. The Section 508 Requirements are described in Appendix B to this Task Order PWS. The security and privacy, and the Program Management and Integration requirements are described in the following four phases:

Program Startup Phase: The startup, definition, documentation and approval of the Program Management and Integration Services frameworks including program management, project management, software development lifecycle, operations management and other related elements, necessary to manage the overall program, associated discrete projects, and ongoing day-to-day operational services.

Program Build-Out Phase: The provision of Program Management and Integration Services to build-out all in-scope services across all four IRS.gov Task Order PWSs: 1) Website Help Desk, 2) Web Operations, 3) Web Application Services, and 4) Program Management and Integration Services. This includes all of the activities that will be required to establish the Security and Privacy controls for the environment, and applicable 508 requirements work products.

Program Transition Phase: The provision of Program Management and Integration Services to transition all in-scope services from their respective current states to their respective target environments. This includes all of the Security and Privacy activities and 508 work products required to transition to the newly built solution.

Program Ongoing Operations Phase: The ongoing provision of Program Management and Integration Services necessary to support the successful delivery of all day-to-day operational program elements within specified scope, quality, time, and cost objectives. This provides for the ongoing Security and Privacy and 508 activities required to operate and maintain the new solution.

Task Order PWS for Program Management and Integration Services Program Management and Integration Services for the Program Startup Phase The Contractor shall provide the following Program Management and Integration Services during the Program Startup Phase:

Define and Document the Program Management, Project Management, Software Development Lifecycle, and Operational Management Structure The Contractor shall document a Program Management Plan that clearly delineates their program and project management approach including, at a minimum, the Project Management Institute’s (PMI’s) The Standard for Program Management, Second Edition (ISBN 9781933890524), shown in D, Table 1, Program Management Framework.

Deliverables The Contractor will propose the delivery period/date, and the contents for each of the work products required during the Program Startup Phase. These work products include the following:

No.

Service Area Deliverable Period Content D.4.0.1 Program Management and Integration Program Management Framework Contractor Proposed Contractor Proposed. See Appendix D, Table 1 for guidance.

D.4.0.2 Program Management and Integration Program Management Plan Contractor Proposed Contractor Proposed. See Appendix D, Table 1 for guidance D.4.0.3 Program Management and Integration Project Management Framework Contractor Proposed Contractor Proposed. See Appendix D, Table 2 for guidance.

D.4.0.4 Program Management and Integration Software Development Lifecycle Methodology Contractor Proposed Contractor Proposed.

D.4.0.5 Program Management and Integration Operations Management Framework Contractor Proposed Contractor Proposed. See Appendix D, Table 3 for guidance.

D.4.0.6 Program Management and Integration Service Strategy Process Contractor Proposed Contractor Proposed.

D.4.0.7 Program Management and Integration Innovation Plan Contractor Proposed Contractor Proposed.

D.4.0.8 Program Management and Integration Program Performance Management Plans Contractor Proposed Contractor Proposed.

D.4.0.9 Program Management and Integration Program Benchmarking Framework and Process Contractor Proposed Contractor Proposed.

D.4.0.10 Program Management and Integration EVMS Approach Contractor Proposed Contractor Proposed.

D.4.0.11 Program Management and Integration Integrated Baseline Review Report Contractor Proposed Contractor Proposed.

D.4.0.12 Program Management and Integration Management Plan governing the Resource Pool for New Project Services Contractor Proposed Contractor Proposed.

D.4.0.13 Program Management and Integration Program Risk Assessment Contractor Proposed First release of program and project risk plans as delineated in the proposed Program Management, Project Management, and Operations Management Frameworks.

D.4.0.14 Program Management and Integration Program Communication Plan Contractor Proposed First release of program and project communication plans as delineated in the proposed Program Management Project Management, and Operations Management Frameworks.

D.4.0.15 Program Management and Integration Program Change Management Plan Contractor Proposed First release of program and project change management plans as delineated in the proposed Program Management Project Management, and Operations Management Frameworks.

Exit Criteria The Contractor shall meet the following exit criteria to complete the startup phase:

No.

Service Category Exit Criteria E.4.0.1 Program Management and Integration All Startup Phase project deliverables have been reviewed and approved by the IRS.

E.4.0.2 Program Management and Integration The Startup Phase is completed within scope, quality, time, cost, and other defined goals and objectives.

E.4.0.3 Program Management and Integration The Integrated Baseline Review is jointly conducted by the Contractor and the IRS resulting in schedule, technical approach, and expenditure plan baselines being established.

E.4.0.4 Program Management and Integration The Start-up Phase close project process is complete.

E.4.0.5 Program Management and Integration IRS has certified that the Contractor has a core ANSI-compliant EVMS as required by Office of Management and Budget (OMB) Circular A-11, Planning, Budgeting, Acquisition, and Management of Capital Assets and the Federal Acquisition Regulation (FAR). This validation consists of a system capability analysis to verify that the EVMS complies with the standard and that verifies that the EVMS is in place to assure conformance with contractual terms and conditions.

Program Management and Integration Services for the Program Build-Out Phase The Contractor shall provide Program Management and Integration Services including security and privacy and 508 requirements to build-out all in-scope services across the four IRS.gov Task Order PWSs: 1) Website Help Desk, 2) Web Operations, 3) Web Application Services, and 4) Program Management and Integration Services. The Contractor shall provide Program Management and Integration Services consistent with the frameworks and deliverables approved during the Program Startup Phase.

Security and Privacy Requirements for Build-Out Phases Standards & Guidelines The Contractor shall deliver integrated security functionality compliant with the National Institute of Standards and Technology (NIST) Security Guidelines and Federal Information Processing Standards (FIPS). http://csrc.nist.gov/ The Contractor shall ensure that the management, operations and technical baseline security controls are implemented in accordance with FIPS 199, Standards for Security Categorization of Federal Information Systems, and other current NIST guidance on selecting the appropriate security controls for a Moderate Risk system. This classification may be upgraded to a High Risk system as additional applications are added to IRS.gov in the future.

The Contractor shall ensure that all operations are in compliance with Treasury Security Program TD85-01.

The Contractor shall ensure that all Applications or systems are authorized by the appropriate IRS Designated Authorizing Authority (DAA) or Authorizing Official (AO) and granted an Authority to Operate (ATO) before being placed into production or using production data.

The Contractor shall implement Federally-compliant security measures to prevent remote intrusion, virus infections and service denial schemes to information systems, infrastructure support systems, and telecommunication services supporting the IRS Internet Website.

The Contractor shall be knowledgeable of NIST and FIPS guidance.

The Contractor shall complete the Certification and Accreditation (C&A) process, including risk assessment and Security Testing and Evaluation (ST&E). http://csrc.nist.gov/publications/drafts/800-37-Rev1/SP800-37-rev1-IPD.pdf Security Documentation http://csrc.nist.gov/ The Contractor shall ensure that security and privacy are addressed in portal requirements and design documents.

The Contractor shall document the security controls in the System Security Plan including the justification for any refinements or adjustments to the initial set of controls in accordance with NIST SP 800-18 or current version.

The Contractor shall document and maintain the Information Technology Contingency Plan (ITCP) in accordance with NIST SP 800-34 or current version.

The Contractor shall document and maintain the Incident Response Plan in accordance with NIST SP 800-61 and NIST 800-86 or their current version.

The Contractor shall prepare a Change and Configuration management plan in accordance with all applicable regulatory policy and guidance.

The Contractor shall develop Security Configuration Guidelines for all products not explicitly provided or defined by the IRS.

The Contractor shall create a developer guidance package to be shared with third party developers that documents the security requirements, architecture, security models and design patterns.

The Contractor shall assist the IRS in performing Security Risk Assessment (SRA) that identifies risks related to the design and functionality of the system against compliance with the IRS risk management process, NIST Special Publication (SP) 800-39, NIST (SP) 800-53, and FIPS 200.

The Contractor shall prepare, document, and maintain a Plan of Action and Milestones (POA&M) describing actions taken or planned by the Contractor and any Subcontractors to correct deficiencies in the security controls and to address remaining vulnerabilities in the information system.

The Contractor shall develop rules that describe roles, responsibilities and expected behaviors with regard to information system usage and communicate to all information system users The Contractor shall create the following security documentation:

System Security Plan (SSP)

ITCP

Boundary Scope Memo Privacy Impact Assessment (PIA) Incident Response Plan Configuration management plan Security Configuration Guidelines Continuous Monitoring Plan Incident Response Plan and Incident Response Training Plan Developer guidance package Roles and Responsibilities, and Expected Behavior Rules.

Testing The Contractor shall collaborate with the IRS to perform pre-ST&E activities, coordinate the ST&E and develop the ST&E Plan and ST&E test cases.

The Contractor shall cooperate and assist the independent ST&E Team in executing the ST&E Plan in providing access to facilities and personnel, documentation, reports and requested documents Custom Developed Software Security The Contractor shall coordinate with Business Owner to conduct a Privacy Impact Assessment for new applications and significant changes to existing, prior to the commencement of development in accordance with the IRS Privacy Policy.

The Contractor shall ensure that all custom developed software, components, utilities and tools are documented in the system inventory, the appropriate application security controls are documented in the SSP in accordance with NIST SP 800-37 and are approved to operate prior to production deployment.

All custom-developed software source code shall be inspected during development and tested in a production-like environment using commercial vulnerability assessment tools. All vulnerabilities and negative findings shall be remediated by the Contractor or Subcontractor prior to production deployment unless a deviation is explicitly approved in writing by the IRS Designated Approving Authority (DAA).

The Contractor shall provide the requirements traceability matrix at the end of analysis phase, design phase, build phase, deployment phase that designates the security requirements in a separate section so that they can be traced through the development life cycle. The Contractor and any Subcontractors will also provide the application designs and test plan documentation, and source code to IRS for review.

The Contractor shall follow the NIST SP 800-53, Recommended Security Controls for Federal Information Systems and IRS guidance to ensure that the Software will be or has been developed using secure coding practices in a manner that minimizes security flaws within the Software.

Information Security Awareness and Training The Contractor shall certify the completion of security awareness training by Contractor employees annually. The certification shall be submitted to the IRS Contracting Officer, with a copy to the Contracting Officer's Technical Representative (COTR) and Cybersecurity.

Handling Information Security Incidents The Contractor shall secure and protect from remote intrusion(s), virus infections and denial of service schemes.

The Contractor shall capture and retain audit and event logs that would support the investigation and analysis of security incidents.

The Contractor shall ensure that mechanisms and reporting processes are in place for the timely reporting of all security incidents to Computer Security Incident Response Center (CSIRC) in accordance with NIST SP 800-61 and Department of Treasury guidance.

Safeguarding/Protecting Sensitive but Unclassified Information (SBU) Sensitive but Unclassified (SBU) information shall be identified and protected during data entry, transmission, storage and deletion.

Transmittals of SBU information between IRS and Contractor shall be encrypted in transit in accordance with IRS policies.

Security Configuration and Change Management The Contractor shall establish Security Configuration Management processes and procedures that are consistent with industry and government best practices such as NIST SP 800-14 Generally Accepted Principles and Practices for Securing Information Technology Systems.

The Contractor shall develop an IRS approved Security Configuration and Change Management Plan for the implementation and approval of all (emergency and normal) changes to the infrastructure and to the security configuration baselines.

The Contractor shall validate their proposed solution to the Federal Desktop Core Configuration (FDCC) using the Security Content Automation Protocol (SCAP) validated software, as specified in OMB 08-22, Guidance on the Federal Desktop Core Configuration (FDCC), August 11, 2008. (i.e., Desktops used in administration of portal systems and applications).

The Contractor shall design and implement an SCMDB (Security Configuration Management Database) or equivalent repository for tracking and access by authorized staff of critical changes to security configuration baselines.

Security Audit The Contractor shall establish security audit process and procedures that are consistent with industry and government best practices such as NIST SP 800-12 Introduction to computer security.

The Contractor shall develop an IRS approved Security Audit Plan for all required portal system components and applications which handle any SBU or PII. (i.e., operating systems, internal application processes, middleware, file or database data accessed).

The Contractor shall design and implement security audit services for the hosted infrastructure to properly capture the administrative/user related activities of the site and associated applications including but not limited to:

Capture and retention of host systems/application audit and security event logs that would support the investigation and forensic analysis of security incidents. Such as security administrative events (user management and policy), audit log access events (creation or manipulation of audit logs themselves), and security mediated events (identification and authentication, data access, etc).

Capture and retention of critical infrastructure systems to facilitate root cause analysis and reconstruction of security events.

The Contractor shall design and implement audit services for the hosted infrastructure and the retention of audit and event logs that support the investigation and analysis of security incidents according to IRS approved guidelines.

Security Patch Management The Contractor shall establish Security Patch Management process and procedures that are consistent with industry and government best practices such as NIST SP 800-40 v.2 Creating a Patch and Vulnerability Management Program.

The Contractor shall develop an IRS approved Security Patch Management Plan for all required portal system components and applications including procedures for notification, receipt and acknowledgements with IRS CSIRC of patch advisories and updates affecting security within a pre-negotiated period as identified in the patch management plan throughout the software lifecycle.

The Contractor shall design and implement an automated Patch Management System which addresses impending threats to the Web portal and related critical infrastructure.

Security Incident Monitoring, Handling and Response The Contractor shall establish security incident response/reporting process and procedures that are consistent with industry and government best practices such as NIST SP 800-61 Computer Security Incident Handling Guide, NIST SP 800-40 v.2 Creating a Patch and Vulnerability Management Program and other IRS and Department of Treasury guidance.

The Contractor shall secure and protect from remote intrusion(s), virus infections and denial of service schemes The Contractor shall ensure that mechanisms and reporting processes are in place for the timely reporting of all security incidents to IRS CSIRC in accordance with NIST SP 800-61 and Department of Treasury guidance.

The Contractor shall develop an IRS approved incident monitoring and response plan for the hosted infrastructure to properly assess the security posture of the sites and associated applications including but not limited to:

Continuous monitoring of security control status

24x7 event monitoring User and System Administrator activity monitoring The Contractor shall design and implement a Vulnerability Management System to detect, prevent, and address security threats to the IRS public user portal environment which exchanges security status and interoperates effectively with internal IRS CSIRC capabilities. This includes, but is not limited to:

Firewall Management

Network Intrusion Detection – Monitoring for, detecting, and responding to attempted electronic threats, attacks, and intrusions at all network entry points and hosting sites Host Intrusion Detection – Monitoring for, detecting and responding to attempted electronic threats, attacks, and intrusions of computer host systems Denial of Service attack prevention Antivirus Detection and Virus Incident Response Services Application-level protection or monitoring and auditing Compromise of Identity and Access Controls Recurring security assessment of infrastructure systems and applications Testing of Incident Response and Detection capabilities.

Disaster Recovery Planning The Contractor shall develop and test an IRS approved disaster recovery plan at the FIPS 199 moderate or high level, with specific process, procedures, and personnel required to reconstitute all critical security services and management support for the continued protection of system information and resources. This includes all portal components and controls which comprise the security and privacy, boundary, and is not limited to:

Firewalls and Specialty Gateways (XML, etc)

Network Intrusion Detection Systems - Monitoring for, detecting, and responding to attempted electronic threats, attacks, and intrusions at all network entry points and hosting sites Host Intrusion Detection Systems Identity and Access Control Mechanisms.

Monitoring Services The Contractor will propose their monitoring strategy which will include comprehensive details of monitoring capabilities.

Section 508 Requirement for Build-Out Phases The Contractor will develop a test plan that outlines the anticipated products and/or services to be tested for compliance with Section 508 and how the test will be conducted. (Please refer to Appendix C for a sample 508 Test Plan Template.)

Deliverables The Contractor will propose the delivery period/date, and the contents for each of the work products required during the Build-Out Phase. These work products include the following:

No.

Service Area Deliverable Period Content D.4.1.1 Program Management and Integration Build-Out Phase Project Charter Contractor Proposed Contractor Proposed D.4.1.2 Program Management and Integration Build-Out Phase Project Management Plan Contractor Proposed Contractor Proposed D.4.1.3 Program Management and Integration Build-Out Phase Project WBS Contractor Proposed Contractor Proposed D.4.1.4 Program Management and Integration Build-Out Phase Project Budget Contractor Proposed Contractor Proposed D.4.1.5 Program Management and Integration Build-Out Phase Close Project Review Contractor Proposed Contractor Proposed D.4.1.6 Program Management & Integration Security & Privacy

POA&M

Contractor Proposed Plan of action and milestones (POA&M) to correct deficiencies identified in the Security Assessment Report (SAR), and other security assessments.

D.4.1.7 Program Management & Integration Security & Privacy POA&M Updates Contractor Proposed POA&Ms documentation delivery to the PPMO for inclusion in TAF within 60 days of identification.

D.4.1.8 Program Management & Integration Security & Privacy Incident Response Training Plan Contractor Proposed Incident Response Training Plan.

D.4.1.9 Program Management & Integration Security & Privacy Security Configuration and Change Management Plan Contractor Proposed Security Configuration and Change Management Plan D.4.1.10 Program Management & Integration Security & Privacy Security Audit Plan for portal systems and applications Contractor Proposed Security Audit Plan for portal systems and applications D.4.1.11 Program Management & Integration Security & Privacy Security Patch Management Plan Contractor Proposed Security Patch Management Plan D.4.1.12 Program Management & Integration Security & Privacy Incident Handling, Monitoring and Response Plan Contractor Proposed Incident Handling, Monitoring and Response Plan D.4.1.13 Program Management & Integration Security & Privacy Disaster Recovery Plan Contractor Proposed Disaster Recovery Plan D.4.1.14 Program Management & Integration Security & Privacy

ITCP

Contractor Proposed IT Contingency Plan D.4.1.15 Section 508 Section 508 Compliance Test Plan Contractor Proposed A test plan that outlines the anticipated products and/or services to be tested for compliance with Section 508 and how the test will be conducted. (Please refer to Appendix C for a sample 508 Test Plan Template.)

Exit Criteria The Contractor shall meet the following exit criteria to complete the Build-Out phase:

No.

Service Category Exit Criteria E.4.1.1 Program Management and Integration All Build-Out Phase project deliverables have been reviewed and approved by the IRS.

E.4.1.2 Program Management and Integration The Build-Out Phase is completed within scope, quality, time, cost, and other defined goals and objectives.

E.4.1.3 Program Management and Integration The Program Build-Out Phase close project review is complete and approved by the IRS.

E.4.1.4 Program Management & Integration Security & Privacy Receive an ATO from the Certification Program Office.

E.4.1.5 Program Management & Integration Security & Privacy Develop plans of actions and milestones POA&M for findings identified in the Security Assessment Report.

E.4.1.6 Program Management & Integration Security & Privacy Working drafts of the following:

Security Configuration and Change Management Plan

Security Audit Plan for portal systems and applications Security Patch Management Plan Incident Monitoring, Handling and Response Plan Disaster Recovery Plan

Program Management and Integration Services for the Program Transition Phase The Contractor shall provide Program Management and Integration Services to manage the transition of all in-scope Call Center, Web Operations, and Web Application services from their respective current states to their respective target environments. The Contractor shall provide Program Management and Integration Services consistent with the frameworks and deliverables approved during the Program Startup Phase.

Security and Privacy Requirements for Transition Phases The Contractor shall ensure all required security deliverables are effectively launched in the production environment.

The Contractor shall document the transition process to provide traceability for each requirement in the production environment.

The Contractor shall provide a transition plan prior to transitioning security and privacy requirements.

The Contractor shall provide regular documentation of transition status up to and including completed transition.

The Contractor shall engage IRS in all instances of transition situations requiring exceptions or non-compliance with stated requirements to receive guidance on appropriate steps for resolving the situation.

Security Configuration and Change Management The Contractor shall ensure security configuration management process and procedures are consistent with industry and government best practices such as NIST SP 800-14 Generally Accepted Principles and Practices for Securing Information Technology Systems.

The Contractor shall ensure all standard installation, operation, maintenance, update, and/or patching of systems and software shall not alter the configuration settings from the approved IRS security configuration baselines.

The Contractor shall manage and maintain the IRS approved Security Configuration and Change Management Plan for the implementation and approval of all (emergency and normal) changes to the infrastructure and to the security configuration baselines.

The Contractor shall manage and maintain SCMDB (Security Configuration Management Database) or equivalent repository for tracking and access by authorized staff of critical changes to security configuration baselines.

The Contractor shall complete all security and change management items on the Transition Phase “go-live” checklist and receive IRS approval to transition into production status.

Security Audit The Contractor shall ensure security audit process and procedures are consistent with industry and government best practices such as NIST SP 800-12 Introduction to computer security.

The Contractor shall manage and maintain the IRS approved Security Audit Plan for all required portal system components and applications which handle any SBU or PII. (i.e., operating systems, internal application processes, middleware, file or database data accessed).

The Contractor shall manage and maintain security audit services for the hosted infrastructure to properly capture the administrative/user related activities of the site and associated applications including but not limited to:

Capture and retention of host systems/application audit and security event logs that would support the investigation and forensic analysis of security incidents. Such as security administrative events (user management and policy), audit log access events (creation or manipulation of audit logs themselves), and security mediated events (identification and authentication, data access, etc).

Capture and retention of critical infrastructure systems to facilitate root cause analysis and reconstruction of security events.

The Contractor shall manage and maintain audit services for the hosted infrastructure and the retention of audit and event logs that support the investigation and analysis of security incidents according to IRS approved guidelines.

The Contractor shall complete all security audit items on the Transition Phase “go-live” checklist and receive IRS approval to transition into production status.

Security Patch Management The Contractor shall ensure security patch management process and procedures are consistent with industry and government best practices such as NIST SP 800-40 v.2 Creating a Patch and Vulnerability Management Program.

The Contractor shall manage, maintain, and follow the IRS approved Security Patch Management Plan.

The Contractor shall manage and maintain the automated Patch Management System.

The Contractor shall complete all security patch management items on the Transition Phase “go-live” checklist and receive IRS approval to transition into production status.

Security Incident Monitoring, Handling, and Response The Contractor shall ensure security incident response/reporting process and procedures are consistent with industry and government best practices such as NIST SP 800-61 Computer Security Incident Handling Guide, NIST SP 800-40 v.2 Creating a Patch and Vulnerability Management Program and other IRS and Department of Treasury guidance.

The Contractor shall manage and maintain the IRS approved Incident Monitoring, Handling and Response Plan.

The Contractor shall ensure that mechanisms and reporting processes are in place for the timely reporting of all security incidents to CSIRC in accordance with NIST SP 800-61 and Department of Treasury guidance.

The Contractor shall capture and retain audit and event logs that would support the investigation and analysis of security incidents.

The Contractor shall manage and maintain monitoring services for the hosted infrastructure to properly assess the security posture of the site and associated applications including but not limited to:

Continuous monitoring of security control status

24x7 event monitoring User and System Administrator activity monitoring The Contractor shall secure and protect from remote intrusion(s), virus infections and denial of service schemes.

The Contractor shall manage and maintain the Vulnerability Management System to detect, prevent, and address security threats to the IRS public user portal environment which interoperates effectively with internal IRS CSIRC capabilities.

The Contractor shall complete all security incident monitoring, handling, and response items on the Transition Phase “go-live” checklist and receive IRS approval to transition into production status.

Disaster Recovery Planning The Contractor shall manage, maintain and test the IRS approved disaster recovery plan with specific process, procedures, and personnel required to reconstitute all critical security services and management support for the continued protection of system information and resources.

The Contractor shall complete all disaster recovery planning items on the Transition Phase “go-live” checklist and receive IRS approval to transition into production status.

Section 508 Requirements for Build-Out Phases The Contractor shall update the Section 508 test plan that outlines the products and/or services that are tested for compliance with Section 508 and how the test will be conducted The Contractor shall document a test report that reflects the results of the Section 508 test plan that was conducted prior to production.

Deliverables The Contractor will propose the delivery period/date, and the contents for each of the work products required during the Transition Phase. These work products include the following:

No.

Service Area Deliverable Period Content D.4.2.1 Program Management and Integration Transition Phase Project Charter Contractor Proposed Contractor Proposed D.4.2.2 Program Management and Integration Transition Phase Project Management Plan Contractor Proposed Contractor Proposed D.4.2.3 Program Management and Integration Transition Phase Project WBS Contractor Proposed Contractor Proposed D.4.2.4 Program Management and Integration Transition Phase Project Budget Contractor Proposed Contractor Proposed D.4.2.5 Program Management and Integration Transition Phase Close Project Review Contractor Proposed Contractor Proposed D.4.2.6 Program Management and Integration Program Risk Assessment Contractor Proposed Update program and project risk plans D.4.2.7 Program Management and Integration Program Communication Plan Contractor Proposed Update program and project communication plans D.4.2.8 Program Management and Integration Program Change Management Plan Contractor Proposed Update program and project change management plans D.4.2.9 Program Management & Integration Security & Privacy Documentation Prior to production.

Documentation to support Transition activities, including processes and procedures, compliance evidence and full documentation to support IV&V by a source selected by the IRS.

D.4.2.10 Program Management & Integration Security & Privacy Security Configuration and Change Management Plan Contractor Proposed Security Configuration and Change Management Plan D.4.2.11 Program Management & Integration Security & Privacy Security Audit Plan for portal systems and applications Contractor Proposed Security Audit Plan for portal systems and applications D.4.2.12 Program Management & Integration Security & Privacy Security Patch Management Plan Contractor Proposed Security Patch Management Plan D.4.2.13 Program Management & Integration Security & Privacy Incident Handling, Monitoring and Response Plan Contractor Proposed Incident Handling, Monitoring and Response Plan D.4.2.14 Program Management & Integration Security & Privacy Disaster Recovery Plan Contractor Proposed Disaster Recovery Plan D.4.2.15 Program Management & Integration Security & Privacy

ITCP

Contractor Proposed IT Contingency Plan D.4.2.16 Section 508 Section 508 Compliance Updated Test Plan Transition An updated test plan that outlines the products and/or services that are tested for compliance with Section 508 and how the test will be conducted.

D.4.2.17 Section 508 Section 508 Compliance Test Report Transition; prior to production A test report that reflects the results of the Section 508 test plan that was conducted prior to production.

Exit Criteria The Contractor shall meet the following exit criteria to complete the Transition phase:

No.

Service Category Exit Criteria E.4.2.1 Program Management and Integration All Transition Phase project deliverables have been reviewed and approved by the IRS.

E.4.2.2 Program Management and Integration The Transition Phase is completed within scope, quality, time, cost, and other defined goals and objectives.

E.4.2.3 Program Management and Integration The Program Transition Phase close project review is complete and approved by the IRS.

E.4.2.4 Program Management & Integration Security & Privacy Support IRS processes and provide appropriate accesses for independent verification and validation of the effectiveness of the Transition to operation.

E.4.2.5 Program Management & Integration Security & Privacy Successfully meet criteria for a full ATO.

E.4.2.6 Program Management & Integration Security & Privacy Final drafts of the following:

Security Configuration and Change Management Plan

Security Audit Plan for portal systems and applications Security Patch Management Plan Incident Monitoring, Handling and Response Plan Disaster Recovery Plan E.4.2.7 Section 508 Successful completion of Section 508 compliance testing per plan prior to production and approval from the IRS.

Program Management and Integration Services for the Ongoing Operations Phase The Contractor shall provide Program Management and Integration Services to operate the IRS environment for services shown in Figure 1- Scope of Task Order PWSs, within specified scope, quality, time, and cost objectives, and as described in the IRS Program Management Framework, Project Management Framework, Software Development Lifecycle, and Operations Management Framework.

Security and Privacy Requirements for Ongoing Operations Phases Standards & Guidelines The Contractor shall ensure that the appropriate security controls are consistently enforced in all processes, procedures, and software modules.

The Contractor shall ensure Continuous Monitoring activities are integrated within the System Development Lifecycle (SDLC) in accordance with NIST SP 800-37.

The Contractor shall conduct regular assessments of the security controls using appropriate methods and procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome The Contractor shall support FISMA-compliant on-site assessment of security by IRS representatives or designee.

The Contractor shall annually update and re-submit a Self-Assessment required by NIST SP 800-53, Recommended Security Controls for Federal Information Systems (http://csrc.nist.gov/publications) to the COTR for delivery to the Information Systems Security Officer (ISSO). Subcontracts: The Contractor’s annual update to its Self-Assessment Questionnaire shall include similar information for any Subcontractor or outsourcing partner that performs under the SOW to (1) develop an IRS information system(s) at the Contractor’s or Subcontractor’s facility, or (2) host and/or maintain an IRS information system(s) at the Contractor’s/Subcontractor’s facility.

The Contractor shall ensure that Security documentation is reviewed and updated as necessary.

Security Documentation The Contractor shall document the Security Impact Analysis (SIA) of all changes made to the system in accordance with NIST 800-37 and NIST 800-30, current version.

The Contractor shall provide updated versions of security documentation for major changes to the system to appropriate IRS DAA.

Continuous Monitoring, Testing, and Reporting The Contractor shall develop and submit for approval a detailed plan to test and monitor the status of security controls in the enterprise.

The Contractor shall conduct assessments of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and effective.

The Contractor shall ensure that changes and modifications to the system adhere to the Configuration Management Policy; and evaluate the impact on the security posture, functionality and infrastructure for all proposed changes.

The Contractor shall ensure control deficiencies are documented in a Plan of Action and Milestones (POA&M), with appropriate remediation actions and time-frames.

The Contractor shall review, update as needed, and test the ITCP at least annually.

The Contractor shall review, update and test the incident response plan.

The Contractor shall update the Certification and Accreditation (C&A) documentation to ensure that the C&A artifacts are kept current and contain all information and supporting evidence.

The Contractor shall collaborate with the IRS to perform pre-ST&E activities, coordinate the ST&E, and develop the ST&E Plan and ST&E test cases.

The Contractor shall cooperate with and assist the annual independent audit team in executing a NIST SP 800-53 control test audit plan as prescribed by Cyber security or the DAA, providing access to facilities and personnel, documentation, reports and requested documents.

The Contractor shall participate in both the annual ITCP Tabletop Training and Exercise and a Functional ITCP as designated by the MITS PMO.

The Contractor shall test the POAMs closed in the previous quarter to ensure the mitigation action has produced the desire outcome.

The Contractor shall annually test a subset of Security controls as designated by the DAA of MITS-28 using the template provided by the MITS PMO.

The Contractor shall participate in a Contractor site review annually.

The Contractor shall provide access to infrastructure systems and applications for required periodic vulnerability scanning and independent validation and verification of security.

Custom Developed Software Security The Contractor shall coordinate with the Business Owners to conduct a Privacy Impact Assessment (PIA) for new applications and for significant changes to existing applications, prior to development and in accordance with the IRS Privacy Policy.

The Contractor shall ensure that all custom developed software, components, utilities, and tools are documented in the system inventory, are approved to operate prior to production deployment, and the appropriate application security controls are documented in the SSP in accordance with NIST SP 800-37.

The Contractor shall implement and maintain version and revision control for all custom developed software, components, utilities, and tools, using numerical identifiers and maintaining a readme.txt file documenting all changes by date and version.

All custom software source code developed by the Contractor shall be inspected during development and tested in a production like environment using commercial vulnerability assessment tools.

All vulnerabilities and negative findings discovered by the Contractor during custom developed software source code testing shall be remediated by the Contractor or Subcontractor prior to production deployment unless a deviation is explicitly approved in writing by the IRS DAA.

The Contractor shall provide a requirements traceability matrix at the end of each analysis, design, build, and deployment phase that designates the security requirements in a separate section so that they can be traced through the development life cycle.

The Contractor and any Subcontractors will provide the application designs and test plan documentation, and source code to IRS for review.

The Contractor shall apply continuous monitoring requirements to all custom developed software, and use automated commercial vulnerability assessment tools…