Revised Section C_date Oct2011.pdf

REFM LOGISTICS SERVICES TIRNO-11-R-00009

SECTION C – PERFORMANCE WORK STATEMENT

C-1 Revised Oct 2011

C.1 OBJECTIVE

The objective of this Performance Work Statement (PWS) is to acquire logistics services for the Internal Revenue Service (IRS) nationwide. All Technical Exhibits (TE) mentioned herein are located in Section J, List of Attachments, of this solicitation.

The IRS requires logistics services that will provide:

o Warehousing, transportation, repairs, other logistics services, and work order processing that directly or indirectly support approximately 100,000 IRS employees located at approximately 654 offices throughout the 48 contiguous United States, including 12 Campus locations, including the Washington DC Metropolitan Area, and three Computing Centers, as shown in Section J-6, Technical Exhibits (TE) 1 and TE 2.

o A fully Automated Management Information and Inventory (AMIS) System.

o Dependable, sustainable logistics services for the IRS workforce to support the processing either directly or indirectly of more than 222 million tax returns and the collection of nearly $2 trillion in revenue.

o Adaptable and flexible services to meet the changing requirements at all

IRS offices.

o Property to the customer in a timely, safe, undamaged, clean, and usable condition.

o Protection to personnel and property.

o Cost effective services.

C.2 CAMPUS AND COMPUTING CENTER LOCATIONS – FIXED PRICE

The contractor shall provide all necessary labor, materials, equipment, supplies and supervision necessary to perform all Basic Services requirements. Basic Services consists of warehousing, transportation, repair and other logistics services for the campus and computing centers and their local posts of duty.

Local posts of duty are any IRS office within a 50 mile radius of the main campus or computing center. The contractor is not responsible for the storage, transportation, movement, repair or recycling/disposal/excessing of any property that contains hazardous materials. Workload requirements are outlined in Technical Exhibits (TE) 3, 4, 5, 6 and 7.

C-2 Revised Oct2011

C.2.1 WAREHOUSE SERVICES

The Contractor shall provide point-to-point warehouse services such as receiving, loading and unloading, inspecting, controlling, reporting, tracking, preparing, storing, retrieving, shipping, excessing, disposing and work order processing. The contractor shall provide inside delivery of property, as requested. The contractor shall maintain warehouse loading docks in a neat, orderly, broom-clean and safe condition at all times.

Every six months beginning from the date of award, the contractor shall provide a written report to the CO and COTR Team regarding the amount of cubic feet used for storage. The Government will utilize this report to determine available space that could be utilized for other uses. Workload data for warehouse services is provided in Technical Exhibit 3, Warehouse Services Workload.

C.2.1.1 Receive Property

The Contractor shall receive and prepare property for storage or delivery.

Property may be received from incoming shipments, customers inside the building or customers at alternate locations. The contractor shall retrieve property from its current location and store it as requested by the work order. As required, the contractor shall contact the Sub-COTR for disposition of unanticipated or unsatisfactory deliveries.

*Note: The contractor is not responsible for receiving and signing for shipments from FEDEX, UPS, etc. with the exception of the Covington Territory. The contractor shall receive, sign for and deliver packages provided by these companies. The aforementioned companies deliver packages to 7490 Kentucky Drive, Covington, KY.

C.2.1.2 Store Property

The Contractor shall store property using safe, efficient storage techniques that provide protection against damage and deterioration. The Contractor shall provide the Sub-COTR, every six months, with a report of all property that is in storage. The report shall show the description, location and amount of time the property has been in storage. The volume of property by location and types of property stored at each warehouse are provided in Technical Exhibit 4.

C.2.1.3 Provide Above Capacity Storage

The contractor shall provide above capacity storage as approved by the Contracting Officer. Above Capacity storage shall be executed and effective only after all other storage facilities are at capacity.

C-3

The contractor shall notify the Contracting Officer, in writing, when 95% of the available storage space is occupied. The need for above capacity storage will be approved in writing by the Contracting Officer prior to acquiring the storage. The contractor shall provide a fully supported cost estimate to the Contracting Officer.

A negotiated fixed price for above capacity storage will then be incorporated into the contract via modification.

C.2.1.4 Rotate Envelopes

The contractor shall rotate envelopes on a first-in first-out basis to preclude waste caused by shelf life expiration or degradation, unless otherwise directed by the Sub-COTR.

C.2.1.5 Recycle/Excess/Dispose of Property

Upon receipt of a work order, the contractor shall recycle/dispose/excess property to include pipeline tax processing equipment, office furniture and published products as described in Technical Exhibits 4 and 5. The contractor shall prepare, transport, document, report and track property through recycle/disposal/excess process. For disposals, the contractor shall identify a disposal location for all property and notify the Sub-COTR of the location.

Information Technology (IT) equipment shall only be recycled/excessed/disposed of using UNICOR locations or UNICOR trailers at the campus or computing center site; donations to local school systems or by the use of Perscholas.

C.2.1.6 Warehouse Pickup and Delivery

The contractor shall provide warehouse pickup and delivery services. This includes the pickup of property from the warehouse and delivered to the requestor and pickup from the requestor and delivered to the warehouse for storage.

C.2.2 TRANSPORTATION SERVICES

The contractor shall provide point-to-point transportation services such as preparing, securing, receiving, loading and unloading, picking-up, delivering, inspecting, controlling, tracking, reporting, shipping, and work order processing.

The contractor shall provide inside delivery of property, as requested. The contractor shall use, maintain, repair, and manage contractor-supplied vehicles approved by the Government. Additionally, the truck shall be locked at all times.

The contractor shall make vehicles available for inspection upon request by the Government.

C-4

C.2.2.1 Conduct Scheduled Routes

The contractor shall transport property on regularly scheduled and recurring routes to locations as depicted in Technical Exhibit 6. The contractor shall propose transportation schedules to the Sub-COTR for the routes depicted in Technical Exhibit 6. During IRS’ peak tax season, the contractor shall make the necessary number of trips per schedule to transport all property from point to point. The contractor shall load and unload, and maintain orderly and usable loading docks along scheduled routes.

C.2.2.2 Provide Special Handling

The contractor shall transport tax documents as described in IRM 10.2.13. Tax documents represent approximately 75% of all Campus and Computing Center workload. The contractor shall only accept tax documents in closed, boxed, wrapped, or covered containers.

The contractor shall transport tax documents in enclosed, locked, and secured vehicles at all times to protect against compromise, damage, spillage, or loss.

The contractor shall notify the Sub-COTR immediately if documents are compromised, damaged, spilled, or lost.

C.2.2.3 Perform Unscheduled Pick-Ups and Deliveries

The contractor shall perform pick-ups and deliveries for unplanned pick-ups and deliveries outside of scheduled routes and locations.

C.2.2.4 Transport Certified and Registered Mail

The contractor shall transport Certified and/or Registered mail from/to the main territory campus location to/from the post office. The contractor shall pick up, sign for and deliver Certified and/or Registered Mail to a centralized distribution location at the main campus. The contractor shall also open post office boxes as identified by the Government and deliver the contents to the centralized distribution location. The process for picking up, signing/stamping and delivering certified/registered mail could take up to an hour dependent upon the location.

C-5

C.2.3 REPAIR SERVICES

The contractor shall provide repair services for all pipeline tax processing equipment. This does not include office equipment such as computers, typewriters, calculators, copiers, fax machines, scanners, etc. The contractor shall track, log, inspect, control, report, and process work orders as required for completing repairs.

The cost for repairs, including parts, materials, and labor, shall not exceed either 60% of the estimated replacement cost (to be determined by the Government) or $250.00, whichever is lower. The contractor shall notify the Sub-COTR in writing of repairs exceeding these limits. For repairs that exceed these limits, the Government will make a determination to continue with the repair or purchase new. If the Government determines that repair is the choice, the contractor shall make the repair as part of basic services. If the Government decides to purchase new, this will become the responsibility of the Government. Workload is provided in Technical Exhibit 7 for the Campus and Computing Center locations.

The contractor will be responsible for contacting and scheduling repairs that are under warranty by the manufacturer. The contractor shall adhere to warranty terms and conditions. The Government will provide the contractor with any available warranty information following award.

The contractor shall not be responsible for the purchase of major systems furniture components, such as walls, doors storage units, etc., repair or replacement of appliances (microwaves, refrigerators, toaster ovens, televisions, etc.). These services will be the responsibility of the Government. The contractor shall be responsible for the repair of the electrical components inside the systems furniture.

C.2.3.1 Repair Property

The contractor shall perform repairs, adjustments, and modifications to Government property. The contractor shall be responsible for the purchase, removal, storage, replacement and proper disposal of fluorescent light bulbs for systems furniture in accordance with the latest applicable Federal, State, local and environmental regulations for managing the removal, storage, and disposal of fluorescent light bulbs.

The contractor is not responsible for the purchase, replacement or disposal of light bulbs associated with desk top lamps or fixtures located in the buildings’ ceilings.

C-6

C.2.3.2 Provide Locksmith Services

The contractor shall make keys, repair, install, re-key, and replace locks on office property as requested by the work order. The contractor shall also install lock bars on filing cabinets as requested by the work order. The total number of locksmith services permitted on one request is 12. The total number of keys permitted on one request is 24. The contractor shall label all key replacements with the lock number associated with that key.

The contractor is not responsible for any locksmith services related to doors permanently affixed to the building.

C.2.4 OTHER LOGISTICS SERVICES

The contractor shall provide all labor, equipment, materials and supplies, to include boxes and tape, to support office moves and box and body moves. The contractor shall provide services to move property and boxes point-to-point including, but not limited to, disassembling, reassembling, controlling, reporting, tracking, preparing, transporting, packing, unpacking, placing, and processing work orders. The contractor shall provide inside delivery of property, as requested.

Packing and unpacking does not refer to the packing and unpacking of desks, cabinets, bookcases, credenzas, etc. This is the responsibility of the Government. The contractor is not responsible for the movement of any desk, cabinet, credenza, bookcases etc that has not been emptied of its contents.

C.2.4.1 Move Boxes

The contractor shall move boxes as requested through work orders. The maximum number of boxes permitted on a single request is 200. The Government considers a pallet of shrink wrapped boxes as one (1) box. *In lieu of a work order request, the Philadelphia Campus requires daily sweeps three times per day to pickup and deliver from 23 centralized drop points.

Drop point locations will be provided to the successful offeror after award.

C.2.4.2 Move Property

The contractor shall support office moves as requested through work orders.

Contractor supplied boxes shall be regular commercial sizes and shapes.

C-7

Property moves are limited to 15 persons per work order request with up to 265

sq. ft. of office space each. The move may include the movement of a computer, peripheral equipment, credenzas, bookcases, file cabinets, boxes, etc. Any requests for services in excess of these limits will not be the responsibility of the logistics services contract.

C.2.4.3 Labor Support

The following types of services are required under labor support: microphone set ups and removal; hanging/removing pictures, signs, banners, and bulletin boards; hanging/removing/changing the time on clocks; hanging/removing Automated External Defibrillators (AED) and health unit equipment on walls;

provide nameplate services (maximum 12 names per request);

installing/moving/removing walk-off mats and directory boards; assembly and disassembly of child care furniture and equipment; movement of individual items from one place to another, using equipment as necessary.

Individual items include but are not limited to: conventional desks; rolling stock, chairs, free standing partitions, cabinets; tables; canteen equipment; televisions, VCRs, projectors; typewriters; ells; flip charts; podiums/lecterns; empty pallets;

flags and stands; tax form take one bins; book, trophy, display cases; child care center furniture; pedestal fans; rolling blueprint machines; rolling dry-erase boards; hampers; pallets of products; outdoor furniture. Assembly of carts and trash hampers. Moves may be within or between a workstation, an enclosed office, open office area, corridors, lobbies, classrooms, conference rooms, storage areas, guard posts, canteens, cafeteria, child care center, fitness center (excluding fitness equipment), health unit, floors, between dock and work area/office/corridor/storage area/class or conference room.

The contractor shall perform box and body moves which consist of a 1 person move to include their computer, peripheral equipment, chair and up to five (5) boxes of property.

The contractor shall also support special events under labor support. Special events are defined as assemblies, seminars, meetings or other events.

Examples of such events are blood drives, weekly production meetings, fairs for IRS employees such as health fairs, town hall meetings and collection of charitable donations. Supporting special events may consist of delivery and setup of furniture, rearranging existing furniture, breakdown and removal of furniture. Supporting special events does not include cleanup of debris and does not support setting up for non-IRS occupants of the building.

C-8

C.2.4.4 Forms Management

The Government requires contractor support to receive, inventory, track, store, pick up/deliver and dispose of all IRS Published Products. In the event that a discrepancy is noted upon receipt of a newly delivered published product, the contractor shall notify the Forms Coordinator immediately.

The type and amount of published products requiring receipt, inventory, tracking, storage, pickup/delivery and disposal is outlined in Technical Exhibit 5.

C.3 POSTS OF DUTY – COST PLUS FIXED FEE SERVICES (CPFF)

The contractor shall provide all necessary labor, materials, equipment, supplies and supervision necessary to perform all Basic Services requirements. The contractor shall provide all services to the posts of duty on a CPFF basis.

The contractor shall provide an informational copy of all quotes to the Sub-COTR for services estimated less than $3,000.00. For services that are estimated to be $3,000.00 or more, the contractor shall submit a detailed quote, along with evidence of competition, to the Contracting Officer for approval. Evidence of competition shall consist of a minimum of three subcontractor quotes and supporting documentation.

The contractor shall notify, in writing, the Contracting Officer when 80% of the available funding for each CPFF CLIN has been expended. Upon receipt of the written notification, the Contracting Officer will provide the contractor with written direction within 2 work days.

The cost for repairs, including parts, materials, and labor, shall not exceed either 60% of the estimated replacement cost (to be determined by the Government) or $250.00, whichever is lower. The contractor shall notify the Sub-COTR in writing, of repairs exceeding these limits.

C.3.1 Repair Services

The contractor shall provide repair services for all Government property. This does not include office machines such as computers, typewriters, calculators, copiers, fax machines, scanners, etc. The contractor shall track, log, inspect, control, report, and process work orders as required for completing repairs.

The cost for repairs, including parts, materials, and labor, shall not exceed either 60% of the estimated replacement cost (to be determined by the Government) or $250.00, whichever is lower. The contractor shall notify the Sub-COTR of repairs exceeding these limits.

C-9

For repairs that exceed these limits, the Government will make a determination to continue with the repair or purchase new. If the Government determines that repair is the choice, the contractor shall make the repair as part of basic services.

If the Government decides to purchase new, this will become the responsibility of the Government.

The contractor shall be responsible for contacting and scheduling repairs that are under warranty by the manufacturer. The contractor shall adhere to warranty terms and conditions. The Government will provide the contractor with any available warranty information following award. The contractor shall be responsible for the repair of the electrical components inside the systems furniture.

The contractor shall not be responsible for the purchase of systems furniture components, repair or replacement of kitchen appliances (microwaves, refrigerators, toaster ovens, etc.). These services will be the responsibility of the Government.

C.3.1.1 Repair Property

The contractor shall perform repairs, adjustments, and modifications to Government property. The contractor shall be responsible for the removal, storage, replacement and proper disposal of fluorescent light bulbs for systems furniture in accordance with the latest applicable Federal, State, local and environmental regulations for managing the removal, storage, and disposal of fluorescent light bulbs.

The contractor is not responsible for the purchase, replacement or disposal of light bulbs associated with desk top lamps or fixtures located in the buildings’ ceilings.

C.3.2 Provide Locksmith Services

The contractor shall make keys, repair, install, re-key, and replace locks on office property as requested by the work order. The contractor shall also install lock bars on filing cabinets as requested by the work order. The total number of locksmith services permitted on one request is 12. The total number of keys permitted on one request is 24. The contractor shall label all key replacements with the lock number associated with that key.

The contractor is not responsible for any locksmith services related to doors permanently affixed to the building.

C-10

C.3.3 Other Logistics Services

The contractor shall provide all labor, equipment, materials and supplies, to include boxes and tape, to support office moves The contractor shall provide services to move property point-to-point including, but not limited to, disassembling, reassembling, controlling, reporting, tracking, preparing, transporting, packing, unpacking, placing, and processing work orders. The contractor shall provide inside delivery of property, as requested.

Packing and unpacking does not refer to the packing and unpacking of desks, cabinets, bookcases, credenzas, etc. This is the responsibility of the Government. The contractor is not responsible for the movement of any desk, cabinet, credenza, bookcases etc, that has not been emptied of its contents no matter what the distance.

C.3.3.1 Move Boxes

The contractor shall move boxes as requested through work orders. The maximum number of boxes permitted on a single ticket is 200. The Government considers a pallet of shrink wrapped boxes as one (1) box.

C.3.3.2 Move Property

The contractor shall support office moves as requested through work orders.

Property moves are limited to 15 persons per work order request with up to 265

sq. ft. of office space each. The move may include the movement of up to five

(5) boxes each, their computer, peripheral equipment, credenzas, bookcases, file cabinets, etc. Any requests for services in excess of these limits will not be the responsibility of the logistics services contract.

C.3.3.3 Labor Support

The following types of services may be required at Posts of Duty offices:

microphone set ups and removal; hanging/removing pictures, signs, banners, and bulletin boards; hanging/removing/changing the time on clocks;

hanging/removing AED and health unit equipment on walls; providing nameplate services; installing/moving/removing walk-off mats and directory boards;

movement of individual items from one place to another, using equipment as necessary.

C-11

Individual items include, but are not limited to: conventional desks; rolling stock, chairs, free standing partitions, cabinets; tables; canteen equipment; televisions, VCRs, projectors; typewriters; ells; flip charts; podiums/lecterns; empty pallets;

flags and stands; tax form “take one” bins; book, trophy, display cases; pedestal fans; rolling blueprint machines; rolling dry-erase boards; hampers; pallets of products.

Moves may be within or between a workstation, an enclosed office, open office area, corridors, lobbies, classrooms, conference rooms, storage areas, floors, between dock and work area/office/corridor/storage area/class or conference room.

C.3.3.4 Recycle/Excess/Dispose of Property

Upon receipt of a work order, the contractor shall recycle/dispose/excess property such as office furniture and Information Technology equipment. The contractor shall prepare, transport, document, report and track property through recycle/disposal/excess process.

For disposals, the contractor shall identify a disposal location for all property and notify the Sub-COTR of the location. Information Technology (IT) equipment shall only be recycled/excessed/disposed of using UNICOR, donations to local school systems or by the use of Perscholas. The locations of the UNICOR facilities are outlined in Technical Exhibit 14.

C.4 WORK ORDER PROCESSING

Work Order Processing is a requirement for all services under this solicitation and any resultant contract. The Government’s principle process to order services is through the Employee Resource Center (ERC)/ Knowledge, Incident/Problem, Service Asset Management (KISAM). The types, descriptions and times for completion (cycle times) of work orders typically requested are listed in Technical Exhibit 9.

In the event the contractor receives a work order that does not have sufficient information to complete the request, the contractor shall obtain clarification from the Sub-COTR. If clarification is not received within 48 hours of the contractor receiving the request, the contractor may cancel the request. The contractor shall process and close work orders timely as described in Technical Exhibit 9.

The contractor shall ensure the Sub-COTR is provided with or has the ability to obtain current status upon request.

C-12

C.5 AUTOMATED MANAGEMENT INFORMATION AND INVENTORY

SYSTEM (AMIS)

The contractor shall provide and use an Automated Management Information and inventory System (AMIS) to manage all requirements of this PWS. The AMIS shall be compatible with the ERC/KISAM and have the ability to receive and transmit work order requests and updates between the two systems. The contractor shall comply with IRM Part 2 series and IRM Part 10 series, including compliance with Section 508.

The contractor shall provide an interim system to track, capture, and report all workload as described in this PWS for the period from award through full AMIS implementation. The contractor shall transfer all data from the interim system to the final AMIS once implemented (this applies to a successor and not the incumbent).

The contractor shall receive, control, report, track, prepare, update, and process all work orders, including forms requests, in the cycle times listed in Technical Exhibit 9. The system shall have the ability to track printed products and property from time of receipt to disposal.

The system shall be able to accept and process text files from the IRS which will establish a product line in the automated system and have the capability to accept uploads from Publishing Services as they relate to customers order point numbers, which identifies the customer and delivery point information.

Work Orders may be placed on hold if the due date falls outside of the required cycle time or with written approval from only the CO, COTR(s) or Sub-COTR(s).

The contractor shall propose and describe a state-of-the-art solution that, if implemented, can replace historical practices with more efficient and automated work order processing. Regardless of the mechanism used to initiate a work order, the contractor shall record all work orders in an automated management information and inventory system (AMIS) to control handling, track progress and report completion.

The contractor shall be responsible for the monthly cost of DSL Service at the campus and computing center locations to have internet connectivity. At those locations where no DSL connectivity is available, the contractor is responsible for ensuring there is alternative internet connectivity that is compliant with the IRS’ cyber security regulations.

C-13

C.5.1 System Access

The contractor shall restrict access to AMIS to properly authorized individuals performing the services required by the PWS. Individuals requiring access will be the Contracting Officer, the designated COTR(s), the designated Sub- COTR(s) and his/her backup and the Forms Coordinators. All authorized individuals information will be provided to the successful offeror after award.

C.5.2 Systems Operations and Maintenance

The contractor shall develop and maintain controls, policies, and procedures for system operation and maintenance in accordance with IRS guidelines. IRM 10.8 provides guidance for implementation, utilization, data exchange and complying with security requirements to include but not limited to annual Federal Information Security Management Act (FISMA) reviews. The contractor shall provide, maintain, and implement a disaster recovery plan, to include, but not limited to, capturing, maintaining, and updating system data to avoid work stoppage and data loss during downtime. The contractor shall provide redundancy, data back up, and data storage capacity to meet the PWS performance requirements. The contractor shall notify the COTR team of any planned system downtime a minimum of five (5) calendar days in advance.

The contractor shall notify the COTR team within one hour following any unplanned down time. Aside from the planned system downtime, the AMIS shall be operational during the hours of 6:00 am and 9:00 pm Eastern Time. These hours will account for the time differences between the East Coast and the West Coast.

C.5.3 System Documentation

The contractor shall provide documentation to the Government as prescribed by OMB Circular A-130 and IRM 2.5 and 2.16 series to test, implement, and document system configuration. The contractor shall provide documentation for changes to the hardware, firmware, software, and applications to be approved by the Government prior to implementation. The contractor shall be responsible for testing, implementing, and documenting enhancements and new solutions. The Government will not be obligated to implement any contractor-proposed solutions into the Government IT enterprise. The contractor shall implement procedures as prescribed by the IRS Enterprise Portfolio and Project Management office and follow IRS Enterprise Life Cycle methodology.

C-14

C.5.4 System Security Requirements

The contractor shall provide documentation required as prescribed in the IRS Demand Management, Work Request (WR) Process in accordance with IRM

2.22.1. The contractor shall submit required system documentation for system Security Assessment and Authorization (SA&A) and Security Control Assessment (SCA). The guidance for this documentation is set forth in the National Institute of Standards and Technology (NIST) 800 series guidance, OMB Circular A-130. The contractor shall provide a system that properly interfaces with IRS firewall technologies. Upon successful completion of the SA&A and SCA, the Government will issue an Authority to Operate prior to system implementation.

Information Security / Federal Information Security Management Act

(FISMA)

Pursuant to the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002, P.L. 107-347, the contractor shall provide minimum security controls required to protect Federal information and information systems.

The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability.

The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor of an agency.

This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data.

An IRS information or information system are defined as a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

C-15

Treasury / IRS Policies for Information Technology (IT) Security

The contractor shall comply with Department of Treasury Security Manual TDP 15-71, and Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance. The contractor shall comply with IRS Internal Revenue Manuals (IRM) and Law Enforcement Manuals (LEM) when developing or administering IRS information and information systems.

The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

IRM 10.8.1 require IRS' sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearances required; receive security awareness and training required for contractor activities or facilities; and any facility physical security requirements. Most IRS information is categorized as SBU. This includes:

a.) taxpayer information, b.) employee data - such as evaluations, c.) personnel and payroll records, d.) financial and statistical information on agency operations not normally available for public disclosure, and e.) proprietary information provided to the government by third parties.

Oversight of Contractor Systems

Any system the contractor implements is considered a major IT system and subject to an annual FISMA Contractor Review / site visit. All contractors that manage, operate or program an IRS Information or Information system are subject to IRS oversight to conduct a FISMA Contractor site review of the contractor’s IT operation and physical environment / facilities. At the discretion of IRS MITS Cybersecurity and the owning Business Unit, a FISMA Contractor review shall be determined based on a risk-based decision and whether it is cost effective to conduct such a review.

C-16

Certification and Accreditation Process

Contractors systems that collect, maintain, operate or use agency information or an information system on behalf of the agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews, risk assessments, security plans, control testing, a Privacy Impact Assessment (PIA), contingency planning, and certification and accreditation, at a minimum meet NIST guidance, if required by the IRS.

Contractor System Review / Site Visit

The contractor shall be subject to at the option / discretion of the agency, to periodically test, (but no less than annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

Information Security Awareness and Training

The contractor shall comply with IRS mandatory annual UNAX briefings.

Perform HSPD-12 Personal Identity Verification, physical and personnel security screening / background investigation for approval of a contractor badge for staff like access.

All contractors and contractor employees who could have access to return information must complete the mandatory UNAX briefing. Contractors shall certify the completion of training by their employees in accordance with IRSAP Clause IR1052.204-9003. The contractor shall comply with all aspects of this clause.

C-17

Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

The contractor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The contractor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 security controls and IRS specific security procedures to ensure that information is transported in encrypted form.

The contractor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information.

Safeguarding / Protecting Sensitive Personally Identifiable Information (PII)

Sensitive PII is defined by OMB as “any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” Information systems can be either electronic or manual.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Management Act (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information, such as the following guidance from OMB Policy M-06-16:

C-18

1. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing;

2. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining agency access;

3. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and

4. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

OMB Policy M-07-18 Ensuring New Acquisitions Include Common Security Configurations

The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC). This includes Internet Explorer 7 configured to operate on Windows http://csrc.nist.gov/itsec/guidance_WinXP.html Windows XP and Vista (in Protected Mode on Vista). For the Windows XP settings, see:

http://csrc.nist.gov/itsec/guidance_xp.html, and for the Windows Vista settings, see: http://csrc.nist.gov/itsec/guidance_vista.html. In accordance with OMB issued policy memorandum M-07-11, “Implementation of Commonly Accepted Security Configurations for Windows Operating Systems: “operating systems [Windows XP and VISTA] and/or plans to upgrade to these operating systems must adopt these standard security configurations by February 1, 2008.”

The National Institute of Standards and Technology (NIST) Guidance for Information Security

The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum security controls identified in NIST Special Publication 800-53 Recommended Security Controls for Federal Information / NIST 800-53A and Revision 1, and FIPS 200 Minimum Security Requirements for Federal Information and Information Systems.

The contractor shall follow the best practices and guidance established by NIST special publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

C-19

Handling Information Security Incidents

The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

The contractor shall maintain procedures for detecting, reporting, and responding to security incidents, and mitigating risks associated with such incidents before substantial damage is done to federal information or information systems. The contractor shall immediately report all computer security incidents that involve IRS information systems to the IRS Computer Security Incident Response Center (CSIRC). Any theft or loss of IT equipment with federal information / data must be reported within one hour of the incident to CSIRC. Those incidents involving the loss or theft of sensitive but unclassified (SBU) data (i.e. taxpayer, PII) shall be reported to CSIRC, first-line manager, and Treasury Inspector General for Tax Administration (TIGTA). Based on the computer security incident type, CSIRC may further notify the Treasury Computer Security Incident Response Capability (TCSIRC) in accordance with TCSIRC procedures.

REPORT INCIDENTS TO IRS CSIRC:

Web Site http://www.csirc.web.irs.gov/incident/ Email csirc@csirc.irs.gov Phone (202) 283-4809 Toll-Free (866) 216-4809, Fax (202) 283-0345

C.5.5 System Data Reports

The contractor shall provide a suite of reports that at a minimum will identify the usage of printed products broken down by product/revision/version including; receipts, customer orders filled, printed products that have not been issued to customers for a specific period of time, transfers to other campuses and disposals; identify all Government property in storage, all movement of that property from receipt to usage/disposal; closed date of all work order requests;

warehouse utilization in cubic feet, quoted amount and actual billed amount of CR work orders; and other reports as determined by IRS to be necessary in the day to day operation of the program.

C-20

The report writing capability shall support queries and sorting of all data elements included in Technical Exhibit 9, ERC/KISAM Call Types. The contractor shall provide the capability to export reports into Microsoft products.

C.5.6 System Data Exchange

The contractor shall develop and implement a data exchange process between the ERC/KISAM and the AMIS. The contractor shall develop and implement a data exchange process to transfer all data elements between IRS Current Production Environment systems and the AMIS that are required to manage PWS workload.

C.5.7 System Data Storage

The contractor shall provide system capacity to maintain current and archived data to meet PWS requirements. The contractor shall transfer all records to the Government before disposal. The contractor shall retain system records in accordance with National Archives and Records Administration's (NARA) General Records Schedules 1-25 (NARA) detailed in IRM 1.15.17 through 1.15.62.

C.5.8 System Data Disclosure

The Government will own all stored data. The contractor shall safeguard data and not release, sell, or offer data without explicit written permission from the CO, reference Section I, FAR Clause 52.227-14, Rights in Data-General, - Alternate I.

C.6 PERFORMANCE REQUIREMENTS

The contractor shall meet all requirements of the PWS. The following are the performance objectives and performance thresholds that the contractor will be held to:

Performance Objectives PWS

Reference Performance Threshold

1. Maintain warehouse and loading docks at the Campus and Computing Centers

C.2.1 Products stored safely and area has a broom-clean appearance 100% of the time.

C-21

2. Receive Property C.2.1.1 Inspect and document receipt of incoming shipments of items within two days of receiving the item(s) 100% of the time.

3. Transport property timely C.2.2.1 Meet published transportations schedule within 15 minutes of scheduled times 99.9% of the time.

4. Transport special handling documents

C.2.2.2 No special handling documents compromised, damaged, spillage or lost 99.8% of the time.

5. Process customer orders timely

C.2.1; C.2.2 C.2.3; C.2.4;

C.4

Meet ERC cycle times for call type of order placed 85% of the time by Territory and 90% of the time nationwide (number of work orders processed without customer complaint/total number of work orders processed

6. Process customer orders accurately

C.2.1; C.2.2 C.2.3; C.2.4;

C.3

Accurately process ERC customer orders 85% of the time by Territory and 90% of the time nationwide (number of work orders processed without customer complaint/total number of work orders processed).

7. Operational AMIS C.5 Maintain daily accessibility and functionality 99% of the time.

8. Maintain an accurate AMIS, including inventory

C.5.2 Provide accurate records 99% of the time.

C.7 GOVERNMENT PROPERTY/EQUIPMENT/FACILITIES

In accordance with FAR 52.245-2, Government Property Installation Operation Services, the Government will furnish or make available for use by the contractor selected property including equipment, facilities and services on an “as is, where is condition.” Property supplied by the Government shall be used only for performance of work associated with any resultant contract.

C-22

The contractor or the contractor personnel shall not use Government property in any manner for personal advantage, other business endeavors, or private gain.

The contractor shall prepare a report of Government property in accordance with FAR 52.245-1(f)(i)(iv). This report shall be provided to the Contracting Officer annually at the beginning of each performance period.

In the event of any lost or stolen Government Property and it is due to the willful misconduct or lack of good faith by the contractor’s managerial staff, the contractor shall be held responsible for the reimbursement or the replacement cost of the lost or stolen property.

Government Property/Equipment Furnished is listed in Technical Exhibit 11.

Government Facilities Furnished is listed in Technical Exhibit 12.

C.7.1 Government Property Furnished (GPF)

The Government will allow limited use of existing voice, facsimile, and copier services located in the contractor work areas or another area that the Government has determined would not result in a disruption of Government operations. The Government will provide the contractor with office space, storage space, repair space for equipment/property repairs and break areas These spaces will vary in size, scope and availability dependent upon the location.

The Government will provide parking spaces for work vehicles and personal vehicles at the campus and computing center locations only. The amount of parking spaces is limited to the available space at each location. Throughout the duration of the contract, the amount of parking spaces for both work vehicles and personal vehicles may be reduced due to changing requirements of the Government. In those instances, the contractor will be responsible for acquiring any needed parking spaces at no additional cost to the Government.

Any contractor owned electronic equipment shall never be plugged into a government communication line. The government is obligated to provide the contractor access to voice, facsimile and copier equipment but is not obligated to have any or all of these items placed in the contractor’s space.

C.7.2 Government Equipment Furnished (GEF)

The contractor shall jointly inventory and inspect available GEF to determine which items, if any, the contractor will accept for use under this contract. The joint inventory shall be signed and dated by the contractor Project Lead and the Government Sub-COTR. The contractor shall maintain a detailed electronic inventory of GEF on the AMIS.

C-23

The contractor shall maintain GEF preventative maintenance and repair records, and related information.

The Government will furnish the GEF identified in Technical Exhibit 11 in its present condition. The Government will retain ownership of the GEF. The Government will not replace GEF. The contractor shall bear the cost of making the GEF the contractor chooses to use suitable for use. The contractor shall manage, maintain, and repair the GEF the contractor chooses to use. The contractor shall adhere to GEF warranty terms and conditions. The Government will provide the contractor with applicable GEF warranty information following award, if available.

C.7.3 Government Facilities Furnished (GFF)

The contractor shall use the mandatory GFF as listed in Technical Exhibit 12.

The Government will fund the mandatory GFF. The Government reserves the right to change the content and size of the GFF. The Government will renegotiate GFF leases as required. The contractor shall allow unrestricted access to authorized Government employees at the GFF and any contractor facilities. The contractor shall request any changes or modifications to the GFF through the CO. The contractor shall be liable for the cost of any repairs caused by neglect or misuse as determined by the Government.

C.7.4 Alternative Facilities

The contractor may use alternative facilities in addition to the mandatory GFF in order to meet the storage requirements identified in Technical Exhibits 4 and 5.

Alternative facilities shall be approved by the Government. The Government will approve alternative facilities based on Federal, State, local requirements, and IRS policy. The contractor shall assume relocation costs and all other costs associated with the alternative space. The contractor shall meet all PWS requirements during any relocation.

C.7.5 Ready Storage

The Government will provide up to 3,000 square feet of ready storage area in the campus and computing center locations only for the…