RFP Solicitation 06 30 2011 1142 am.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL

ITEMS

1. REQUISITION NUMBER

M-1-M1-81-RP-014 000

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NUMBER

5. SOLICITATION NUMBER

TIRNO-11-R-00028

6. SOLICITATION ISSUE

DATE

06/30/2010

7. FOR SOLICITATION

INFORMATION

CALL:

a. NAME

FLOYD, ANGELA M.

b. TELEPHONE NUMBER (No collect alls) c

202-283-1283

8. OFFER DUE DATE/

LOCAL TIME

07/22/2011 12:00 PM EST

9. ISSUED BY CODE IRS0088 10. THIS ACQUISITION IS

UNRESTRICTED OR SET ASIDE: % FOR

SMALL BUSINESS EMERGING SMALL

BUSINESS

NAICS: 541

HUBZONE SMALL

BUSINESS

Internal Revenue Service 6009 Oxon Hill Road, Suite 500 Oxon Hill, MD 20745

SIZE STANDARD: $7.0 Million/ $12.5 Million

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

11. DEVLIVERY FOR FOB DESTINATION

UNLESS BLOCK IS MARKED

12. DISCOUNT TERMS 13a. THIS CONTRACT IS A

RATED ORDER UNDER DPAS

(15 CFR700)

13b. RATING

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB X RFP

15. DELIVER TO CODE 20224999 16. ADMINISTERED BY CODE IRS0088

Internal Revenue Service 1111 Constitution Avenue, NW Washington , DC 20224

Internal Revenue Service 6009 Oxon Hill Road, Suite 500 Oxon Hill, MD 20745

17a. CONTRACTOR/ CODE 00055905 FACILITY 18a. PAYMENT WILL BE MADE BY CODE INVB030

OFFEROR CODE

TO ALL OFFERORS

IRS Beckley Finance Center P.O. Box 9002 Tel: (304) 254-3300 Beckley, WV 25802

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED. SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

__________ __________0001 EA

1.00

Continuing Education Provider Registration and Tracking System in accordance with following Statement of Objectives.

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4, FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29. AWARD OF CONTRACT: REF. OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5).

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT)

30c. DATE SIGNED

31b NAME OF CONTRACTING OFFICER (TYPE OR PRINT)

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 1449 (REV. 3/2005) PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

X X X

X

X

X

STANDARD FORM 1449 (REV. 3/2005) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21. 22.

QUANTITY

UNIT

23.

UNIT PRICE (US$)

24.

AMOUNT (US$)

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER

34. VOUCHER NUMBER 35.AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

36. PAYMENT

COMPLETE PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT

NUMBER

39.S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42.a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42.c DATE REC’D (YY/MM/DD)

42d. TOTAL CONTAINERS

CONTINUING EDUCATION PROVIDER AND TRACKING SYSTEM

SECTION I- STATEMENT OF OBJECTIVES

1.0 Background

In June of 2009, the IRS Commissioner launched a comprehensive review of return preparers in an effort to help the IRS better leverage this community with the twin goals of increasing taxpayer compliance and ensuring uniform and high ethical standards of conduct for preparers.

The IRS Strategic Plan for 2009 – 2013 addresses the importance of return preparers in two objectives:

1) Strengthen partnerships with tax practitioners, tax return preparers, and other third parties in order to ensure effective tax administration, and

2) Ensure that all practitioners, tax return preparers, and other third parties in the tax system adhere to professional standards and follow the law.

In December 2009, the IRS announced the results of the review and made multiple recommendations to increase the oversight of return preparers. Please refer to the IRS Return Preparer Report (dated December 2009) for a greater understanding of the context and detail of the IRS Return Preparer recommendations: http://www.irs.gov/pub/irs-pdf/p4832.pdf.

Since the report, the IRS has selected an external vendor to register tax return preparers for Preparer Tax Identification Numbers and, more recently, vendors to provide testing and fingerprinting services for return preparers. In addition, included in the recommendations, was the implementation of annual Continuing Education requirements (hereafter, referred to as “CE”) for all return preparers who are not attorneys, CPAs, enrolled agents, enrolled actuaries, or enrolled retirement plan agents.

1.1 Scope/Objective

The purpose of this request is to procure vendor support to assist the IRS in the registration of CE Providers. CE Providers will be responsible for presenting continuing education programs to Return Preparers. The IRS would approve Providers based on established standards.

The CE Vendor will be responsible for continuing education provider registration development and administration activities, including hosting and maintaining a system to administer registration by electronic and paper means and the capture of registration data from both formats. Both the on-line and the paper process should provide applicants an easy, quick, and secure way of applying for CE Provider approval. Ongoing collaboration with the IRS and ongoing customer service activities should be available to support all development and administration activities. (See Attachment 3 - CE Vendor Process Flow)

Separately, another vendor (hereafter, the “Registration Vendor”) has previously been selected and has designed a Preparer Tax Identification Number (PTIN) registration system which issues a unique identification number for all paid tax return preparers (hereafter, “preparers”). This system allows return preparers to register, renew, and pay the IRS user fee. The CE Vendor will be required to interface with the Tax Professional PTIN System and electronically record CE earned by individual PTIN holders submitted by CE Providers to the CE Vendor. The CE Vendor will not have access to any of the Registration Vendor’s data. The Registration Vendor and the CE Vendor will have data interfaces (described throughout this document) relating to http://www.irs.gov/pub/irs-pdf/p4832.pdf matching identifying numbers to CE Provider records. All Vendors must ensure that there is a secure database/platform protecting return preparer personally identifiable information.

As part of the federal government, the IRS is required to provide security and privacy protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, or disclosure of information or information systems used or operated by the IRS or by a contractor for the IRS. All of the work performed under this contract must, therefore, adhere to NIST Federal, Treasury, and IRS security and privacy standards.

1.2 CE Requirement

Generally, preparers who are not attorneys, CPAs or enrolled agents and who prepare Form 1040 series tax returns for compensation will be required to obtain annual CE. Preparers who are required to take CE will meet their CE requirements by taking courses from an IRS Approved Provider. This will be an annual requirement to be fulfilled prior to renewal of the PTIN (by December 31 of each year).

Fifteen hours of continuing education credit will be required annually, including 2 hours of ethics or professional conduct, three hours of federal tax law updates, and 10 hours of federal tax law topics. CE Providers will need to be issued identifying numbers that can track these three categories of CE provided. In addition, the type of course (self study, on-line group, or face to face) would also be collected and tracked. The new CE reporting requirement for preparers is expected to begin on January 1, 2012 to be completed by December 31, 2012.

The CE Vendor will develop an English-language, web-based application for use by approximately 2,200 - 3,000 CE Providers. This number represents the current estimate, and may increase or decrease. The Vendor should be prepared to begin CE Provider registration, fee collection, and issuance of CE Provider Identification numbers, notice generation, and system reporting on or before September 30, 2011. If that date cannot be met, the Vendor should provide a timeline showing the earliest date anticipated for system readiness.

Functionality of an interface for the electronic submission and reporting of individual return preparer continuing education information shall commence on or before June 1, 2012 (see 1.7.2 below). In addition, the CE Vendor will be required to add functionality to support CE from other groups such as Enrolled Agents, Enrolled Retirement Planning Agents, and Actuaries, that may have different standards for CE approval, in a second phase to the project. These additions may have differing requirements and fees. The CE Vendor will also systemically generate Provider candidates for post-audit review by the IRS. All general IT application functional requirements, unless otherwise noted, will be included with registration rollout and available on or before September 30, 2011.

1.3 On-line Registration of CE Providers

1. Register all CE Providers using the minimal data capture requirements outlined in

Attachment 4.

2. Issue CE Provider approval letters on behalf of the IRS with Provider numbers (and

Course Numbers or ranges) in a printable form to be used by the CE Providers.

3. Provider numbers and applicant data obtained at the time of application and any data updated after assignment of the provider number shall be maintained by the Vendor, with extracts/reports provided to the IRS on an as yet to be determined frequency and in an as yet to be determined format.

4. Secure on-line a user fee to recover vendor costs and possibly an IRS user fee in the future.

5. Secure agreement to an as yet to be determined ethics statement prior to issuance of the Provider Number(s).

6. Using IRS security guidelines, accept scanned attachments if any documentation is required for the on-line registration process.

7. Provide ability for Continuing Education Provider applicants to save registration data and re-enter system for completion at a later time.

8. Enable secure password protected access for CE providers to register, renew, update and access notices, reminders, etc. via secure mailbox. Send first time approval letters by US Mail, if required.

1.4 Paper Registration of CE Providers

1. Develop a paper version of the on-line registration form which will allow CE Providers to register to be approved for providing CE. The paper version of the on-line registration form is to be available to individuals affected by the Americans with Disabilities Act, individuals with religious beliefs that prevent them from registering on-line, individuals where on-line registration is not readily accessible, or at the discretion of the IRS. The paper version for registration will be available at the same time as the on-line registration is available.

2. Include a process to handle paper registration forms and checks for payment according to IRS-defined procedures around paper storage security requirements.

1.5 Renewal

1. CE Provider renewal will occur annually. A window for the renewal period will span over 3 months for all Providers to meet renewal prior to the expiration date.

Renewals will be offered September – November annually.

2. Do not authorize renewal if Provider has been noted as suspended or expelled in the system.

3. Secure on-line user fee to recover vendor costs prior to renewal.

4. Include a process to handle paper renewal forms as defined in 1.4, Paper

Registration of CE Providers and checks for payment.

1.6 System Interface

The CE Vendor’s system must interface with the IRS Registration Vendor for electronically recording and transmitting CE Provider information completed by PTIN holders. The CE Vendor will be expected to execute federally mandated Non-Disclosure, Interconnection Security Agreement, and Memorandum of Understanding with the IRS as a condition of establishing the interface. Additionally, the CE Vendor should be prepared to provide substantial documentation support to both Enterprise Life Cycle processes, as well as security requirements in order to ensure consensus and understanding around the interface requested. The CE Vendor’s development organization should currently hold a Capability Maturity Model Integration (CMMI) Level 2 or above certification. If vendors are unable to offer CMMI-DEV Level 2 certification, a plan to reach that level within a reasonable time frame is the next preferred. If vendors are unable to offer such a plan, demonstration of a comparable project management discipline acceptable to the IRS is expected.

1.7 Back Office Functionality

1. Enable secure remote access by IRS users. Provide role-based access and authorization with associated permissions to be identified (e.g. management, examiner, etc.).

2. Provide ability for the CE Providers to electronically submit, in bulk, individual tax return preparer CE coursework data to be passed on by the CE Vendor system to the Tax Professional PTIN System for association with the preparer’s PTIN account according to a pre-defined schedule beginning June 1, 2012. Interface requirements between CE and Registration Vendors will be developed and coordinated by the Registration Vendor, in conjunction with the IRS. The CE Vendor must ensure that the transmission and storage of CE data by PTIN be maintained within a secure interface/database.

3. Provide functionality to revoke an approved Provider status.

4. Enable an appeals process for denied CE Providers to appeal to the IRS and an appropriate letter notification process.

5. Systemically identify random candidates for post-audit reviews to be conducted by the IRS. Also provide ability to generate a manual post-audit review if deemed necessary by the IRS.

6. Provide ability to enter notes in CE Vendor system (e.g. waiting for substantiation documents for approval, denied, suspended with reasons/codes, post-audit review findings, etc.).

1.8 Automated Notice Issuance

1. Once the Provider is approved, issue an Approval Letter on behalf of the IRS with automatically generated provider and course numbers, outlining requirements, due dates with regard to reporting, or any items unique to the Provider’s situation according to IRS specifications. This correspondence should be available through the secure, password protected access for CE Providers covered in Section 1.3, number 8.

2. Include systemic notice issuance to Providers using pre-established business rules.

These notices will serve as reminders of upcoming or past-due requirements.

3. Include ability to issue ad-hoc notices (systemic or targeted), as needed.

4. Retain an electronic copy of all correspondence issued to Providers that is accessible from the Provider’s record.

5. Create and address letters, envelopes, and labels as needed.

6. Support batch mailing processing functions.

1.9 IRS Employee/TIGTA Access

IRS and Treasury Inspector General for Tax Administration (TIGTA) employees will be issued a secure method of accessing the CE system for unlimited remote access to the complete CE system as needed. This may occur in a phased in process and the IRS has not defined authorization levels at this time.

1.10 Customer Service

1. Develop a service delivery program to ensure that Continuing Education Providers can get responses to questions related to registration, renewal, processes, and timelines, and on-line application/account management system usability, as well as complete activities such as checking the status of their registration/renewal.

2. Provide approved CE providers and course information to the Registration Vendor to be used by tax preparers seeking to identify CE opportunities.

3. Develop a process to effectively address complaints from CE Providers. The Vendor will address the majority of the complaints; however, the Vendor should also establish a process for elevating appropriate complaints to the IRS. The IRS contact will determine a course of action for each complaint, and will provide a resolution and final answer to the Vendor or, at IRS option, return to the Vendor for resolution.

4. Make customer service available to Providers at least 14 days prior to the system availability.

5. Include in the service delivery program, at a minimum, the staffing of a toll-free call center to include access for deaf and hearing-impaired individuals and the development of the web site that includes on-line instructions/guidance regarding provider requirements, due dates, how to register/renew, etc.

6. Ensure service delivery is responsive to Provider needs, minimize wait/hold times, ensure reasonable coverage in all U.S. time zones, and consistently provide Providers with accurate and complete information.

7. Develop and make available to IRS employees internal processes and procedures for use by Vendor Customer Service Representatives to ensure quality and consistency of service delivery.

8. Develop a comprehensive Quality Assurance Plan that includes monitoring of calls, quality standards, review of paper processing activities and oversight/reviews of all processes. Enable remote access to call monitoring and all review functions by IRS employees.

9. Ensure that the call center operators who respond to applicant inquiries are trained on the specifics of the program to offer accurate answers to customers. Subject to IRS approval, the CE Vendor shall provide a process to confirm the identity of the caller and the specific information to be provided.

10. Ensure service delivery is responsive to candidate needs in the areas of security or privacy such as stolen passwords, identity theft, or other security and privacy anomalies that require swift and immediate attention.

1.11 508 Compliance

Vendor will ensure all communication is 508 compliant. If Video/Multimedia becomes a delivery mechanism and/or components of training then those technical provisions will be applicable in all identified 508 clauses. IRS certification will be required within 6 months of the award of the contract. Please refer to Section 508 later in this document for additional information. (Refer to

6.0 and Attachment 5)

1.12 Account Management

The CE Vendor will provide the following account management/CE Provider capabilities:

1. Include a log-in interface with lost user ID and/or password functionality (specifically, a password reset capability).

2. Include a log-in interface with an expired password change/revalidation capability.

3. Include capability for automated notice issuance to Providers using pre-established business rules. The Vendor, rather than the IRS, will have some responsibility for communications with the CE Providers. For example, notices to remind users of upcoming requirements (renewal, etc.). All electronic notifications should be transmitted securely.

4. Notify CE Providers who applied via a paper application the status of their application via U.S. mail.

5. Develop the capability to issue ad hoc notices, as needed.

6. Develop the capability to utilize a secure mailbox for the CE Provider. This may be used to securely respond to CE Provider inquiries and other Provider communications. For clarification see NIST SP 800-45, Guidelines on Electronic Mail Security and IRS IRM 10.8.1.4.6.3 on Electronic Mail (E-mail) and IRM 1.10.3, Standards for Using Email section 1.10.3.2.1 ("Secure Messaging & Encryption").

7. Undeliverable mail will be handled by the Vendor using guidelines approved by the

IRS.

8. Responsible for all costs related to this process at no cost to the Government. The Vendor will not be reimbursed by the federal government for fees, costs, or any other charges or expenses.

1.13 Quality Control

1. Establish processes to solicit feedback from CE Providers to assess and continuously improve the process. The feedback should be in the form of a customized survey for CE Providers. The Vendor will summarize the survey information as specified by the IRS and provide the information to the IRS in report format

2. Develop a comprehensive Quality Assurance Plan for all processes related to CE registration (i.e. development, customer service, administration, communication, transmission, complaint, and fee processing procedures).

1.14 Regular and Ad Hoc Reports

Provide IRS with CE Provider data via standardized and ad-hoc reports (to be determined by IRS), downloads, and/or extracts on a pre-determined, periodic and on an “as needed” basis.

Report related interfaces must be available 14 days before CE Provider implementation.

1.15 Ownership

IRS will own all data collected from the CE Providers. At the IRS’ discretion, the Vendor will be required to securely transfer any or all information to IRS. In addition, should the Vendor discontinue in this capacity, it will be required to securely transfer all data to the IRS or a new Vendor designated by the IRS.

1.16 System Interface

1. Electronically transmit individual PTIN holder’s CE information and provide CE Provider data to the Registration Vendors System using a secure interface.

2. Provide for IRS access to the applicable CE Vendor’s system to review and evaluate CE

Providers and other data in real time.

3. Overall system functionality shall minimize downtime and maximize responsiveness and usability – consistent with private sector best practices.

4. Execute the federally mandated Non-Disclosure, Interconnection Security Agreement, and Memorandum of Understanding with the IRS as a condition of establishing the interface.

5. The CE Vendor’s development organization should currently hold a Capability Maturity Model Integration (CMMI) Level 2 or above certification. If vendors are unable to offer CMMI-DEV Level 2 certification, a plan to reach that level within a reasonable time frame is the next preferred. If vendors are unable to offer such a plan, demonstration of a comparable project management discipline acceptable to the IRS is expected.

1.17 Administration

1. Commence CE Provider approval on or before September 30, 2011. If that date cannot be met, the Vendor should provide a timeline showing the earliest date anticipated for system readiness.

2. Offer CE Provider approval year round. The precise number of CE Providers is unknown. However, the IRS estimates that there will be approximately 2,200 - 3,000 Providers.

3. Host IRS site visits to ensure compliance. The CE Vendor must implement all IRS recommendations for security within a federally mandated timeframes such as TDP 8501 and IRM 10.8.1 after the site visit.

4. Comply with authentication requirements as outlined in OMB Memorandum M-04-04, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63, and the most current NIST SP 800-53 (requires that FISMA-governed systems follow SP 800-63 guidance for authentication).

5. Process user fee payments. The Vendor will be responsible for any insufficient fund issues.

2.0 Qualification of Contractor Personnel

The Vendor will validate the following personnel requirements:

1. Possession of experience in technical and project management expertise needed to successfully carry out the scope of work proposed;

2. Experience, expertise and educational background of staff members who will work on the project are sufficient to successfully accomplish the work they will perform;

3. Qualifications of staff members working on the project are sufficient to successfully carry out the work which they will perform;

4. Potential subcontractor staff members possess all of the above qualifications;

5. All products/services of other parties (if a partnership is needed) meet the above qualifications;

6. The approximate time each staff member will spend on the project; and

7. Successfully pass IRS background investigation.

3.0 Managerial and Administration Considerations

Vendor will provide/substantiate the following:

1. A timeline detailing the specific dates for completion and delivery of items specified in the proposal. Timeline must be realistic for carrying out the project;

2. An effective, efficient, and achievable quality assurance plan;

3. A high-value product, given the services/products described and the cost estimates provided by the Vendor;

4. The product offered is of a high quality product adhering to market value prices;

5. An outline for an effective, efficient, and achievable plan to transmit required data in electronic format; and

6. An outline for a sustainable database plan that includes all required data and reports.

4.0 Business Requirements

To ensure conformity with security standards required to safeguard sensitive information about or held by the government, the Vendor must address compliance with all of the requirements as follows:

4.1 Confidentiality of Information

The CE Vendor must ensure the confidentiality of all information received, obtained or generated by the Vendor in the course of operating this program. Requirements for safeguarding Privacy Act protected records and records designed as Official Use Only (OUO) are set forth in the IRS Acquisition Procedures (IRSAP) and in the Federal Acquisition Regulation (FAR) clauses 52.224-1 and (FAR) 52.224-2. Requirements for safeguarding non-tax information must match the requirements applicable to federal agencies as stated in the Privacy Act of 1974 (5 U.S.C. § 552a).

4.2 Review of Forms

Any forms, notices, screen shots, etc. designed by the Vendor for use by the applicants must be approved by the IRS before use in order to ensure compliance with applicable laws.

4.3 Safeguards

The Vendor is required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data. The Vendor shall afford the Government access to their facilities, installations, technical capabilities, operations, documentation, records, and databases. If new or unanticipated threats or hazards are discovered by either the Government or the Vendor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. Each officer or employee of the Vendor or sub-vendor at any tier to whom "Official Use Only" information may be made available or disclosed shall be notified in writing by the Vendor that "Official Use Only" information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such "Official Use Only" information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. Sections 641 and 3571. Section 641 of 18 U.S.C. provides, in pertinent part, that whoever knowingly converts to his use or the use of another, or without authority sells, conveys, or disposes of any record of the United States or whoever receives the same with the intent to convert it to his or her use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine or imprisoned up to ten years or both.

4.4 Disaster Recovery Plans

The CE Vendor should have detailed disaster recovery plans that comply with NIST and IRS requirements.

4.5 Ownership of Data

Any data collected by the Vendor will become property of the IRS. FAR 52.227-14, Rights in Data, further govern ownership.

4.6 Protection Against Misconduct

In performing the services described herein, the CE Vendor agrees to comply with, and assume responsibility for, compliance by his/her employees with the following requirements:

1. All work shall be performed under the supervision of the Vendor or the Vendor's responsible employees.

2. Any confidential Privacy Act (PA) information made available in any format shall be used only for the purpose of carrying out the provisions of this contract. Confidential PA information includes all identifying taxpayer information and PA records as defined by 5USC 552a (Privacy Act). This confidential PA information shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection by or disclosure to anyone other than an officer or employee of the Vendor shall require prior written approval of the Internal Revenue Service. Requests to make such inspections or disclosures should be addressed to the IRS Contracting Officer.

3. All confidential PA information shall be accounted for upon receipt and properly stored in locked file cabinets for paper and encrypted for electronic data before, during, and after processing. In addition, all related output shall be given the same level of protection as required for the source material.

4. The Vendor certifies that the data processed during the performance of this contract shall be completely purged from all data storage components of his/her computer facility, and no output will be retained by the Vendor at the time the IRS work is completed. If immediate purging of all data storage components is not possible, the Vendor certifies that any IRS data remaining in any storage component will be safeguarded to prevent unauthorized inspections or disclosures.

5. Any spoilage or any intermediate hard copy printout, which may result during the processing of IRS data, shall be given to the IRS Contracting Officer or his/her designee. When this is not possible, the Vendor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and shall provide the IRS Contracting Officer or his/her designee with a statement containing the date of destruction, description of material destroyed, and the method used.

6. Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, should be guilty of a misdemeanor and fined not more than $5,000.

4.7 Subcontractors

No work involving information furnished under this contract will be subcontracted without the specific written approval of the IRS Contracting Officer. Subcontractors are held to the same level of confidentiality and privacy requirements inclusive of special contract requirements as is the CE Vendor.

4.8 Controlled Access Protections

All computer systems processing, storing and transmitting tax data must meet or exceed controlled access protections (CAP) wherein the operating security features of the system has the following minimum requirements: an approved security policy, accountability, assurance and documentation. All security features must be available (object reuse, audit trails, identification/authentication and discretionary access control) and activated to protect against unauthorized access, use, disclosure, disruption, modification, or destruction of federal tax information. All computer systems are required to be compliant with the Federal Information Security Management Act of 2002 (FISMA) pursuant to Section 3544(a) (1) (A) (ii). In this regard, the most current NIST standards and guidance must be implemented and adhered to by the Vendor.

4.9 Unauthorized Inspection/Disclosure

Should a Vendor or one of his/her officer(s) or employees make any unauthorized inspection(s) or disclosure(s) of confidential PA information, the terms of the termination for cause clause (FAR 52.212-4(m)), incorporated herein by reference, may be invoked, and the Vendor will be considered to be in breach of this contract.

5.0 Disclosure of Information

5.1 Information Security/Federal Information Security Management Act (FISMA)

Pursuant to the Federal Information Security Management Act (FISMA), Title III of the E- Government Act of 2002, P.L. 107-347, the Vendor shall provide minimum security controls required to protect Federal information and information systems. The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability.

As determined by the IRS, the Vendor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a Vendor or sub-vendor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data. IRS information systems operated by the Agency or by a Contractor at the direction of the IRS are defined as a General Support System (GSS), Major or Minor Application with security categorization impact level of low, moderate or high according to the results of a Federal Information Processing Standard (FIPS) Publication 199 impact analysis.

5.2 Treasury/IRS Policies for Information Technology (IT) Security

The Vendor shall comply with Treasury Directive Publication (TD P) 15-71 Department of Treasury Security Manual, TD P 85-01 Treasury’s Information Technology Security Program, and Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance. The Vendor shall comply with IRS Internal Revenue Manuals (IRM), Law Enforcement Manuals (LEM) and successor documents when developing or administering IRS information and information systems.

5.3 Security Assessment and Authorization (SA&A) Process

Vendors systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews and continued security authorization. Some of the key elements of this process are risk assessments, security plans, security control testing, a Privacy Impact Assessment (PIA), contingency planning, and technical system certification and business owner system authorization. All systems that complete this process will, at a minimum, meet NIST guidance, as required by the IRS. The required NIST Security Assessment and Authorization process documented in NIST Special Publication (SP) 800 37, revision1;

Guide for Applying the Risk Management Framework to Federal Information Systems.

5.4 Federal Desktop Core Configuration

The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the Federal

Desktop Core Configuration (FDCC). This includes Internet Explorer 7 and 8 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and Windows 7.

For the Windows XP settings, see: http://csrc.nist.gov/itsec/guidance_WinXP.html, and for the Windows Vista settings, see: http://csrc.nist.gov/itsec/guidance_vista.html. In accordance with OMB issued Policy memorandum M-07-11, “Implementation of Commonly Accepted Security Configurations for Windows Operating Systems: “operating systems [Windows XP and VISTA] and/or plans to upgrade to these operating systems must adopt these standard security configurations.”

5.5 Vendor System Review/Site Visit

The Vendor shall be subject to, at the option/discretion of the agency, periodic testing, (but no less than annually) to evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls, as indicated by the security plan, of every information system that maintains, collects, operates or uses federal information on behalf of the agency. The agency and Vendor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The Vendor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

5.6 Information Security and Awareness Training

The Vendor shall comply with IRS mandatory annual Computer Security Awareness briefings, UNAX briefings and receive an initial orientation before access to IRS Information Systems. Perform HSPD-12 Personal Identify Verification, physical and personnel security screening / background investigation for approval of a vendor badge for staff like access; then obtain 5081 approval to IRS information systems. All Vendors and Sub-vendor employees who are involved with the management, use, programming or maintenance of IRS information systems must complete the IRS mandatory Computer Security briefing.

Cyber security oversees a series of security awareness training sessions; in particularly the Unauthorized Access (UNAX) training and Computer Security Awareness training, which is conducted annually and mandatory for all IRS employees and Vendors. FISMA requires continuous security awareness training to inform personnel, including vendors, other users, and individuals with significant IT Security responsibilities that support the operations and assets of the agency to receive specific training on agency guidance, policies and procedures to reduce information security risks.

All Vendors and Sub-vendor employees who could have access to sensitive IRS information must complete the mandatory UNAX briefing. Vendors shall certify the completion of training by their employees annually. The certification shall be submitted to the contracting officer, with a copy to the COTR and Cybersecurity Training Team.

5.7 Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

The Vendor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The Vendor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite.

http://csrc.nist.gov/itsec/guidance_WinXP.html http://csrc.nist.gov/itsec/guidance_vista.html

In those instances where personally identifiable information is transported to a remote site of the Vendor, the Vendor shall implement NIST 800-53 security controls and IRS specific security procedures to ensure that information is transported in encrypted form.

The Vendor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information.

5.8 Safeguarding / Protecting Sensitive Personally Identifiable Information (PII)

Sensitive PII is defined by OMB as “any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” Information systems can be either electronic or manual. IRM 10.8.1 require IRS' sensitive information is to be handled and protected at the Vendor's site, including any information stored, processed, or transmitted using the Vendor's computer systems. Vendor personnel shall perform a background investigation and/or clearances required; receive security awareness and training required for Vendor activities or facilities; and any facility physical security requirements.

Most IRS information is categorized as SBU. This includes:

a) Taxpayer information;

b) Employee data - such as evaluations;

c) Personnel and payroll records;

d) Financial and statistical information on agency operations not normally available for public disclosure; and

e) Vendor/vendor proprietary information provided to the government by third parties.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Management Act (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information.

Therefore, the Vendor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information, such as the following guidance from OMB Policy M-06-16:

1. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by an Executive or an individual he/she may designate in writing;

2. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining agency access;

3. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and

4. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

5.9 The National Institute of Standards and Technology (NIST) Guidance for

Information Security

The Vendor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The Vendor shall establish the minimum security controls identified in the most current NIST SP 800-53 Recommended Security Controls for Federal Information Systems and Organizations, the most current NIST 800- 53A Guide for Assessing the Security Controls in Federal Information Systems and Organizations, and FIPS 200 Minimum Security Requirements for Federal Information and Information Systems. The Vendor shall follow the best practices and guidance established by the most current NIST special publication 800 Series and FIPS for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

5.10 Handling Information Security Incidents

The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non-Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

The Vendor shall maintain procedures for detecting, reporting, and responding to security incidents, and mitigating risks associated with such incidents before substantial damage is done to federal information or information systems. The Vendor shall immediately report all computer security incidents that involve IRS information systems to the IRS Computer Security Incident Response Center (CSIRC) using the contact information indicated below. Any theft or loss of IT equipment with federal information / data must be reported within one hour of the incident to CSIRC. Those incidents involving the loss or theft of sensitive but unclassified (SBU) data (i.e. taxpayer, PII) shall be reported to CSIRC, first-line manager, and Treasury Inspector General for Tax Administration (TIGTA). Based on the computer security incident type, CSIRC may further notify the Treasury Computer Security Incident Response Capability (TCSIRC) in accordance with TCSIRC procedures.

6.0 Section 508 Compliance

This contract is subject to Section 508 of the Rehabilitation Act of 1973. Contract clauses which describe Section 508 requirements can be found in Section III, Paragraphs 22.0 through 24.0. Information about how Section 508 will be evaluated can be found in Section IV, Paragraph 9.0. The 508 Test Plan template is included as Attachment 5 to this RFP.

7.0 Survey of Public

The Paperwork Reduction Act of 1980 (Pub. L. 96-511) imposes a requirement on federal agencies to obtain approval from the Office of Management and Budget (OMB) before collecting information from more than 10 members of the public. If the activities proposed by the Vendor require such collection, preparation of an OMB Package containing the information detailed in Attachment 2 is required.

7.1 Kickoff Meeting

Within five (5) business days of award, the CE Vendor shall meet with IRS representatives at a mutually agreed upon location in the Washington, DC area or via teleconference. The kickoff meeting will include a discussion and adjustments, as required, to the Vendor’s plan of execution submitted with its proposal. The Vendor shall provide minutes of the kickoff meeting to the government five business days after the conclusion of the meeting.

7.2 Vendor Background Investigation

All vendor employees assigned to the contract are subject to a background investigation as detailed in Attachment 1.

7.3 Performance Measurement

The proposed program shall contain a metrics and/or a proposed method for measuring vendor performance. The Performance Measurement Program should, at a minimum, address efficient, effective service delivery and IT functionality.

7.4 Post-Implementation Evaluation

The Vendor will evaluate implementation within 6 months of commencement, and annually thereafter for the entire program. Evaluation to include a summary of National and International implementation activities, key successes, barriers encountered, and recommended improvements and next steps.

SECTION II - PRICING

1.0 PRICING

1.1 NO-COST BASIS

The vendor(s) assume the responsibility for the return preparer continuing education and tracking system requirements on a no-cost basis to the government. The vendor(s) will not be reimbursed by the federal government for fees, costs, or any other charge or expense. The vendor is expected to cover its cost and any profit by charging reasonable provider fees.

1.2 PRICING TABLE

The contractor shall provide “provider fees” for the base period and for each option period.

Base Period: Date of Award through 24 consecutive months from date of award

Fee Charged

Provider Fee $___________ Option Period 1: 12 consecutive months

Fee Charged

Provider Fee $___________ Option Period 2: 12 consecutive months

Fee Charged

Provider Fee $___________ Option Period 3: 12 consecutive months

Fee Charged

Provider Fee $____________

SECTION III - CONTRACT CLAUSES

1.0 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/current/html/FARTOCP52.html#wp372482

NUMBER TITLE DATE

52.202-1 DEFINITIONS JUL 2004

52.203-3 GRATUTIES APR 1984

52.203-11 CERTIFICATION AND DISCLOSURE

REGARDING PAYMENTS TO INFLUENCE

CERTAIN FEDERAL TRANSACTIONS

SEP 2007

52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE

CERTAIN FEDERAL TRANSACTIONS

OCT 2010

52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON

RECYCLED PAPER

AUG 2000

52.204-7 CENTRAL CONTRACTOR REGISTRATION APR 2008

52.204-9 PERSONAL IDENTITY VERIFICATION OF

CONTRACTOR PERSONNEL

SEPT 2007

52.209-5 CERTIFICATION REGARDING

RESPONSIBILITY MATTERS

APR 2010

52.209-6 PROTECTING THE GOVERNMENT’S

INTEREST WHEN SUBCONTRACTING WITH

CONTRACTORS DEBARRED, SUSPENDED,

OR PROPOSED FOR DEBARMENT

SEPT 2006

52.212-4 CONTRACT TERMS AND CONDITIONS—

COMMERCIAL ITEMS

JUNE 2010

52.217-5 EVALUATION OF OPTIONS JULY 1990

52.227-14 RIGHTS IN DATA—GENERAL DEC 2007

52.237-1 SITE VISIT APR 1984

(End of clause) https://www.acquisition.gov/far/current/html/FARTOCP52.html#wp372482

2.0 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (OCT 2010)

(a) The Contractor shall comply with the following Federal…