DRAFT_TIRNO-16-R-00026_6.6.2016.pdf

OMB Control No. 1505-0081

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER UNDER DPAS (15

CFR 700)

RATING

PAGE OF PAGES

1 | 196

2. CONTRACT NUMBER

3. SOLICITATION NUMBER

DRAFT TIRNO-16-R-00026

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

5. DATE ISSUED

06/06/2016

6. REQUISITION/PURCHASE NO.

Q-7-QF-02-PO-R01 000

7. ISSUED BY CODE 12163 8. ADDRESS OFFER TO (If other than Item 7) CODE 3678

Internal Revenue Service 6009 Oxon Hill Road, Suite 500

Oxon Hill, MD 20745

IRS Procurement 6009 Oxon Hill Road Oxon Hill, MD 20745

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder”

SOLICITATION

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in ________________ until PM (Hour) local time (Date).

CAUTION LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR

INFORMATION

CALL:

A. NAME B. TELEPHONE (NO COLLECT CALLS) C. E-MAIL ADDRESS

Tara Scott

AREA CODE

NUMBER

240-613-7467

EXT.

Tara.scott@irs.gov

11. TABLE OF CONTENTS

() SEC. DESCRIPTION PAGE(S) () SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE PART II - CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 2 X I CONTRACT CLAUSES 125-145

X B SUPPLIES OR SERVICES AND PRICE/COST 2-4 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 5-56 X J LIST OF ATTACHMENTS 146

X D PACKAGING AND MARKING 57 PART IV - REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 58-59

X K

REPRESENTATIONS, CERTIFICATIONS

X F DELIVERIES OR PERFORMANCE 60-65 AND OTHER STATEMENTS OF OFFERORS 147-173

X G CONTRACT ADMINISTRATION DATA 66-76 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 174-189

X H SPECIAL CONTRACT REQUIREMENTS 77-124 X M EVALUATION FACTORS FOR AWARD 190-196

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____ calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS AMENDMENT NO. DATE AMENDMENT NO. DATE

(The offeror acknowledges receipt of amendments to the 0000

SOLICITATION for offerors and related documents numbered and dated):

15A. NAME

AND

ADDRESS

OF

OFFEROR

CODE FACILITY 16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN

OFFER (Type or print)

15B. TELEPHONE NUMBER 15C. CHECK IF REMITTANCE

ADDRESS IS DIFFERENT FROM ABOVE -

ENTER SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE 18. OFFER DATE

AREA CODE

NUMBER

EXT.

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c) ( ) 41 U.S.C. 253(c) ( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN (4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

X

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (Rev. 9-97)

Previous edition is unusable Prescribed by GSA – FAR (48 CFR) 53.214(c)

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 PURPOSE

The purpose of this contract is to acquire performance-based services for the provision of Managed Web Portal services for the Internal Revenue Service (IRS). This effort supports the framework and functionality of the IRS portals services utilized by the American Taxpayer, IRS Employees and Registered Users.

B.2 TYPE OF CONTRACT

This is a single, Indefinite Delivery, Indefinite Quantity (IDIQ) contract with a two (2) year base, and three (3) one year (12 months) option periods. The IRS has chosen to pursue an IDIQ contract to reduce lead time to award task orders and maximize the flexibility of selecting contract types appropriate to the specific tasks under consideration.

At the discretion of the Contracting Officer, the Government may use a variety of contract types under this contract, including: Firm Fixed Price (FFP), Time and Materials (T&M), or a combination thereof. At the discretion of the government, use of an “Award Term” incentive plan may be utilized to reward a contractor for excellent performance. The Contracting Officer will utilize the performance assessment information generated as specified in the guidelines of the

Award Term Plan found in Section J, Attachment TBD to determine whether the Contractor has earned any award term extension(s) to the period of performance of the resulting contract.

B.3 BID RATES FOR PREPARATION OF FIRM FIXED PRICE/TIME AND MATERIALS

TASK ORDERS

All task orders issued on a Firm Fixed Price (FFP) basis will be priced in accordance with the fully burdened labor rates, including profit/fee, developed in response to the excel spreadsheet found in Section J, Attachment TBD. The rates are the offeror’s prices to the managed service area, and in accordance with any additional information that provides the labor categories used in support of the contract in which case the loaded hourly rates are the ceiling price rates and the Contractor may, at its discretion, elect to propose lower hourly rates on a task by task basis.

All task orders issued on a Time and Materials basis will be priced in accordance with the fully burdened labor rates developed in response to tables found in Section J, ATTACHMENT TBD and Section G, Requirements for other than Fixed Price Task Orders. Indirect costs allocated to any direct materials and other direct costs shall be proposed consistent with the payment requirements in the clause at FAR 52.216-7, Allowable Cost and Payment Clause (JUN 2013).

The prices established in Section J, Attachment TBD shall serve as a list of the ceiling prices that the Government shall pay for any particular CLIN in any of the task orders issued under this contract.

At the request of either the contractor or the Government, the contractor may throughout the life of the contract propose additional labor categories, rates and descriptions, assets and ODCs that are necessary to support requirements of this contract. These additional CLINs will be negotiated on a case-by-case basis. The additional CLINs proposed, upon determination by the Government that they are fair and reasonable, will be incorporated into the Cost/Price Schedule, by modification to this contract.

B.4 MINIMUM OBLIGATED AMOUNT

The IDIQ contract includes an initial obligation of funds in the amount of $ TBD to cover the minimum order guarantee. IRS is required to order and the Contractor is required to furnish the minimum order amount of services.

B.5 MAXIMUM CONTRACT CEILING

This is a single award IDIQ contract with an overall ceiling price of $500,000,000.00. The maximum aggregate dollar value (inclusive of estimated cost, fixed price, profit/fee for all task orders issued) shall not exceed the established contract price ceiling. Should any Award Terms be granted to an Offeror that will extend the life of the contract past the third option period (December 30, 2020-December 29, 2021) then the contract’s maximum ceiling may be modified by the Contracting Officer to incorporate performance based payments. In accordance with FAR subpart 32.1004(b)(2)(ii) Procedures (Performance Based Payments), all award term financing (when combined) shall not exceed 90 percent of the contract price if on a whole contract basis, or 90 percent of the delivery item price if on a delivery item basis.

B.6 DISCOUNTS

The offeror is encouraged to offer any and all discounts for supplies and services provided under future task orders for the managed web portals. The type or amount of discount may vary based on the circumstances of each particular task order and should be proposed in accordance with the Contractor’s pricing policies.

B.7 MOST FAVORED CUSTOMER AND PRICE REDUCTIONS

All prices under this contract shall be equal to or lower than the Contractor’s, including teaming partners’, and subcontractors’ most favored customer (unless otherwise agreed upon by the Government and the Contractor) as follows:

a) The Contractor shall reduce all CLIN prices included in this contract to be equal to or lower than prices paid by other commercial and Government customers for the same or similar line items.

b) The Contractor shall reduce prices for products and labor services under this contract to be equal to or lower than those paid by other commercial or Government customers for the same or similar services. At a minimum, all prices must be equal to or less than prices established under the General Services Administration (GSA) Federal Supply Schedule Program.

Price reductions shall be subject to the following conditions:

a) The Contractor shall propose all price reductions to the Contracting Officer and Enterprise Technology Implementation (ETI) Office.

b) The proposed price reduction shall be effective on the first day of a given invoicing period following the government’s approval.

c) The proposed price reduction shall be applicable to all task orders.

d) Price reduction proposals shall include all contract pricing tables, and the effective date(s) of the price reduction. The Contractor shall provide all revised pricing tables in an electronic format (or formats) to be specified by the Government at the time of submission.

e) Should the Government execute a price reduction modification on a date after the proposed price reduction effective date, the price reduction shall be deemed to have occurred on the first day of the next invoicing period for that service, following the proposed price reduction effective date.

Price reductions will become effective beginning the billing period after the Government makes a written “Notice of Price Adjustment.” This written notice will be followed by a price reduction modification to the contract.

All contractor proposed price reductions must be agreed to by the Government. In some instances, the Government may not agree to the price reduction, especially if the proposed price reduction may result in incompatibility with other IRS systems. If the Contractor does not agree with the Government’s “Notice of Price Adjustment”, they shall provide a “Notice of Disagreement” to the Government within 30-days of receipt of the price adjustment notice. If agreement cannot be reached within five (5) business days after issuance of the “Notice of Disagreement,” the disagreement will be resolved in accordance with the provisions of the “Disputes” clause in Section I.1 (FAR 52.233-1).

Section C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 INTRODUCTION

The Internal Revenue Service (IRS), Enterprise Technology Implementation Division (ETI), has embarked on a transformation program for its web portals referred to as the Integrated Enterprise Portals (IEP). The IRS seeks a comprehensive contract vehicle designed to enable flexibility to manage the existing services and accommodate the changing dynamics of the requirements due to Congressional mandates placed on the IRS.

The IEP is a fully scalable, managed private cloud-like, virtualized infrastructure capability dedicated to the IRS that provides technology services to internal and external users. The IEP is the front door to the IRS backend and plays a mission critical role in serving tax payers, tax preparers and employees. The IEP provides fully integrated core services, including IT infrastructure, operations, security, application, integration and support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles. (Refer to the Solicitation Section TBD, for details of the existing landscape).

Four distinct IRS portals under the Integrated Enterprise Portal (IEP) umbrella currently support the IRS user communities: the IEP Public User Portal (PUP) (also known as irs.gov), the IEP Registered User Portal (RUP), the IEP Employee User Portal (EUP), and the IEP Transaction Portal Environment (TPE), each with its own Information Technology (IT) infrastructure and governance. These portals are described below:

The IEP PUP is the IRS external or Internet portal, irs.gov, which allows unrestricted public access to non-sensitive materials and applications forms, instructions, news, and tax calculators. No authentication is required for access to any materials on the

IEP PUP.

The IEP RUP is the IRS external portal that allows registered individuals and third party users (collectively, “partners” – registration and login authentication required) and other individual taxpayers or their representatives access for interaction with selected tax processing and other sensitive systems, applications, and data.

The IEP EUP is the internal IRS portal that allows IRS employee users to access IRS data and systems, such as tax administration processing systems, financial information systems, and other data and applications, including mission critical applications. Registration and authentication are required for access to sensitive and mission critical applications.

The IEP TPE hosts information on the Affordable Care Act (ACA) legislation which enables the IRS to support initial enrollment via the ACA Health Insurance Marketplace. IEP TPE has processed more than 45 million transactions between the US Department of Health and Human Services (HHS) Center for Medicare and Medicaid Services and the IRS, which has allowed more than 7 million Americans to enroll successfully via the ACA Health Insurance Marketplaces.

The government is seeking Contractor support to provide fully managed, scalable Web hosting services for the IRS’ external stakeholders and its internal customers. The selected Contractor will be responsible for providing all labor, hardware, software, equipment, materials, communications, facilities, and other necessary IT infrastructure to implement, deploy, operate, manage, and support the existing websites in a Federal Information Security Management Act (FISMA) moderate secure environment, as well as its underlying technology infrastructure.

C.1.1 BACKGROUND

The IRS Integrated Enterprise Portals (IEP) Contract TIRNO-11-D-00041 was awarded to Accenture Federal Services, LLC on May 19, 2011 to rehost and migrate web content for three existing portals: PUP, EUP, and the RUP to a new content management system with common IT infrastructure and governance. A fourth portal TPE was added to the IEP platform in YEAR to accommodate congressional mandates for the IRS under the Affordable Care Act (ACA) legislation. The contract was established with a five-year base period and five 12-month option periods for a total contract term of 10 years. At time of award, the estimated value over the 10-year period was $320 million but in base year four the contract value was increased to $480 million.

Since contract award, two major within-scope development efforts were initiated which needed and will continue to need enhanced portal services - the Modernized e-File (MeF) system which necessitated capacity enhancements, and the passage of the federally mandated ACA which required new portal capabilities to be developed. To streamline the development and integration of existing and new applications within the new portal, the Integrated Test Environment was designed and implemented. Finally, new portal Application Integration/Systems Integration (AI/SI) services were also added to assist application developers for existing and future applications in adapting to the new portal architecture. AISI is integral to the portal service offering to ensure continuous support for transitioning existing applications and integrating new applications seamlessly onto the new portal platform.

There have been multiple task orders issued under this IDIQ contract relating to various aspects of design, analysis, planning, development, web hosting, program management, and operation and maintenance (O&M) of the PUP, RUP, EUP and TPE.

The IEP is a fully scalable, managed private cloud-like, virtualized infrastructure capability dedicated to the IRS that provides technology services to internal and external users. The IEP is the front door to the IRS backend and plays a mission critical role in serving tax payers, tax preparers and employees. The IEP provides fully integrated core services, including IT infrastructure, operations, security, application, integration and support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles. (Refer to the Solicitation Section TBD, for details of the existing landscape).

C.2 CONTRACT CONSTRAINTS AND OBJECTIVES

The IRS has established a set of objectives for this acquisition. The Contractor’s approach to the work is expected to support the IRS in achieving these objectives. In developing proposed approaches, the Contractor should note that it is bound by the following constraints (the Contractor may propose unique and innovative approaches that may differ as long as the outcomes are equivalent).

C.2.1 CONTRACT CONSTRAINTS

2.1.1 Constraint: Proposed approaches must utilize standard and best practices in designing and implementing all IT infrastructure platforms and will avoid the use of custom or proprietary solutions.

2.1.2 Constraint: Proposed solutions which are cloud-based must comply with IRS security policy, IRM 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy, regarding cloud deployment models. Any proposed cloud solutions must be Federal Risk and Authorization Management Program (FedRAMP) compliant.

2.1.3 Constraint: Proposed approaches must comply with the project management standards from the Project Management Institute’s (PMI’s) Government Extension to the PMBOK® Guide, Current Edition; A Guide to the Project Management Body of Knowledge (PMBOK® Guide), Current Edition; and The Standard for Program Management, Current Edition.

2.1.4 Constraint: Proposed approaches to software development must be consistent with Web agile development best practices and compatible with IRS Policy and Procedures Memorandum No. 39.1(B), Capability Maturity Models® for Software.

2.1.5 Constraint: Proposed approaches adhere to all applicable Internal Revenue Manuals

(IRMs). (Refer to the Solicitation Section TBD.)

2.1.6 Constraint: Proposed approaches adhere to all applicable National Institute of Standards and Technology (NIST) special publications and manuals, most current version.

2.1.7 Constraint: Proposed approaches provide an IT infrastructure where all facilities, hardware, software, network, and network connections are located in the United States of America and all connections, and contacts to the IRS hardware, software, network, and workload are approved by the IRS.

2.1.8 Constraint: Proposed approaches should result in systems that are scalable (up or down) to meet expected changes in processing volumes.

2.1.9 Constraint: The proposed approach must comply with FAR criteria regarding all items within the design being IPv6 capable, with the proposed approach including the operation all devices in a dual stack (IPv4/IPv6) environment.

2.1.10 Constraint: Proposed approach ensures that each item delivered under this contract is able to accurately transmit, receive, process, and function correctly using the Internet Protocol Version 6 (IPv6) and complies with the current USGv6 Product Profile (NIST SP 500-267, Profile for IPv6 in the U.S. Government). Each item delivered is supported by the Contractors’ IPv6 technical support.

2.1.11 Constraint: The Website Help Desk solution shall be provisioned in a secure institutional facility in the United States, and shall not be supported by any home-based operation or agent. All Help Desk personnel must be located within the United States and pass the background check procedures required by the IRS.

C.2.2 CONTRACT OBJECTIVES. The IRS seeks a comprehensive contract vehicle designed to enable flexibility to manage the existing services and accommodate the dynamic changing requirements of the agency moving forward. The four primary objectives to be fulfilled through this acquisition effort:

1. Maintain current operational effectiveness and high level of customer service, expand Portal functionality in response to evolving customer requirements, provide tailored sets of web services across the multiple IRS divisions, and optimize technical capabilities of the Portal platform, by identifying efficiencies in analysis, design and implementation of functional enhancements.

2. Strengthen the security posture of IEP, by improving processes and utilizing tools to identify, report, and correct or mitigate security-related incidents and anomalies.

Operating state-of the-art security products and techniques to future Portal design and development efforts and to the implementation of advanced technical capabilities.

3. Enhance the IRS Project Manager’s (PM’s) oversight and accountability for the Portal solution and reduce operational costs.

4. Establish a contract structure to include performance based services, measurable standards and performance incentives.

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

This Performance Work Statement (PWS) describes the scope and expectations for a Performance-Based Acquisition with mission-oriented, outcome-driven performance measures and incentives. The scope of work to be performed is envisioned to include the following distinct operational areas:

Portal Service and Program Integration Services to operate the IRS environment within specified scope, quality, time, and cost objectives, and as described in IRS Program Management, Project Management, Software Development Lifecycle, and Operations Management Framework.

Portal Infrastructure Services that include managing the physical facilities furnished with hardware, software, middleware, network connectivity, and peripherals required to establish and host the new IEP environment, as well as services needed to improve IEP operations in new functional areas arising during the period of performance

Portal Web Hosting Services that provide comprehensive application hosting support for application development, testing, integration and production, including provisions for capacity management, incident management, performance monitoring, and application infrastructure integration support

Portal Security Services to ensure security processes and procedures are consistent with industry and government best practices, such as NIST Special Publication (SP) 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems

Portal Application Services that provide the enhancement and break/fix support for Contractor-managed applications on IEP 1.5, including maintaining all tools/applications, continual optimization of the site based on user experience, working with customers to identify requirements, and designing, development, testing and releasing of the application.

Portal Website Help Desk Services that provide the irs.gov website Help Desk to serve taxpayers as a “first aid station” for IEP 1.5 website questions, such as navigation of IRS content and forms retrieval. The irs.gov website Help Desk provides a complementary service to the IRS toll-free tax assistance line and, therefore, does not respond to tax questions, personal inquiries, or Economic Stimulus queries.

Throughout the period of performance, and dependent upon funding, the IRS may expand the baseline Portal functionality, incurring full life-cycle implementation of new functionality to be integrated with the existing solution. Such implementations will be conducted in accordance with the IRS Enterprise Lifecycle (ELC) process for the appropriate ELC, and will also include stakeholder outreach and communications, organizational change management, end user training, and transition to O&M support. The Contractor will be responsible for O&M of the expanded baseline.

The Contractor shall execute key tasks, as described further in the following sections of this performance work statement, which support the successful execution of the Portal program and its associated deliverables.

C.3.1 Portal Service and Program Integration Services

The Contractor shall define and document the Program Management, Project Management, Software Development Lifecycle, and Operational Management Structures. Portal Service Management Services required under this contract include, but are not limited to, management of project Contractor personnel; creation, monitoring and coordination of activities; project reporting; attending governance and project related meetings; working collaboratively with the Government; assisting the Government in preparation of supporting documentation; and producing all deliverables identified under the overall contract.

Specific activities include:

As part of the Service Strategy process, the Contractor shall evaluate and propose optimizations to irs.gov visitor interactions, technologies, staffing, or business practices that might allow the Contractor and the IRS to perform services in a more productive, cost-effective, secure, or reliable manner as consistent with overall IRS objectives.

The Contractor shall establish a process to manage, prioritize, and allocate funds for a pool of ad hoc staff resources available for new project services.

The Contractor shall develop and maintain an Integrated Master Schedule which incorporates the Contractor, sub-contractor and IRS stakeholder detailed tasks necessary to ensure successful project execution.

The Contractor shall coordinate a quarterly Customer Satisfaction Review process based on the stakeholder list provided by the IRS ETI. The Customer Satisfaction Review process will be coordinated in conjunction with the IRS ETI.

At no time during the performance of the contract shall the level of conformance go below the level of conformance in place at the time of award. At no additional cost, the contractor shall provide information, documentation, and support relative to the supplies and services as described in the contract PWS.

The Contractor shall utilize standard and best practices in designing and implementing all IT infrastructure platforms and will avoid the use of custom solutions, wherever possible; the Contractor must receive government concurrence on the solution.

The Contractor shall provide the Government with visibility into changes in the IT infrastructure.

The Contractor shall keep the IRS informed of all issues while working with IRS application and middleware groups to manage the production environment according to established Service Level Objectives (SLOs).

The Contractor shall establish processes that adhere to the IRS ELC, and will maintain the day-to-day operations using the Information Technology Infrastructure Library (ITIL) process to ensure functionality, reliability, availability, performance, and security of the applications, business systems, tools, and data residing in or passing through the IRS Web hosting environment, and document these processes.

The Contractor shall support all changes as needed by the IRS to the underlying SLO for Performance Targets around Requests, Changes and Releases on the IEP. The Contractor shall routinely report Service Level Objectives metrics.

The Contractor shall propose a methodology for program measurement in the Quality Assurance Program, including a process for developing, implementing, and monitoring a set of performance measures to ensure that program activities are effectively and efficiently supporting both business and IT strategies. This includes implementing program-wide measures, quantifiable outcomes, and providing an approach for monitoring actual-versus-expected performance.

Deliverables and Information

Deliverables for Portal Service and Program Integration Services are available in Appendix TBD

C.3.2 Portal Infrastructure Services

The Contractor shall define and document the portal IT infrastructure, including the physical facilities (hardware, software, middleware, network connectivity, and peripherals) required to establish and host the new IRS Web environment, as well as services needed to improve portal operations in any new functional areas arising during the period of performance.

The Contractor shall provide an IRS Web Hosting environment that will meet IRS’ target service levels and maximize the availability of the new IRS Web environment, while protecting all IEP 1.5 assets and IRS data and processes from any type of loss and certify that it is ready for use based upon mutually agreed to criteria with the IRS.

The Contractor shall provide IEP hosting environments to allow deployment of IRS created or acquired applications using libraries, services, and tools supported by the IEP

Contractor. This will include, but not limited to, appropriate operating systems, databases, middleware, software tools, and managed services for application development, testing, and production operation. The Contractor shall design the infrastructure to be flexible, cost effective and expandable. IEP 1.5 infrastructure service shall be compliant with IRS Security requirements. Also, see the Portal Security Services section of this PWS.

Additionally, these environments shall meet the following minimum characteristics:

1. Broad network access for IEP 1.5 capabilities to be readily available over the network and accessed through standard mechanisms.

2. Resource Pooling for IEP 1.5 resources to be pooled to support the multiple IEP environments, with different physical and virtual resources dynamically assigned and reassigned according to IEP 1.5 stakeholder demand.

3. Rapid Elasticity such that IEP resources can be elastically provisioned and released, in some cases automatically, to rapidly increase and decrease in scale, commensurate with IEP demand.

4. Measured Service allowing IEP environments to be managed effectively and optimized by leveraging metering capabilities appropriate to the type of service usage (e.g., storage, processing, bandwidth, and active user accounts).

The Contractor shall provide IT infrastructure capacity that will dynamically allocate capacity resources to satisfy all IEP workloads, including, but not limited to, hosted IRS applications.

The Contractor shall demonstrate to the IRS, with key capacity indicators, that such infrastructure capacity requirements are satisfied.

The Contractor shall provide a resilient, highly available infrastructure service. The infrastructure service should, as minimum, be sufficient to maintain consistent response time and availability, and meet the IRS web hosting service level targets regardless of events such as, but not limited to, multiple infrastructure components degradation or failures, natural disasters, or power grid failures.

The Contractor shall integrate IEP infrastructure with the IRS external user and with IRS backend systems with PUP/RUP/EUP/TPE portal workload patterns. The Contractor shall demonstrate the successful IEP integration.

The Contractor shall provide an IEP 1.5 infrastructure, including production and non-production environments that is IPv6 enabled and dual stacked. This functionality shall be in place in IEP 1.5 from the Internet-facing platforms to the edge routers interfacing with the IRS, including, but not limited to:

Network elements (routers, firewalls, switches, load balancers, etc.)

Transport readiness (Wide Area Network (WAN), Internet and wireless access) Remote access Extranet readiness including provider transport services and solutions IP address and address resolution solutions Must comply with IRS IPv6 addressing schema Must use IRS IPv6 assigned addresses internal to the enterprise IP services such as Domain Name System (DNS)/Dynamic Host Configuration

Protocol (DHCP), Proxies, load balancers All platforms, both Web and application servers

The IRS intentions are that:

From Internet-Facing: an Internet user can access IEP 1.5 from the IPv4 and IPv6

Internets From IRS -Facing: The IRS has embarked on dual stacking the internal IRS enterprise, thus allowing network communications over IPv4 or IPv6, based on the functionality of the applications operating on the platforms (Note: Existing applications are not designed to use both IPv4 and IPv6 packets to achieve their functionality). IRS intends for all applications within the IRS enterprise to ultimately use IPv6, and then the IRS will gradually remove IPv4 from the network once testing confirms the application’s IPv6 full functionality.

Additionally, the IEP infrastructure shall be able to accurately transmit, receive, process, and function correctly in a dual stack environment of the Internet Protocol Version 4 (IPv4), and Internet Protocol Version 6 (IPv6). Specifically, the Contractor shall comply with current USGv6 Product Profile (NIST SP500-267) and provide as a work product either a Supplier Declaration of Conformity per NIST SP 500-273 or a letter of compliance stating that what has been built is IPv6 Capable.

The Contractor shall refresh infrastructure components based on realized cost efficiencies, improved availability, and mutually agreed to pricing structures.

As part of technology refresh activities, the Contractor shall provide the periodic replacement and upgrades of incremental releases (‘dot releases’) of Commercial off the Shelf (COTS) software to maintain reliability and speed of the IEP 1.5 operational platform, in a manner that does not impact operations performance. For major release ('non dot releases’) upgrades, the Contractor shall identify its impact to the IEP services.

If the impact is containable or equivalent to incremental releases, the Contractor shall follow normal incremental releases refreshing approach. If the impact is significant, the Contractor shall generate a change request (CR) and follow the IEP change management process.

The Contractor shall provide support for application owners, upon request, to accommodate any IEP technology refresh updates.

The Contractor shall operate under the latest versions/standards allowable within the enterprise guidelines, including but not limited to relevant sections in the IRS Enterprise Operations’ (EOps) operation standard and IRS initiatives such as Chief Technology

Officer (CTO) N/N-1 Initiative. (Reference Attachment TBD)

Deliverables and Information for Portal Infrastructure Services are available in Appendix TBD.

C.3.3 Portal Web Hosting Services

The IRS is seeking to obtain Portal Web Hosting services. The Contractor shall define and document, in a Web Hosting Concept of Operations (CONOPS), its solution to provide comprehensive application web hosting support for development, testing, integration and production, including provisions for capacity management, incident management, performance monitoring, and infrastructure integration support.

C.3.3.1 Web Hosting Support

The Contractor shall divide IEP 1.5 web hosting environments into production environments and non-production environments. The production environments will support the production workload and shall be put under strict control. The non-production environments provide the IEP customer capability for development and testing, and shall service the customer with flexibility needed. All environments shall be controlled by the IEP 1.5 change management process.

The Contractor shall provision application development/testing/production environments according to the current AS-IS IEP specifications and IRS Enterprise standards (including, but not limited to, security standards) to support existing applications, tools, utilities and functionalities following the IRS ELC.

The Contractor shall support release management for each application. Normally each application will have multiple releases and each release needs certain types of IEP Web hosting environments. The Contractor shall be able to provide development/testing environments as requested by each application team. Currently, the IEP has provided the customer with the following categories of environments:

a) Sandbox (SBX)

b) Development (DEV)

c) System Integration Test (SIT)

d) Enterprise Integration Test Environment (EITE)

e) Functional Integration Test (FIT)

f) System Acceptance Test (SAT)

g) User Acceptance Test (UAT)

h) Performance Test Environment (PETE)

i) Production (PROD)

The Contractor shall be able to provision additional types of environments as IRS ELC or IEP customer environment needs change.

The IEP non-production environments shall be available and accessible to IRS for application development and testing purpose. At least one non-production environment shall be capable of being accessible to IRS external partners when needed. All IEP environments shall allow concurrent deployment and execution of multiple applications, tools, utilities and functionalities in accordance with the IEP change management process.

The Contractor shall maintain all IEP non-production environments synchronized with the corresponding IEP production environment to the best extent possible, as agreed by IRS, in order to minimize unanticipated integration issues during production deployments. The provisioned environments shall be capable of seamlessly migrating applications between the development, testing, and production environments without causing any outage due to infrastructure incompatibility between the environments.

The Contractor shall provide storage for each provisioned environment to ensure environment meets IEP customer needs. The provisioned data storage shall be in accordance with capacity management process, IRS security policy and IRS data storage policy.

The Contractor shall establish the processes and procedures for periodic backup and restore of all components within Web Hosting environments. The Contractor shall provide processes for storing, retrieving, and archiving IRS data and provide the Government with visibility into archived operational data, in accordance with the IRM 1.15, Records and Information Management and the Federal Information Security Management Act (FISMA), Title III of the e-Government Act of 2002, P. L. 107-347.

The Contractor shall demonstrate the accuracy, validity, effectiveness and maturity of the backup and restore capability, including, but not limited to, satisfying IRS authorized third party auditing needs with contractor’s backup and restore parameters.

The Contractor shall provide IEP Web Hosting Operations and Maintenance services in according with the ITIL IT Operations and IT Infrastructure Management frameworks.

The Contractor shall execute the relevant activities and procedures required to deliver and support the services at the agreed levels. Specially, the operations and maintenance shall ensure the effective operation of the following, but not limited to:

a) IEP network Infrastructure

b) IEP server infrastructure

c) Server middleware

d) Hosted applications

The IEP web hosting service operations and maintenance shall include, but are not limited to, the defined processes such as Change Management, Incident Management, Capacity Management, Patch Management, etc.

The Contractor shall ensure IEP 1.5 availability according to SLO/Service Level Agreement (SLA) regardless of contractor routine maintenance activities.

C.3.3.2 Capacity Management

The Contractor shall be accountable for all IEP 1.5 performance and capacity matters, and shall provide capacity management services to ensure that all current and future capacity and performance aspects of the IEP IT infrastructure are provided to meet business requirements and service levels.

The Contractor shall anticipate workload increase, and manage effectively to satisfy the IEP capacity demand. Based on the Contractor-proposed capacity model, the Contractor shall define key capacity performance indicators. These indicators will reflect capacity measures for the IEP environment components which include, but are not limited to, the virtual machine environments, XML Gateways, application servers, database servers, storage, and network bandwidth to fulfill the capacity demand for the IEP environments. Capacity planning for these environments shall include management of licenses and certificates required to operate the environments at the planned capacity level. The Contractor shall provide the capability to meet both predicted and unpredicted user demands (no less than 25% of predicted usage demand) without degradation to service.

The Capacity Management process shall be aligned with the ITIL Capacity Management definition (Business Capacity, Service Capacity, Component Capacity, and Capacity Reporting) (Refer to IRM 2.144, Capacity Management). Specifically, the process shall include, but is not limited to, the following activities:

- The Contractor shall monitor current IEP utilization and performance for all IEP environments and engage with stakeholders to demonstrate current capacity and work with IRS customers and IEP stakeholders to collect future demands and forecast the IEP capacity demands.

- The Contractor shall conduct capacity analysis and planning, propose and prioritize solutions to ensure capacity will meet current and future demand.

- The Contractor shall support and participate in the IEP Capacity Governance process, including working group participation and presentations as required.

Contractor activities will include recommending capacity adjustments and plans to Capacity Governance, ensuring decisions and issues are resolved in a timely manner, and managing and escalating risks appropriately.

- The Contractor shall implement the Capacity Governance approved capacity solutions; this implementation shall follow the IEP Change Management process.

- The Contractor shall perform continuous process improvement on the Capacity Management process.

The Contractor shall establish key capacity and performance indicator operational controls limits, based on archived historical data, which demonstrate the capacity management process maturity and improve understanding of IEP capacity performance, issues, and trends. The Contractor shall support TIGTA capacity management auditing activities, including, but not limited to, providing archival historical data as needed.

The Contractor shall provide a Capacity Management Plan which describes their process for capacity management to ensure that all current and future capacity and performance aspects of the IEP infrastructure are provided to meet business requirements at the agreed cost. Specifically, this plan shall include, but not be limited to, key capacity and performance indicator definitions and key capacity and performance indicator metrics, and address the capacity management process requirements as defined earlier in this section.

The Contractor shall provide a Throughput Report which serves as input and output to the capacity management process. This throughput report measures the service volume provided by the infrastructure. The report information shall include key throughput indicators such as the number of sessions supported, amount of data, etc.

The Contractor shall routinely report Capacity Management status in a Capacity Management self-assessment performance status which captures the activities and verifiable performance delivery of the Contractor’s execution of the IEP 1.5 capacity management process. Specifically, the Contractor shall provide information documented in Capacity Management plan, such as key capacity indicator metrics, key performance indicator metrics, and key capacity indicator threshold breaches. The Contractor shall also propose capacity adjustment solutions and demonstrate adjustment implementation.

The Contractor shall provide Capacity Demand information correlated to key capacity indicators. This information should reflect contractor defined short-term and long-term capacity demand in terms of the key capacity indicators and serves as input and output to the capacity management process.

C.3.3.3 Incident/Problem Management

The Contractor shall establish Incident/Problem Management processes according to the ITIL Incident/Problem Management framework, and shall manage incidents and problems for all phases of this contract. The Contractor processes shall integrate with the IRS Incident/Problem Management processes.

The Contractor shall perform continuous process improvement on the Incident/Problem Management processes to continuously improve the service quality.

For incident/problems related to the Contractor managed IEP 1.5 components, the Contractor shall manage the incident and problem. For all incidents that impact IRS, the Contractor shall service them and notify IRS in accordance with IRS Incident Management process and incident prioritization designation. The Contractor shall comply with the IRS Incident Management process defined SLOs, including, but not limited to, Priority 1/Priority 2 (P1/P2) Incident ticket resolution times.

The Contractor shall work with IRS stakeholders to coordinate the responses to operational incidents, and, as needed, shall participate and support the incident triage process to determine incident ownership. As appropriate, the Contractor shall assist incident owners with incident resolution.

The Contractor shall provide an automated system to support the IEP Incident/Problem Management processes, which is equivalent to the IRS automated Incident/Problem Management system. The Contractor Incident/Problem Management system shall be able to integrate with the IRS system. The automated system shall be available prior to the IEP 1.5 operational phase.

The Contractor shall develop and maintain an IEP Incident/Problem Management Standard Operating Procedure (SOP), which demonstrates the establishment of the IEP Incident/Problem Management processes prior to IEP 1.5 operational phase; once baselined, the Contractor shall maintain the SOP using the Change Management process.

The Contractor shall manage and track the status of all incidents and problems, and shall provide the IRS regular incident and problem updates to demonstrate incident/problem management process compliance, the effectiveness of the incident/problem management activities, and the performance of the incident/problem management process against SLO criteria.

C.3.3.4 Monitoring

The Contractor shall provide monitoring services to ensure the successful IEP 1.5 service delivery to customers; at a minimum, this effort shall include the capability to properly assess the availability, reliability, performance, security and the health of the IEP 1.5 operations of IT infrastructure and its associated applications.

Examples of monitoring activities include, but are not limited to:

- Event monitoring

- Alert generation due to application performance degradation or failure

- Alert generation due to failure of IT infrastructure and application that may jeopardize the external facing service delivery

- Alert generation due to reaching or exceeding a threshold

- Availability monitoring

- Performance monitoring

- Resource utilization monitoring

- Security monitoring (Refer to Portal Security Services area for specific requirements).

The Contractor shall establish the system monitoring process and integrate the system monitoring process with its other processes and services, including but not limited to:

incident management, performance management, and application infrastructure integration services to foster a proactive event management and effective service delivery management.

The Contractor shall integrate the IEP 1.5 monitoring capability and process with the IRS Enterprise end-to-end monitoring capability and process.

The Contractor shall provide user behavior and usage analysis for hosted applications in production and non-production environments, based on web hosting data available to the Contractor, to assist the application owners to improve their application services.

The Contractor shall provide IT infrastructure usage analytics and metrics for production and non-production environments to increase IT infrastructure usage efficiency. Usage analytics and metrics shall be tailored to the unique utilization characteristics of production environments or non-production environments. For example, in production environments, analytics can be workload related factors such as network bandwidth, Central Processing Unit (CPU) utilization, and memory utilization. In non-production environments, example analytics can be associated with metrics such as log-in history data, log-in session duration, and frequency that measure non-production environment utilization.

The Contractor shall also provide service utilization analytics and metrics for IEP 1.5 Web Hosting support services to assist the IEP 1.5 service provider to improve web hosting services effectiveness and efficiency. The IEP 1.5 Web Hosting support services, include, but are not limited to, IEP change management, IEP incident management, and more.

The Contractor shall update system monitoring requirements, risks, and assumptions as required to support the existing application built-in monitoring capabilities or equivalent monitoring capabilities available using the IEP tools.

The Contractor shall provide routine and ad hoc monitoring reports demonstrating the health and status of the IEP 1.5 IT…