SECTION_J-ATTACHMENT_A_Current_State_of_Portals_and_Help_Desk.pdf

SECTION J- ATTACHMENT A

Internal Revenue Service

Solicitation TIRNO-16-R-00026 IEP 1.5

Current State of the Portals and Help Desk Environment

Version 2

June 1, 2016

2 June 6, 2016

1. Introduction The Internal Revenue Service (IRS) is planning to award a new managed services contract to build and transition the existing IRS Integrated Enterprise Portals (IEP) to a new state that continues to meet the future business needs of the IRS.

2. Document Purpose and Organization The IRS has chartered the Portal Re-Compete Acquisition Project to administer the acquisition processes necessary to award the new managed services contracts for Integrated Enterprise Portal (IEP) Public User Portal (PUP) aka IRS.gov, the Registered User Portal (RUP), and the Employee User Portal (EUP), Transaction Portal Environment (TPE) and Foreign Account Tax Compliance Act (FATCA). This document is intended to provide potential contract bidders with current state background information necessary to understand the scope, complexity, scale, and growth expectations of IRS’ major Portals.

The Current State document is divided into six major sections:

Section 1: Introduction

Section 2: Document Purpose and Organization

Section 3: Integrated Enterprise Portals Background & Overview

Section 4: Core Services

Section 5: Workloads

Section 6: Current State Volumes and Volume Forecasts

Each of the current state description sections is organized as a table structure with the following elements as shown in Table 2.0.1.

Table 2.0.1 Current State Description Elements

Table Element Table Element Definition

System Name The system’s formal designation in Request for Proposal (RFP) documents.

Target Audience The group or groups the system is intended to serve.

Content and Services The information, functions, and resources available on the system.

Technical Platform A general description of the technology components that comprise the system.

System Integrations A general description of the interfaces and connections between the system and other systems.

3 June 6, 2016

Table Element Table Element Definition

Location The current system locations.

Managed Service Provider

(MSP)

The current Managed Service Provider.

This document concludes with four appendices:

• Appendix A: List of Current IEP Applications - provides information on all applications that are available on the IEP PUP website, IEP RUP Login Authenticated (LA), RUP - Self Authenticated (SA) applications, IEP EUP applications, IEP TPE applications, and FATCA applications.

• Appendix B: IEP Application Interfaces and Descriptions.

• Appendix C: Key Current State Organizations – identifies organizations that have stakeholder roles in the operations and maintenance (O&M) of the current portal infrastructure.

• Appendix D: Acronym List.

3. Integrated Enterprise Portals Background & Overview The mission of the IRS is to provide America’s taxpayers top-quality services by helping them understand and meet their tax responsibilities and enforcing the law with integrity and fairness to all. In 2015, IEP IRS Websites served over 2.7 billion page views to more than 760 million site visitors globally.

The IEP is a fully scalable, managed private cloud capability dedicated to IRS that provides technology services to internal and external users. The IEP is the front door to the IRS backend and plays a mission critical role in serving tax payers, tax preparers and employees. The IEP provides fully integrated core services, including infrastructure, operations, security, application, integration & support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles. The result is a single, flexible, scalable and reliable digital platform that supports a variety of performance and availability requirements in excess of 99.99% availability and sub-second responses, even in the event of an unexpected disaster during peak tax season.

The IEP platform supports:

• Exponential growth of online electronic filings and taxpayer access to information

• Automation of key business processes

4 June 6, 2016

• Centralized logging and monitoring that is integrated with IRS E2E systems

• Balanced system capability to meet demand by dynamic application scaling

• Consistent user experiences for the taxpayer and tax preparer

• Improved data and content sharing between IRS user communities

• Improved services for taxpayers and preparers

• Enhanced security posture of web-based applications

The core IEP platform consists of the following types of services that support multiple IRS workloads:

• Infrastructure: Tiered network and firewall, storage compute and virtualization management, data center services, and dynamic traffic-based throttling capabilities spanning both physical data center and operations & management services.

• Operations: Capabilities that support the operation of workloads and understanding the usage of applications, such as web analytics, reporting, monitoring, logging, dynamic scaling, operational application dashboards, patch management, change management, and fully integrated event-driven automated deployment of infrastructure and applications.

• Security: Includes both technologies and operations services to protect against a range of digital attacks and work with IRS security professionals to maintain relevance and continued compliance of the platform, existing applications and workloads, and new workloads, application styles and applications as they are released.

• Application: Standardized platform services to accelerate delivery and deployment of business applications, including web services and service virtualization, web applications, identity and access management, databases, messaging, portal & content management, and fully automated application environment deployments.

• Integration & Support - Services supporting the integration, on-boarding and engineering of new IRS business applications, application styles, workloads or technologies into the fully integrated and managed platform.

• Program Management: Develops implements, maintains, and regularly improves program and project management practices that are compatible with the Project Management Institute’s (PMI’s) The Standard for Program Management.

By leveraging core services described above, the IEP scales to numerous virtual workloads, isolating each as needed to meet varying security requirements. Currently, the IEP supports the following seven workloads, each with a different target audience and security:

• Public User Portal (PUP)

• EITC Central

• Political Organization Filing and Disclosure (POFD)

• Registered User Portal (RUP)

5 June 6, 2016

• Transactional Portal Environment (TPE)

• Employee User Portal (EUP)

• Foreign Account Tax Compliance Act (FATCA)

The IRS IEP is comprised of the following components and associated accountabilities as outlined in Table 3.1.2. Based on a recent third-party benchmark performed on the IEP, over half of IEP services are Custom services. Custom services are service components that are not typically found in standard Operations & Maintenance offerings such as Application Development and Maintenance, Program Management, Security and Middleware/Integration.

A Website service model description is also provided to delineate current Managed Service Provider/IRS accountabilities across major service areas. The IEP follows a tailored ELC lifecycle. The information is presented as a table with the following elements as shown in Table 3.1.1.

Table 3.1.1 Website Service Model Description Elements

Table Element Table Element Definition

Lifecycle Service/Process

A major system lifecycle function based on Information Technology Infrastructure Library (ITIL) latest version framework. Note: Selected ITIL services/processes are omitted if they are not currently operational.

MSP

Managed Service Provider. An ‘X’ in this column indicates primary service ownership lies with the MSP. The IRS may play a supportive service role.

IRS

Internal Revenue Service. An ‘X’ in this column indicates primary service ownership lies with the IRS. The MSP may play a supportive service role.

Joint An ‘X’ in this column indicates the IRS and the MSP share service ownership.

Table 3.1.2 IRS IEP Components and Accountabilities

Lifecycle Service/Process MSP Joint IRS

Pr og ra m

M an ag em e nt

Program Support

X

Process Support X

6 June 6, 2016

Lifecycle Service/Process MSP Joint IRS

Reporting/SLOs X

Se cu ri ty

Monitoring, Compliance, Reporting X

O pe ra tio ns

Application Operations Support X

Production Application Management (monitoring, logging, E2E) X

Middleware Support X

Service Desk X

IRS.gov Web Site Help Desk X

Incident Management X

H os tin g 37 IEP environments including management, development, test, and production / Operating System X

N et w or ki ng

Multiple geographically-separated data centers X

Telco – Redundant Dedicated Circuits, Vendor Diversity

Other – Redundant, Vendor Diversity X

Business Continuity (Geographically separated sites able to handle full workload) X

4. Core Services The IEP platform core supports multiple workloads and application styles to establish a set of re-usable technology and process services that can be configured to meet the unique demands of

7 June 6, 2016 applications and environments. The core services of the IEP are tightly integrated and automated to establish a robust platform that is integrated with IRS’ processes and technologies to accelerate the delivery of IRS business applications.

4.1 Infrastructure Services

The Infrastructure services provided by IEP enable IRS to dynamically provision environments and virtual infrastructure to support a variety of business needs from proof of concepts to full production deployments.

4.1.1. Network and Firewall

IEP maintains multiple data centers in an active/active state to monitor internet health, minimize latency, improve connection speeds for clients, provide fail-over key toolsets and applications, and meet Service Level Agreement (SLA) requirements. A robust networking architecture supports the demands and flexibility of IEP. The core of the IEP network provides high-speed (10 Gbps/ 1 Gbps) layer 2 and layer 3 switching between VLANs, DMZ connections, partner networks, and outside internet connections. Networks with different security levels are separated via firewalling - virtual, physical, or both. Depending on demand need and security requirements, physical and virtual network elements can be used to manage traffic, provide security, and respond to the changing needs of the virtual data center.

Internet traffic is load balanced across the geographically separated data centers, enabling application availability even during data center outages or upgrades. Traffic is also automatically rerouted to secondary locations based on user need and network efficiency, while remaining completely transparent to the end-user. IEP also has the flexibility to configure dynamic or planned fail-over during outages and required maintenance. Configuration and administration is accessible through a web browser interface.

The Wide Area Network (WAN) architecture includes interconnection of routers, switches and firewalls which help optimize traffic patterns from registered users, MSP data centers and IRS data centers that host multiple backend systems. The WAN architecture is separated by network zones which include the public internet, the connection between the data centers.

IEP provides the ability to safely and easily extend network access to desktops to remote users, devices, and endpoints after authentication. Remote access to the IRS IEP environments is restricted to users connected to the IRS intranet or privileged MSP networks, and is specially designed for operational management as well as for development and testing.

The IEP Local Area network (LAN) infrastructure was designed and built with agility and scalability in mind to meet anticipated future growth demands. The logical LAN design is based on multiple private secured environments that allow ingress and egress traffic through firewalls.

8 June 6, 2016

4.1.1 Storage

The IEP provides multiple tiered storage protocols. The storage supports 99.99% uptime.

The storage design provides the following services:

• Archival, primary and transient storage for applications

• High-performance tiered storage for applications with intensive IO requirements.

• Fault management, performance reporting, capacity reporting.

If the storage requirements grow (e.g., IOPS increase, files space increase etc.) beyond current capabilities, the design incorporates further deployments to meet application workload requirements (high IOPS such as virtualization software data stores, high capacity but low IOPS such as Backups).

4.1.2 Computing and Virtualization Management

The virtualization scheme utilized by the IEP provides the following:

• A shared physical infrastructure that is managed and controlled by a virtualization and management capability.

• An ability to create different logical environments (e.g., development, test, production), with network boundaries between them, on the same shared hardware infrastructure.

• A separation of the workloads running on the infrastructure from the actual infrastructure

– i.e., software is separated from hardware and both are managed and can be evolved independently.

• The ability to allocate resources to environments and to change that allocation dynamically in response to the actual needs of the workloads running in those environments.

IEP compute architecture provides elasticity and optimizes the operational efficiency and utilization of physical resources. IEP can reallocate compute resources to support peak times, and reallocate production capacity to development and test environments during seasonal lulls in workloads. Furthermore, this architecture allows in-place hardware upgrades without impacting application availability as well as environmental isolation and segmentation.

4.1.3 Data Center Services

The data centers being used to house IEP infrastructure are geographically separated across time zones within the United States such that local disasters do not result in a loss of service.

Equipment is located in racks and cages within the data center’s secure FISMA-moderate compliant environments. All data centers use state-of-the-art cabling, wiring, air flow, smoke detection, fire suppression, temperature control, humidity control, and backup power generation.

9 June 6, 2016

4.1.4 Dynamic Traffic-Based Scaling

Automation of datacenter workflows enable rapid provisioning of virtual machines that provide the required services to support IRS applications in the IEP. This serves as the cornerstone of auto-scaling to match demand with resource availability. Additionally, it helps to facilitate patch management, change and configuration management, and disaster recovery.

4.2 Operations Services

4.2.1 ITIL Service Management

The IEP operations management uses several ITIL-compliant tools and ITIL-based processes that work hand-in-hand with established IRS tools (e.g., KISAM, Installation Request Tracking Ticket (IRTT)). The tools and processes have a specific focus on ensuring that the processes support the activities to provide an overarching Operations Management Framework that span and govern multiple dimensions of the service, including:

• Internal IEP interactions

• Consulting -IRS interactions

• IEP O&M interactions

• IEP enhancement-focused interactions.

The IEP Service Management include the following:

• Change Management

• Release and Deployment Management

• Event Management and Monitoring

• Request Fulfilment

• Incident Management

• Problem Management

• Access Management

• Availability Management

• Capacity Management

4.2.1.1 Configuration Management

The IEP program performs configuration management on the following configuration item categories:

• Documentation: All project documentation including program level documentation, deliverables, reports, templates, requirements, designs, and test.

10 June 6, 2016

• Code Documentation: Source code for applications maintained and updated by MSP Team.

• Training: Any artifacts used to train end users. Examples include training presentations.

• Deployment Guides: Documents or manuals detailing the steps to operate an application. Examples include installation manuals and operations guides.

• Infrastructure: IEP Infrastructure items including Hardware (Server, Network and

Storage) and Virtual components.

4.2.1.2 Configuration Management System

The IEP program provides the Configuration Management System that is designed to support the IRS’s processes and the Information Technology Infrastructure Library 2011 specifications. The Configuration Management System ensures that Configuration Items (CIs) are correctly planned, identified, controlled, reported, verified, and audited throughout their lifecycle in the delivery of services. A Configuration Item is any component that need to be managed in order to deliver the services provided to the IRS. Currently the Configuration Management System supports:

• ITIL® centric processes.

• Supports over 415 IRS, MSP, and third-party contractor resources.

• Supports detailed Reporting and Dashboard capabilities to provide insight to leadership.

• Integrated with third party orchestration tools, using web services, to automate deployment of virtual machines.

• Supports submission of over 1,000 tickets per month.

• Provides processing of all internal and client system access requests.

• Provides a platform to allow the automation of manual processes and approvals.

• Automated VM provisioning using web services and third party orchestration tools.

• Identify capacity problems, potential software security risks, and provide the IRS with accurate reports.

The Configuration Management System is used to manage the IEP’s ITSM processes of Service Request Fulfillment, Incident Management, Problem Management, Change Management, and Release Management. The Configuration Management System is comprised of three main modules to support the services provided to the IRS:

4.2.1.2.1 Configuration Management Database (CMDB)

The Configuration Management System provides the CMDB that provides the detailed reporting and acts as the master Infrastructure Inventory database. The CMDB not only tracks the Configuration Items within the IEP IT environment for Configuration Management, but also incorporates their relationships amongst other CIs, users, and groups in addition to the CIs activities in the other IEP’s ITSM processes of Service Request Fulfillment, Incident

11 June 6, 2016

Management, Problem Management, Change Management and Release Management. The Configuration Management System includes a Configuration Management module that supports the Configuration Management processes outlined in this document which includes a Discovery Tool and Business Services Management Map. Both are capable of effectively identifying CIs, attributes, and relationships within the IEP IT environment. The IEP CMDB currently contains nearly 11,000 CIs.

4.2.1.2.2 Infrastructure Discovery

The Configuration Management System Discovery application detects the computers and Infrastructure devices connected to the IEP network. When Discovery detects a computer or device, it explores the device's configuration, provisioning, and current status, then updates the CMDB, accordingly, to include this computer or device in the inventory. On computer systems, Configuration Management System Discovery also identifies the software that is running and any TCP connections between computer systems and creates all the relationships between computer systems.

4.2.1.2.3 Asset Management

Asset Management tracks the financial, contractual, and inventory details of hardware, software, and virtual infrastructure – as well as non‑IT assets – throughout their lifecycle. Asset requests are handled using workflows to obtain approvals, validate entitlements, issue chargebacks, and provision services. Once an asset is deployed, Asset Management records all maintenance activity and enables IEP to perform regular audits, right up until asset retirement. The tool includes a normalization module that helps to de-dup data, Consolidate Configuration Item (CI) data by getting rid of Inconsistent data such as multiple names for a single vendor, product, or product version leads to conflicts and duplicates, Standardize CIs with a comprehensive catalog of CI models and categories. Additionally this module provides End Of Life dates for software and hardware installed in the IEP allowing the MSP to notify the IRS, and manage our products end of life dates so renewals, software upgrades, and potential product EOL are not missed that affect the program.

4.2.1.3 Incident Management

The IEP Service Desk, a single point of contact to the IRS’s EOps Enterprise Service Desk and other IRS Help Desks, provides 24x7x365 Incident and Service Request support, including the identification, triage, troubleshooting, and resolution of both non-Production and Production incidents. These activities utilize both the MSP ITSM (IT Service Management) tool and KISAM, the IRS change management and ticketing tool, and interact with existing IRS processes such as the IRS Support Restoration Team (SRT) process and the Change Request Process for emergencies.

12 June 6, 2016

The IEP Service desk provides initial triage support for all KISAM incidents assigned to the IEP infrastructure (PUP/RUP/TPE/EUP). In addition, the MSP provides triage support for additional incidents as requested for applications hosted on the IEP platform. The Service Desk also opens KISAM tickets as a means to engage other IRS troubleshooting groups whenever IEP support teams have determined that an incident is outside of the IEP. Groups with whom the MSP coordinates include:

• IRS application development teams

• IRS Middleware

• Backend Single-Sign-on support team

• IT Security managers

• Enterprise operations

• Application business owners

• External transmitters

• External vendors

It is important to note that the IEP teams assist multiple Incident Management efforts, even when the ticket is not related to issues with the IEP. Crucial information and subject matter expertise from the IEP team is frequently a key contributor to troubleshooting and analysis.

The IEP Service Desk manages all emergency communications involving the IEP as a means to keep users/customers informed of service events and actions with the IRS and inside of IEP.

Additionally, the IEP Service Desk provides business hours support for the IEP-ITE environments and adheres to SLOs during established IEP Service Desk business hours: Monday through Friday, 9:00 AM ET – 6:00 PM ET.

4.2.2 Operational Capabilities

The following operational capabilities: logging, monitoring, dashboards, and reporting are aligned to support the Operations of the IEP.

4.2.2.1 Logging

Logs are collected and stored from applications, application platforms, databases, and middleware components. These logs are sent to the IRS’ E2E logging servers to provide application and system level monitoring to the IRS E2E monitoring applications for IRS’ analysis, processing, reporting and auto-ticket generation. The IEP also performs application level logging for IRS business analytics, such as IT Reporting tool for the ACA.

13 June 6, 2016

4.2.2.2 Monitoring

The MSP comprehensively monitors the IEP infrastructure 24x7x365 in the following ways:

• End User experience monitoring of applications and websites

• Connection or other connectivity failures between caching and origin infrastructure

• Internal, bottom-up infrastructure alerting, monitoring and reporting of applications, bandwidth, databases, operating systems, networks, servers, middleware components, and websites

• Health, capacity and performance monitoring and alerting of the virtual infrastructure

4.2.2.3 Dashboards

The MSP provides dashboards to IRS enabling autonomous data analysis and reporting for the following capabilities:

• End user statistics

• Website usage

• A2A Transactional health

• Application/infrastructure availability

• Infrastructure and bandwidth usage

• Log Analytics

• Website Optimization

4.2.2.4 Reporting

The Reporting process consists of gathering metrics from multiple data sources and generating reports, which provide a consolidated view into IRS.gov, applications, and IEP infrastructure performance analytics. This process facilitates the gathering of data on an ongoing basis, which provides consistent metrics to the IRS on an ad-hoc, daily, weekly, and monthly basis. The MSP also provides monthly diagnostic reports detailing the current state of the website. These diagnostic reports provide information regarding broken / inappropriate links, automated section 508 checks, page weight and search-ability. In addition to the ad-hoc reporting requests, the following sample list of standing reports is provided:

• Sr. IT executive report

• Daily Filing Season Report

• OMB E-300 Metrics

• Response Time Report

• Help Desk Contact Database Extracts

• Help Desk Operational Metrics

• Help Desk Customer Satisfaction Surveys

14 June 6, 2016

• IPV4/V6 Report

• Service Level Objective performance report

4.2.3 Automated Deployments

Application deployments on the IEP are streamlined through end-to-end automation and integration of core services described in this section. This enables repeatable and reliable deployment of application changes, while abstracting and automating the detailed integration of services required to support the application execution environment. Deployments can be initiated through the service management tool, or an event-driven interface to alleviate the need for manual processes. The application interface provides IRS Application owners a mechanism to configure, customize, and deploy fully integrated applications across multiple environments, including Production. Automation also retains the prior version of an application deployment up to three days after a new deployment is performed in case it is required for emergency rollback.

There is also a standardized process to provide an interface for niche application deployments that do not follow one of the three application styles, or new technologies not currently in the standardized platform.

The following components are configurable for an application:

• Targeted environments for application deployments

• Application style and components configurations

• Application server configurations

• Webserver configurations

• Messaging server configurations

• Database configurations

• Gateway server configurations

• Secure File Transfer Protocol configurations

4.2.4 Patch Management

The MSP provides patch management to support continual patching cycles for the infrastructure, applications and shared services driven by vulnerability requirements per the Internal Revenue Manual (IRM).

All Management, Development, Testing and Production environments for all workloads are patched year-round, even during peak periods of filing season and open enrollment to maintain the security and integrity of the IEP. The MSP coordinates the patching windows with all applications provided in the Appendix then proceeds through the IRS Change Management process for approval. Prior to patching Production, the MSP coordinates IRS testers for validation during Production patching windows.

15 June 6, 2016

4.2.5 Change Management

The MSP is responsible for managing the changes required to operate, maintain, and upgrade the IEP while working with the IRS change management process.

• Overseeing and managing the introduction of all changes into the Production and higher test environments (SIT, PETE and EITE), and coordinates the approval of all requested changes with IRS

• Participating in the IRS ITE change control process and governance process for IEP

• Assisting the IRS in the assessment and prioritization of changes to validate minimum conflict of change introduced into the IEP environment

• Operating under a standardized IEP Change Management Process with defined approval processes and documented interactions with the IRS PCMB, the IRS Change Control ticketing systems, KISAM and IRTT, using GFE, and other IRS Change Control Boards for all production changes on the IEP. The joint IEP/IRS Change Control process is used to track all changes occurring on the IEP.

• Adhering to a Change Control process according to an IRS approved Change Risk Matrix for all changes

• Managing changes based on an IRS defined CCB and Change Advisory Board structure and a Change Risk Matrix indicating a) levels of approvals and b) IRS visibility into different types of Changes

• IEP system changes are categorized into changes requiring IRS approval, changes requiring notification to the IRS, and MSP operation changes that are outside of the IRS change management process

4.3 Security Services

The IEP security controls are configured in accordance with the appropriate Internal Revenue Manual (IRM) and National Institute of Standards and Technology (NIST) guidelines to support a Federal Information Security Management Act (FISMA) Moderate system. The IEP Security follows the NIST 800-37 Risk Management Framework. Security technologies and services are built across each of the workloads (defined in section 5) and fully integrated with automated deployments. Capabilities include: continuous monitoring, anti-virus, configuration management/file integrity management, bot-detection/prevention, distributed denial of service protection, intrusion detection and malicious source detection and isolation, advanced security analysis, static source code vulnerability analysis, threat identification and analysis, dynamic application vulnerability scans, and web-services XML threat mitigation.

4.3.1 Compliance

The Security function offers compliance services tailored to the IRS’ unique needs which are driven by the need to meet known, established and recurring requirements such as FISMA

16 June 6, 2016 reporting, to the interpretation, analysis, and implementation of new compliance initiatives aimed at addressing a new generation of technologies and threats.

The IEP compliance program is based on NIST guidance with details and refinement provided through an IRM and Treasury Department overlay. A full documentation set has been created to capture the compliance posture of the program and provide the basis for assessment activities.

Regular IRS CyberSecurity assessments are supported throughout the year to include direct support for IEP systems and indirect support for independently accredited systems which inherit IEP controls.

The IEP Security Team performs the following Security Compliance activities:

• Full implementation of Internal Revenue Service organizational policy, Internal Revenue Manual (IRM) 10.8.X

• Fully documented System Security Plan against 800-53 Rev. 4 controls (Security controls identified for Federal systems)

• Document/manage control failures with documented plans of remediation and necessary timelines called Plan of Action and Milestones (POA&M) tracked in IRS system

• Provide system asset inventory and compliance reports

• Annually test the security contingency plan to prepare for site failure, disaster, etc. to maintain system availability/recovery

• Support annual IRS assessment of the security controls in place on the systems (Annual

Security Controls Assessment (ASCA)) and annual site review of contractor’s work place to validate safety and security of workplace

• Facilitate IRS performing testing on systems

• Conduct simulated security incidents quarterly to test response capabilities

• Support TIGTA audit requests

• Conduct Privacy Impact Assessment or assess privacy exposure risk for application with business owners

4.3.2 Operations

IEP Security Operations is responsible for all day-to-day security activities across all portals operations. IEP Security maintains daily operational security processes, tools, and security efforts in order to maintain the defined security posture and enforce adherence to all applicable NIST 800-53 controls commensurate with system categorization. More specifically, the core mission and effort of the Operations Team is to protect IEP hardware and software systems from internal and external threats that impact site confidentiality, integrity, and availability. Working in conjunction with compliance standards and across various technical teams, IEP Security supports and performs the following operational activities within a Continuous Monitoring model:

17 June 6, 2016

• Threat and Vulnerability Management

• Compliance scanning/monitoring

• Static and Dynamic Application Security Testing

• Web Application Firewall (WAF)

• Automated web-based attack protection

• Host-based Security Protection

• Security Configuration and Change Management/File Integrity Management

• Security Information and Event Management (SIEM)

• Incident Response

The IEP Security Team performs the following Security Operations activities:

• Implement and manage daily security operations to analyze, monitor, and respond to risk on daily basis across all systems

• Monitor for security events and suspicious activity 24/7 to rapidly respond to prevent/contain risks

• Work to prevent outages, system damage, and taxpayer data exposure

• Maintain all security monitoring tools to make sure they are operational across all systems and device in environment at all times

• Implement Security Configuration and Change Management procedures as well as

Security Impact Assessment process throughout change process

• Implement security auditing procedures especially for critical components

• Implement procedures to prevent, detect, mitigate constant/repeated threats and maintain sound incident handling, monitoring, and response procedures

• Conduct forensic analysis of potential incidents/suspicious activity; support formal investigations

• Implement patch and vulnerability management program

• Perform external vulnerability scanning and input into vulnerability management

• Operate using a Separation of Duties Matrix

• Monitor outbound connections and identify activities relating to data exfiltration by attackers

• Applications are vetted against necessary tools, approvals, and approved to go-live, and maintain version/revision control for any application/code changes

• Support IRS external vulnerability and penetration testing across portals environment

• Applications are assessed for vulnerabilities via vulnerability assessment tools

• Vulnerabilities are mitigated prior to pushing application to production environments

• Provide application designs, test documentation, and source code to IRS to support application code assessment concurrence prior to production deployment

• Applications are tested at least quarterly for vulnerabilities

18 June 6, 2016

4.3.3 Security Reporting

The team reports on the following:

• Provide security metrics showing security operational processes

• Provide information around threats, vulnerabilities, and risk for the information system

• Document risks and mitigations to include impact, likelihood, etc.

• Provide weekly security status reports

• Document and review how potential security incidents were investigated/reviewed

• Provide a status of vulnerabilities within the environment

• Provide security incident report identifying the investigation of suspected incident, analysis performed

4.3.4 Threat Mitigation and Protection

As the external threat landscape continues to evolve, IEP Security has implemented various threat mitigation and edge security services to protect IEP portals from perimeter threats as well as robust data analytics capabilities to identify, normalize, and correlate threat data and intelligence across the portals. The core threat mitigation and protection capabilities are as follows:

• Web Application Firewall (WAF)

• SQL Injection Protection

• Remote File Inclusion Protection (RFI)

• Cross-site Scripting Protection (XSS)

• Cross-site Request Forgery

• Distributed Denial of Service Protection (DDOS)

• Automated Web Attack Protection

• IP Blocking/Blacklisting

• IP Reputation Protection

• Enterprise Log Management

• Security Analytics

• Security Information and Event Management (SIEM)

• Proactive Security Alerting and Notification

• Security Dashboards

19 June 6, 2016

4.4 Application Services

4.4.1 Application Styles

The IEP supports multiple application styles including Application to Application (A2A), Web Application, and Component Application.

4.4.1.1 Application to Application (A2A)

The A2A style is generally used for system-to-system interaction. This style enables external applications to connect to IRS web services via HTTPS. This style does not present the user with a graphical user interface because the interaction is primarily system-to-system.

4.4.1.2 Web Application

The Web Application style provides a web front-end for end user interaction with the IEP applications. This style supports applications that require a graphical user interface to interact with end-users.

4.4.1.3 Component Application

The Component Application style enables IEP application owners to deploy configurations for a specific technology component instead of a group of technologies like other application styles.

4.4.2 Standard Technologies

4.4.2.1 Application Servers

Application Servers serve as a standard component of the Web Application style and are also available for use under the A2A style.

4.4.2.2 Web Servers

A common use of web servers in IEP is to provide separation between the application layer and the public. All Web Application styles utilize a web server for this purpose.

4.4.2.3 Authentication and Authorization

IEP deploys tools to support authentication and authorization of IRS application services. These tools provide secure Single Sign-On (SSO) and identity access management so users can be authenticated for access to the deployed applications.

20 June 6, 2016

4.4.2.4 Database

Oracle Relational Database Management System (RDBMS) is the IRS standard for databases.

RDBMS is primarily used for session persistence and content database.

• Session Persistence: Enables state-full interaction between the users and the application.

These databases are used to overcome the connectionless nature of request-response paradigm inherent in the Transmission Control Protocol/Internet Protocol (TCP/IP). This is created automatically for applications configured to use the database session persistence method.

• Content Database: Used by applications for application configuration content. In addition to session databases, certain IEP applications also use persistent data stores to store application configuration data.

4.4.2.5 Messaging Services

Messaging Services are used to facilitate communication between the IEP and back-end IRS applications. Message Queuing (MQ) technology is currently leveraged to allows multiple IEP applications and services to use a single transport type to asynchronously transfer messages to

IRS.

The configuration of the IEP MQ servers require significant amount of coordination between the shared responsibilities of IEP and IRS. The IRS Middleware Infrastructure Integration Section (MIIS) MQ administrators are responsible to gather, package, and submit MQ updates and artifacts to the IEP MQ Team. The supplied artifacts from MIIS are depended to fully configure the IEP MQ servers to enable communication to the IRS back-end. The IEP ITSM tool is utilized to facilitate the transfer of MQ artifacts to the IEP MQ Team via an Application Migration Request ticket.

4.4.2.6 Secure File Transfer Protocol (SFTP)

Applications in IEP use a secure file transfer solution to move attachments between the portal and backend applications. When an attachment is ready for consumption, an IEP application sends a message to the back end application via the AMDAS API. The back end server then retrieves the attachment from the secure file transfer solution server using SFTP.

4.4.2.7 Secure Gateway

The secure gateway is a server that scans messages and files sent to IEP for potential threats such as viruses, malware, and intrusions. The secure gateway can validate file types and submission sizes that users upload to verify they comply with defined restrictions.

21 June 6, 2016

4.4.2.8 XML Gateways

XML Gateways provide additional security for IRS hosted web services. XML Gateways provide a set of capabilities for processing and protecting inbound and outbound transactions including:

• XML validation and transformation

• Anti-virus protection

• Denial-of-service protection

• XML attack detection/prevention

• Access management of Web Service

• Logging and auditing

4.5 Integration & Support Services

4.5.1 Application Service Operations

The Application Service Operations (ASO) Team is responsible for ensuring applications on the IEP are available and operational. The ASO Team interfaces with the incident and change management processes to work all issues through to resolution. The ASO Team provides 24x7x365 support of IEP production applications.

The IEP ASO groups fulfill the following O&M-related high-level tasks:

• Provide application related global load balancing solution change support for current applications

• Provide deployment support for current IEP applications documented in Appendix A/B

• Provide production IEP application migration support for applications documented in

Appendix A/B

• Provide assistance with deployment support

• Provide external partner application testing support

• Provide application deployment and coordination support

• Provide application related infrastructure changes request support

• Coordinate patching efforts with the Application teams

• Provide Change Request, Service Request, and Incident support

• Provide standard build window IEP application support

• Provide standard Content Management System build window support

• Provide P1/P2 Service Restoration Team (SRT) IEP application support

• Provide P3/P4 IEP application support

• Provide initial triaging of P1/P2/P3/P4 tickets for applications

• Assist with the coordination of testing activities with Application teams

22 June 6, 2016

• Provide application log file support for Application teams

• Provide application monitoring and logging support

• Provide On-call Application Operations support for P1 and P2 production incidents

• Provide legacy application, identity management and messaging support for versions supported by the IRS

• Provide daily Health Checks and confidence testing following IEP deployments

• Application onboarding & integration activities

• Research and troubleshoot Configure application parameters

• Conduct Post-Deployment Validation

• Control room support for application specific activities such as Filing Season support for

ACA and MeF

4.5.2 Application Systems Integration

The Application Systems Integration (ASI) Team provides integration and technical guidance to the IRS application teams. This guidance enables the IRS application teams to be able to successfully design, develop, test, and deploy in the IEP. More specifically:

• Provide ongoing integration services for the buildout and testing of all applications regardless of their position in the development lifecycle

• Perform application architecture and engineering support for new applications o Preliminary engineering study o Requirements gathering o Effort-scoping o Serve in an advisory role during the plan, analyze, test and deploy phases of the software development lifecycle

• Provide performance testing support o Application performance tuning o Planning and executing performance tests o Analysis of performance test results

• Provide sustained after hours support for special projects e.g., supporting application testing in EITE or FIT

• Support annual DR/Alternate processing site/DR performance testing

• Support the onboarding of new applications or redesign/enhancements to the production applications

• Maintain the automated deployment process documentation to include any relevant updates or changes

4.5.3 Application Development

23 June 6, 2016

The Application Development (App/Dev) Team is responsible for full lifecycle development and maintenance of the MSP managed applications in Appendix A/B. The App/Dev Team designs, builds and develops, tests, and deploys in the IEP. Additionally, the team maintains documentation (requirements, designs, test scripts, etc.) and supports the regular patching cycles with application support and validation activities for the MSP managed applications. The App/Dev Team interfaces with the incident, security, and change management processes to work all issues through to resolution and supports regular maintenance releases of the applications along with annual updates to implement legislative updates. Releases are planned and prioritized with the IRS.

For MSP managed applications, the App/Dev Team leverages the software development lifecycle to implement updates, and for non-MSP managed applications in the PUP, supports deployment and auxiliary testing activities (see below).

The SDLC for the MSP supported applications in Appendix A/B may include the following activities for the maintenance releases and annual updates:

• Analysis

• Planning

• Requirements

• Design

• Development o Front end (e.g.; HTML, CSS, JSP, JavaScript) o Back end (e.g,; Web, Batch, SOA, MQ) o Secure Gateway policies o System Integration o Project build tools and IEP-DD package creation

• Unit and Integration Testing

• Security code scans / analysis / remediation

• Lower environment deployment support

• Lower environment testing support

• Interagency and Release Testing

• System Testing

• Backend Integration testing

• Browser Testing

• Section 508 Testing and IRS IRAP coordination o Includes manual verification and the use of IRS approved testing tools

• Dynamic Application vulnerability scanning

• Performance Testing

• Site usage Reporting Validation

• Generating ad-hoc and scheduled reports

24 June 6, 2016

• User Acceptance Testing Support

• Deployment

• Production Implementation Testing

• Service Introduction Support

For non-MSP managed applications, the following activities are the responsibility of the MSP:

• Lower environment deployment support

• Backend Integration testing

• Browser Testing

• Section 508 Testing and IRS IRAP coordination o Includes manual verification and the use of IRS approved testing tools

• Dynamic Application vulnerability scanning

• Performance Testing

• Site usage Reporting Validation

• Deployment

• Production Implementation Testing

4.5.4 Capacity Management

Capacity Management is necessary to manage the resources within the IEP. The MSP manages capacity for licensing, compute, storage, network throughput, and caching bandwidth. The Capacity Working Group (CWG) meets on a pre-defined schedule to review requests for capacity within the IEP. Non-production environment requests are reviewed and approved by the CWG, and Production environment capacity requests are processed through the Capacity Governance Board (CGB) for approval.

4.6 Program Management

The Managed Service Provider implements the following Program Management activities:

• Manages the program measurement in the Quality Assurance Surveillance Plan (QASP), including a process for developing, implementing, and monitoring a set of performance measures to validate that program activities efficiently and effectively support both business and IT strategies.

• Manages the resource on-boarding and clearance process for IEP. This includes working with IRS CORs to complete the Minimum Background Investigation (MBI) for all resources and service providers that support the IEP including resources and subcontractors that support the Help Desk, Service Desk, and Hosting capabilities. The team also works with IRS to request badges and laptops for cleared resources as needed.

25 June 6, 2016

• Develop and maintain the overall Program Management Plan that clearly delineates the program and project management approach including, at a minimum, the Project Management Institute’s The Standard for Program Management.

• Oversees and governs contractual obligations and risks associated with this contract.

• Manages the IRS coordinated review cycle of all work products and deliverables.

• Performs quality assurance of work products and deliverables.

• Manages the Service Strategy process in partnership with the IRS to seek new solutions and initiatives for business problems and provide proactive recommendations and assessment.

• Manages staffing and time tracking of resources.

• Manages Benchmark process with IRS.

• Manages subcontractors, procurement activities, and vendor contractual obligations.

• Manages IEP O&M Asset Management including but not limited to:

o a) Hardware maintenance agreement with vendors.

o b) Software subscription renewals and license entitlement compliance.

• Performs contract change control.

• Manages new work requests from IRS.

• Provides quality control and oversight over the IEP O&M Service Level Objective reporting to the IRS.

• Operates and maintains the IEP Self Service Catalog for estimating hosting of applications in the IEP environment.

4.6.1 Automated Front Door (AFD)

The Managed Service Provider is responsible for submitting all deliverables, work products, Change Requests, and Work Requests through the IRS Automated Front Door (AFD). The AFD is an IRS SharePoint site that can only accessed from an IRS laptop. IRS reviews and either approves or rejects submitted items using this site. Items that are rejected can be re-submitted using the site following the contract specifications.

4.6.2 Technical Review Board (TRB)

The IRS hosts a weekly Technical Review Board (TRB) that is supported technically and operationally by the Managed Service Provider. On certain occasions, the IRS may also request ad-hoc TRBs for high priority IRS initiatives. The Managed Service Provider’s program and project leads are available to attend all TRBs and provide input on system technical changes, UWRs, VROMs and Work Requests.