Section_J-Attachment_C.1_Current_State_of_the_Portals_and_Help_Desk_Environment_-_v2.9.pdf

Internal Revenue Service

Solicitation Number: TIRNO-16-R-00026 IRS Integrated Enterprise Portal 1.5 (IEP 1.5)

Current State of the Portals and Help Desk Environment

Version 2.9

September 21, 2016

SECTION J-ATTACHMENT C.1

2 September 22, 2016

1. Introduction

The Internal Revenue Service (IRS) is planning to award a new managed services contract to build and transition the existing IRS Integrated Enterprise Portals (IEP) to a new state that continues to meet the future business needs of the IRS.

2. Document Purpose and Organization

The IRS has chartered the Portal Re-Compete Acquisition Project to administer the acquisition processes necessary to award the new managed services contracts for Integrated Enterprise Portal

(IEP) Public User Portal (PUP) aka IRS.gov, the Registered User Portal (RUP), and the

Employee User Portal (EUP), Transaction Portal Environment (TPE) and Foreign Account Tax

Compliance Act (FATCA). This document is intended to provide potential contract bidders with current state background information necessary to understand the scope, complexity, scale, and growth expectations of IRS’ major Portals.

The Current State document is divided into six major sections:

Section 1: Introduction

Section 2: Document Purpose and Organization

Section 3: Integrated Enterprise Portals Background & Overview

Section 4: Core Services

Section 5: Workloads

Section 6: Current State Volumes and Volume Forecasts

Each of the current state description sections is organized as a table structure with the following elements as shown in Table 2.0.1.

Table 2.0.1 Current State Description Elements

Table Element Table Element Definition

System Name The system’s formal designation in Request for Proposal (RFP) documents

Target Audience The group or groups the system is intended to serve

Content and Services The information, functions, and resources available on the system

Technical Platform A general description of the technology components that comprise the system

System Integrations A general description of the interfaces and connections between the system and other systems

3 September 22, 2016

Table Element Table Element Definition

Location The current system locations

Managed Service Provider

(MSP)

The current Managed Service Provider

This document concludes with five appendices:

Appendix A: List of Current IEP Applications - provides information on all applications that are available on the IEP PUP website, IEP RUP Login Authenticated

(LA), RUP - Self Authenticated (SA) applications, IEP EUP applications, IEP TPE applications, and FATCA applications.

Appendix B: IEP Application Interfaces and Descriptions.

Appendix C: Business Impact Analysis Data – Identifies the IEP system and key applications Recovery Time Objectives

Appendix D: Key Current State Organizations – identifies organizations that have stakeholder roles in the operations and maintenance (O&M) of the current portal infrastructure.

Appendix E: Acronym List.

3. Integrated Enterprise Portals Background and Overview

The mission of the IRS is to provide America’s taxpayers top-quality services by helping them understand and meet their tax responsibilities and enforcing the law with integrity and fairness to all. In 2015, IEP IRS Websites served over 2.7 billion page views to more than 760 million site visitors globally.

The IEP is a fully scalable, managed private, virtualized infrastructure capability dedicated to

IRS that provides technology services to internal and external users. The IEP is the front door to the IRS backend and plays a mission critical role in serving tax payers, tax preparers and employees. The IEP provides fully integrated core services, including infrastructure, operations, security, application, integration & support, and program management services, to establish a fully integrated robust platform that supports multiple workloads, also referred to as Portals and major applications, and application styles. The result is a single, flexible, scalable and reliable digital platform that supports a variety of performance and availability requirements in excess of

99.99% availability and sub-second responses, even in the event of an unexpected disaster during peak tax season.

The IEP platform supports:

4 September 22, 2016

Exponential growth of online electronic filings and taxpayer access to information

Automation of key business processes

Centralized logging and monitoring that is integrated with IRS E2E systems

Balanced system capability to meet demand by dynamic application scaling

Consistent user experiences for the taxpayer and tax preparer

Improved data and content sharing between IRS user communities

Improved services for taxpayers and preparers

Enhanced security posture of web-based applications

The core IEP platform consists of the following types of services that support multiple IRS workloads:

Infrastructure: Tiered network and firewall, storage compute and virtualization management, data center services, and dynamic traffic-based throttling capabilities spanning both physical data center and operations & management services.

Operations: Capabilities that support the operation of workloads and understanding the usage of applications, such as web analytics, reporting, monitoring, logging, dynamic scaling, operational application dashboards, patch management, change management, and fully integrated event-driven automated deployment of infrastructure and applications.

Security: Includes both technologies and operations services to protect against a range of digital attacks and work with IRS security professionals to maintain relevance and continued compliance of the platform, existing applications and workloads, and new workloads, application styles and applications as they are released.

Application: Standardized platform services to accelerate delivery and deployment of business applications, including web services and service virtualization, web applications, identity and access management, databases, messaging, portal & content management, and fully automated application environment deployments.

Integration & Support: Services supporting the integration, on-boarding and engineering of new IRS business applications, application styles, workloads or technologies into the fully integrated and managed platform.

Program Management: Develops, implements, maintains, and regularly improves program and project management practices that are compatible with the Project

Management Institute’s (PMI’s) The Standard for Program Management.

By leveraging core services described above, the IEP scales to numerous virtual workloads, isolating each as needed to meet varying security requirements. Currently, the IEP supports the following seven workloads, each with a different target audience and security:

Public User Portal (PUP)

EITC Central

Political Organization Filing and Disclosure (POFD)

Registered User Portal (RUP)

5 September 22, 2016

Transactional Portal Environment (TPE)

Employee User Portal (EUP)

Foreign Account Tax Compliance Act (FATCA)

The IRS IEP is comprised of the following components and associated accountabilities as outlined in Table 3.1.2. Based on a recent third-party benchmark performed on the IEP, over half of IEP services are custom services. Custom services are service components that are not typically found in standard Operations & Maintenance offerings such as Application

Development and Maintenance, Program Management, Security and Middleware/Integration.

A Website service model description is also provided to delineate current Managed Service

Provider/IRS accountabilities across major service areas. The IEP follows a tailored ELC lifecycle. The information is presented as a table with the following elements as shown in Table

3.1.1.

Table 3.1.1 Website Service Model Description Elements

Table Element Table Element Definition

Lifecycle

Service/Process

A major system lifecycle function based on Information Technology

Infrastructure Library (ITIL) latest version framework. Note: Selected ITIL services/processes are omitted if they are not currently operational.

MSP

Managed Service Provider. An ‘X’ in this column indicates primary service ownership lies with the MSP. The IRS may play a supportive service role.

IRS

Internal Revenue Service. An ‘X’ in this column indicates primary service ownership lies with the IRS. The MSP may play a supportive service role.

Joint An ‘X’ in this column indicates the IRS and the MSP share service ownership.

Table 3.1.2 IRS IEP Components and Accountabilities

Lifecycle Service/Process MSP Joint IRS

P ro g ra m

M a n a g em e n t

Program Support

X

Process Support X

6 September 22, 2016

Lifecycle Service/Process MSP Joint IRS

Reporting/SLOs X

S ec u ri ty

Monitoring, Compliance, Reporting X

O p er a ti o n s

Application Operations Support X

Production Application Management (monitoring, logging, E2E)

Middleware Support X

Service Desk X

IRS.gov Web Site Help Desk X

Incident Management X

H o st in g

37 IEP environments including management, development, test, and production / Operating System

N et w o rk in g

Multiple geographically-separated data centers X

Telco – Redundant Dedicated Circuits, Vendor Diversity

Other – Redundant, Vendor Diversity

Business Continuity (Geographically separated sites able to handle full workload)

4. Core Services

The IEP platform core supports multiple workloads and application styles to establish a set of re-usable technology and process services that can be configured to meet the unique demands of applications and environments. The core services of the IEP are tightly integrated and automated

7 September 22, 2016 to establish a robust platform that is integrated with IRS’ processes and technologies to accelerate the delivery of IRS business applications. The IEP uses Shared Service components.

Shared Service components are components of the architecture that are used by more than one application.

4.1 Infrastructure Services

The Infrastructure services provided by IEP enable IRS to dynamically provision environments and virtual infrastructure to support a variety of business needs from proof of concepts to full production deployments.

4.1.1 Network and Firewall

IEP maintains multiple data centers in an active/active state to monitor internet health, minimize latency, improve connection speeds for clients, provide fail-over key toolsets and applications, and meet Service Level Agreement (SLA) requirements. A robust networking architecture supports the demands and flexibility of IEP. The core of the IEP network provides high-speed

(10 Gbps/1 Gbps) layer 2 and layer 3 switching between VLANs, DMZ connections, partner networks, and outside internet connections. Networks with different security levels are separated via firewalling - virtual, physical, or both. Depending on demand need and security requirements, physical and virtual network elements can be used to manage traffic, provide security, and respond to the changing needs of the virtual data center.

Internet traffic is load balanced across the geographically separated data centers, enabling application availability even during data center outages or upgrades. Traffic is also automatically rerouted to secondary locations based on user need and network efficiency, while remaining completely transparent to the end-user. IEP also has the flexibility to configure dynamic or planned fail-over during outages and required maintenance. Configuration and administration is accessible through a web browser interface.

The Wide Area Network (WAN) architecture includes interconnection of routers, switches and firewalls which help optimize traffic patterns from registered users, MSP data centers and IRS data centers that host multiple backend systems. The WAN architecture is separated by network zones which include the public internet, the connection between the data centers.

IEP provides the ability to safely and easily extend network access to desktops to remote users, devices, and endpoints after authentication. Remote access to the IRS IEP environments is restricted to users connected to the IRS intranet or privileged MSP networks, and is specially designed for operational management as well as for development and testing.

The IEP Local Area network (LAN) infrastructure was designed and built with agility and scalability in mind to meet anticipated future growth demands. The logical LAN design is based on multiple private secured environments that allow ingress and egress traffic through firewalls.

8 September 22, 2016

4.1.2 Storage

The IEP provides multiple tiered storage protocols. The storage supports 99.99% uptime.

The storage design provides the following services:

Archival, primary and transient storage for applications

High-performance tiered storage for applications with intensive IO requirements

Fault management, performance reporting, capacity reporting

If the storage requirements grow (e.g., IOPS increase, files space increase, etc.) beyond current capabilities, the design incorporates further deployments to meet application workload requirements (high IOPS such as virtualization software data stores, high capacity but low IOPS such as Backups).

4.1.3 Computing and Virtualization Management

The virtualization scheme utilized by the IEP provides the following:

A shared physical infrastructure that is managed and controlled by a virtualization and management capability.

An ability to create different logical environments (e.g., development, test, production), with network boundaries between them, on the same shared hardware infrastructure.

A separation of the workloads running on the infrastructure from the actual infrastructure

– i.e., software is separated from hardware and both are managed and can be evolved independently.

The ability to allocate resources to environments and to change that allocation dynamically in response to the actual needs of the workloads running in those environments.

IEP compute architecture provides elasticity and optimizes the operational efficiency and utilization of physical resources. IEP can reallocate compute resources to support peak times, and reallocate production capacity to development and test environments during seasonal lulls in workloads. Furthermore, this architecture allows in-place hardware upgrades without impacting application availability as well as environmental isolation and segmentation.

4.1.4 Data Center Services

The data centers being used to house IEP infrastructure are geographically separated across time zones within the United States such that local disasters do not result in a loss of service.

Equipment is located in racks and cages within the data centers’ secure FISMA-moderate compliant environments. All data centers use state-of-the-art cabling, wiring, air flow, smoke

9 September 22, 2016 detection, fire suppression, temperature control, humidity control, and backup power generation.

IEP has a 200MB per second data line to sync data between the two data centers.

4.1.5 Dynamic Traffic-Based Scaling

Automation of datacenter workflows enable rapid provisioning of virtual machines that provide the required services to support IRS applications in the IEP. This serves as the cornerstone of auto-scaling to match demand with resource availability. Additionally, it helps to facilitate patch management, change and configuration management, and disaster recovery.

4.1.6 Internal Interfaces

IEP interfaces with multiple IRS Data Centers, IRS Call Centers, and IRS2Go.

4.1.7 External Interfaces with other Government Agencies

IEP interfaces with the following entities:

1. Department of Health and Human Services (HHS) Center for Medicare and Medicaid

Services

2. Department of Education

3. 50+ State Tax Agencies

4. International Data Exchange

5. Large Transmitters (e.g., Intuit, H&R Block)

6. Medium Transmitters (e.g., TaxPro)

7. Small Transmitters (e.g., Accountants)

8. Insurance Companies and Large Employers (e.g., Aetna, United Healthcare)

4.2 Operations Services

4.2.1 ITIL Service Management

The IEP operations management uses several ITIL-compliant tools and ITIL-based processes that work hand-in-hand with established IRS tools (e.g., KISAM, Installation Request Tracking

Ticket (IRTT)). The tools and processes have a specific focus on ensuring that the processes support the activities to provide an overarching Operations Management Framework that span and govern multiple dimensions of the service, including:

Internal IEP interactions

Consulting-IRS interactions

IEP O&M interactions

IEP enhancement-focused interactions

10 September 22, 2016

The IEP Service Management include the following:

Change Management

Release and Deployment Management

Event Management and Monitoring

Request Fulfillment

Incident Management

Problem Management

Access Management

Availability Management

Capacity Management

4.2.1.1 Configuration Management

The IEP program performs configuration management on the following configuration item categories:

Documentation: All project documentation including program level documentation, deliverables, reports, templates, requirements, designs, and test.

Code Documentation: Source code for applications maintained and updated by MSP

Team.

Training: Any artifacts used to train end users. Examples include training presentations.

Deployment Guides: Documents or manuals detailing the steps to operate an application. Examples include installation manuals and operations guides.

Infrastructure: IEP Infrastructure items including Hardware (Server, Network and

Storage) and Virtual components.

4.2.1.2 Configuration Management System

The IEP program provides the Configuration Management System that is designed to support the

IRS’s processes and the Information Technology Infrastructure Library 2011 specifications. The

Configuration Management System ensures that Configuration Items (CIs) are correctly planned, identified, controlled, reported, verified, and audited throughout their lifecycle in the delivery of services. A Configuration Item is any component that needs to be managed in order to deliver the services provided to the IRS. Currently the Configuration Management System supports:

• ITIL® centric processes

• Over 415 IRS, MSP, and third-party contractor resources

• Detailed Reporting and Dashboard capabilities to provide insight to leadership

• Integrated with third party orchestration tools, using web services, to automate deployment of virtual machines

11 September 22, 2016

• Submission of over 1,000 tickets per month

• Processing of all internal and client system access requests

• A platform to allow the automation of manual processes and approvals

• Automated VM provisioning using web services and third party orchestration tools

• Identification of capacity problems, potential software security risks, and provides the

IRS with accurate reports

The Configuration Management System is used to manage the IEP’s ITSM processes of Service

Request Fulfillment, Incident Management, Problem Management, Change Management, and

Release Management. The Configuration Management System is comprised of three main modules to support the services provided to the IRS:

4.2.1.2.1 Configuration Management Database (CMDB)

The Configuration Management System provides the CMDB that provides detailed reporting and acts as the master Infrastructure Inventory database. The CMDB not only tracks the

Configuration Items within the IEP IT environment for Configuration Management, but also incorporates their relationships amongst other CIs, users, and groups in addition to the CIs activities in the other IEP’s ITSM processes of Service Request Fulfillment, Incident

Management, Problem Management, Change Management and Release Management. The

Configuration Management System includes a Configuration Management module that supports the Configuration Management processes outlined in this document which includes a Discovery

Tool and Business Services Management Map. Both are capable of effectively identifying CIs, attributes, and relationships within the IEP IT environment. The IEP CMDB currently contains nearly 11,000 CIs.

4.2.1.2.2 Infrastructure Discovery

The Configuration Management System Discovery application detects the computers and

Infrastructure devices connected to the IEP network. When Discovery detects a computer or device, it explores the device's configuration, provisioning, and current status, then updates the

CMDB, accordingly, to include this computer or device in the inventory. On computer systems, Configuration Management System Discovery also identifies the software that is running and any TCP connections between computer systems and creates all the relationships between computer systems.

4.2.1.2.3 Asset Management

Asset Management tracks the financial, contractual, and inventory details of hardware, software, and virtual infrastructure – as well as non‑IT assets – throughout their lifecycle. Asset requests are handled using workflows to obtain approvals, validate entitlements, issue chargebacks, and provision services. Once an asset is deployed, Asset Management records all maintenance

12 September 22, 2016 activity and enables IEP to perform regular audits, right up until asset retirement. The tool includes a normalization module that helps de-duplicate data by consolidating Configuration

Item (CI) data and getting rid of inconsistencies such as multiple names for a single vendor, product, or product version; and standardizing CIs with a comprehensive catalog of CI models and categories. Additionally, this module provides End of Life (EOL) dates for software and hardware installed in the IEP allowing the MSP to notify the IRS, and manage our products EOL dates so renewals, software upgrades, and potential product EOL are not missed that affect the program.

4.2.1.3 Incident Management

The IEP Service Desk, a single point of contact to the IRS’s EOps Enterprise Service Desk and other IRS Help Desks, provides 24x7x365 Incident and Service Request support, including the identification, triage, troubleshooting, and resolution of both non-Production and Production incidents. These activities utilize both the MSP ITSM (IT Service Management) tool and

KISAM, the IRS change management and ticketing tool, and interact with existing IRS processes such as the IRS Support Restoration Team (SRT) process and the Change Request Process for emergencies.

The IEP Service desk provides initial triage support for all KISAM incidents assigned to the IEP infrastructure (PUP/RUP/TPE/EUP). In addition, the MSP provides triage support for additional incidents as requested for applications hosted on the IEP platform. The Service Desk also opens

KISAM tickets as a means to engage other IRS troubleshooting groups whenever IEP support teams have determined that an incident is outside of the IEP. Groups with whom the MSP coordinates include:

IRS application development teams

IRS Middleware

Backend Single-Sign-on support team

IT Security managers

Enterprise Operations

Application business owners

External transmitters

External vendors

It is important to note that the IEP teams assist multiple Incident Management efforts, even when the ticket is not related to issues with the IEP. Crucial information and subject matter expertise from the IEP team is frequently a key contributor to troubleshooting and analysis.

The IEP Service Desk manages all emergency communications involving the IEP as a means to keep users/customers informed of service events and actions with the IRS and inside of IEP.

Additionally, the IEP Service Desk provides business hours support for the IEP-ITE

13 September 22, 2016 environments and adheres to SLOs during established IEP Service Desk business hours: Monday through Friday, 9:00 AM ET – 6:00 PM ET.

4.2.2 Operational Capabilities

The following operational capabilities: logging, monitoring, dashboards, and reporting are aligned to support the operations of the IEP.

4.2.2.1 Logging

Logs are collected and stored from applications, application platforms, databases, and middleware components. These logs are sent to the IRS’ E2E logging servers to provide application and system level monitoring to the IRS E2E monitoring applications for IRS’ analysis, processing, reporting and auto-ticket generation. The IEP also performs application level logging for IRS business analytics, such as IT Reporting tool for the ACA.

4.2.2.2 Monitoring

The MSP comprehensively monitors the IEP infrastructure 24x7x365 in the following ways:

End User experience monitoring of applications and websites

Connection or other connectivity failures between caching and origin infrastructure

Internal, bottom-up infrastructure alerting, monitoring and reporting of applications, bandwidth, databases, operating systems, networks, servers, middleware components, and websites

Health, capacity and performance monitoring and alerting of the virtual infrastructure

4.2.2.3 Dashboards

The MSP provides dashboards to IRS enabling autonomous data analysis and reporting for the following capabilities:

End user statistics

Website usage

A2A Transactional health

Application/infrastructure availability

Infrastructure and bandwidth usage

Log Analytics

Website Optimization

14 September 22, 2016

4.2.2.4 Reporting

The Reporting process consists of gathering metrics from multiple data sources and generating reports, which provide a consolidated view into IRS.gov, applications, and IEP infrastructure performance analytics. This process facilitates the gathering of data on an ongoing basis, which provides consistent metrics to the IRS on an ad-hoc, daily, weekly, and monthly basis. The MSP also provides monthly diagnostic reports detailing the current state of the website. These diagnostic reports provide information regarding broken / inappropriate links, automated section

508 checks, page weight and search-ability. In addition to the ad-hoc reporting requests, the following sample list of standing reports is provided:

Sr. IT executive report

Daily Filing Season Report

OMB E-300 Metrics

Response Time Report

Help Desk Contact Database Extracts

Help Desk Operational Metrics

Help Desk Customer Satisfaction Surveys

IPV4/V6 Report

Service Level Objective performance report

4.2.3 Automated Deployments

Application deployments on the IEP are streamlined through end-to-end automation and integration of core services described in this section. This enables repeatable and reliable deployment of application changes, while abstracting and automating the detailed integration of services required to support the application execution environment. Deployments can be initiated through the service management tool, or an event-driven interface to alleviate the need for manual processes. The application interface provides IRS Application owners a mechanism to configure, customize, and deploy fully integrated applications across multiple environments, including Production. Automation also retains the prior version of an application deployment up to three days after a new deployment is performed in case it is required for emergency rollback.

There is also a standardized process to provide an interface for niche application deployments that do not follow one of the three application styles, or new technologies not currently in the standardized platform.

The following components are configurable for an application:

Targeted environments for application deployments

Application style and components configurations

Application server configurations

Webserver configurations

Messaging server configurations

Database configurations

15 September 22, 2016

Gateway server configurations

Secure File Transfer Protocol configurations

4.2.4 Patch Management

The MSP provides patch management to support continual patching cycles for the infrastructure, applications and shared services driven by vulnerability requirements per the Internal Revenue

Manual (IRM).

All Management, Development, Testing and Production environments for all workloads are patched year-round, even during peak periods of filing season and open enrollment to maintain the security and integrity of the IEP. The MSP coordinates the patching windows with all applications provided in the Appendix, then proceeds through the IRS Change Management process for approval. Prior to patching Production, the MSP coordinates IRS testers for validation during Production patching windows.

4.2.5 Change Management

The MSP is responsible for managing the changes required to operate, maintain, and upgrade the

IEP while working with the IRS change management process.

Overseeing and managing the introduction of all changes into the Production and higher test environments (SIT, PETE and EITE), and coordinates the approval of all requested changes with IRS

Participating in the IRS ITE change control process and governance process for IEP

Assisting the IRS in the assessment and prioritization of changes to validate minimum conflict of change introduced into the IEP environment

Operating under a standardized IEP Change Management Process with defined approval processes and documented interactions with the IRS PCMB, the IRS Change Control ticketing systems, KISAM and IRTT, using GFE, and other IRS Change Control Boards for all production changes on the IEP. The joint IEP/IRS Change Control process is used to track all changes occurring on the IEP.

Adhering to a Change Control process according to an IRS approved Change Risk Matrix for all changes

Managing changes based on an IRS defined CCB and Change Advisory Board structure and a Change Risk Matrix indicating a) levels of approvals and b) IRS visibility into different types of changes

IEP system changes are categorized into changes requiring IRS approval, changes requiring notification to the IRS, and MSP operation changes that are outside of the IRS change management process

16 September 22, 2016

4.3 Security Services

The IEP security controls are configured in accordance with the appropriate Internal Revenue

Manual (IRM) and National Institute of Standards and Technology (NIST) guidelines to support a Federal Information Security Management Act (FISMA) Moderate system. The IEP Security follows the NIST 800-37 Risk Management Framework. Security technologies and services are built across each of the workloads (defined in section 5) and fully integrated with automated deployments. Capabilities include: continuous monitoring, anti-virus, configuration management/file integrity management, bot-detection/prevention, distributed denial of service protection, intrusion detection and malicious source detection and isolation, advanced security analysis, static source code vulnerability analysis, threat identification and analysis, dynamic application vulnerability scans, and web-services XML threat mitigation.

4.3.1 Compliance

The Security function offers compliance services tailored to the IRS’ unique needs which are driven by the need to meet known, established and recurring requirements from FISMA reporting, to the interpretation, analysis, and implementation of new compliance initiatives aimed at addressing a new generation of technologies and threats.

The IEP compliance program is based on NIST guidance with details and refinement provided through an IRM and Treasury Department overlay. A full documentation set has been created to capture the compliance posture of the program and provide the basis for assessment activities.

Regular IRS CyberSecurity assessments are supported throughout the year to include direct support for IEP systems and indirect support for independently accredited systems which inherit

IEP controls.

The IEP Security Team performs the following Security Compliance activities:

Full implementation of Internal Revenue Service organizational policy, Internal Revenue

Manual (IRM) 10.8.X

Document/manage control failures with documented plans of remediation and necessary timelines called Plan of Action and Milestones (POA&M) tracked in IRS system

Provide system asset inventory and compliance reports

Annually test the security contingency plan to prepare for site failure, disaster, etc. to maintain system availability/recovery

Support annual IRS assessment of the security controls in place on the systems (Annual

Security Controls Assessment (ASCA)) and annual site review of contractor’s work place to validate safety and security of workplace

Facilitate IRS performance testing on systems

Conduct simulated security incidents quarterly to test response capabilities

Support TIGTA audit requests

17 September 22, 2016

Conduct Privacy Impact Assessment or assess privacy exposure risk for application with business owners

4.3.2 Operations

IEP Security Operations is responsible for all day-to-day security activities across all portals operations. IEP Security maintains daily operational security processes, tools, and security efforts in order to maintain the defined security posture and enforce adherence to all applicable

NIST 800-53 controls commensurate with system categorization. More specifically, the core mission and effort of the Operations Team is to protect IEP hardware and software systems from internal and external threats that impact site confidentiality, integrity, and availability. Working in conjunction with compliance standards and across various technical teams, IEP Security supports and performs the following operational activities within a Continuous Monitoring model:

Threat and Vulnerability Management

Compliance scanning/monitoring

Static and Dynamic Application Security Testing

Web Application Firewall (WAF)

Automated web-based attack protection

Host-based Security Protection

Security Configuration and Change Management/File Integrity Management

Security Information and Event Management (SIEM)

Incident Response

The IEP Security Team performs the following Security Operations activities:

Implement and manage daily security operations to analyze, monitor, and respond to risk on daily basis across all systems

Monitor for security events and suspicious activity 24/7 to rapidly respond to prevent/contain risks

Work to prevent outages, system damage, and taxpayer data exposure

Maintain all security monitoring tools to make sure they are operational across all systems and device in environment at all times

Implement Security Configuration and Change Management procedures as well as

Security Impact Assessment process throughout change process

Implement security auditing procedures especially for critical components

Implement procedures to prevent, detect, mitigate constant/repeated threats and maintain sound incident handling, monitoring, and response procedures

Conduct forensic analysis of potential incidents/suspicious activity; support formal investigations

18 September 22, 2016

Implement patch and vulnerability management program

Perform external vulnerability scanning and input into vulnerability management

Operate using a Separation of Duties Matrix

Monitor outbound connections and identify activities relating to data exfiltration by attackers

Vet applications against necessary tools, approvals, and approved to go-live, and maintain version/revision control for any application/code changes

Support IRS external vulnerability and penetration testing across portals environment

Assess applications for vulnerabilities via vulnerability assessment tools

Mitigate vulnerabilities prior to pushing application to production environments

Provide application designs, test documentation, and source code to IRS to support application code assessment concurrence prior to production deployment

Applications are tested at least quarterly for vulnerabilities

4.3.3 Security Reporting

The team reports on the following:

Provide security metrics showing security operational processes

Provide information around threats, vulnerabilities, and risk for the information system

Document risks and mitigations to include impact, likelihood, etc.

Provide weekly security status reports

Document and review how potential security incidents were investigated/reviewed

Provide a status of vulnerabilities within the environment

Provide security incident report identifying the investigation of suspected incident, analysis performed

4.3.4 Threat Mitigation and Protection

As the external threat landscape continues to evolve, IEP Security has implemented various threat mitigation and edge security services to protect IEP portals from perimeter threats as well as robust data analytics capabilities to identify, normalize, and correlate threat data and intelligence across the portals. The core threat mitigation and protection capabilities are as follows:

Web Application Firewall (WAF)

SQL Injection Protection

Remote File Inclusion Protection (RFI)

Cross-site Scripting Protection (XSS)

Cross-site Request Forgery

Distributed Denial of Service Protection (DDOS)

19 September 22, 2016

Automated Web Attack Protection

IP Blocking/Blacklisting

IP Reputation Protection

Enterprise Log Management

Security Analytics

Security Information and Event Management (SIEM)

Proactive Security Alerting and Notification

Security Dashboards

4.4 Application Services

4.4.1 Application Styles

The IEP supports multiple application styles including Application to Application (A2A), Web

Application, and Component Application.

4.4.1.1 Application to Application (A2A)

The A2A style is generally used for system-to-system interaction. This style enables external applications to connect to IRS web services via HTTPS. This style does not present the user with a graphical user interface because the interaction is primarily system-to-system.

4.4.1.2 Web Application

The Web Application style provides a web front-end for end user interaction with the IEP applications. This style supports applications that require a graphical user interface to interact with end-users.

4.4.1.3 Component Application

The Component Application style enables IEP application owners to deploy configurations for a specific technology component instead of a group of technologies like other application styles.

4.4.2 Standard Technologies

4.4.2.1 Application Servers

Application Servers serve as a standard component of the Web Application style and are also available for use under the A2A style.

20 September 22, 2016

4.4.2.2 Web Servers

A common use of web servers in IEP is to provide separation between the application layer and the public. All Web Application styles utilize a web server for this purpose.

4.4.2.3 Authentication and Authorization

IEP deploys tools to support authentication and authorization of IRS application services. These tools provide secure Single Sign-On (SSO) and identity access management so users can be authenticated for access to the deployed applications.

4.4.2.4 Database

Oracle Relational Database Management System (RDBMS) is the IRS standard for databases.

RDBMS is primarily used for session persistence and content database.

Session Persistence: Enables state-full interaction between the users and the application.

These databases are used to overcome the connectionless nature of request-response paradigm inherent in the Transmission Control Protocol/Internet Protocol (TCP/IP). This is created automatically for applications configured to use the database session persistence method.

Content Database: Used by applications for application configuration content. In addition to session databases, certain IEP applications also use persistent data stores to store application configuration data.

4.4.2.5 Messaging Services

Messaging Services are used to facilitate communication between the IEP and backend IRS applications. Message Queuing (MQ) technology is currently leveraged to allow multiple IEP applications and services to use a single transport type to asynchronously transfer messages to

IRS.

The configuration of the IEP MQ servers requires significant amount of coordination between the shared responsibilities of IEP and IRS. The IRS Middleware Infrastructure Integration

Section (MIIS) MQ administrators are responsible to gather, package, and submit MQ updates and artifacts to the IEP MQ Team. The supplied artifacts from MIIS are depended to fully configure the IEP MQ servers to enable communication to the IRS backend. The IEP ITSM tool is utilized to facilitate the transfer of MQ artifacts to the IEP MQ Team via an Application

Migration Request ticket.

4.4.2.6 Secure File Transfer Protocol (SFTP)

Applications in IEP use a secure file transfer solution to move attachments between the portal and backend applications. When an attachment is ready for consumption, an IEP application

21 September 22, 2016 sends a message to the backend application via the AMDAS API. The backend server then retrieves the attachment from the secure file transfer solution server using SFTP. SFTP is how

IEP connects with the IRS backend systems.

4.4.2.7 Secure Gateway

The secure gateway is a server that scans messages and files sent to IEP for potential threats such as viruses, malware, and intrusions. The secure gateway can validate file types and submission sizes that users upload to verify they comply with defined restrictions.

4.4.2.8 XML Gateways

XML Gateways provide additional security for IRS hosted web services. XML Gateways provide a set of capabilities for processing and protecting inbound and outbound transactions including:

XML validation and transformation

Anti-virus protection

Denial-of-service protection

XML attack detection/prevention

Access management of Web Service

Logging and auditing

4.5 Integration & Support Services

4.5.1 Application Service Operations

The Application Service Operations (ASO) Team is responsible for ensuring applications on the

IEP are available and operational. The ASO Team interfaces with the incident and change management processes to work all issues through to resolution. The ASO Team provides

24x7x365 support of IEP production applications.

The IEP ASO groups fulfill the following O&M-related high-level tasks:

Provide application related global load balancing solution change support for current applications

Provide deployment support for current IEP applications documented in Appendix A/B

Provide production IEP application migration support for applications documented in

Appendix A/B

Provide assistance with deployment support

Provide external partner application testing support

Provide application deployment and coordination support

Provide application related infrastructure changes request support

22 September 22, 2016

Coordinate patching efforts with the Application teams

Provide Change Request, Service Request, and Incident support

Provide standard build window IEP application support

Provide standard Content Management System build window support

Provide P1/P2 Service Restoration Team (SRT) IEP application support

Provide P3/P4 IEP application support

Provide initial triaging of P1/P2/P3/P4 tickets for applications

Assist with the coordination of testing activities with Application teams

Provide application log file support for Application teams

Provide application monitoring and logging support

Provide On-call Application Operations support for P1 and P2 production incidents

Provide legacy application, identity management and messaging support for versions supported by the IRS

Provide daily Health Checks and confidence testing following IEP deployments

Application onboarding & integration activities

Research and troubleshoot Configure application parameters

Conduct Post-Deployment Validation

Control room support for application specific activities such as Filing Season support for

ACA and MeF

4.5.2 Application Systems Integration

The Application Systems Integration (ASI) Team provides integration and technical guidance to the IRS application teams. This guidance enables the IRS application teams to be able to successfully design, develop, test, and deploy in the IEP. More specifically:

Provide ongoing integration services for the buildout and testing of all applications regardless of their position in the development lifecycle

Perform application architecture and engineering support for new applications

− Preliminary engineering study

− Requirements gathering

− Effort-scoping

− Serve in an advisory role during the plan, analyze, test and deploy phases of the software development lifecycle

Provide performance testing support

− Application performance tuning

− Performance testing planning and execution

− Analysis of performance test results

23 September 22, 2016

Provide sustained after hours support for special projects e.g., supporting application testing in EITE or FIT

Support annual DR/Alternate processing site/DR performance testing

Support the onboarding of new applications or redesign/enhancements to the production applications

Maintain the automated deployment process documentation to include any relevant updates or changes

4.5.3 Application Development

The Application Development (App/Dev) Team is responsible for full lifecycle development and maintenance of the MSP managed applications in Appendix A/B. The App/Dev Team designs, builds and develops, tests, and deploys in the IEP. Additionally, the team maintains documentation (requirements, designs, test scripts, etc.) and supports the regular patching cycles with application support and validation activities for the MSP managed applications. The

App/Dev Team interfaces with the incident, security, and change management processes to work all issues through to resolution and supports regular maintenance releases of the applications along with annual updates to implement legislative updates. Releases are planned and prioritized with the IRS.

For MSP managed applications, the App/Dev Team leverages the software development lifecycle to implement updates, and for non-MSP managed applications in the PUP, supports deployment and auxiliary testing activities (see below).

The SDLC for the MSP supported applications in Appendix A/B may include the following activities for the maintenance releases and annual updates:

Analysis

Planning

Requirements

Design

Development

− Front end (e.g., HTML, CSS, JSP, JavaScript)

− Back end (e.g., Web, Batch, SOA, MQ)

− Secure Gateway policies

− System Integration

− Project build tools and IEP-DD package creation

Unit and Integration Testing

Security code scans / analysis / remediation

Lower environment deployment support

Lower environment testing support

Interagency and Release Testing

24 September 22, 2016

System Testing

Backend Integration testing

Browser Testing

Section 508 Testing and IRS IRAP coordination

− Includes manual verification and the use of IRS approved testing tools

Dynamic Application vulnerability scanning

Performance Testing

Site usage Reporting Validation

Generating ad-hoc and scheduled reports

User Acceptance Testing Support

Deployment

Production Implementation Testing

Service Introduction Support

For non-MSP managed applications, the following activities are the responsibility of the MSP:

Lower environment deployment support

Backend Integration testing

Browser Testing

Section 508 Testing and IRS IRAP coordination

− Includes manual verification and the use of IRS approved testing tools

Dynamic Application vulnerability scanning

Performance Testing

Site usage Reporting Validation

Deployment

Production Implementation Testing

4.5.4 Capacity Management

Capacity Management is necessary to manage the resources within the IEP. The MSP manages capacity for licensing, compute, storage, network throughput, and caching bandwidth. The

Capacity Working Group (CWG) meets on a pre-defined schedule to review requests for capacity within the IEP. Non-production environment requests are reviewed and approved by the

CWG, and Production environment capacity requests are processed through the Capacity

Governance Board (CGB) for approval.

4.6 Program Management

The Managed Service Provider implements the following Program Management activities:

Manages the program measurement in the Quality Assurance Surveillance Plan (QASP), including a process for developing, implementing, and monitoring a set of performance

25 September 22, 2016 measures to validate that program activities efficiently and effectively support both business and IT strategies.

Manages the resource on-boarding and clearance process for IEP. This includes working with IRS CORs to complete the Minimum Background Investigation (MBI) for all resources and service providers that support the IEP including resources and subcontractors that support the Help Desk, Service Desk, and Hosting capabilities. The team also works with IRS to request badges and laptops for cleared resources as needed.

Develops and maintain the overall Program Management Plan that clearly delineates the program and project management approach including, at a minimum, the Project

Management Institute’s The Standard for Program Management.

Oversees and governs contractual obligations and risks associated with this contract.

Manages the IRS coordinated review cycle of all work products and deliverables.

Performs quality assurance of work products and deliverables.

Manages the Service Strategy process in partnership with the IRS to seek new solutions and initiatives for business problems and provide proactive recommendations and assessment.

Manages staffing and time tracking of resources.

Manages Benchmark process with IRS.

Manages subcontractors, procurement activities, and vendor contractual obligations.

Manages IEP O&M Asset Management including but not limited to:

a) Hardware maintenance agreement with vendors.

b) Software subscription renewals and license entitlement compliance.

Performs contract change control.

Manages new work requests from IRS.

Provides quality control and oversight over the IEP O&M Service Level Objective reporting to the IRS.

Operates and maintains the IEP Self Service Catalog for estimating hosting of applications in the IEP environment.

4.6.1 Automated Front Door (AFD)

The Managed Service Provider is responsible for submitting all deliverables, work products, Change Requests, and Work Requests through the IRS Automated Front Door (AFD). The AFD is an IRS SharePoint site that can only be accessed from an IRS laptop. IRS reviews and either approves or rejects submitted items using this site. Items that are rejected can be re-submitted using the site following the contract specifications.

4.6.2 Technical Review Board (TRB)

The IRS hosts a weekly Technical Review Board (TRB) that is supported technically and operationally by the Managed Service Provider.