TIRNO17Q00341_DG__9-26-2017.pdf

OMB Control No. 1505-0081

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER

Q-7-QS-33-SP-P09 000

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

September 22, 1017

4. ORDER NUMBER

5. SOLICITATION NUMBER

TIRNO-17-Q-00341

6. SOLICITATION ISSUE

DATE

2017-09-21 05:00:00.0

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

DIANNE L GOOSBY

b. TELEPHONE NUMBER (No collect calls)

2406135134

8. OFFER DUE DATE/

LOCAL TIME

2017-10-21 13:24:00.0

9. ISSUED BY CODE 12163 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE:0 % FOR

Internal Revenue Service 5000 Ellin Road Lanham MD 20706

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOSB PROGRAM

HUBZONE SMALL BUSINESS EDWOSB NAICS: 541519

DIANNE L GOOSBY 2406135134 SERVICE-DISABLED VETERAN

OWNED SMALL BUSINESS

8(A) SIZE STANDARD:

11. DELIVERY FOR FOB DESTINATION

UNLESS BLOCK IS MARKED

12. DISCOUNT TERMS 13a. THIS CONTRACT IS A

RATED ORDER UNDER DPAS

(15 CFR700)

13b. RATING

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE

3091 16. ADMINISTERED BY CODE 12163

Internal Revenue Service

5000 Ellin Road, Building B

Lanham, MD 20706

Lanham , MD 20706

Internal Revenue Service 5000 Ellin Road

17a. CONTRACTOR/

CODE FACILITY

18a. PAYMENT WILL BE MADE BY CODE 3678

CODE

OFFEROR

IRS Beckley Finance Center

P.O. Box 9002

Tel: (304) 254-3300

Beckley, WV 25802

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED. SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

Base Period: September 29, 2017 through December 28, 2017

0001 Professional support services for ESAT PMO. 3.00 MO __________ __________

Detailed work requirements are included in the PWS.

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4, FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29. AWARD OF CONTRACT: REF. OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5).

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

X

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT)

30c. DATE SIGNED

31b NAME OF CONTRACTING OFFICER (TYPE OR PRINT)

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 1449 (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE (US$)

24.

AMOUNT (US$)

Option Year One (1): December 29, 2017 through March 31, 2018.

1001 Professional support services for ESAT-PMO.

Detailed work requirements are included in the PWS

3 Mos

Detailed work requirements are included in the PWS

Option Year Two April 1, 2018 through June 30, 2018

2001 Professional support services for ESAT-PMO 3 Mos

Detailed work requirements are included in the PWS.

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER

34. VOUCHER NUMBER 35.AMOUNT VERIFIED

CORRECT FOR

36. PAYMENT

COMPLETE PARTIAL FINAL

37. CHECK NUMBER

PARTIAL

FINAL

38. S/R ACCOUNT NUMBER 39.S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42.a. RECEIVED BY (Print) 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42.c DATE REC’D (YY/MM/DD)

42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 3/2005) BACK

SECTION I

SUPPLIES OR SERVICES AND PRICE/COSTS

1. This is a firm-fixed price type contract

This requirement is for Enterprise Security Audit Trails Program Management

Office (ESAT-PMO). The Contractor must perform in accordance with the attached Performance Work Statement (PWS). The contractor shall provide developer testing, program-related expertise for the design, development, and deployment of a security event auditing solutions for the Internal Revenue

Service (IRS) IT environment. The period of performance shall be from

September 29, 2017 through June 30, 2018 with two (2) 3- month option periods.

The Government estimates for the firm fixed price is a total of 21,000 hours for 6 months.

The effort contained in this labor mix may be reallocated upon the mutual agreement between the Contractor and the COTR without the issuance of a formal modification as long as the resulting total does not exceed the total dollar value of the fixed priced CLINs.

The labor category definitions are listed in Attachment 4, Labor Category

Descriptions.

Offerors must map their proposed GSA labor categories against the

Government’s labor categories as listed below.

B2. Base Period – September 29, 2017 through December 28, 2017

CLIN Labor Category Hours Unit Price Total

0001 ArcSight Enginners 1500

0002 Senior Splunk Engineer 500

0003 Splunk Engineers 1000

0004 Systems Architect/Integration Specialist 500

0005 Project/Task Lead 500

0006 Data Modeling SME 500

0007 IT Program Analysis 500

0008 ForeScout SME 1000

0009 Guardium SME 1000

Total

Total Base Period Price $_________________

2.2

O Option Period One (1) – December 29, 2017 through March 30 , 2018

CLIN Labor Category Hours Unit Price Total

1001 ArcSight Enginners 1500

1002 Senior Splunk Engineer 500

1003 Splunk Engineers 1000

1004 Systems Architect/Integration Specialist 500

1005 Project/Task Lead 500

1006 Data Modeling SME 500

1007 IT Program Analysis 500

1008 ForeScout SME 1000

1009 Guardium SME 1000

Total Option Period 1 Price $__________________

Total Price Option Peroid 1: $__________________

2.3

O Option Period Two (2) – March 31 , 2018 through June 30, 2018

CLIN Labor Category Hours Unit Price Total

2001 ArcSight Enginners 1500

2002 Senior Splunk Engineer 500

2003 Splunk Engineers 1000

2004 Systems Architect/Integration Specialist 500

2005 Project/Task Lead 500

2006 Data Modeling SME 500

2007 IT Program Analysis 500

2008 ForeScout SME 1000

2009 Guardium SME 1000

Total Option Period 1 Price $__________________

Total Price Option Period 2: $___________________

Total Price (including Base Period Option Period 1, and Option Period 2

ECTION II

Performance Work Statement (PWS)

Enterprise Security Audit Trails Program Management Office

(ESAT-PMO)

C.1 INTRODUCTION AND BACKGROUND

The Enterprise Security Audit Trails Program Management Office (ESAT-PMO) of the IRS

Cybersecurity division develops security event auditing solutions for information systems within the IRS. The primary focus of ESAT-PMO is the implementation of the Auditing solutions that adhere to IRS governance, directives and policies based on NIST Special Publication 800-53 Audit and Accountability (AU) family of security controls. ESAT-PMO manages development and implementation for enterprise security tools in its efforts to accomplish this mission: Tools include

HP ArcSight, Splunk, IBM Guardium, and implementation and integration support of Continuous

Diagnostics and Mitigation (CDM) tools which include ForeScout, Splunk, BigFix, ResOne, Tripwire, and Archer. Application audit solutions include the Security Auditing Analysis System (SAAS).

Solution design can also include integration of data from other tools across the organization as identified.

ESAT-PMO is moving towards an automated solution to include infrastructure and tools to support real-time and / or near real-time reporting of audit events. ESAT-PMO is also analyzing current policies and processes to align and support this effort of modernization.

C.1.1 ENTERPRISE AUDIT REQUIREMENTS MANAGEMENT AND COMPLIANCE

The Government is tasked with providing support for enterprise audit requirements management and compliance based on federal mandates. Compliance to audit requirements is based on IRS IRM

10.8.1 and NIST 800-53 AU control family. Compliance to audit requirements is the responsibility of the application and system owners as an Enterprise Lifecycle (ELC) artifact with guidance provided by ESAT-PMO. Additionally, ESAT-PMO is responsible for supporting the infrastructure for the collection and analysis of audit and event data as part of Security Information and Event Management (SIEM) solutions. ESAT-PMO directly supports the organizations audit and management compliance goals.

C.1.2 SECURITY TOOLS

ESAT-PMO leverages various tools such as HP ArcSight, Splunk, IBM Guardium, to collect, store, process, and report on auditable security events from systems and applications. ESAT-PMO also supports the ForeScout and Splunk systems as part of the overall Continuous Diagnostics and

Mitigation initiative. ESAT-PMO is responsible for the exploratory research, proof of concept, implementation, operation, and maintenance of the all COTS tools and their supporting infrastructure.

ESAT-PMO manages the Security Auditing Analysis System (SAAS) tool as the SAAS Program

Office (SAAS-PMO).

C.2 OBJECTIVES

The primary objective of this PWS is to procure the necessary skills and knowledge to provide comprehensive support in the implementation, operation, maintenance, and evolution of

ESAT-PMO solution across the enterprise.

C.3 SCOPE OF WORK AND DESCRIPTION OF TASKS

In support of ESAT-PMO, the contractor will perform tasks and activities to assist the Program

Office in successfully meeting its programmatic requirements under IRS agency mission. This will include work on the Security Audit and Analysis System (SAAS) and Enterprise Security Audit

Trails (ESAT) program tools. The contractor’s activities will support resolution of GAO and

TIGTA findings and recommendations. The contractor will also support the goal of meeting auditing and monitoring requirements outlined in IRM 10.8.1.

For all tasks the Contractor will support the function of knowledge transfer to the IRS by communicating alongside of IRS staff in briefings, meetings and working sessions, actively identifying Single Points of Failure in knowledge and skill capability between IRS and Contractor personnel and working to resolve any gaps in capability. The Contractor will produce Standard

Operating Procedure documentation for tools and systems supported, and will participate in maintenance of system security plans and other FISMA required documentation. All artifacts documents, code, or material created will be the property of the IRS and stored in a designated location (generally SharePoint).

C.3.1 TASK AREA 1: GENERAL REQUIREMENTS

SUBTASK C.3.1.1 ORIENTATION BRIEFING

Within two weeks of task order award, the contractor shall conduct an orientation briefing for the

Government. The Government does not desire an elaborate orientation briefing nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the Government and contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held at the Government's facility and both parties shall mutually agree upon the date and time.

The completion of this briefing shall include the following:

The contractor and Government personnel who will perform work under this task order will be introduced.

The Government will show the applicable facilities to the contractor, if the contractor will be performing work on the Government's site.

The Government may provide any GFP to the contractor at this time.

Any issues concerning the contractor clearances for contractor personnel will be discussed.

The contractor shall demonstrate confirmation of their understanding of the work to be accomplished under this PWS.

The contractor shall provide the accounting period end dates to be used for the term of this task order.

The Government will provide direction to the contractor in case of government showdown.

Deliverables: Orientation briefing.

C.3.2 TASK AREA 2: GENERAL TOOL SUPPORT

SUBTASK C.3.2.1 ARCSIGHT SUPPORT

In support of the government’s mission, the contractor will provide ArcSight support for design, architecture, development, unit test, deployment, installation, configuration, integration, operation, and maintenance to include:

ArcSight infrastructure and application administration

ArcSight ingestion, connector and syslog management engineering and support across server, database, and mainframe systems

ArcSight server and DB administration

Advanced event analysis and use of ArcSight as a business tool - Across multiple instances of

ArcSight

Communications with stakeholders and customers to understand and address business requirements and expectations for the use of ArcSight

Expertise with :

o ArcSight ESMs, version 6.9.1 o ArcMC appliances version 2.2 o Linux version 6.X o Ability to support new product releases as needed

Deliverables: weekly status briefings, weekly performance metrics, monthly performance reports outlining the actions associated with ArcSight system support and business application within the

IRS.

SUBTASK C.3.2.2 IBM GUARDIUM SUPPORT

In support of the government’s mission, the contractor will provide Guardium support for design, architecture, development, unit test, deployment, installation, configuration, integration, operation, Guardium infrastructure and application administration

Guardium ingestion, connector and syslog management engineering and support across server, database, and mainframe systems

Guardium server and DB administration

Advanced event analysis and use of Guardium as a business tool

Communications with stakeholders and customers to understand and address business requirements and expectations for the use of Guardium

Content use cases, categorization files, filters, reports, queries, dashboards, rules, and Active

Channels depending on the COTS product

Expertise with Guardium version- 9.5.x & 10.0.x and integration capabilities with:

o BigFix – 9.2 o Tivoli – 7.x o VMware: vSphere – 5.5.0 o VMware: vCenter – 5.5.0 o Versions of Windows server 2003 - 2012 o RHEL 5.10, 6.5, 6.6, 6.7 o Oracle version 10.2.x, 11.2.x o Other operating systems and environments as deployed by the IRS outlining the actions associated with the Guardium support and business application within the IRS.

SUBTASK C.3.2.3 SPLUNK SUPPORT

In support of the government’s mission, the contractor will provide Splunk support for design, architecture, development, unit test, deployment, installation, configuration, integration, operation, Splunk infrastructure and application administration

Splunk ingestion, connector and syslog engineering/management and support across applications, server, database, and mainframe systems

Support for Guardium SQL database auditing ingestion into Splunk

Splunk search head, indexer and forwarder administration

Advanced event analysis and use of Splunk as a business tool

Ability to support multiple instances and modules of Splunk

Communications with stakeholders and customers to understand and address business requirements and expectations for the use of Splunk.

Content use cases, categorization files, filters, reports, queries, dashboards, rules, and Active

Channels depending on the COTS product

Expertise with Splunk Enterprise with ability to demonstrate support for premium solutions such as Enterprise Security, User Behavior Analytics, and IT Service Intelligence outlining the actions associated with Splunk system support and business application within the

SUBTASK C.3.2.4 FORESCOUT SUPPORT

In support of the government’s mission, the contractor will provide ForeScout support for design, architecture, development, unit test, deployment, installation, configuration, integration and maintenance to include:

Deployment of CounterACT in an enterprise environment

CounterACT configuration to include o Port assignment o Channel configuration

Console installation

Managing and configuring CounterACT using command line access

Configuring and troubleshooting plugins including, but not limited to:

o Switch plugins o HPS Inspection Engine (i.e. nmap scans, WMI credentialed scans) o Macintosh/Linux Property Scanner (ssh credential scan)

Importing and assigning network segments to CounterACTs

Policy configuration o Creating policies for asset discovery o Experience writing intuitive and effective policies

Extensive networking experience o Understanding of enterprise network architecture and how CounterACT will have to integrate within a network o Networking protocols and how CounterACT will work with them

Integration of CounterACT with other systems, especially Splunk

Content use cases, categorization files, filters, reports, queries, dashboards, rules, and Active

Channels depending on the COTS product

Expertise with but not limited to:

o ForeScout CounterACT 7.0.0 (build 513) o Plugin API Version 1-50 o JRE Version Oracle Corp(1.80_92)

Deliverables: weekly status briefings, , weekly performance metrics, monthly performance reports outlining the actions associated with ForeScout system support and business application within the

C.3.3 TASK AREA 3: PROGRAM MANAGEMENT OFFICE (PMO) SUPPORT

SUBTASK C.3.3.1 ESAT-PMO DOCUMENTATION AND SUPPORT

The Contractor under the direction of the Government will be responsible for supporting the completion and maintenance of required documentation and artifacts related to ESAT-PMO. This includes producing and maintaining artifacts such as management and director level briefings, PMI type project documentation such as work breakdown structures, schedules, risk and communications management artifacts, and PowerPoint presentations to abstract and communicate details relating to the PMO activities.

Documentation support will also include resource utilization reports for the Contracting Officer that describe actions in support for tools, status for items with specific deliverables, and resource utilization rates that could be beyond fixed tasks.

Deliverables: PowerPoint Presentations, Visio diagrams, work break down structures and other

Project Management Institute artifacts, various spreadsheets or tables, and Microsoft Word documents.

SUBTASK C.3.3.2 ESAT-PMO CUSTOMER SUPPORT AUDIT REQUIREMENTS SUPPORT

The Contractor under the direction of the Government will be responsible for supporting the interpretation of NIST 800-53 AU control to stakeholders traversing Enterprise Life Cycle processes and completing requisite audit control planning for inclusion in System Security Plan and

Standard Operating Procedure documentation. This includes, but is not limited to, defining auditable events to satisfy GAO, TIGTA or other compliance standards, assisting system owners in defining procedures and details needed to satisfy audit control requirements, and assistance in the development of Interface Control Documents when audit data must be transmitted to a central repository. Audit requirements support also includes supporting SAAS customers through life cycle processes and the creation of artifacts associated with systems development and the documentation of interface controls between systems.

Deliverables: PowerPoint Presentations, Visio diagrams, various spreadsheets or tables, Interface control documents, and Microsoft Word documents relevant to the management of the 800-53 AU control family and SAAS application.

C.3.4 TASK AREA 4: TECHNICAL SERVICES

SUBTASK C.3.4.1 ENTERPRISE LEVEL AUDIT ANALYSIS AND USE CASE

DEVELOPMENT

The Contractor will build the capability for the IRS to conduct audit analysis and requirements verification by associating collected event data with applications, systems, and infrastructure.

This task must enable the IRS to demonstrate audit capability across applications and systems from a holistic capability, minimizing the need for specific individual audit plans and providing the ability to generate evidence to support fulfillment of system security plan audit controls for application and system owners. The initial target scope for this task is applications and systems in the Premium Services list maintained by Enterprise Operations. This capability needs to be demonstrated across both existing ArcSight environments and emerging capability in the Splunk environment. Be able to track and record access attempts and activities to be able to correlate to people and systems.

The Contractor will provide technical Subject Matter Experts as required to support development and implementation of Use Cases in support of Insider Threat and other Security Information and

Event Management (SIEM) solutions – including filters and data management within ArcSight and use of the Splunk programming language (similar to regular expression languages) for use case design, data mapping activities, reporting, and dashboard representations of data to support

Insider Threat and other Cybersecurity programs.

Deliverables: Data structures in ArcSight and Splunk that line support the analysis of application or infrastructure event data and the correlation of events to people and systems.

SUBTASK C.3.4.2 SPLUNK AND ARCSIGHT INFRASTRUCTURE EXPANSION

Contractor will provide technical Subject Matter Experts as required to support expansion of the environment to include architecting Search Head, Indexer, and Forwarder instances needed to service the expanding enterprise demand expected on the Splunk System as cross organizational use cases emerge. Contractor will advise and recommend enhancements to ArcSight that can include additional analysis capability and/or strategies for data retention.

Deliverables: Implementation plans, architectural recommendations and physical requirements needed to act upon either infrastructure in motion or proposed for acquisition.

SUBTASK C.3.4.3 CAPABILITY STRATEGIES AND PROCESS MODERNIZATION

The Contractor will provide technical Subject Matter Experts to perform tool and process analysis to create a strategic plan to integrate and optimize the use of tools and data across the organization. This effort would involve creating a comprehensive map of the functionality of existing and emerging tools being deployed within the organization, where these tools align to operational and risk management capabilities, and proposals to optimize tools, organizational processes, and resources to produce economy of scale toward IRS goals and strategic planning.

Deliverables: Cross functional tool capability analysis, process impact, and recommendations for organizational improvement.

C.3.5 TASK AREA 5: PERIOD OF PERFORMANCE AND CONTRACT CLOSE-OUT

SUBTASK C.3.5.1 TRANSITION TO SUPPORT (T2S)

The transition to support process shall include, but not be limited, to the following:

Knowledge transfer of technical skills and lessons learned to IRS staff upon completion of deliverables and work products.

Operations and maintenance processes and procedures.

Transfer of complete documentation for all delivered functionality. Deliverables shall be in softcopy and hardcopy format and shall be the sole property of the federal government. The format of deliverables will be provided in a format which will allow the government to modify and update when/if necessary.

Knowledge transfer of configurable data including user names and passwords and application settings.

Deliverable – Documentation that will allow and support transition activities to include but not limited to instructions, procedures, processes, work flows, presentations.

SUBTASK C.3.5.2 PERIOD OF PERFORMANCE SUMMARY REPORT

Provide a summary of work performed, including a list of deliverables, at the end of each Base and Optional Period of Performance.

The Government also reserves the right to request this report at any point during the performance of the order at the discretion of the Contracting Officer. This ad hoc report, if desired, will only be requested once during the life of the task order and is in addition to the regularly scheduled Period of Performance Summary report.

Deliverable – Period of Performance Summary Report

C.3.6 Task Area 6: 508 COMPLIANCE

The Contractor will comply with all IRS 508 compliance requirements as addressed in the following clauses:

REHABILITATION ACT OF 1973, SECTION 508 IT ACCESSIBILITY

REQUIREMENTS (Section 508)

The Government is mandated to comply with Section 508. To that end, the Contractor shall provide integration support under this PWS and shall achieve Section 508 compliance and maintain documentation demonstrating Section 508 compliance as stated below.

Full compliance of the Section 508 applicable technical standards must be obtained prior to performance (Implementation). The Contractor’s system shall comply with Section 508 requirements.

IRS reserves the right to test the Contractor for full compliance of the applicable Section 508 standards and provisions prior to implementation of services.

The following Section 508 Standards are applicable to this requirement:

IR1052.239-9008 Section 508 Information, Documentation and Support (SEP 2006)

In accordance with 36 CTR 1194, Subpart D, the electronic information technology (EAT) products and product support services furnished in performance of this contract shall be documented to indicate the current conformance level with Section 508 of the Rehabilitation Act of 1973, per the

1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s

Electronic and Information Technology Accessibility Standards. At no time during the performance of the award shall the level of conformance go below the level of conformance in place at the time of award. At no additional cost, the contractor shall provide information, documentation, and support relative to the supplies and services as described in the RFQ. The contractor shall maintain this detailed listing of compliant products for the full contract term, including forms of extensions, and shall ensure that it is current within five calendar days after award and within three calendar days of changes in products being utilized as follows:

(a) Product support documentation provided to end-users shall be made available in alternate formats upon request, at no additional charge.

(b) End-users shall have access to a description of the accessibility and compatibility features of products in alternate formats or alternate methods upon request, at no additional charge.

(c) Support services for products shall accommodate the communication needs of end-users with disabilities.

(End of clause)

IR1052.239.9010 Section 508 Services (SEP 2006)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated electronic and information technology (EAT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CTR 1194, Subpart B, and functional performance criteria in

36 CTR 1194.31, Subpart C, unless an agency exception to this requirement exists.

The following technical standards and provisions have been determined to be applicable to this contract:

_X_ 1194.21, Software applications and operating systems.

_x_(a) _x_(b) _x (c) _x_(d) _x_(e) _x_(f) _x_(g) _x_(h) _x_(i)

_x_(j) _x_(k) _x_(l)

_X_ 1194.22, Web-based intranet and internet information and applications.

_x_(a) _x_(b) _x (c) _x_(d) _x_(e) _x_(f) _x_(g) _x_(h) _x_(i)

_x_(j) _x_(k) _ x_(l) _x_(m) _x_(n) _x_(o) _x_(p)

___ 1194.23, Telecommunications products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i)

__(j) __(k) - __(k:1) __(k:2) __(k:3) __(k:4)

___ 1194.24, Video and multimedia products.

__(a) __(b) _x_(c) _x_(d) _x_(e)

___ 1194.25, Self-contained, closed products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j)

___ 194.26, Desktop and portable computers.

__(a) __(b) __(c) __(d)

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EAT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CTR 1194.31) apply to this contract.

_X_ (a) At least one mode of operations and information retrieval that does not require user vision shall be provided, or support for assistive technology used by people who are blind or visually impaired shall be provided.

_X_ (b) At least one mode of operation and information retrieval that does not require visual acuity greater than 20/70 shall be provided in audio and enlarged print output working together or independently, or support for assistive technology used by people who are visually impaired shall be provided.

_X_ (c) At least one mode of operation and information retrieval that does not require user hearing shall be provided, or support for assistive technology used by people who are deaf or hard of hearing shall be provided.

_X_ (d) where audio information is important for the use of a product, at least one mode of operation and information retrieval shall be provided in an enhanced auditory fashion, or support for assistive hearing devices shall be provided.

_X_ (e) At least one mode of operation and information retrieval that does not require speech shall be provided, or support for assistive technology used by people with disabilities shall be provided.

_X_ (f) At least one mode of operation and information retrieval that does not require fine motor or simultaneous actions and that is operable with limited reach and strength shall be provided.

C.4 Skill Set Breakdown

Based on the task list above below are the resources we expect to utilize in support of those tasks based on the full duration of the contract award. Some of these resources may be utilized across multiple tasks.

ArcSight

Three server, system, storage ArcSight language, and integration experienced

SMEs

3 resources

4500 hrs.

Splunk

One senior Splunk engineer

Two server, system, storage and splunk language programmers

3 resources 4500 hrs.

Infrastructure

One system integration specialist with cross platform support capabilities

1 resources

1500 hrs.

Process/Program Support

One project manager

One IT Analyst with life cycle process experience, Nist 800-53 and AU control family application expertise

One data modeling SME

3 resources

4500 hrs.

ForeScout - Two ForeScout SMEs 2 resources 3000 hrs

Guardium - Two Gardium SMEs 2 resources 3000 hrs

Total Resources 14

Total Resource hours 21,000

C.5 LIST OF DELIVERABLES

The following is a list of deliverables and associated due dates. Due to the dynamic scope of many of these deliverables, due dates for some deliverables will be identified by the ESAT‐PMO

Program Manager at the time of request.

Section

Number Deliverable Name Deliverable Due Date

C.3.1.1 Orientation Briefing 2 weeks from award

C.3.2.1 ArcSight Weekly

Status Briefing Ongoing Weekly

C.3.2.1

ArcSight

Performance Metrics Ongoing Weekly

C.3.2.1

ArcSight

Performance Reports

Formally: monthly; informal: ad-hoc upon request by technical team lead

C.3.2.2

IBM Guardium

Weekly Status

Briefing

Ongoing Weekly

C.3.2.2

IBM Guardium

Performance Metrics Ongoing Weekly

C.3.2.2

IBM Guardium

Performance Reports

Formally: monthly; informal: ad-hoc upon request by technical team lead

C.3.2.3 Splunk Weekly

Status Briefing Ongoing Weekly

C.3.2.3

Splunk Performance

Metrics Ongoing Weekly

C.3.2.3

Splunk Performance

Reports

Formally: monthly; informal: ad-hoc upon request by technical team lead

C.3.2.4 ForeScout Weekly

Status Briefing Ongoing Weekly

C.3.2.4

ForeScout

Performance Metrics Ongoing Weekly

C.3.2.4

ForeScout

Performance Reports

Formally: monthly; informal: ad-hoc upon request by technical team lead

C.3.3.1 Enterprise

Documentation Varies - TBD at time for request

C.3.3.2 Customer Audit

Requirement Support Varies - TBD at time for request

C.3.3.2 Audit Analysis

Documentation Varies - TBD at time for request

C.3.4.1

Use Case

Development

Documentation

Varies - TBD at time for request

C.3.4.2

Infrastructure

Expansion

Documentation

Varies - TBD at time for request

C.3.4.3

Strategy and

Modernization

Documentation

Varies - TBD at time for request

C.3.5.1 Transition

Documentation Within 10 days of request.

C.3.5.2 POP Performance

Summary Report Optional; Within 10 days of the end of the PoP.

C.6 DELIVERY, INSPECTION, AND ACCEPTANCE CRITERIA

C.6.1 DELIVERY

The Contractor will submit all deliverables to the COR and any ESAT‐PMO Government FTE(s) identified as the primary point of contact by the Program Manager. These primary points of contact for each ESAT‐PMO work stream will be identified in the orientation briefing identified in section C.3.1.1 of this SOW. Electronic submissions will be considered the default method and the Government will inform the Contractor in writing of a physical delivery address should physical copies be required.

All original‐copy deliverables will be submitted using the Microsoft Office suite of tools (Word, Excel, PowerPoint, Visio, Project, etc.) using their standard formats unless prior approval has been received from the COR.

C.6.2 INSPECTION AND ACCEPTANCE

The satisfactory completion of objectives will be subject to validation by the COR that Contractor performance meets the terms and conditions of this SOW and all future amendments. All deliverables will meet the following requirements:

• Accuracy ‐ work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity ‐ work products shall be clear and concise; engineering terms shall be used, as appropriate. All diagrams shall be easy to understand and relevant to the supporting narrative.

• File Editing ‐ All text and diagrammatic files shall be editable by the

Government.

• Format ‐ work products shall be submitted electronically through established

ESAT‐PMO procedures. All deliverables will be completed using Microsoft Office products.

Timeliness ‐ work products shall be submitted on or before the due date specified above.

The COR will be responsible for any formal Receipt and Acceptance functions on behalf of the government.

The Contractor will allow the Government fifteen (15) government working days to inspect and validate all submitted deliverables. Should any deficiencies be found, the Government will submit written comments to the Contractor detailing these deficiencies. The Contractor will address these comments and resubmit the deliverable within five (5) government working days from the date comments are received, or by the agreed upon due date for the deliverable, whichever is later.

Following the correction of any defects, the Government will have five (5) government working days to re‐evaluate the deliverable and document any reasons for non‐acceptance. Should the government fail to respond by close of business on the fifth day, the deliverable will be deemed acceptable by default.

C.7 CONTRACT ADMINISTRATION INFORMATION

C.7.1 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The COR for this order will be:

C.7.2 PERIOD OF PERFORMANCE

The period of performance for this order will be as follows:

Base Period: September 29, 2017 through December 28,2017

Option Period 1: December 29, 2017 through March 30, 2018

Option Period 2: March 31, 2018 through June 30, 2018

The government reserves the right to exercise each of the option periods in one-month increments as necessary.

C.7.3 PLACE OF PERFORMANCE

All tasks will be performed at the Government's facilities or at select Contractor facilities approved in advance by the COR. For tasks to be performed off‐site, all Contractor personnel requiring remote network access will comply with all IRS telework policies and procedures.

C.8 GOVERNMENT FURNISHED PROPERTY AND INFORMATION

GFP (to include material, equipment, and/or information) may be provided in the performance of this task order. The following GFP will be provided to the contractor:

ITEMS QUANTITY

Contractor identification badge TBD Contractor Building Access TBD Desktop computer with Local Area Network and limited application access TBD Office space (desk, chair, standard office equipment) TBD Telephone with VMS TBD Access to enterprise policies, templates, and other non‐sensitive information relevant to the tasks described in this statement of work

At the end of this task order, disposition of GFP shall be in accordance with FAR 52.245.1 and FAR

52.245.5.

C.9 TRAVEL

It is not expected that travel will be required under this award.

C.10 ACCESS TO GOVERNMENT FACILITIES

The contractor is allowed limited access to the government's facilities, as required for successful performance of this SOW and with prior approval by the ESAT‐PMO Program Manager and

COR. The locations specified below are acceptable primary Posts of Duty for Contractor personnel, however, it should be noted that the support of some tasks under this SOW may be restricted to certain locations.

New Carrollton Federal Building

5000 Ellin Rd

Enterprise Computing Center – Martinsburg (ECC‐MTB)

250 Murall Drive

Kearneysville, WV 25430

Enterprise Computing Center – Memphis (ECC‐MEM)

5333 Getwell Road

Memphis, TN 38118

1. 1052.232-7003 Electronic Invoicing and Payment Requirements for the

Invoice Processing Platform (IPP) (Aug 2012)

The U.S. Department of the Treasury, Financial Managements Internet Payment

Platform (IPP) is a government-wide electronic payment information service that replaces the Payment Advice Internet Delivery (PAID) system. IPP allows vendors to receive their remittance information from their financial institution. Effective October

31, 2008, IPP replaced the PAID system. Former PAID users have been automatically migrated to IPP and need to complete the initial provisioning process from the new user

ID, temporary password, and web address sent by Treasury. This is necessary in order to log in to the IPP and view or download payment information. New vendors may register on-line at https://ipp.gov. For additional information, refer to the IPP Customer

Support at (866) 973-3131.

The IPP will continue to support the following notification services previously offered by PAID: Web access only to remittance data, no payment notification emails sent, payment notification without remittance detail, and payment notification with remittance detail. Users may select event-driven notifications and schedule the frequency. Vendors can only access their own payment data. IPP remittance information includes the following data: ACH trace number, supplier name, agency name, payment status, issue date, invoice number, PO number, invoice amount, discount amount, payment amount, bank name, and bank address. The IPP will collect payment data for 18 months, which will be available for search, display and download.

Payment information will be uploaded to the IPP daily from Treasury systems on the date of payment.

(End of Clause)

2. IR1052.204-9005 SUBMISSION OF SECURITY FORMS AND

RELATED MATERIALS (OCT 2015)

As described in Department of the Treasury Security Manual (TD P 15-71), Chapter I, Section 1, Position Sensitivity and Risk Designation, Contractor personnel assigned to perform work under an IRS contract/order/agreement must undergo security investigative processing appropriate to the position sensitivity and risk level designation associated to determine whether the Contractor (including subcontractor) personnel should be permitted to work in the identified position. The Contracting

Officer`s Representative (COR) (in the absence of the COR, the Contracting Officer

(CO)) shall work with the contractor to ensure that contractor (or subcontractor) employee is granted staff-like access to Sensitive but Unclassified (SBU) information, IRS/contractor (including subcontractor) facilities, information system/asset that process/store SBU information without the required investigation.

For security requirements at contractor facilities using contractor-managed resources, please reference Publication 4812, Contractor Security Controls. The contractor shall grant staff-like access to IRS SBU information or information system/assets only to individuals who have received staff-like access approval (interim or final) from IRS

Personnel Security.

a. Contractor (including subcontractor) personnel performing under an agreement that authorizes staff-like access to and in IRS/contractor (including subcontractor) facilities, and access to SBU information or information systems are subject to (and must receive a favorable adjudication or affirmative results with respect to) the following eligibility/suitability pre-screening criteria, as applicable:

(1) IRS account history for tax compliance (for initial eligibility, as well as periodic checks for continued compliance while actively working on IRS contracts);

(2) Selective Service registration compliance;

(3) U.S. citizenship/lawful permanent residency compliance;

(4) Background investigation forms;

(5) Credit history;

(6) Federal Bureau of Investigation fingerprint results; and

(7) Prior federal government background investigations.

In this regard, Contractor shall furnish the following electronic documents to the

Contractor Security Management (CSM) at CSM@irs.gov within 10 business days (or shorter period) of assigning (or reassigning) an employee to this contract/order/agreement and prior to the contractor (including subcontractor) employee performing any work or being granted staff-like access to IRS SBU or

IRS/contractor (including subcontractor) facilities, information systems/assets that process/store SBU information thereunder:

? IRS provided Risk Assessment Checklist (RAC) Form 14606;

? Non-Disclosure Agreement (if contract terms grant SBU access); and, ? Any additional required security forms, which will be made available through

CSM and the COR.

b. Tax Compliance, Credit Checks and Fingerprinting:

1. Contractors (including subcontractors) whose duration of employment exceeds 180 days must meet the eligibility/suitability requirements for access and shall undergo a background investigation based on the assigned position risk designation as a condition of work under the Government contract/order/agreement.

2. If the duration of employment is less than 180 days or access is infrequent (i.e. 2 -3 days per month), and the contractor requires unescorted access, the contractor

(including subcontractor) employee must meet the eligibility requirements for access in

IRM 10.23.2.9, as well as a FBI Fingerprint result screening.

3. For contractor (including subcontractor) employees not requiring access to IT systems, a background investigation is not needed and will not be requested if a qualified escort, defined as an IRS employee or as a contractor who has been granted staff-like access, escorts a contractor meeting the conditions of number b.2 above at all times while the escorted contractor accesses IRS facilities and equipment.

The contractor (including subcontractor) employee will be permitted to perform under the contract/order/ agreement and have access to IRS facilities only upon notice of an interim or final approval, as defined in IRM 10.23.2 - Contractor Investigations, and is otherwise consistent with IRS security practices and related IRMs, to include, but not limited to, IRM 1.4.6 - Managers Security Handbook, IRM10.2.14 - Methods of

Providing Protection, and IRM 10.8.1 - Policy and Guidance.

The Associate Director, Personnel Security prior to completion of the full investigation, will grant interim staff-like access approval as follows:

a. Individuals who possess a current active U.S. Government security clearance for access to classified information may be granted interim staff-like access for positions after 1) the clearance is verified through the Joint Personnel Adjudication System

(JPAS), and 2) after favorable adjudication of pre-screening eligibility/suitability checks. Individuals with Top Secret clearance may be granted interim staff-like access approval to occupy positions designated at any risk level. Individuals with Secret or

Confidential clearances may be granted interim staff-like access approval to occupy positions designated Moderate or Low Risk.

b. Individuals not possessing a current or active U.S. Government security clearance for access to classified information or not possessing a prior Government personnel security investigation that meets the scope and criteria required for their position may be granted interim staff-like access approval upon receipt of all required contractor security forms, and favorable adjudication of pre-screening eligibility/suitability checks.

As prescribed in IRM 10.23.2, escorting in lieu of staff-like access for IT systems and access to SBU data (escorted or unescorted) will not be allowed.

[End of Clause]

3. IR1052.204-9006 Notification of Change in Contractor Employee

Employment Status, Assignment, or Standing (OCT 2015)

The contractor shall via e-mail (CSM@irs.gov), notify the Contracting Officer (CO), Contracting Officer's Representative (COR) and the Contractor Security Management

(CSM) within 1 business day of the contractor (including subcontractor) becoming aware of any change in the employment status, information access requirement, assignment, or standing of a contractor (or subcontractor) employee under this contract or order - to include, but not limited to, the following conditions:

* Receipt of the employee`s notice of intent to separate from employment or discontinue work under this contract/order;

* Knowledge of the employee`s voluntary separation from employment or performance on this contract/order (if no prior notice was given);

* Transfer or reassignment of the employee and performance of duties under this contract/order, in whole or in part, to another contract/order (and if possible, identify the gaining contract/order and representative duties/responsibilities to allow for an assessment of suitability based on position sensitivity/risk level designation);

* Denial of or Revocation of Access (RAC) as determined by the IRS

* Separation, furlough or release from employment;

* Anticipated extended absence of more than 45 days;

* Change of legal name;

* Change to citizenship or lawful permanent resident status, or employment eligibility;

* Change in gender or other distinction when physical attributes figure prominently in the biography of an individual;

* Actual or perceived conflict of interest in continued performance under this contract/ order (provide explanation); or

* Death.

When required by the COR, the contractor may be required to provide the information required by this clause to the IRS using the RAC or security documents as identified by

CSM.

The notice shall include the following minimum information:

* Name of contractor employee;

* Nature of the change in status, assignment or standing (i.e., provide a brief non-personal, broad-based explanation);

* Affected contract/agreement/order number(s);

* Actual or anticipated date of departure or separation;

* When applicable, the name of the IRS facility or facilities this individual routinely works from or has access to when performing work under this contract/order;

* When applicable, contractor (including subcontractor) using contractor (or subcontractor) owned systems for work must ensure that their systems are updated to ensure employees no longer have continued access to IRS work, either for systems administration or processing functions; and

* Identification of any Government Furnished Property (GFP), Government

Furnished Equipment (GFE), or Government Furnished Information (GFI) (to include

Personal Identity Verification (PIV) credentials or badges) provided to the contractor employee and its whereabouts or status.

In the event the subject contractor (including subcontractor) employee is working on multiple contracts, orders, or agreements, notification shall be combined, and the cognizant COR for each affected contract or order (using the Contractor Separation

Checklist (Form 14604 (Rev. 4-2015)) shall be included in the joint notification along with the CSM. These documents (the RAC and security forms) are also available by email request to CSM.

The vendor POC and the COR must ensure all badges, Smart Cards, equipment, documents, and other government furnished property items are returned to the IRS, systems accesses are removed, and Real Estate & Facilities Management is notified of federal workspace that is vacant.

As a general rule, the change in the employment status, assignment, or standing of a contractor (or subcontractor) personnel to this contract or order would not form the basis for an excusable delay for failure to perform under the terms of this contract, order or agreement.

[End of clause]

4. IR1052.224-9008 SAFEGUARDS AGAINST UNAUTHORIZED

DISCLOSURE OF SENSITIVE BUT UNCLASSIFIED

INFORMATION (NOV 2015)

1. Treasury Directive Publication 15-71 (TD P 15-71), Chapter III - Information

Security, Section 24 - Sensitive But Unclassified Information defines SBU information as `any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States

Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.` SBU may be categorized in one or more of the following groups-

* Returns and Return Information

* Sensitive Law Enforcement Information

* Employee Information

* Personally Identifiable Information

* Other Protected Information

2. Confidentiality requirements…