Treasury and IRS Clauses (Full Text).docx

TREASURY/IRS CLAUSES

1052.232-7003 Electronic Invoicing and Payment Requirements for the Invoice Processing Platform (IPP) (Aug 2012)

The U.S. Department of the Treasury, Financial Managements Internet Payment Platform (IPP) is a government-wide electronic payment information service that replaces the Payment Advice Internet Delivery (PAID) system. IPP allows vendors to receive their remittance information from their financial institution. Effective October 31, 2008, IPP replaced the PAID system. Former PAID users have been automatically migrated to IPP and need to complete the initial provisioning process from the new user ID, temporary password, and web address sent by Treasury. This is necessary in order to log in to the IPP and view or download payment information. New vendors may register on-line at https://ipp.gov. For additional information, refer to the IPP Customer Support at (866) 973-3131.

The IPP will continue to support the following notification services previously offered by PAID: Web access only to remittance data, no payment notification emails sent, payment notification without remittance detail, and payment notification with remittance detail. Users may select event-driven notifications and schedule the frequency. Vendors can only access their own payment data. IPP remittance information includes the following data: ACH trace number, supplier name, agency name, payment status, issue date, invoice number, PO number, invoice amount, discount amount, payment amount, bank name, and bank address. The IPP will collect payment data for 18 months, which will be available for search, display and download. Payment information will be uploaded to the IPP daily from Treasury systems on the date of payment.

(End of Clause)

IR1052.232-7003 Electronic Invoicing and Payment Requirements for the Invoice Processing Platform (IPP) (Aug 2012)

(a) Definitions:

"Short payment" as used in this clause means an invoice that includes the cost or price for supplies or services delivered or performed, as well as the cost or price for supplies or services not yet tendered to the Government in accordance with the terms of the contract, order or agreement.

Short payment example: The contract requires the delivery of a set number of items, with the price, delivery location, and delivery due date also specified. The vendor delivers 50% of the items as specified but invoices for 100% of the items. Before implementation of the IPP, the IRS would have paid the vendor for the items delivered and instructed the vendor to re-invoice the IRS when the balances of the items were delivered. In other words, the IRS would "short pay" the invoice since the IRS did not remit payment for the full invoice amount. With implementation of the IPP, the IRS can no longer do this because the IRS cannot accept an electronic invoice that includes items not yet received. The IRS will reject the invoice. The vendor needs to submit an invoice for only the items received by the IRS (in this case, 50%), and, assuming that these items meet all other contract terms and conditions, the IRS will pay the invoiced amount. The vendor submits subsequent invoice(s) for items as they are delivered and accepted.

(b) The Invoice Processing Platform (IPP) is a secure Web-based electronic invoicing and payment information service available to all Federal agencies and their suppliers. Effective October 1, 2012, invoicing for payment through the IPP will be mandatory for all new contract awards. Additional information regarding the IPP may be found at the IPP website address https://www.ipp.gov. Contractors must complete the contractor point of contact information below, and submit it with their proposal submissions. Contractors may contact the IPP Helpdesk for assistance via e-mail at ippgroup@bos.frb.org or via phone at (866) 973-3131. Once a contract award has been made, the contractor will be contacted by the IPP via e-mail to set-up an account. It will be necessary for contractors to login to their IPP accounts every 90 days to keep their IPP accounts active.

(c) Contractor Point of Contact Information

Contractor Name:

Contractor IPP Point of Contact Name:

Contractor Phone Number:

Contractor E-mail Address:

(d) Electronic Invoicing and Payment Requirements

Vendor invoices submitted electronically through the IPP should be in the proper format and contain the information required for payment processing. In order to be approved for payment, a proper invoice must list the items specified in FAR 52.232-25 (a)(3)(i) through (a)(3)(x), or in the case of a Commercial Item Contract, the items included in 52.212-4(g)(1)(i) through (g)(1)(x).

Under this contract, the following documents are required to be submitted as an attachment to the invoice (Contracting Officer fills in additional documentation that must be furnished by the contractor (e.g. timesheet)):

NONE

(e) Payment and Invoice Questions

For payment and invoice questions, contact the Beckley Finance Center at (304) 254-3372 or via e-mail at cfo.bfc.ipp.customer.support@irs.gov.

(f) Waiver

If the Contractor is unable to use the IPP for submitting payment requests starting on October 1, 2012, then a waiver form must be completed and submitted with the contractors proposal submission for review and approval by the Contracting Officer based on one of the conditions listed in the waiver form included as Attachment 1 to this clause. The vendor will be notified prior to award as to whether their request for waiver has been approved or denied. If the waiver is granted, then a copy of the waiver must be submitted with each paper invoice that the vendor submits to the payment office or the invoice will be returned.

(g) Short Payment

Short payment on vendor submitted invoices will no longer be processed or paid. If any portion of the invoice does not meet the requirements for a proper invoice, the entire invoice shall be rejected and returned to the vendor unpaid.

(End of Clause)

IR1052.232-7003 W Internal Revenue Service (IRS) Invoice Processing Platform (IPP) Waiver Form

The IRS invoicing and payment requirements clause (IR1052.232-7003) requires that all invoices under awards made (or effective) on or after October 1, 2012, be submitted electronically via the IPP unless a waiver is requested and granted. If the Contractor is unable to submit its invoice through the IPP, the Contractor shall complete this waiver form indicating the reason for the waiver request by selecting the appropriate box below and providing a narrative summarizing in detail the circumstances requiring a waiver. For a solicitation, submit the waiver form with the proposal submission. For a modification that incorporates the IPP clause into an existing contract, submit the form with the modification. The CO will notify the vendor via e-mail or another appropriate means of communication prior to award as to whether their waiver has been approved or denied. If the waiver is granted, then a copy of the approved waiver must be submitted with each invoice that the vendor submits to the payment office or the invoice will be returned.

Reason for requesting a waiver of the requirement to submit an electronic invoice via the IPP:

Attach a separate sheet of paper with a summary narrative substantiating the circumstances for the waiver exception selected from above (1 through 7).

Waiver Submitted By:

Contractor Name

Name of Person Submitting Request for Waiver Title

Signature of Person Submitting Request for Waiver (electronic signature not acceptable)

E-mail Address Phone No.

Contract/Order No. Date Submitted

Waiver Approved By:

Contracting Officer’s Name Printed

Contracting Officer’s Signature Date (electronic signature is not acceptable)

(End of Clause)

IR1052.239-9000 Section 508 Information, Documentation and Support (Dec 2019)

In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work, performance work statement or statement of objectives (select one). The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services _X__ 601 General _X__ 601.1 _X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4 _X__ 603 Support Services _X__ 603.1 _X__ 603.2 _X__ 603.3

(End of clause)

IR1052.239-9001 Section 508 Conformance (Dec 2019)

Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachment entitled, _________ (Please state where attachment may be found).

The following technical standards have been determined to be applicable to this contract:

_X__ Chapter 4: Hardware _X__ 401 General _X__ 401.1 _X__ 402 Closed Functionality _X__ 402.1 _X__ 402.2(1-6) _X__ 402.3 _X__ 402.4 _X__ 402.5 _X__ 403 Biometrics _X__ 403.1 _X__ 404 Preservation of Information Provided for Accessibility _X__ 404.1 _X__ 405 Privacy _X__ 405.1 _X__ 406 Standard Connections _X__ 406.1 _X__ 407 Operable Parts _X__ 407.1 _X__ 407.2 _X__ 407.3 _X__ 407.4 _X__ 407.5 _X__ 407.6 _X__ 407.7 _X__ 407.8 _X__ 408 Display Screens _X__ 408.1 _X__ 408.2 _X__ 408.3 _X__ 409 Status Indictors _X__ 409.1 _X__ 410 Color Coding _X__ 410.1 _X__ 411 Audible Signals _X__ 411.1 ___ 412 ICT with Two-Way Communication ___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 _X__ 413 Closed Caption Processing Technologies _X__ 413.1 _X__ 414 Audio Description Processing Technologies _X__ 414.1 _X__ 415 User Controls for Captions and Audio Descriptions _X__ 415.1 _X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 ___ 504 Authoring Tools ___ 504.1 ___ 504.2 ___ 504.3 ___ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 ___ 702.3 _X__ 702.4 ___ 702.5 _X__ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9 (End of clause)

IR1052.239.9002 Section 508 Services (Dec 2019)

All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 4: Hardware _X__ 401 General _X__ 401.1 _X__ 402 Closed Functionality _X__ 402.1 _X__ 402.2(1-6) _X__ 402.3 _X__ 402.4 _X__ 402.5 _X__ 403 Biometrics _X__ 403.1 _X__ 404 Preservation of Information Provided for Accessibility _X__ 404.1 _X__ 405 Privacy _X__ 405.1 _X__ 406 Standard Connections _X__ 406.1 _X__ 407 Operable Parts _X__ 407.1 _X__ 407.2 _X__ 407.3 _X__ 407.4 _X__ 407.5 _X__ 407.6 _X__ 407.7 _X__ 407.8 _X__ 408 Display Screens _X__ 408.1 _X__ 408.2 _X__ 408.3 _X__ 409 Status Indictors _X__ 409.1 _X__ 410 Color Coding _X__ 410.1 _X__ 411 Audible Signals _X__ 411.1 ___ 412 ICT with Two-Way Communication ___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 _X__ 413 Closed Caption Processing Technologies _X__ 413.1 _X__ 414 Audio Description Processing Technologies _X__ 414.1 _X__ 415 User Controls for Captions and Audio Descriptions _X__ 415.1 _X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 ___ 504 Authoring Tools ___ 504.1 ___ 504.2 ___ 504.3 ___ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 ___ 702.3 _X__ 702.4 ___ 702.5 _X__ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9

(End of clause)

IR1052.224-9008 Safeguards Against Unauthorized Disclosure Of Sensitive But Unclassified Information (Nov 2015)

1. Treasury Directive Publication 15-71 (TD P 15-71), Chapter III – Information Security, Section 24 – Sensitive But Unclassified Information defines SBU information as ‘any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy.’ SBU may be categorized in one or more of the following groups—

• Returns and Return Information

• Sensitive Law Enforcement Information

• Employee Information

• Personally Identifiable Information

• Other Protected Information

2. Confidentiality requirements for tax returns and return information are established by Section 6103 of the Internal Revenue Code (26 USC 6103), and the penalties for unauthorized access and disclosure of returns and return information are found in Sections 7213, 7213A and 7431 of the Internal Revenue Code (26 USC 7213, 7213A and 7431).

3. Contractors who perform work at contractor (including subcontractor) managed sites using contractor or subcontractor managed IT resources shall adhere to the general guidance and specific security control standards or requirements contained in Publication 4812, Contractor Security Controls, IRM 10.23.2 - Personnel Security, Contractor Investigations and IRM 10.8.1 - Information Technology (IT) Security, Policy and Guidance. Typically, all contracts that require contractor (including subcontractor) employees to handle, manage, or process SBU information shall be protected at the moderate risk level. Publication 4812 and IRM 10.8.1 and 10.23.2 provide comprehensive lists of all security controls and guidance.

4. As directed by the Contracting Officer, the contractor will be required to input data into Archer or a similar system to describe the security controls being used to protect information.

5. Eligibility, Fitness and Suitability. Contractor (including subcontractor) personnel hired for work within the United States or its territories and possessions and who require access, wherever the location, to IRS owned or controlled facilities or work on contracts that involve the design, operation, repair, or maintenance of information systems, and/or require access to SBU information, must meet the eligibility requirements under IRM 10.23.2, Personnel Security, Contractor Investigations, and shall be subject to security screening and investigative processing, commensurate with the position sensitivity level, and in accordance with IRM 10.23.2, and TD P 15-71. Contractor (including subcontractor) employees must be favorably adjudicated prior to starting work on the contract/order or before being granted staff-like access (or interim staff-like access, if approved by Personnel Security) to IRS information systems or SBU information.

6. General Conditions for Allowed Disclosure. Any SBU information, in any format, made available to contractor (including subcontract) personnel shall be treated as confidential information and shall be used only for the purposes of carrying out the requirements of this contract. Inspection by or disclosure to anyone other than a duly authorized officer or employee of the contractor (including subcontractor) shall require prior written approval of the IRS. Requests to make such inspections or disclosures shall be addressed to the Contracting Officer (CO).

7. Nondisclosure Agreement. Consistent with TD P 15-71, Chapter II, Section 2, and IRM 10.23.2.17 - Nondisclosure Agreement for Sensitive but Unclassified Information, each contractor (including subcontractor) employee who requires access to SBU information shall complete, sign and submit to Personnel Security – through the CO (or COR, if assigned) — an approved Nondisclosure Agreement (See Attachment 2) prior to being granted access to SBU information under any IRS contract or order.

8. Encryption. All SBU information must be protected at rest, in transit, and in exchanges (i.e., internal and external communications). The contractor (including subcontractor) shall employ encryption methods and tools to ensure the confidentiality, integrity, and availability of SBU information.

9. Incident and Situation Reporting. The contractor (including subcontractor) shall report any incident/situation in accordance with IRM 10.8.1.4.8.5 - Incident Reporting and to the COR. Concurrent with its reporting it to the COR, the contractor (including subcontractor) shall report incidents/situations (24x7x365) to Computer Security Incident Response Center (CSIRC)(IT infrastructure)/Situation Awareness Management Center (SAMC) (anything that does not affect the IT infrastructure) through any of the following methods:

Telephone: (202) 283-4809 (local) or toll free hotline at (866) 216-4809

Fax: (202) 283-0345

E-mail: samc@cirsc.irs.gov

In addition, if the SBU information is or involves returns or return information, or threatens the safety or security of personnel or information systems, the contractor shall report the incident/situation to the Treasury Inspector General for Tax Administration (TIGTA) hotline at (800) 366-4484.

10. Access to, Processing and Storage of Sensitive but Unclassified (SBU) Information. The contractor (including subcontractor) shall not allow contractor or subcontractor employees to access, process or store SBU on Information Technology (IT) systems or assets located outside the continental United States and its outlying territories.

Contractors (including subcontractors) utilizing their own IT systems or assets to receive or handle IRS SBU data shall not commingle IRS and non IRS data.

11. Disposition of SBU Information. All SBU information processed during the performance of this contract, or to which the contractor (or subcontractor) was given access (as well as all related output, deliverables, or secondary or incidental by-products, information or data generated by the contractor or others directly or indirectly from the source material), regardless of form or format, shall be completely purged from all data storage components of the contractor’s or subcontractor facility(s) and computer systems, and no SBU/PII information will be retained by the contractor either--

• When it has served its useful, contractual purpose, and is no longer needed to meet the contractor’s (including subcontractor) other, continuing contractual obligations to the IRS or

• When the contract expires, or is terminated by the IRS (for convenience, default, or cause).

The contractor (including subcontractor) shall completely purge from its systems and Electronic Information Technology, and/or return all SBU/PII information (originals, copies, and derivative works) within 30 days of the point at which it has served its useful contractual purpose, or the contract expires or is terminated by the IRS (unless, the CO determines, and establishes, in writing, a longer period to complete the disposition of SBU/PII information).

The contractor shall provide to the IRS a written and signed certification to the COR that all SBU materials/information (i.e., case files, receipt books, PII data and material, removable media (disks, cds, thumb drives)) collected by, or provided to, the contractor been purged, destroyed or returned.

12. Subcontractors. Subcontractors of the contractor are held to the same provisions, investigative requirements, and standards of conduct for handling and protecting SBU information as employees of the prime contractor.

13. Other Safeguards. [Insert any additional disclosure safeguards provided by the Program Office/COR or that the Contracting Officer determines are necessary and in the best interest of the Government and not addressed elsewhere in the contract. If none are entered here, there are no other safeguards applicable to this contract action.]

(End of Clause)

INFORMATION SYSTEM SECURITY REQUIREMENTS FISMA SECURITY CONTRACT LANGUAGE (MAJOR IT SYSTEMS / APPLICATIONS or SERVICES)

1. Information Security / Federal Information Security Management Act (FISMA)

a. Pursuant to the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002, P.L. 107-347, the contractor shall provide minimum security controls required to protect Federal information and information systems. The term ‘information security’ means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentially, integrity and availability.

b. The contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; or information systems used or operated by an agency or by a contractor or subcontractor of an agency. This applies to individuals and organizations having contractual arrangements with the IRS, including employees, contractors, vendors, and outsourcing providers, which use or operate information technology systems containing IRS data.

c. An IRS information or information system are defined as a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization impact level of low, moderate or high, and those systems identified by the As Built Architecture (ABA) and agency FISMA Master Inventory.

2. Treasury / IRS Policies for Information Technology (IT) Security

a. The contractor shall comply with Department of Treasury Security Manual TDP 15-71, and Internal Revenue Manual 10.8.1 Information Technology Security Policy and Guidance. The contractor shall comply with IRS Internal Revenue Manuals (IRM), Law Enforcement Manuals (LEM) and successor documents when developing or administering IRS information and information systems.

b. The contractor shall comply with the Taxpayer Browsing Protection Act of 1997 - Unauthorized Access (UNAX), the Act amends the Internal Revenue Code 6103 of 1986 to prevent the unauthorized inspection of taxpayer returns or tax return information.

3. Security Authorization and Accreditation Process Contractors systems that collect, maintain, contain or use agency information or an information system on behalf of the agency (a General Support System (GSS), Major or Minor Application with a FIPS 199 security categorization) must ensure annual reviews and continued security certification and accreditation. Some of the key elements of this process are risk assessments, security plans, security control testing, a Privacy Impact Assessment (PIA), contingency planning, and technical system certification and business owner system accreditation. All systems that complete this process will, at a minimum, meet NIST guidance, as required by the IRS.

4. System Review / Site Visit The contractor shall be subject to at the option / discretion of the agency, to periodically test, (but no less than annually) and evaluate the effectiveness of information security controls and techniques. The assessment of information security controls may be performed by an agency independent auditor, security team or Inspector General, and shall include testing of management, operational, and technical controls, as indicated by the security plan, of every information system that maintain, collect, operate or use federal information on behalf of the agency. The agency and contractor shall document and maintain a remedial action plan, also known as a Plan of Action and Milestones (POA&M) to address any deficiencies identified during the test and evaluation. The contractor must cost-effectively reduce information security risks to an acceptable level within the scope, terms and conditions of the contract.

5. Information Security Awareness and Training

a. The contractor shall comply with IRS mandatory annual Computer Security Awareness briefings, UNAX briefings and receive an initial orientation before access to IRS Information Systems. Perform HSPD-12 Personal Identify Verification, physical and personnel security screening / background investigation for approval of a contractor badge for staff like access; then obtain 5081 approval to IRS information systems. All contractors and subcontractor employees who are involved with the management, use, programming or maintenance of IRS information systems must complete the IRS mandatory Computer Security briefing. Failure to comply will all above will be considered unsatisfactory/non-performance and will be adjucated per applicable FAR rules.

b. Cyber security oversees a series of security awareness training sessions; in particularly the Unauthorized Access (UNAX) training and Computer Security Awareness training, which is conducted annually and mandatory for all IRS employees and contractors. FISMA requires continuous security awareness training to inform personnel, including contractors, other users, and individuals with significant IT Security responsibilities that support the operations and assets of the agency to receive specific training on agency guidance, policies and procedures to reduce information security risks.

c. All contractors and subcontractor employees who could have access to return information must complete the mandatory UNAX briefing. Contractors shall certify the completion of training by their employees annually. The certification shall be submitted to the contracting officer, with a copy to the COTR and Mission Assurance Security Services Awareness and Training Team.

6. Office of the President Management and Budget (OMB) Policies for Security of Federal Automated Information Resources

a. The contractor shall comply with OMB Circular No. A-130 Security of Federal Automated Information Resources Appendix III. The contractor shall comply with the guidance in OMB Circular policy M-06-16 Protection of Sensitive Agency Information to implement protections for personally identifiable information being transported and/or stored offsite. In those instances where personally identifiable information is transported to a remote site of the contractor, the contractor shall implement NIST Special Publication 800-53 security controls and IRS specific security procedures to ensure that information is transported in encrypted form. The contractor shall comply with OMB Circular Policy M-06-15, Safeguarding Personally Identifiable Information (PII), and Policy M-06-19 Reporting Incidents Involving Personally Identifiable Information.

7. Safeguarding / Protecting Sensitive Personally Identifiable Information (PII)

a. Sensitive PII is defined by OMB as “any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.” Information systems can be either electronic or manual. IRM 10.8.1 require IRS' sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearance required; receive security awareness and training required for contractor activities or facilities; and any facility physical security requirements.

b. Most IRS information is categorized as SBU. This includes:

i. taxpayer information,

ii. employee data - such as evaluations,

iii. personnel and payroll records,

iv. financial and statistical information on agency operations not normally available for public disclosure, and

v. vendor / contractor proprietary information provided to the government by third parties.

c. Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Management Act (FISMA), the Government Act of 2002, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information, such as the following guidance from OMB Policy M-06-16:

i. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing;

ii. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining agency access;

iii. Use a “time-out” function for remote access and mobile devices requiring user reauthentication after 30 minutes inactivity; and

iv. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

8. The National Institute of Standards and Technology (NIST) Guidance for Information Security

a. The contractor shall follow Information Security guidance established by the National Institute of Standards and Technology (NIST). The contractor shall establish the minimum-security controls identified in NIST Special Publication 800-53 Recommended Security Controls for Federal Information, NIST 800-53A Guide for Assessing the Security Controls in Federal Information Systems, and FIPS 200 Minimum Security Requirements for Federal Information and Information Systems. The contractor shall follow the best practices and guidance established by NIST special publication 800 Series and Federal Information Processing Standards (FIPS) for computer security. The IRS may determine such applicable Information Technology (IT) Security standards and policies.

9. Handling Information Security Incidents

a. The IRS Computer Security Incident Response Capability (CSIRC) defines a security incident as: “any adverse event whereby some aspect of computer security could be threatened. Adverse events may include the loss of data confidentiality, disruption of data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the system.” User Compromise, Disclosure of Taxpayer/Sensitive Data, Malicious Code (successful or unsuccessful), Denial of Service (DoS) (successful or unsuccessful), Website Defacement, Identity Theft, Misuse of Resources or Policy Violation, Loss or Theft of IT Equipment, IRM/LEM Non- Compliance, Unauthorized Access Attempt, Probe/Scan, and any other security incident that may threaten or damage any IRS or federal agency information or information system(s).

b. The contractor shall maintain procedures for detecting, reporting, and responding to security incidents, and mitigating risks associated with such incidents before substantial damage is done to federal information or information systems. The contractor shall immediately report all computer security incidents that involve IRS information systems to the IRS Computer Security Incident Response Center (CSIRC) using the contact information indicated below. Any theft or loss of IT equipment with federal information / data must be reported within one hour of the incident to CSIRC. Those incidents involving the loss or theft of sensitive but unclassified (SBU) data (i.e. taxpayer, PII) shall be reported to CSIRC, first-line manager, and Treasury Inspector General for Tax Administration (TIGTA). Based on the computer security incident type, CSIRC may further notify the Treasury Computer Security Incident Response Capability (TCSIRC) in accordance with TCSIRC procedures.

10. CONTACTING IRS CSIRC

Web Site http://www.csirc.web.irs.gov/incident/ Email csirc@csirc.irs.gov Phone (202) 283-4809 Toll-Free (866) 216-4809, Fax (202) 283-0345 IRS Specialized Information Technology (IT) Security Training (Role-Based) Requirements (IR1052.204-9007) Include the following clause in Section H or in another appropriate section in solicitations, contracts, task/delivery/purchase orders, interagency agreements, and BPAs, above the micro-purchase threshold, if the contract or order requires/permits contractors and contractor employees to have staff-like access to IRS owned or controlled facilities, information systems, or Sensitive but Unclassified (SBU) information, and the contractor employees will have a significant information technology (IT) security role or responsibility.

11. Contractor Security Requirements It is the contractor’s responsibility to know and understand which regulations and standards promulgated by the Occupational Health and Safety Administration applies to them and their sub-contractors, as well as any local or state health and safety regulations. Sub-contractors who have less than 10 employees are not exempt from OSHA regulations and standards while working on a federal contract.

Contractors and subcontractors shall be trained in ladder safety per 29 CFR 1910.23 and use the appropriate non-conductive ladders for any work involving electrical devices.

The contractor shall not leave a ladder to climb onto any structures, in the ceiling spaces or anywhere else, that are not meant for human occupancy. The contractor will ensure they provide the necessary equipment for their employees and subcontractors to work at heights safety and in compliance with 29 CFR 1910.28 and 29 CFR 1910 Subpart F.

The contractor will not drill into any wall, ceiling or other substrate without first receiving written consent, from the Building Manager (in non-delegated buildings) or the asbestos program manager in a delegated building, that the area to be penetrated is free of asbestos.

The contractor’s employees and sub-contractors shall be trained in asbestos awareness per 29 CFR 1910.1001.