Treasury IRS SRM BPA - MRAS

The U.S. Department of the Treasury, specifically the Internal Revenue Service (IRS), is seeking contractor support services for cybersecurity and security risk management. The purpose of this contract is to ensure compliance with federal statutory, legislative, and regulatory requirements to protect the confidentiality, integrity, and availability of IRS electronic systems, services, and data. The contract will cover a wide range of tasks including security risk assessment services, NIST security control assessment execution, cybersecurity supply chain risk management program execution, plan of action and milestones compliance management, digital identity risk assessment, high-value asset/critical infrastructure protection program management, information system continuous monitoring, penetration testing and continuous analysis, vulnerability management detection and response, advanced application analysis, CCPMO support, security risk management and analysis, stakeholder enterprise cybersecurity unified risk evaluation and mitigation support session, business impact analysis and BITA testing analytics, security risk management front office support.

The period of performance for this contract is from February 1, 2024 to January 31, 2029. The place of performance will be primarily at the contractor's location or authorized telework/telecommute locations using IRS-owned and managed IT assets. However, contractors may be required to work onsite at IRS locations in the greater Washington DC Metropolitan area as needed. The contractor must have expertise in IT security knowledge and experience including FISMA compliance, NIST standards, risk management framework (RMF), cybersecurity supply chain risk management (C-SCRM), information security continuous monitoring (ISCM), penetration testing, vulnerability management, cloud security, and more.

Overall, this contract aims to enhance the IRS's cybersecurity posture by providing comprehensive support services in various areas of cybersecurity and security risk management.