2.25.2. IRS Integrated Enterprise Portal Usage Standard

(1) Purpose This IRM section details policy, processes and procedures stakeholders will follow in order to acquire and utilize web services provided by the Integrated Enterprise Portals (IEP) program.

(2) Audience This IRM section is applicable to all IT organizations and Business units that rely on the IEP for web services

(3) Policy Owner Web Infrastructure Services Division (WISD), under Enterprise Operations, Information Technology

(4) Program Owner The WISD Director is the Program Manager and is accountable for oversight, operations, funding and sustainment of the IEP program

(5) Primary Stakeholders All IRS organizations requiring IEP web-services in order to accomplish their mission

(6) Contact Information To recommend changes or to make any suggestions to this IRM section, email WISD it. acioeops.wiso.direct.reports@irs.gov

(1) A "Portal" as used in this standard is defined as the web-based infrastructure (hardware and software) that serves as the entry point for web access to IRS applications and data. The portal provides communications services, platform services, security services and applications services, content management services, common services, and secure methods for accessing/updating IRS application and data. The various portals are distinguished by whether their users are internal or external, by the nature of the interaction or exchange, and by the nature of threats, risks, and protections required by the data or applications, including the method of authentication and authorization.

(2) The Integrated Enterprise Portals (IEP) combines the infrastructure of the Public User Portal (PUP) (formerly the Digital Daily), and the Registered User Portal (RUP), to leverage efficiencies, and the Employee User Portal (EUP), to streamline processes.

(3) The IEP-PUP (IRS.GOV) is the IRS external portal that allows unrestricted public access to non-sensitive materials and applications, including forms, instructions, news, and tax calculators. No authentication is required for access to any materials on the IEP-PUP.

(4) The IEP-RUP is the IRS external portal that allows registered individuals and third party users (registration and login authentication required) and other individual taxpayers or their representatives (self authentication with shared secrets required) to access IRS for interaction with selected tax processing and other-sensitive systems, applications, and data. User interactions are encrypted from the user’s workstation or system to the portal, across the Internet or via direct circuits. The IEP-RUP, via the Common Communication Gateway, also supports IRS extranets, such as the exchange of bulk files of information with the IRS and the Virtual Private Network (VPN) (both inbound and outbound), by registered and authorized external entities.

(5) The IEP-EUP is the internal IRS portal that allows IRS employee users to access IRS data and systems, such as tax administration processing systems, financial information systems, and other data and applications, including mission critical applications. Modernization registration and authentication are required for access to sensitive and mission critical applications, and all user interactions with those systems are encrypted from workstation to portal across the IRS internal network. The IEP-EUP allows IRS employee users with LAN accounts (Windows Network Login) to access Intranet sites, selected applications, non-sensitive data and selected sensitive processing where network encryption and modernization logon are not required (e.g., employee access to selected elements of their own personnel data). IRS network authentication is a basic requirement for access to any materials or services, and is also required to access modernization registration and authentication.

(6) The ACA-TPE is a portal that hosts several Affordable Care Act applications and is a secure conduit between IRS and Health and Human services (HHS).

(7) The term Managed Service with respect to IEP means that the system, hardware, software, cloud service providers (CSP) and other components that make up the IEP are owned and managed by the IEP vendor in order to provide IT services to the IRS. All services provided by the contractor follow an ITIL model ensuring all necessary services are provided to the IRS and it’s stakeholders. The goal of the managed service is to find efficiency while also obtaining leading edge technology in order to support the IRS and it’s stakeholders. Since the contractor performs all necessary functions to support the IEP, there is no need for Federal employees to duplicate the work done by the contractor. The managed service provider uses various technologies and products to provide these services. In accordance with the FAR, decision on the technologies and products and the way the system is designed is at the discretion of the IEP vendor so long as it meets contract requirements for service, performance and security.

(1) All proposed and design-phase business applications requiring end-user interactions (human-computer interactions) or external file transfer and system-to-system capabilities shall conform to this IRM.

(2) This standard does not cover stand-alone workstation software applications (e.g., office automation) which do not interact with separate systems or applications beyond standard network file sharing. Also, this standard does not apply to top security level organizations that have exceptions or have been permitted certain access to systems with the appropriate approval.

(3) The following standard statements shall be adhered to:

1. All data and applications, which do not require authentication and are/will-be available to the general public, shall be accessed through the Integrated Enterprise Portal - Public User Portal.

2. All interaction by external entities, which requires authentication, will be accessed through the Integrated Enterprise Portal - Registered User Portal.

3. All internal tax administration processing involving taxpayer data and subject to unauthorized access (UNAX) restrictions shall be accessed through the Integrated Enterprise Portal (IEP) -Employee User Portal (EUP) and require modernization authentication and workstation to portal encryption.

4. All other internal IRS employee interactions with IEP hosted applications should also be accessed through the IEP services as provided by the IEP MSP, with modernization logon and encryption requirements determined by the respective application data sensitivity and risk profile

(1) All IEP services should be requested by using the IEP Service Catalog in accordance with the WISD customer support processes

(2) All service requests that impact cost, scope, security posture or risk to portals must go through the IEP TRB. WISD will appoint a point of contact to ensure IEP stakeholders are informed of the necessary information and documentation in order to receive a Very Rough Order of Magnitude (VROM) estimate document. VROM’s consist of development and operations costs, level of effort to provide services, and time for delivery of services.

(3) IEP CD Processes: All customers needed to make updates to applications that reside in the IEP following the IEP CD and/or standard IEP deployment process. This process is fully documented in the IEP service catalog that is provided by the managed service

(1) The IRS IEP Usage Standard will be managed and enforced by the Web Infrastructure Services Division, Enterprise Operations within Information Technology.

(2) WISD will:

• Facilitate communication and information flow across the Enterprise for the IEP.

• Provide guidance and communication to stakeholders across the IEP.

• Ensure decisions regarding the IEP are executed in a timely manner.

• Ensure that appropriate procedures, processes, and guidelines are in place for the management of the IEP.

(3) The office of Online Services (OLS) is responsible for the standards and guidelines as it relates to portal web sites and will:

• Provide standards and guidance to IRS users submitting web applications to the IEP.

• Ensure correct hosting environments are used based on Security standards and guidance for IRS application security levels.

• Provide guidance to IRS users for portal environments and ensure that consistent reviews apply appropriate criteria. Support all portal standards and guideline documentation governed by IT.

(1) The primary roles and responsibilities for IRS accessibility guidance belong to IRAP. The IRAP Program Manager serves as the official Section 508 Coordinator for the IRS. As such, IRAP will:

• 1. Proactively seek and bring together Section 508 related updates (laws, regulations, policies, guidelines, etc.).

• 2. Notify Integrated Enterprise Portal (IEP) directly of these updates.

• 3. Promulgate and market accessibility requirements throughout the agency, as necessary.

• 4. Assist the Managed Service contractor or the application in preparing the accessibility portion of a web development life cycle framework that can be integrated into day-to-day operations.

• 5. Participate with Managed Service contractors or the application in the evaluation of automated testing tools that support 508 web accessibility for possible use in the web development life cycle.

• 6. Endorse selected Section 508 software tools that assist site owners in making their web sites compliant with this IRM.

• 7. Support Managed Service contractor or the application Accessibility Plan for technical support.

(1) The Integrated Enterprise Portal (IEP) uses the OneSDLC Managed Service Path. The Managed Services Path is designed to capitalize on the benefits of Managed Services provided by either an outside service (3rd party); internal intra-business processes; and/or existing infrastructure (operational) service provider. This could include software package(s), integrated software packages, shared-services and/or infrastructure components (assets) e.g., servers, web hosting, network centric, workstations, support services and/or web hosting. The managed service is: (a) proprietary; and/or, (b) not maintained by the IRS. The standard detailed reviews required in the development of new solutions or the purchase of a service is not required when the solution is being provided and maintained by a service provider. The Managed Services Path is oriented toward selection and acceptance of the managed services solution, i.e., outside source (3rd party), intra-business processes, and/or infrastructure (operational) service provider.

(1) IEP services provided by the IEP MSP vendor

(2) The major IEP service areas available for use by IRS application owners/developers are outlined in the following sections