IRS RFI: Phishing-Resistant Multi-Factor Authentication (MFA) for Mainframe Platforms & Applications

Notice ID: RFI2526APMO

OBJECTIVES

1. Enable and enforce phishing-resistant multi-factor authentication (MFA) across IBM® z/OS, IBM® z/TPF (Includes TOS / HCM), IBM® z/VM, and Unisys platforms to enable Personal Identity Verification (PIV)/MFA of for all mainframe applications, high value assets (HVAs), and other critical systems in accordance with federal information system security mandates, emerging legislative directives, recent audit findings / recommendations, and Agency strategic objectives and security regulations.
2. Achieve Agency compliance with recent and emerging federal reporting and information security standards, e.g., FY25 Federal Information System Modernization Act (FISMA) required metrics, National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) Security Controls
3. Harden filing-season critical assets and designated HVAs against evolving cybersecurity threats
4. Remediate recent audit findings and implement recommendations by oversight entities such as the Government Accountability Office (GAO), Treasury Inspector General for Tax Administration (TIGTA), and Department of Homeland Security (DHS)
5. Further the organization’s transition to a zero-trust security posture in accordance with the DHS Cybersecurity Infrastructure and Security Agency (CISA) Continuous Diagnostics and Mitigation (CDM) program framework and Department of the Treasury guidance.
6. Improve overall software purchasing processes; lower costs, increase compliance, improve effectiveness, and reduce the total cost of ownership associated with existing products and services. IRS expects the selected vendor(s) to provide aggressive volume-based pricing discounts and to develop a mechanism for protecting or reducing prices throughout the designated contract term. The IRS requires the ability to transfer licenses, at any point in the agreement or thereafter, to another agency or owner (e.g., another Treasury bureau). Additionally, the IRS requires the ability to transfer the maintenance agreements for the same to another government agency or owner along with the licenses. Any software must be covered by a maintenance contract that will provide corrective / remedial service in the event of a problem or incident

More here.

🔊 Listen to Story