Data Security On-site Review for Child Support for Tribes

The purpose of this Request for Bid (RFB) document is to provide interested parties with information to enable them to prepare and submit a bid for conducting data security on-site reviews for nine (9) tribal child support programs as outlined in Attachment E Scope of Services.
Child support programs are required by federal statute to have procedures to intercept the federal tax refunds of delinquent child support participants. In Wisconsin, the child support program is administered by the Department of Children and Families’ (DCF), Bureau of Child Support (BCS), though county and tribal agencies handle case management and access Federal Tax Information (FTI) using the state’s Kids Information Data System (KIDS) and ancillary applications. Successful case management, however, necessitates tribal technologies such as workstations, Multifunctional Devices (MFDs), and VoIP phones are in use and interact with FTI.
FTI must be secured to federal regulations as dictated by the IRS Office of Safeguards in IRS Publication 1075 Tax Information Security Guidelines for Federal, State and Local Agencies and is largely based on the controls found in NIST Special Publication 800-53r5 Security and Privacy Controls for Information Systems and Organizations.
As of January 2023, the IRS has required compliance with the Taxpayer First Act (TFA). Section 2004 of TFA requires the state agency to conduct on-site reviews of contractors with access to FTI. The IRS considers nine (9) tribes with access to FTI via the state to be contractors. On-site reviews must be conducted at least every three (3) years.
In coordination with DCF and the tribes, on-site reviews must assess compliance of the unique technical structure that each tribe uses in the reception, processing, storing, accessing, or protection of FTI. The on-site review will also assess the management and operational controls in place to assist in securing FTI in both technical and non-technical environments. Assessing the unique technical environment associated with each tribe’s child support program is complex and time-consuming, requiring professionals with advanced technical skills, proficiency, and experience in conducting security assessments.
The State as represented by DCF intends to use the results of this RFB to award a single contract to the entity with technical skills and experience in security assessment to conduct nine (9) on-site reviews of each tribe’s technical and non-technical environment used in support of their child support program.
Questions should be submitted as described in the Bid Document Section 1.5. Do not submit questions through eSupplier.