Modernization and Information Technology Services (MITS) Delegation Order 28 (D.O. 28) provides MITS executives with delegated signature authority for approving information technology purchases of goods and services. The CIO has responsibility for all IT purchases of products and services acquired by the Internal Revenue Service (IRS). The Director Client Services is the D.O. 28 delegated signature authority to approve IT requisitions initiated from the business units for all Functional Areas (aka PACS).

The purpose of this document is to provide guidance to all IRS personnel on the critical elements necessary to complete the requisition approval process.

MITS is the organization responsible for approving IT requisitions and, therefore, MITS Executives are accountable for ensuring their accuracy. IRS personnel involved in the processing of IT requisitions must follow the guidance contained in this manual.

The Director Client Services is responsible for reviewing all IT requisitions initiated from business units and ensuring the requisitions have been routed through the appropriate DIO, all appropriate reviews are completed, the correct Internal Order (aka PCAS) code is assigned, and a requisition summary is attached to the requisition.

This document is authorized by:

The signature authorities and associated re-delegations supported by D.O. 28 apply to requisitions for purchases of IT products and services; however, it does not apply to the following:

While most requisitions are for specific IT resources, many requisitions are for block funding, which is earmarked for IT resources and is to be applied to a Purchase Card. These process guidelines also apply to this type of requisition. Users of Purchase Cards are reminded to review the IRS Purchase Card Guide (Document 9185) link and the Restricted Purchase List link for instructions on how to use the card and buying restrictions. Be sure to note the restricted Purchase Card use regarding disclosures of taxpayer returns or return information. This restriction also applies to employee/personnel and Official Use Only (OUO) information. The following web links apply: http://erc.web.irs.gov and http://awss.procurement.irs.gov, respectively.

There are also web links for Credit Card Services and the Treasury Commercial Vehicles (TCV) Purchase Card Program. The links are: http://awss.web.irs.gov/ess/CCS/ccs.htm and http://erc.web.irs.gov/Displayanswers/folderContent.asp?folderID=10, respectively.

All organizations within IRS are responsible for generating business requirements and ensuring the business requirements are part of their Strategic and Program Plan. When an organization identifies an information technology business requirement, contact must be made with the Business Systems Planner (BSP) to ensure that the requirement is addressed in the Strategic and Program Plan.

A Business Justification typically consists of: 1) the technical requirements of the acquisition, 2) how it supports the organization’s business requirement, 3) how the business requirement supports the Strategic and Program Plan, 4) a basis of cost estimate, and 5) any other relevant information. The Business Justification does not need to follow a particular format, as long as it includes the minimum items (1-4) above, and is incorporated as Item 1 in the Requisition Summary (see Exhibit 2.21.1-3 ). Below is an example of a generic Business Justification:

Requisitioners who are usually Points of Contact (POCs) are responsible for initiating the requisition process and for bringing all necessary Agency expertise and resources to the task in order to ensure the IT acquisition is ready to forward to the Office of Procurement.

The responsibilities of the Point of Contact include the following and are also reflected in Diagram 1 - Parallel Process: Refine Technical Requirements.

Diagram 1 - Parallel Process: Refine Technical Requirements

Figure 2.21.1-1

A Request for Information Services (RIS) is required only for those requisitions that are expected to utilize MITS staffing resources. Requisitions for acquisitions that will not require such resources do not need a RIS. The web link for the process is:

After completion of the required reviews and concurrences, update the Requisition Summary to certify all appropriate programmatic and technical reviews have been satisfactorily completed. IT requisitions initiated by a business unit routed through the appropriate DIO, to ensure all appropriate reviews are completed, the correct Internal Order (aka PCAS) is assigned, and a requisition summary is attached to the requisition prior to forwarding the requisition to the Director Client Services.

For an approved E-300 Business Case, the question addressing this issue on the Requisition Summary must be answered. In addition, the Business Case Number and Date of Approval must be inserted into the spaces provided. The only remaining area that needs to be completed on the Requisition Summary is the Disclosure Section since disclosure is not fully accounted for in the Business Case. The web link below contains the Disclosure information required to be completed.

Attach the Requisition Summary to the webRTS record using the webRTS Attachment Option, and submit the webRTS record to the first name on the requisition approval routing path. IT requisitions initiated from business units must include the Director Client Services in the webRTS approval path.

A Technical Tier Review may consist of an architectural, engineering, capacity, or standards review for the IT acquisition. There are four types of infrastructure Technical Tier Reviews as shown in the Table below. Each of the Technical Tier Reviews has different business processing rules and selection of the appropriate Technical Tier Review is based on the type of IT acquisition. Some acquisitions may require multi-Technical Tier reviews and concurrences.

The table below identifies Tier responsibility and the equipment/software under their review:

Tier I consists of mainframes, computer-related hardware, software, maintenance, and related services. The scope will vary depending on the nature of the acquisition. Concurrence should be referenced in the Requisition Summary. Refer to Exhibit 2.21.1-2, Points of Contact.

Tier II consists of servers plus related hardware, software, maintenance, and services, supporting a centralized/corporate application environment, but NOT Office Automation. The scope of the review will vary depending on the acquisition. The following web link applies:

Tier III consists of end-user computing related hardware, software, server software, maintenance and related services, including desktops, laptops, and personal communications devices; Windows-based servers supporting this environment, including file and print servers; and domain controllers.

Tier III acquisitions are handled directly by the Tier III owner, except when the Tier III requirement is initiated and funded from a business units financial plan (aka Funds Center). However, ad hoc requests for acquisitions of this type may be received. If this occurs, visit OS GetServices

OS GetServices is a self service desk tool that provides the capability to report a computer, printer, fax, or any other IT-related problem. IT products and services can also be requested. Software requests must come through OS GetServices unless the Business Unit is funding the purchase. The status of an existing request can be checked. OS GetServices web ticketing is available throughout the organization. The following web link provides more information:

Tier III Server Standards Review

Tier IV consists of telecommunications, including voice and data transmission hardware, software, and related services. Concurrence should be referenced in the Requisition Summary. Refer to Exhibit 2.21.1-2, Points of Contact.

Security is an increasingly important aspect of the acquisition process. Mission Assurance & Security Services ensures products or services being acquired are in alignment with prevailing internal and external guidance and mandates, established internal systems, data and physical security policies, and technology standards. Detailed information on Security can be found in IRM 25.10.1.

Requisitioners are required to complete a Security Compliance Review Checklist for IT requisitions. The Checklist can be found at:

The Checklist provides the analysis required to determine whether a product is compliant, is considered an exception, or requires a waiver. An assertion in the Requisition Summary must be provided that such a review has taken place.

IRS requires that every system that contains sensitive But Unclassified (SBU) data and personal identifiable information to have a Privacy Impact Assessment (PIA). This includes new systems, systems undergoing major modifications, and systems that are being re-certified. Privacy issues must be addressed when systems are being developed, and privacy protections must be integrated into the development life cycle of these automated systems. The PIA process can be found at:

The above site covers process information, including exceptions when requisitions do not need to be reviewed by Disclosure. For additional privacy process information, see IRM 11.3.14

The Capability Maturity Model Integrated - Software Engineering (CMMI-SW) is an increasingly important aspect of the acquisition process for services involving software development. If a technical requirement calls for software development, then the contractor is required to have a minimum rating of CMMI-SW Level 2. If it cannot be determined that the acquisition is for software development or if the vendor is considered to be non-CMMI Level 2, contact the Office of Strategic Acquisition Initiatives.

Once it is determined whether or not the acquisition involves software development, such information must be indicated in the "Item Description" field of the webRTS record. Also, provide information about the nature of the software development. This action notifies the Contracting Officer that certain clauses must be incorporated into the contract. CMMI compliance must also be annotated in the Requisition Summary.

Additional information can be found at the following web links:

Effective June 25, 2001, the Federal government implemented Section 508 of the Rehabilitation Act of 1973, Amendments of 1998 (29 U.S.C. § 794(d)). Section 508 requires that the Federal government when developing, procuring, maintaining, or using electronic information technology (EIT), must ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by Federal employees without disabilities. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal department or agency, have access to and use of information and data that is comparable to that provided to the public without disabilities. Section 508 permits individuals to file a complaint against Agencies that are alleged to have denied the comparable access and individuals are permitted to file a civil action. If substantiated, Agencies may be found liable for both attorneys' fees and/or injunctive relief; but not compensatory damages.

The Federal Acquisition Regulation, Part 2.101, definitions –

For any EIT requirement, you must go to the IRS Information Resources Accessibility Program (IRAP) website and follow the instructions appropriate to your acquisition.

When purchasing EIT supplies or services, requesters/requiring officials must: (1) establish their requirement, (2) compare the requirement against the Access Board's technology specific standard checklist, (3) select the applicable standard(s), (4) perform the necessary market research to determine if compliant supplies or services are commercially available, (5) prepare a determination and finding, and (6) check http://irap.no.irs.gov for IRAP approval requirements. In the event the supplies or services are not commercially available or only partially available, the requester/requiring official must address these circumstances within the determination and finding and, when applicable, attach the necessary exception documentation. If the requester/requiring officials make a determination and finding based on Undue Burden, they must attach the necessary exception documentation. A Determination and Finding must be completed for each proposed procurement which contains the furnishing of any EIT supply or service.

The Federal Acquisition Regulation (FAR), Part 39, implements Section 508 requirements with regard to contracts and Section 508 documentation.

For additional information on EIT definitions, forms and detailed requirements, refer to the following web sites:

Disclosure Notification refers to the circumstances in which there may be proprietary or other sensitive information; this includes taxpayer data, employee information, and Official Use Only (OUO) data which may be gathered, managed, or obtained as a result of development of an information technology system. All IRS IT hardware, software, and files are designated as Sensitive But Unclassified (SBU) based on the potentially sensitive information they contain. Accordingly, the National Disclosure Approving Official requires all IT acquisitions to include appropriate Disclosure terms and conditions in the contract. Additional information can be found at the Disclosure website:

The "Disclosure and Privacy Act" boxes in the webRTS record for any IT requisition that does not fall into one of the exception categories listed in Exhibit 2.21.1-3, Requisition Summary, must be checked. However, for all other requisitions, do not check the boxes. For more information on Disclosure requirements, see IRM 11.3 and IRM 11.3.24 regarding Disclosures to Contractors.

Once all the appropriate reviews, concurrences, and notifications have taken place, a Requisition Summary must be developed summarizing and indicating these findings. It must be attached to the requisition using the Attachment Option. Refer to Exhibit 2.21.1-3 for the Requisition Summary Template and Instructions.

Approvers are the individuals in the requisition approval path who review the requisition and, if the requisition is correct, release it to the next person in the approval path.

The Requisition Signatory Authority approver is the person who, under D.O. 28, has the authority to sign requisitions at specified dollar amounts and who ensures that the requisition is fully compliant with IRS requirements prior to forwarding it to the Financial Plan Manager. The Director Client Services is the person who under D.O. 28 has the authority to sign requirements for IT requisitions initiated from business units for all Functional Areas (aka PACS) and must be included in the webRTS approval path. The Requisition Signature Authority list can be found at the following web link:

The webRTS record for this requisition must include evidence that an individual who is authorized to approve this requisition, as specified in the Requisition Signatory Authority list or in an appropriate re-delegation memorandum, has approved this requisition and the date of the approval. IT requisitions initiated from business units that include the Director Client Services in the webRTS approval path constitutes evidence of authorized approval.

This evidence may be the actual processing of the requisition by the approver in webRTS or if the approver does not use webRTS, a note should be inserted into the history record indicating that the requisition was approved by (name/title/symbols of authorized approver and date approved). If you are unsure who your "authorized approver" is, refer to the Requisition Signatory Authority list:

If the person who approves the requisition in webRTS is " Acting" for the authorized approver, include the following phrase in the webRTS history record:

The Financial Plan Manager ensures that appropriate funding is available, the correct Internal Order (aka PCAS) code is used, the correct signature is on the requisition, based on the D. O., and is always the last person in the requisition approval path before the requisition is forwarded to Procurement.