What the IRS is, in procurement terms
The Internal Revenue Service is a bureau of the Department of the Treasury, and in data terms it is one of the largest operations in the federal government. It processes well over 260 million returns and forms a year, ingests billions of third-party information returns (W-2, the 1099 series, 1098, K-1), and brings in roughly $5 trillion in gross collections, which the agency describes as about 96 percent of the money that funds federal operations. Every record in that flow is governed by a criminal-penalty statute. That single fact shapes how the IRS buys technology more than any budget line does.
The agency's current shape traces to the IRS Restructuring and Reform Act of 1998 (P.L. 105-206), which replaced a geographic structure with taxpayer-facing operating divisions: Wage and Investment, Small Business/Self-Employed, Large Business and International, and Tax Exempt and Government Entities. Criminal Investigation sits alongside them as the only federal law-enforcement body with jurisdiction over federal tax crimes. In 2024 the agency layered a functional realignment on top, consolidating leadership under chiefs for Taxpayer Services, Compliance, Information Technology, and Operations, reporting through the Deputy Commissioner to the Commissioner.
For a vendor, the useful reading of that history is this: the IRS has a durable divisional structure that owns the mission problems, and a separate technology organization that owns the systems. Requirements are usually born in a division and executed by IT. Knowing which side you are talking to changes what you should say.
Where the budget sits
The IRS annual appropriation has run around $12.3 billion in recent years, split across four accounts: Taxpayer Services, Enforcement, Operations Support, and Business Systems Modernization. Operations Support is the account that carries most of the technology spend, including infrastructure, cloud, security, and the shared services that keep filing season running. Business Systems Modernization is the smallest of the four and the most volatile.
On top of that base sat the Inflation Reduction Act of 2022 (P.L. 117-169), which appropriated roughly $79.4 billion in multi-year supplemental funding through fiscal 2031, allocated across enforcement, operations support, taxpayer services, and business systems modernization. That money has been reduced several times since: the Fiscal Responsibility Act of 2023 (P.L. 118-5) rescinded $1.4 billion, and the fiscal 2024 and fiscal 2025 appropriations acts each rescinded roughly $20 billion more. The practical effect for a vendor is that IRS technology programs run on a mix of annual appropriation and shrinking multi-year balances, and program offices are sharply attentive to whether a proposed effort produces something usable inside a single funding cycle.
Two more figures matter for framing. The IRS projected a gross tax gap of $696 billion for tax year 2022, the difference between tax owed and tax paid on time. And GAO has carried "Enforcement of Tax Laws" on its High-Risk List since 1990. Those two facts are the standing justification for nearly every analytics investment the agency makes.
Realistic entry fit: IRS work types for a small engineering firm
Editorial weighting from public procurement records and practitioner reading. Illustrative, not a measured statistic.
The offices that hold the requirement
Money is one map. Requirements are another. These are the names that appear on IRS technology work often enough to be worth memorizing.
- IRS Information Technology. The CIO organization, including Applications Development, Enterprise Operations, Cybersecurity, User and Network Services, and the Enterprise Program Management Office. Most build and run work lands here.
- Research, Applied Analytics, and Statistics (RAAS). The agency's analytics arm, home of the Compliance Data Warehouse and Statistics of Income. The closest thing the IRS has to a data-science shop.
- Enterprise Digitalization and Case Management Office. Stood up in 2020 to attack paper, scanning, and case handling across divisions. The single best entry point for document AI work.
- Taxpayer Experience Office. Created in 2022 to own the taxpayer-facing service problem across channels: online accounts, correspondence, phones, and in-person.
- Criminal Investigation. Financial crime, cyber, and the Nationally Coordinated Investigations Unit. Buys forensic and analytic tooling with a law-enforcement evidentiary bar.
- Office of the Chief Procurement Officer. The contracting shop, with a dedicated information-technology acquisition function and a small business program. Every award you care about goes through here.
One more actor deserves naming: MITRE operates the Center for Enterprise Modernization, the federally funded research and development center sponsored by Treasury for IRS modernization work. An FFRDC is not a competitor for contract dollars in the normal sense, but its analyses shape how requirements are written. Reading its public output tells you what language the agency is going to use six months from now.
The data, and why it changes everything
Return information is protected by 26 U.S.C. § 6103. That statute has teeth attached: § 7213 makes willful unauthorized disclosure a felony carrying up to five years, § 7213A makes unauthorized inspection a crime even without disclosure, and § 7431 creates a civil cause of action for the taxpayer. Contractors are not shut out. Section 6103(n) and its regulation at 26 CFR 301.6103(n)-1 authorize disclosure to contractors for tax administration purposes, subject to safeguards written into the contract.
Section 6103(n) is the whole game
If the work touches returns or return information, your contract carries 6103(n) language, your staff take annual unauthorized-access training, and your facility and systems are inspected against IRS controls. If the work does not touch return information, most of that falls away and the procurement looks like ordinary federal IT. Establish which side of that line the requirement sits on before you write a word of a response.
Federal Tax Information is also a CUI Specified category in the National Archives registry, with IRC 6103 as its authority. For agencies that receive FTI from the IRS, the governing document is IRS Publication 1075, whose current revision maps to the NIST SP 800-53 Rev. 5 moderate baseline plus IRS-defined controls. For firms contracting directly with the IRS, the document to read is Publication 4812, Contractor Security and Privacy Controls, which sets what a contractor must do when IRS sensitive information lives on contractor systems or in contractor space. Those are two different books, and mixing them up in a proposal is an immediate credibility loss.
The systems you will actually touch
The Individual Master File and Business Master File remain the systems of record for taxpayer accounts, and the individual side still runs code lineage that dates to the 1960s. Customer Account Data Engine 2 is the long-running program to move that processing onto a relational database and shorten the settlement cycle. The Integrated Data Retrieval System is what employees use to look at and act on accounts. Modernized e-File handles electronic return intake. The Information Returns Intake System, launched for filing season 2023, gave small filers a free way to submit 1099s electronically.
On the service side, the Online Account, Tax Pro Account, and Business Tax Account are the public-facing surfaces, with identity proofing handled through credential service providers operating at NIST SP 800-63 identity assurance level 2. The Document Upload Tool moved a large share of correspondence off paper. Enterprise Case Management consolidated dozens of legacy case systems onto a single commercial platform. Direct File ran as a pilot in 12 states for the 2024 filing season and operated in 25 states for 2025.
None of these is a greenfield. Every one of them has an incumbent, a data contract, and a filing-season freeze window during which nothing changes. A proposal that treats an IRS system as a blank canvas reads as unserious. A proposal that names the upstream feed, the downstream consumer, and the freeze window reads as written by somebody who has done this.
Fraud analytics and the compliance side
The Return Review Program replaced the Electronic Fraud Detection System and now scores filed returns for identity theft and refund fraud before refunds release. It is a high-volume, low-latency scoring problem with a brutal cost asymmetry: a false negative pays out a fraudulent refund, and a false positive freezes a legitimate taxpayer's money. The Automated Underreporter program matches third-party information returns against filed returns and generates notices at scale, which is a record-linkage and precision problem more than a modeling one.
Outside the walls, the Security Summit joins the IRS, state tax agencies, and the tax software industry, with the Identity Theft Tax Refund Fraud Information Sharing and Analysis Center as the operational channel for sharing fraud signals. The agency has also stated publicly that it uses machine learning to help select large partnership returns for examination, work run out of Large Business and International.
Governance is not optional here. Executive Order 13960 requires agencies to publish AI use case inventories, and Treasury's inventory lists IRS entries. Current OMB direction runs through M-25-21 and M-25-22, issued in April 2025, which replaced the 2024 memoranda and set expectations for governance, high-impact use cases, and AI acquisition. If a model influences a compliance action against a taxpayer, expect documentation, human review, and an audit trail to be graded as heavily as accuracy.
The security gate
This is where most firms stall. Staff-like access to IRS systems requires a background investigation adjudicated by IRS Personnel Security, typically at the moderate-risk tier, along with fingerprinting and HSPD-12 credentialing under FIPS 201. That process runs on government time, not yours, and months is normal. Contract staffing plans that assume day-one access are wrong, and evaluators know it.
Layered on top: FISMA authorization for any system, an authority to operate under IRS internal security policy, FedRAMP for any cloud service in the boundary, Privacy Impact Assessments under Section 208 of the E-Government Act of 2002, Privacy Act system-of-records coverage, and Section 508 conformance under 29 U.S.C. § 794d for anything a taxpayer or employee touches. Section 508 is not a checkbox at the IRS; forms and notices reach every adult in the country.
Contract vehicles and how work flows
The IRS runs its own contracting office under delegated Treasury authority, and Treasury has its own supplement to the FAR at 48 CFR Chapter 10. Work reaches industry three ways: task orders on existing vehicles, standalone competitions posted to SAM.gov, and subcontracts under primes who already hold the seat.
| Path | What it carries | How a small firm gets on |
|---|---|---|
| TIPSS-4 | Treasury Information Processing Support Services, the IRS-administered multiple-award IDIQ that has carried a large share of Treasury IT services. | Closed to new primes between competitions. Subcontract to a holder, and watch for the follow-on. |
| GSA MAS | SIN 54151S for IT professional services, 518210C for cloud. The lowest-friction on-ramp in federal contracting. | Apply directly. Expect several months and real financial and past-performance documentation. |
| GWACs | Alliant 2, NITAAC CIO-SP, 8(a) STARS III, GSA OASIS+ for professional services, NASA SEWP for products. | On-ramp only when the vehicle opens. Between on-ramps, team with a holder. |
| Open-market | Standalone RFPs and simplified acquisitions posted to SAM.gov, often set aside. | Anything between the $10,000 micro-purchase threshold and the $250,000 simplified acquisition threshold is reserved for small business. |
| Subcontract | Work under an incumbent prime. Fastest route to real IRS past performance. | Large-business primes carry subcontracting plans under FAR 19.702 on awards over $750,000. Ask for the small business liaison by name. |
| 8(a) sole source | Direct award without competition where the agency has a defined need. | Services up to $4.5 million under 13 CFR 124.506, if the firm holds 8(a) status. |
The decision that matters most to a small firm happens before the solicitation exists. Under the rule of two at FAR 19.502-2, a contracting officer sets an acquisition aside for small business when there is a reasonable expectation of at least two capable small offerors at fair market price. That expectation is formed from responses to sources-sought notices and requests for information. Ignoring an RFI because it "isn't a real opportunity" is how firms lose the set-aside before the competition starts.
There is no IRS SBIR, and that is useful to know
Agencies whose extramural research and development obligations exceed $100 million must run an SBIR program under 15 U.S.C. § 638(f). Treasury does not meet that threshold and does not participate. There is no IRS SBIR topic list, no Phase I, no open-innovation call to answer.
That changes the strategy rather than closing the door. Entry to the IRS is a services-contracting problem: vehicle position, past performance, cleared and investigated staff, and a named champion inside a program office. Firms that build in the SBIR world often arrive at Treasury with strong technical depth and no contracting posture. The fix is to treat the vehicle and the personnel-security pipeline as engineering deliverables with schedules of their own, started early and tracked like code.
Where a small engineering firm realistically fits
The core account systems are not where a small firm wins first. The work adjacent to them is. Document and correspondence processing is the clearest example: extraction from scanned forms and notices, quality measurement on that extraction, and routing into case systems. It is bounded, measurable, and the agency has openly committed to reducing paper.
Data engineering is the second lane. Moving data between master files, warehouses, and analytic environments with lineage that survives an inspection is unglamorous and permanently in demand. So is independent model validation, where an evaluator wants somebody other than the model's builder to state what it does under drift, under adversarial input, and on the subpopulations where a wrong answer causes the most harm.
Our team builds exactly this class of system. We hold a standing bench of named engineers, licensed professional engineers, and domain specialists; the firm is SAM.gov active with CAGE 1AYQ0 and JCP / DD-2345 certification, and our people carry seven cloud certifications and fifteen years of production federal delivery across five consulting firms. We work prime or subcontract, and we are comfortable being the technical depth behind somebody else's vehicle seat.
The realistic entry sequence
What IRS buyers respond to
Specificity about data handling comes first. A response that names 6103(n), Publication 4812, the investigation tier its staff will hold, and where the data will physically live is read differently from one that says "we take security seriously." Second is filing-season realism. The agency's calendar is not negotiable, and a schedule that ignores the freeze window signals that the offeror has never worked there.
Third is measurement. On extraction work, name the false-extraction rate and how it will be measured on a held-out sample the government controls. On scoring work, name the operating point and what it costs in taxpayer burden. The IRS is audited by the Treasury Inspector General for Tax Administration and by GAO on a standing basis; every program office has lived through a report. A vendor who arrives with the evidence already structured for that audience is doing the buyer a favor, and buyers remember it.
Common questions on the entry path
Do we need a clearance to work IRS contracts?
Usually not a national-security clearance. What is required is a suitability background investigation adjudicated by IRS Personnel Security, plus HSPD-12 credentialing. The tier depends on the risk designation of the position. Some Criminal Investigation work carries higher requirements, but the standard technology contract does not.
Can a firm without prior IRS work prime a task order?
Yes, on set-aside and simplified acquisitions, and on vehicles where the firm already holds a seat. Relevant past performance from other federal agencies is evaluated on similarity of scope, size, and complexity, not on agency name. Direct IRS experience helps most on the largest efforts.
Does Publication 1075 apply to an IRS contractor?
Publication 1075 governs agencies that receive federal tax information from the IRS, and their contractors. A firm contracting directly with the IRS is generally governed by IRS internal security policy plus Publication 4812 and the security clauses in the contract. Both roads end in a NIST SP 800-53 control set, but the citation you use should match the role you are in.
How long does it take to see revenue?
Plan on a year from first contact to first invoice on a subcontract path, and longer on a prime path that requires a vehicle on-ramp. The personnel-security timeline is the usual long pole, which is why named staff should start paperwork before award, not after.
The first step
Pull the IRS obligation history from USAspending.gov for the last three fiscal years, filtered to the product and service codes that match your work. That single query gives you the incumbent list, the vehicle each award sits on, the period of performance, and therefore the recompete date. From there, pick the two vehicles that carry the most of your kind of work, identify the small business liaison at each incumbent prime, and send a capability statement that names a specific system and a specific measured outcome. That is a week of work and it beats a year of general marketing.
Frequently asked questions
Through task orders on multiple-award vehicles such as TIPSS-4, GSA Multiple Award Schedule contracts, and governmentwide acquisition contracts; through standalone competitions posted to SAM.gov; and through subcontracts under incumbent primes. Contracting runs through the IRS Office of the Chief Procurement Officer under delegated Treasury authority.
26 U.S.C. § 6103 controls disclosure of returns and return information, with criminal penalties under §§ 7213 and 7213A and civil damages under § 7431. Section 6103(n), implemented at 26 CFR 301.6103(n)-1, permits disclosure to contractors for tax administration purposes under contractual safeguards.
No. SBIR participation is required only of agencies with more than $100 million in extramural research and development obligations under 15 U.S.C. § 638(f), and Treasury is below that threshold. Entry to the IRS is a services-contracting path rather than a research-award path.
Document and correspondence digitization under the Enterprise Digitalization and Case Management Office, analytics supported by Research, Applied Analytics, and Statistics, fraud scoring in the Return Review Program, and taxpayer-facing service work under the Taxpayer Experience Office.
Two things: the filing-season change freeze, during which production systems do not move, and the personnel-security investigation timeline for contractor staff, which routinely runs months and cannot be compressed by the vendor.