The IRS IT Commercial Off-The Shelf (COTS) software infrastructure shall only use Software Product Versions, which are approved in the Enterprise Standards Profile (esp).

Purpose This section provides direction for maintaining IRS COTS software across the IRS IT Infrastructure.

Audience IRS IT employees and business units deploying COTS software on the IRS IT infrastructure.

Policy Owner The Director, ES/EA owns the policies contained herein.

Program Owner Enterprise Infrastructure Currency is responsible for the administration, procedures and updates to the program.

Primary Stakeholders All IRS IT ACIO areas and Business units that control COTS software on the IRS IT infrastructure.

Program Goals These are the instructions for maintaining the currency of COTS software on the IRS IT infrastructure.

Terminology referenced in this IRM:

The COTS products on the IRS IT Infrastructure shall be considered in compliance if they are using the most current “Major Version Approved” in the ESP or the immediately preceding major version that is approved in the ESP.

For product versions identified as non-compliant, product custodians will, within 6 months of such identification, provide a plan to become compliant via upgrade, replacement, or removal from the IRS environment, or request to remain on the current version via Risk Acceptance Form and Tool (RAFT).

Following a product version upgrade, any non-compliant instances of the product shall be removed/deleted/deinstalled from the Enterprise or a request to retain the non-compliant version shall be documented via a Risk Acceptance Form and Tool (RAFT). Completion of upgrades, removals, deletions or RAFT approval shall be completed within 12 months of the initial non-compliance date. The Infrastructure Executive Steering Committee (IESC) shall approve the disposition of all non-compliant versions.

Figure 2.17.1-1 provides several sample scenarios and the resulting compliance status.