RMO No. 31-2025 — Guidelines and Procedures on the Conduct of Proof-of-Concept (POC) for Information and Communications Technology (ICT) - related Products/Solutions and Services Digest | Full Text | Annex A | Annex B | Annex C | Annex D | Annex E | Annex F

BUREAU OF INTERNAL REVENUE REPUBLICOF THE PHILIPPINES DEPARTMENT OF FINANCE

Bringing In Revenues for Nation-Building February 28, 2025 PILIPINAS BAGONG

REVENUE MEMORANDUM ORDER NO. 0 3 1 --2 0 2 5

Subject Guidelines and Procedures on the Conduct of Proof-of-Concept (POC) for Information and Communications Technology (ICT)

related Products/Solutions and Services

TO All Revenue Officials,Employees and Others Concerned

I OBJECTIVES

This Order is issued to:

1.Prescribe the guidelines and procedures on the conduct of Proof-of-Concept

(POC)for ICT-related products/solutions and services.

2. Establish adequate controls for proper monitoring of all POC engagements.

3. Ensure submission and completeness of all POC documentations reguired

prior to conduct, during actual and completion of the engagement.

II. DEFINITION OF TERMS

1. Proof-of-Concept - a prototype or early-stage demonstration confirming

whether an idea or technology can deliver the desired outcome.

2.ICT Vendor I Service Provider- a vendor that provides IT solutions and /or

services to end users and organizations.

Project Manager-refers to any BIR official/employee who is designated/ assigned to ensure the tracking and full completion of projects and its

ADMIN UNIT Go JUN 10 2025 E REA 2 4 Functional Manager - a functional owner,process owner, and/or project deliverables.

0 INTERNALREVENU proponent, maybe a high-ranking official in the Bureau who serves as the

overall overseer of the project, providing overall direction and is accountable for the various projects under their respective functional services across the 2SO Service. Bureau.For purposes of this Order, Functional Group refers to Operations Group,Resource Management Group,Legal Group and Large Taxpayers

BIR National Office Bldg., Senator Miriam Defensor-Santiago Avenue, Diliman, Quezon City Trunkline: 8981-7000 ; 8929-7676 Website: www.bir.gov.ph

5. Technical Manager -- refers to Information Systems Group counterpart of

Functional Manager that provides technical expertise and support needed for the project.

6. Disruptions - refers to any unforeseen events that arise, which may hinder ICT operations or processes such as technical issues, data breaches, delays in timelines, natural disasters.

III. POLICIES AND GUIDELINES

1. Functional and Technical Managers shall initiate the conduct of POC discussions on any ICT-related products/solutions or services based on the

Providers, upon approval of the concerned Deputy Commissioner. determined needs and/or proposals/offers of ICT Vendors/Service

2.For POC proposals offered by ICT Vendors/Service Providers to Functional

technical requirements of the Bureau: with the ISG counterpart to ensure that it meets relevant functional and Groups, the following activities shall always be conducted in coordination

c. Recommendation as to acceptance I rejection of the technical a.Evaluation of POC Proposals; b.Conduct of Proof-of-Concept; and

proposal based on the result of evaluation.

3. Once ISG determines that the POC proposal is feasible,a Reguest for Proposal for the Proof-of-Concept (RFP for POC) which is attached herewith

as Annex A shall be publicly announced.

4.The RFP for POC shall remain open for one (1 month from the date of publication.Only those who successfully submit their Letter of Intent (LOI)

and other relevant requirements during the prescribed period shall be considered for participation in the POC.

5. Participation in the POC does not guarantee acceptance of a bid in the actual biddings and awards process for the potential project that may result from the POC.

W jUN 10 2025 ' PF INTERNEN RENVENG 6. All conduct of POC shall require the approval of the Deputy Commissioner of the Information Systems Group (DCIR ISG) and Deputy Commissioner of concerned Functional Group (for non-ISG initiated POC reguests)

C 6 .IcT Vendors/Service Providers shall assume all resource requirements for POC duration / engagement shall not exceed one (1) month. the conduct of POC.

9. Conduct of POC shall not disrupt ICT operations in any way. Unresolved

problems and/or disruptions caused or attributed to the POC shall cause the immediate termination of the POc engagement. A written notice of termination shall be sent to the ICT Vendors/Service Providers and shall be effective immediately.

IV.PROCEDURES

A. POC Initialization

1. Designated Project Manager

1.1 Meet/communicate with prospective ICT Vendors/Service Providers

(ACIR) of the possible conduct of POC. on the conduct of POC; notify the concerned Assistant Commissioner

1.3 1.5 1.6 1.2 1.4 verification as to completeness of requirements. Receive from ICT Vendors/Service Providers the revised / adjusted LOI and the relevant documents specified in the RFP for POC. Receive and review the LOI and POC proposal from ICT Forward the submitted documents of the Proponents to the Information Development &Operations Service(ITPSD-ISDOS)for checking/ Coordinate with ICT Vendors/Service Providers in case of any revision/l by ITPSD-ISDOS. Prepare the RFP for POC for publication on BIR's official online channels. Interested ICT Vendors/Service Providers shall submit an Vendors/Service Providers. Technology Planning & Standards Division - Information Systems adjustment in the POC proposal based on the observations/comments

1.7 1.8 considered.Otherwise, return to ICT Vendors/Service Providers to Prepare and route the endorsement letter for signature of thel concerned ACIR and approval of the DCIR-ISG and Deputy Commissioner of concerned Functional Group (for non-ISG initiated POC requests) POc proposal; validate if the observations / comments werel consider the observations/comments to process POC request. Receive from ITPSD-ISDOS the POC proposal, approved by thel

LADUN jUN 10 2025 U COA' 2F INTERNANT 1.9 1.10 Route NDA for initial of Security Management Division - Information request for POC conduct is disapproved. C and release to ICT Vendors/Service Providers for its signature. Otherwise, inform ICT Vendors/Service Providers thru email that its concerned DCIR(with control number)/disapproved reguest for POC Prepare and affix initial to the Non-Disclosure Agreement for POC conduct (NDA-Annex B) and Acceptable Use Policy(AUP-Annex

2S0 REVENG 1.11 Coordinate closely with SMD and Network Management and Technical Systems Project Management Service (SMD -ISPMS) and signature of ACIR concerned & BIR Data Protection Officer (DPO

the conduct of vulnerability assessment and evaluation of the POc network infrastructure set-up Support Division (NMTSD) on technical requirements, particularly on

2.ICT Vendors / Service Providers

2.1Coordinate with concerned office on the following: 2.1.1 Conduct of POC

2.4Sign the prescribed NDA and AUP 2.2 Submit LOI and POC proposal to the concerned BIR office. Adjust 2.3Adjust/finalize POC proposal POC proposal as may be required. 2.1.2 POC-related meetings;and 2.1.3 Product demonstration

3. Concerned Assistant Commissioner

3.1. Receive justification from the Designated Project Manager of the possible conduct of POC

3.3.Sign the Endorsement Letter. 3.4. Endorse submitted documents of the Proponents to the Office of the 3.5.Sign the NDA. 3.2. Recommend approval of POC proposal following the evaluation by the and POC network infrastructure set-up. DCIR-ISG and Deputy Commissioner of concerned Functional Group ITPSD-ISDOS,SMD and NMTSD on the vulnerability assessment (for non-ISG initiated POC requests) for approval/signature.

4.Data Protection Officer

4.1Sign the NDA

5. Concerned Deputy Commissioner

5.2.Forward toITPSD-ISDOS approved/disapproved POC proposal 5.1.Approve/disapprove POC proposal endorsed by concerned ACIR

6.ITPSD -ISDOS

6.1. Receive the submitted documents of the Proponents from Designated 6.2. Receive the approved / disapproved submitted documents of the Project Manager and check completeness of reguirements / compliance to this Order.

6.3. Assign control number to approved POC proposal and provide copy to Project Manager the disapproved submitted documents of the Proponents from the concerned office of the Deputy Commissioner. Proponents. Designated Project Manager, otherwise return to the Designated

RECE EAWOFINTERNALREVENUE A NAGEMENT DIVISION

ee t

jUN 10 2025

BY ADMINUNIT. IMr 2:s0

7.NMTSD -ISDOS

7.1. Participate in the assessment of POC product or service with BIR

7.2. Provide assistance during POC preparation specifically on network requirements. infrastructure set- up.

8.SMD -ISPMS

8.1. Provide assistance on POC preparation specifically on vulnerability

8.3. Receive copy of approved / signed NDA and AUP from concerned 8.2. Affix initial in the NDA. office. assessment

B.POC Conduct

1.Designated Project Manager

1.4. Coordinate closely with SMD and NMTSD for the assessment of 1.2. Coordinate with ICT Vendors/Service Providers and i or office 1.5.Monitor and document status of POC; prepare and submit to ITPSD 1.1. Facilitate conduct of POC based on the approved POC proposal. 1.3. Recommend discontinuance of POC for unresolved technical issues. technical requirements during POC engagement. ISDOS the POC Weekly Status Report (Annex D) every Monday. concerned to thresh out issues regarding POC implementation, if any. and unresolved technical problems during POC execution.Ensure immediate resolution of problems affecting BIR ICT infrastructure or in cases of unexpected problems on network /security/application

2.ITPSD

2.1 Receive POC Weekly Status Report; prepare and submit Consolidated POC Status Report(Annex E) to ODCIR-ISG thru the ACIR-ISDOS

3.ICT Vendors / Service Providers

3.5. Implement and document resolutions. 3.6. Discontinue conduct of POC if issues are not resolved. 3.1. 3.2.A 3.3. 3.4. p Conduct POC based on approved POC proposal. Correct problems that may affect BIR IT infrastructure, if any. Resolve issues together with Designated Project Manager and ISG Attend meeting/s coordinated by concerned office / PM offices concerned.

RECOADSFANAGEMENTDIVISION ene WOFINTERNALREVENUE

c

JUN 10 2025

SRNXA ADMINUNIT- 1ME Z50

C. POC Evaluation

1. Designated Project Manager

1.2 1.1Prepare POC Evaluation Summary Report (Annex F) for submission Provide ITPSD-ISDOS a copy of signed POC Evaluation Summary to concerned DCIR thru concerned ACIR. ten (10) working days after completion / termination of POC.

1.3 Present to DCIR-ISG and concerned Functional Group result of POC conduct, if required. Report for safekeeping / storing at the ISG Technical Library.

2.ITPSD-ISDOS

2.1 Receive final and signed POC Evaluation Summary Report from concerned office/PM;scan and upload to ISG technical library

3. Concerned Assistant Commissioner

3.1Receive POC Evaluation Summary Report, make recommendation to DCIR-ISG and DCIR of concerned Functional Group (for non-ISG initiated POC requests).

4. Concerned Deputy Commissioner

4.2Inform / recommend to CIR result of POC conduct, if required 4.1Approve / disapprove the recommendation / result of POC conduct.

V. REPEALING CLAUSE

modified accordingly All other issuances which are inconsistent herewith are hereby repealed or

VI.EFFECTIVITY

This Order takes effect immediately.

ROMEGD.LUMAGUI,JR Commissioner of Internai Revenue

G-2

1REd OROCAV OFINTERNALREVENUE ANAGEMENTDIVISIOA

Mes

jUN 10 2025

ADMINUNIT.3 TAM 0