Final RFI Questions - CJIS.xlsx

XLSX spreadsheet 31 KB Posted Mar 26, 2026

Attached to: RFI - Enterprise Collaboration Tools
Solicitation number: 02-25-2026
Issued by: Department of Justice Federal Bureau of Investigation Headquarters Division

About this file

Written by GovTribe AI · Mar 26, 2026

This is a Questions and Answers document from a Request for Information (RFI) issued by the Federal Bureau of Investigation (FBI) Criminal Justice Information Services Division (CJISD) regarding enterprise collaboration and work-tracking tools consolidation. The RFI seeks market capabilities for an integrated platform or ecosystem that combines content collaboration, agile project management, DevOps integration, IT service management, and portfolio governance capabilities. The FBI is open to evaluating both single integrated suites and best-of-breed ecosystem approaches equally, provided all RFI requirements are met.

The solution must support deployment on-premises, in Azure Government, and AWS GovCloud, with compliance to NIST 800-53 Rev 5 standards and air-gapped, fully disconnected operating environments with controlled file transfer only. The platform must accommodate approximately 5,000 users with 2,000-3,000 peak concurrent users, support 15,000-20,000 monthly tickets, 1,000 repositories, and 1,000 CI/CD job iterations daily. Critical requirements include automated identity provisioning from Entra ID and Active Directory with attribute-based access control, support for 100-200 separate helpdesk queues with individual SLAs and permissions, encryption at rest with customer-managed keys, comprehensive logging compliant with OMB M-21-31, vulnerability scanning, privilege access management controls, and integration with enterprise identity services and standard development ecosystems including Azure DevOps and GitLab. The platform must support SAFe agile practices, PI planning, demand intake, capacity planning, portfolio approvals, knowledge management with versioning and approval workflows, enterprise search across all data types, and records retention capabilities. While not mandatory, enhancements such as Software Bill of Materials (SBOM) support, Data Loss Prevention (DLP) controls, break-glass workflows, branch protection enforcement, and private AI capabilities would strengthen vendor responses. The FBI will handle Authority to Operate (ATO) internally, with vendors potentially assisting with artifact provision. Responses were to be submitted electronically to Dionna Brown at the FBI.

View the file

Other files

File	Type	Posted
RFI - Enterprise Collaboration Tools .pdf	PDF	Feb 25, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

RFI Q&A

RFI Question Template
Question #	Question	Government Response
1	Could you please confirm whether this is considered a new requirement? If not, would it be possible to provide the incumbent contractor, contract number, and contract value?	This is not considered a new requirement; however, it is not possible to provide the incumbent contractor, contract number, and contract value.
2	Is CJISD seeking a single integrated suite or an integrated best-of-breed ecosystem under centralized IAM, and will both approaches be evaluated equally?	We are open to both types of solutions and will consider them equally, as long as they meet the requirements stated in the RFI.
3	Should solutions be deployable on AWS, Azure, or both, and are there preferred government cloud environments (AWS GovCloud, Azure Government) versus commercial regions?	The solutions should be able to deploy on-premise, in Azure Government, and in AWS GovCloud.
4	Should solutions be deployable on AWS, Azure, or both, and are there preferred government cloud environments (AWS GovCloud, Azure Government) versus commercial regions?	The solutions should be able to deploy on-premise, in Azure Government, and in AWS GovCloud.
5	Are there CJISD standard landing-zone requirements we must align to (network segmentation, shared services, centralized logging, approved images)?	Yes
6	Should we assume multiple enclaves/instances (Dev, Test, Prod, training), and do you require separate tenants for different programs?	Yes, multiple enclaves/instances (Dev, Test, Prod, training) should be assumed. Yes, we require separate tenants for different programs.
7	For the internet-disconnected, air-gapped, isolated on-prem requirement, what is the expected operating pattern (fully disconnected, periodic patch windows, controlled file transfer only)?	Fully disconnected with controlled file transfer only.
8	In connected environments, what outbound connectivity is permitted (package updates, container registries, identity services, time sync), and what must be fully internalized?	Outbound connectivity goes through inspection via web proxies. Our preference is to utilize internal enterprise registries and updates. Time Sync and Identity services are considered internal services.
9	“No need to install anything,” does this apply to all users including admins, or are admin-only tools (CLI, agents, runners) acceptable within controlled admin workstations?	There are no controlled admin workstations. All users are unprivileged general users of their workstations. CI/CD runners and agents are on servers, which are acceptable for installation. Git clients and CI/CD runners are the exception to this.
10	For ~5,000 users, what should vendors assume for peak concurrent users, ticket volume, repo scale, CI job throughput, and reporting workload?	Peak concurrent users are approximately 2,000-3,000. Ticket volume is approximately 15,000-20,000 created and worked per month. Repository scale is about 1,000 repositories hosted. CI job throughput is around 1,000 iterations per day. Reporting workload is typically performed on a weekly basis with some ad hoc reports generated as needed.
11	What are the required availability targets and DR expectations, including RTO/RPO and allowable maintenance windows?	That is out of scope for the RFI, but RTO/RPO will need to be included as part of the proposal in an RFP/Q.
12	Can CJISD share the current tool categories being consolidated (vendor names not required) and the top pain points driving replacement?	At this time, we cannot share the current tool categories and top pain points driving the replacement.
13	Beyond “NIST-compliant,” should responses map to a specific baseline (e.g., NIST 800-53 Rev 5, CJIS Security Policy, FBI overlays), and at what depth?	NIST 800-53 Rev 5 and responses for the RFI do not need to go into depth in these responses
14	Is CJISD expecting vendor support for CJISD-sponsored ATO (including inheritance) or will CJISD handle ATO internally?	CJIS will primarily handle the ATO internally, although the vendor may be asked to provide artifacts or assistance in some areas.

15	If components are not FedRAMP authorized, is CJISD still open to them when deployed and controlled in CJISD-owned cloud, or is FedRAMP a hard gate?	CJISD is open to solutions deployed and controlled in CJISD-owned cloud environments. FedRAMP is only required when not deployed in a CJIS-owned cloud.
16	What data types will the platform handle (CJI, PII, sensitive internal), and are there explicit handling restrictions for tickets, code, docs, and logs?	The data types will primarily be system issues, although some may include CJI, PII, and/or sensitive internal information when describing the system issue. This solution is not considered a system of record for any CJI, PII, and/or sensitive internal data. There are cases where certain user privileges/roles require access to specific types of items such as tickets, code, documentation, and logs.
17	Are there requirements for encryption at rest (FIPS-validated modules, customer-managed keys, HSM-backed keys), and must CJISD control keys via CJISD-managed KMS/HSM?	Yes
18	Are there mandated TLS versions/ciphers, CJIS PKI requirements, mutual TLS expectations, and restrictions on certificate authorities?	Yes
19	What are CJISD expectations for vulnerability scanning (SAST, DAST, SCA, container scanning), patch SLAs, and evidence reporting?	Implementation will be scanned for vulnerabilities.
20	Does CJISD require SBOM (SPDX/CycloneDX), signed artifacts, build provenance/attestation, and a defined software supply chain process?	While not required, it would greatly enhance trust in the product.
21	What must be logged (auth events, admin actions, repo changes, workflow changes, data exports), and what fields are mandatory for investigations?	Everything in the product should be logged. Mandatory Fields need to be compliant with OMB M-21-31
22	What are retention requirements, immutability expectations (WORM), and export requirements to CJISD SIEM platforms?	Yes, we follow OMB M-21-31.
23	Do you require anomalous access alerting, enhanced monitoring for privileged actions, and break-glass workflows?	Yes
24	Are there CJISD zero-trust requirements to incorporate (device posture, conditional access), and what systems provide those signals?	Currently, the FBI relies on ENTRA ID for authentication and authorization purposes, depending on the system. Zero trust should be maintained within the boundaries of the system after initial authentication and authorization.
25	Should vendors assume CJISD-managed pen testing only, or are vendors expected to provide periodic independent testing results?	CJIS handles validation of the security posture, including penetration testing, which is outside the scope of this RFI.
26	Are DLP controls required for downloads/exports, copy/paste controls, and attachment handling, especially for browser-based access?	While not specifically called out in the RFI, DLP is not required but can enhance the offering.
27	What is the authoritative identity source (AD, Entra ID, both), and is federation required to CJISD enterprise identity services?	Both and Yes
28	Do you require support for both SAML and OIDC, and are there constraints on token lifetimes, refresh flows, and session management?	We do not require both SAML and OIDC. Yes, there are constraints on token lifetimes, refresh flows, and session management.
29	What MFA factors are approved (PIV/CAC, FIDO2, TOTP), and are any factors explicitly prohibited?	Currently, the FBI relies on ENTRA ID for authentication and authorization purposes, depending on the system. MFA should be provided by ENTRA ID and accepted by the solution.
30	What attribute sources should ABAC use (directory attributes, HR, project membership), and does CJISD have a standard attribute schema?	ABAC should use directory attributes. The CJISD standard attribute schema is group memberships.
31	Is automated provisioning required (SCIM, LDAP sync), and should the solution support joiner/mover/leaver workflows?	Yes, automated provisioning is a requirement. A workflow that performs cleanup would add confidence in the product/offering.
32	Are there requirements for PAM-style controls (separate admin identities, just-in-time access, step-up MFA, privileged session logging)?	Yes
33	Will external partners require access, and if so, what is the preferred model (B2B federation, guest accounts, time-bound access, separate tenant)?	No they will not require access
34	Does CJISD have standardized roles aligned to SAFe and ITSM, or should vendors propose a role-permission model?	Please see Number 2, Bullet E in the RFI Requirements.
35	Of the listed integrations (ticketing, git, CI/CD, wiki, email/comms, CRM, private AI/LLM), which are must-have for initial award versus later phases?	We are only collecting market capabilities at this time.
36	Are “out-of-the-box integrations” strictly configuration-only, or is low-code automation (rules/scripting) acceptable?	Low-code automation is acceptable within the solution. All code created for CJISD should be delivered as part of the solution to CJISD.
37	Do you require REST APIs, webhooks/events, and are there constraints on gateways, rate limits, and authentication mechanisms?	Integration via RESTful APIs or other automation mechanisms would provide confidence in the product and should include constraints and limiting mechanisms.
38	Should centralized IAM govern all integrated tools via a single IdP, or are tool-local identities acceptable if synchronized?	All identities should be synced from a single IdP. A local user repository is acceptable if synchronized from the central IdP. There is no syncing from the local user repository to the central IdP.
39	Do you require standardized export/import formats for analytics and migration (CSV/JSON/Parquet), and do you require bulk export tooling?	While there is no standardization requirement, non-proprietary export methods are beneficial.
40	Which SIEM platforms are in scope (e.g., Splunk, Sentinel), and what log formats and transport are required?	SIEM platforms are not in scope for this RFI; however, we adhere to OMB M-21-31.
41	If a service desk is included, does CJISD require integration to existing change management, CMDB, or asset systems?	The service desk, which is included in the RFI scope, needs to be integrated with change management and asset systems.
42	Are there constraints on outbound email, SMTP relays, and collaboration notifications due to network security policies?	Network permissions will need to be configurable to CJIS SMTP relays and servers.
43	Are branch protections, mandatory code reviews, signed commits, and artifact attestation required, and what are the minimums?	While not specifically called out in the RFI, the ability to enforce branch protections, reviews, and other validation techniques enhances the offering.
44	For CI/CD, do you expect self-hosted runners in each enclave, and should runners be ephemeral/autoscaling or static/controlled?	There is no reasonable limitation on the methods for implementing CI/CD
45	In air-gapped deployments, should we assume internal mirrors for packages/containers, and what patch cadence is approved?	Yes, assume that internal mirrors will be available for packages and containers in air-gapped deployments. The approved patch cadence is weekly.
46	Do you require integrated artifact/package management (container registry, Maven/NPM/PyPI mirrors), and what retention/signing rules apply?	There are no mandated requirements for software deployment methods, artifact/package management, or retention/signing rules. Any approach is acceptable as long as it meets our security requirements.
47	Are there requirements for separation of duties and pipeline gating (manual approvals, role separation for build vs deploy)?	Yes, there are requirements for separation of duties. Pipeline gating, including manual approvals and role separation between build and deploy functions, is not required but would significantly enhance confidence in the product offering.
48	Are there constraints or preferences for secrets management (cloud-native secrets, external vault), rotation policies, and auditability?	Although not required, we prefer cloud-native secrets management; however, there are no requirements from security. Rotation policies and auditability should follow standard security practices.
49	Should the platform support IaC workflows (Terraform, ARM/Bicep, CloudFormation), and are there preferred standards?	Yes, the platform should support IaC workflows including Terraform, ARM/Bicep, CloudFormation, and similar tools. CJISD currently uses Terraform and/or CloudFormation, though there is no mandated preference.
50	Which SAFe configuration should be assumed (Essential/Large Solution/Portfolio), and is PI Planning a day-one requirement?	CJIS currently operates at the Large Portfolio level; however, the offering should allow flexibility to change in the future. The solution should support PI planning upon go-live.
51	Are hierarchy item types standardized (story/feature/epic/portfolio epic), or do you expect vendors to propose a structure and governance?	While we currently have a standardized hierarchy of items, we welcome improved methods of operating.
52	Is WSJF required, and are there standard inputs/definitions for cost of delay and job size?	WSJF is heavily used by some systems here but not all systems utilize it. We follow the SAFe definition where WSJF = Cost of Delay (sum of business value, time criticality, and risk reduction/opportunity enablement) divided by Job Size (duration/effort), though specific rating scales and applications may vary by team and context.
53	Which metrics matter most (flow time, predictability, velocity, WIP), and are there mandated reporting formats?	As mentioned in the RFI, we need to have a way to provide metrics. Our users have different types of metrics that matter most. Although not required, a way to create custom metrics would enhance the product offering.
54	Is PowerBI integration expected as a native connector, direct query, or API-based export, and what refresh cadence is required?	We have no preference on the type of Power BI integration. The refresh cadence should be at least daily.
55	Do you require demand intake, capacity planning, and portfolio approvals inside the suite, or can those remain external?	Yes, we do require demand intake, capacity planning, and portfolio approvals.
56	For phone/email/portal intake, do you require telephony integration, call recordings, voicemail-to-ticket, and structured email parsing?	It is not a requirement, but an integrated service that allows phone and email ticket submissions would enhance the product offering.
57	For phone/email/portal intake, do you require telephony integration, call recordings, voicemail-to-ticket, and structured email parsing?	It is not a requirement, but an integrated service that allows phone and email ticket submissions would enhance the product offering.
58	How many helpdesks/queues are expected, and do they require separate SLAs, catalogs, reporting, and permissions?	We expect at least 100-200 helpdesks/queues. Each helpdesk/queue requires separate SLAs, catalogs, reporting, and permissions.
59	Are SLA tiers standardized (P1/P2/P3), and do you require automated escalation rules and compliance dashboards?	SLA tiers are not standardized at CJISD. However, the solution must support automated escalation rules and compliance dashboards, as some teams require these capabilities.
60	Is the scope incident/request only, or do you require problem/change/knowledge/CMDB/service catalog day one?	We require several ticket types that follow Agile SAFe practices on day one.
61	Is CJISD expecting a full CMDB/endpoint inventory, or identity-linked asset views only (given the Active Directory integration reference)?	CJISD needs asset and endpoint inventories, some of which may be imported from a system such as Active Directory.
62	Are CSAT surveys, post-incident reviews, and quality scoring required, and do you have standard measures?	Not a requirement, but we are open to CSAT surveys, post-incident reviews, and quality scoring.
63	Do you require templates, approval workflows, versioning, and content lifecycle rules for knowledge and runbooks?	Yes, the solution should include templates, approval workflows, versioning, and content lifecycle rules for knowledge and runbooks. This is something systems currently utilize and value in their processes.
64	What are expectations for enterprise search across tickets, repos, docs, and wikis, including access-trimmed results?	The product is expected to return search results across all data holdings. How this is accomplished is part of the product architecture.
65	Are there retention or records management requirements for documentation and collaboration artifacts?	The system needs to allow for records retention and the ability to forward to official FBI records management systems. There are only practical limitations on the methods allowed.
66	Are there limits or special handling rules for large artifacts (logs, binaries, images) attached to tickets and documentation?	Not a requirement, but the ability needs to exist in the product.
67	What are the top intended AI use cases (knowledge search, ticket summarization, workflow automation, code assist), and what is out of scope?	We are open to exploring AI use cases as they have not been specifically defined at this time. Vendors may propose relevant AI capabilities. However, all AI solutions must be private and secure; non-private AI uses are strictly out of scope.
68	Are there restrictions on prompt logging, model training, retention of prompts/outputs, and use of sensitive content in AI features?	This depends on the product being proposed and how it integrates with the AI solution suggested/provided.
69	Should vendors assume CJISD-provided private LLM hosting, vendor-provided model stack deployed in CJISD cloud, or both?	Vendors should not make assumptions but should remain open to cloud service offerings.
70	Are there required guardrails (policy enforcement, redaction, role-based access, output filtering) and auditing for AI-generated outputs?	This depends on the product being proposed and how it integrates with the AI solution suggested/provided.
71	Should responses include a full migration plan (repos, tickets, docs, identities), or is CJISD only collecting market capabilities at this stage?	We are only collecting market capabilities at this time.
72	Do you expect phased rollout by program/team, big-bang cutover, or hybrid coexistence with legacy tools during transition?	That is out of scope for the RFI, but product offerings will need to include this as part of their proposal in an RFP/Q.
73	Are there constraints on importing historical data (tickets/comments/attachments), and what minimum history must be retained?	There are no specific constraints on importing historical data. We are open to importing uncompleted work, documentation, and code repositories to a new solution.
74	Do you require role-based training (end users, agents, admins, leadership), train-the-trainer, and do you expect on-site training options?	We are only collecting market capabilities at this time.
75	Are there required training deliverables (job aids, videos, quick references), and must they be hosted inside CJISD platforms?	We are only collecting market capabilities at this time.
76	Do you require a CJISD self-sufficiency plan for admin operations, including SOPs and operational runbooks?	That is out of scope for the RFI, but product offerings will need to include this as part of their proposal in an RFP/Q.
77	What support hours and escalation model are expected (24x7 for P1, business hours for normal), and are there incident response integration requirements?	That is out of scope for the RFI, but product offerings will need to include this as part of their proposal in an RFP/Q.
78	Can the governement provide a current list of tools being utilzed to support the current environments? Are there any tools from the list the FBI intends to keep?	We are only collecting market capabilities at this time and not able to provide this information.
79	What is the government’s primary objective for this acquisition (enterprise tool consolidation, operational modernization, or improved program execution governance)?

•	Consolidation → Jira
•	Modernization / compliance → ServiceNow or Microsoft
•	Program execution rigor → Rally / Digital.ai	Our goal from the RFI is to collect market capabilitie in the content collaboration and work tracking space.
	80	Does the acquisition strategy prioritize consolidation into a single enterprise platform or integration of specialized tools within an ecosystem architecture?

•	Single platform → Jira or ServiceNow
•	Ecosystem acceptable → Rally / Digital.ai / Planview	We are open to both types of solutions and will consider them equally, as long as they meet the requirements stated in the RFI.
	81	Must the platform support fully air-gapped deployment, or is FedRAMP government cloud sufficient?

•	True air-gap → Jira DC / Azure DevOps
•	GovCloud acceptable → ServiceNow stronger	CJISD is open to solutions deployed and controlled in CJISD-owned cloud environments. FedRAMP is only required when not deployed in a CJIS-owned cloud.
	82	What level of Zero Trust or NIST security maturity must the platform directly support?

•	High compliance weighting → ServiceNow / Microsoft
•	Moderate enterprise posture → Jira	NIST 800-53 Rev 5 and responses for the RFI do not need to go into depth in these responses. Currently, the FBI relies on ENTRA ID for authentication and authorization purposes, depending on the system. Zero trust should be maintained within the boundaries of the system after initial authentication and authorization.
	83	Must attribute-based access control be implemented natively in the platform, or can it be enforced through enterprise identity services?

•	Native ABAC → ServiceNow
•	External enforcement acceptable → Jira / Azure parity	ABAC should be natively supported in the solution.
	84	Which capability domains are mandatory versus desirable (Agile execution, DevOps integration, ITSM, portfolio governance, analytics, AI)?

•	Broad mandatory scope → Jira or ServiceNow
•	Narrow execution focus → Rally / Digital.ai	In the RFI, there is no requirement of capability domains being mandatory verus desirable. We are currently looking at market capabilities.
	85	Will delivery processes be standardized (enforced) across teams, or will teams retain significant autonomy in how they choose to execute?

•	Standardized execution → Rally / Digital.ai
•	Team autonomy → Jira	There is no requirement mentioned in the RFI, but having the option to standardize and/or allow automony could enhance the products offering.
	86	How strictly must the solution adhere to SAFe constructs and terminology?

•	Strict SAFe → Rally / Digital.ai
•	Structural equivalence acceptable → Jira	There is no requirement mentioned in the RFI about how strict the solution needs to adhere to SAFe constructs, but we currently follow Agile SAFe and the solution should be able to support this. This is mentioned in #2 under contemplated requirement in the RFI.
	87	What development ecosystems, repositories, and CI/CD platforms must the solution integrate with?

•	Microsoft-centric environment → Azure DevOps
•	Heterogeneous tooling landscape → Jira	Industry Standard ecosystems, repositories, CI/CD Platforms such as Azure DevOps and Gitlab.
	88	What existing platforms and historical data sets must be integrated or migrated to ensure operational continuity?

•	Heavy Atlassian footprint → Jira
•	Microsoft footprint → Azure DevOps
•	Portfolio tooling legacy → Planview	There are no specific constraints on importing historical data from any specific software. We are open to importing uncompleted work, documentation, and code repositories to a new solution.
	89	What risks or pain points with existing tooling most strongly motivated this RFI?

•	Tool sprawl → Jira
•	Governance / audit friction → ServiceNow
•	PI execution coordination pain → Rally / Digital.ai
•	Developer productivity pain → Azure DevOps	We are only collecting market capabilities at this time to better understand the solutions industry has to offer.

File details come from the government source that posted it. Updated Mar 26, 2026.