1. Statement of Need (Open-Source Support Requirement)_draft.pdf

STATEMENT OF NEED

Office of Intelligence and National Security

Statement of Need

For

Protective Intelligence

Monitoring Platform

Software

1. Introduction/Background

The Office of Intelligence and National Security (OINS) has identified an urgent requirement for a comprehensive open-source intelligence (OSINT) platform to enhance its ability to detect, assess, and respond to emerging threats before they escalate. As threat actors increasingly leverage a wide range of digital environments, including mainstream social media platforms, blogs, online forums, alternative networks, and concealed spaces such as deep and dark web communities, the need for continuous and proactive monitoring has become critical.

Currently, the Protective Intelligence team has limited visibility into many of these online environments where early threat indicators frequently surface. This gap in monitoring capabilities heightens the risk of delayed threat detection and reduces the time available to implement appropriate protective measures. Additionally, the Department’s Executive Protection

Unit does not have access to a centralized OSINT platform capable of aggregating, correlating, and analyzing publicly available information relevant to protective intelligence operations.

As adversaries increasingly exploit non-traditional platforms and anonymized digital spaces to communicate, organize, and signal intent, reliance solely on internal monitoring mechanisms is no longer sufficient. To effectively support proactive risk mitigation and safeguard personnel and operations, the Department requires a modern, scalable OSINT solution that provides continuous, comprehensive situational awareness across the evolving digital threat landscape.

2. Scope of Work

The Department’s Executive Protection Unit requires access to a cloud-based, externally hosted

Open-Source Intelligence (OSINT) and digital threat monitoring platform capable of aggregating, correlating, and analyzing publicly available information to provide continuous, real-time threat identification and alerting in support of protective intelligence and executive protection operations. The platform shall enable continuous monitoring of potential threats to one (1) protected subject and include an assessment of the subject’s publicly exposed digital footprint, associated assets, and upcoming travel, with scalable options to incorporate additional protected subjects as operational requirements evolve. The solution must provide the Protective

Intelligence team with the capability to proactively identify, assess, and monitor potential threats across social media platforms, digital and traditional media sources, surface web content, deep web forums, and dark web environments that may impact the protected subject across multiple areas of responsibility.

To meet operational needs, the platform must support threat identification and identity-resolution research, including the ability to identify multiple online accounts posting threatening language and correlate publicly available indicators to assess whether such accounts are likely operated by the same individual. The system must provide geospatial awareness capabilities that visualize clusters, patterns, and changes over time in online activity and allow for multiple authorized end users to analyze geographic references and receive automated alerts when public posts referencing a protected facility appear within at least ten (10) defined geographic areas worldwide. The solution must also provide real-time monitoring and alerting through both desktop and mobile applications to ensure operational continuity when personnel are traveling with the protected subject. Additionally, the platform shall support intelligence dissemination through customizable live monitoring dashboards and subject-based queries, as well as integrated case-management functionality to capture and archive posts, screenshots, and source links; create and share user notes; track potential threat indicators; maintain a running history of findings; and generate exportable reports. Implementation of this capability will transition the Protective

Intelligence team from a reactive posture to a proactive threat identification model, enabling informed decision-making and enhanced risk mitigation in support of executive protection operations.

Major Deliverables

• Cloud-Based SaaS Platform: Provide a vendor-hosted Software-as-a-Service (SaaS) solution requiring no on-premises infrastructure. The platform must be accessible via standard web browsers, compatible with restricted government network environments, and include customizable dashboards that allow a multiple authorized end users to visualize trends and maintain operational awareness.

• Scalable Subject Support and Subscription Model: Support monitoring for one (1) protected subject at initial implementation, with the ability to scale to multiple protected subjects as mission requirements evolve. Licensing shall be subscription-based and aligned with user access levels and data consumption requirements. All platform updates, maintenance, and system enhancements shall be included within the subscription cost.

• Automated Real-Time Alerting and Mobile Accessibility: Deliver automated, real-time alerts notifying executive protection personnel of emerging threat indicators, regardless of whether users are actively logged into the system. In addition to web-based desktop access, the platform should include a mobile application capable of receiving alert notifications and supporting limited response actions to maintain situational awareness during domestic and worldwide travel.

• Comprehensive Monitoring Coverage: Monitor publicly available information across the surface web, social media platforms (including alternative networks), digital and traditional media sources, deep web forums, and dark web environments. The platform shall support keyword-based monitoring, subject-based queries, and identity-resolution research using publicly available information.

• Geospatial Awareness: Provide global mapping and geospatial visualization capabilities supporting monitoring of at least ten (10) defined locations per protected subject, enabling location-based alerting and trend analysis.

• Impersonation and Exposure Detection: Automatically detect and flag impersonation, doxing, fraudulent social media accounts, exposed personal information, and location-based risks. Such incidents shall be surfaced in real time with geospatial or asset-level correlation to enable rapid assessment and mitigation by Protective Intelligence personnel.

• Investigative Reporting and Case Management: Provide investigative reporting tools and dissemination-ready reporting products to support assessment and documentation of identified threats. The platform shall include structured digital case file functionality allowing end users to organize, document, and share information related to specific subjects, incidents, or potential threats within the system.

• Security and Compliance Documentation: Provide documentation sufficient to support the Department’s IT security review process, including independent security certifications, compliance attestations, and penetration testing summaries.

3. Product Specifications

MFR Part Description Quantity

Cloud-based Open-Source

Intelligence (OSINT) and digital threat monitoring platform designed to support executive protection and proactive risk mitigation

Licensing shall be delivered as a cloud-hosted, subscription-based service that includes all software updates, system enhancements, routine maintenance, and vendor-provided training. The solution must provide scalable flexibility in user access levels and support expansion in the number of protected subjects as operational requirements evolve. Training shall include initial onboarding and ongoing instruction sufficient to ensure authorized personnel can effectively utilize all platform capabilities.

4. Period of Performance

12-month base period and four (4), 12-month option periods.

5. Point of Contacts (POCs) for this Action

TBD

6. Shipping Address

N/A