RFI.docx

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION (RFI) TEMPLATE

REQUEST FOR INFORMATION (RFI) 15F067-27-PN-MEA09

INFB - Enterprise Data Management System November 19, 2026

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION (RFI) TEMPLATE

The Federal Bureau of Investigation (FBI) is conducting market research to identify potential sources and assess the availability of a commercial product or solution for the effort below. The Government seeks to determine whether a commercial product currently exists that satisfies the identified need.

The information contained herein only initiates communication with industry in order to assess market potential. No solicitation document exists currently. This Request for Information (RFI) does not constitute a Government obligation to procure these items or issue a solicitation. The Government does not have an obligation to pay for information responding to this RFI and will not accept any responses as offers.

PURPOSE AND STATEMENT OF OBJECTIVES

The FBI seeks industry input to better understand capabilities, technologies, and best practices for an enterprise data management system organized around eight functional layers (Ingestion, Storage, Metadata, Transformation, Feature Extraction, API, Application/Visualization, Infrastructure Management) with crosscutting capabilities for legal compliance, organizational consolidation, migration management, and performance measurement.

The contractor shall provide enterprise data management services supporting the FBI's investigative data lifecycle management requirements over a four-year performance period spanning fiscal years 2027 through 2031. Services shall support FBI Headquarters, all field offices, and all resident agencies across the continental United States and U.S. territories. The contractor shall provide both on-site technical support at FBI facilities and remote development, engineering, and operational support as mission requirements dictate.

Overall Program Objectives

The contractor shall deliver an enterprise data management system that achieves the following overarching program objectives:

· Unified Data Access: Enable authorized personnel to access and query investigative data across all FBI systems regardless of data format, source, or collection authority through a single unified interface, eliminating manual workarounds and reducing investigative hours spent searching disconnected systems.

· Centralized Evidence Management: Provide centralized storage for evidentiary copies of all electronically acquired data with automated data lineage tracking from origin through all derivative transformations, enabling comprehensive lifecycle management and supporting legal compliance requirements for data retention and destruction.

· Scalable Architecture: Design and implement an architecture capable of ingesting, processing, storing, and serving data at volumes exceeding 1,500 TB/month collection rates, with horizontal scalability to accommodate exponential data growth over the next decade without performance degradation.

· Legal Authority Compliance: Implement automated access controls, minimization procedures, retention schedules, and audit capabilities that enforce requirements specific to each legal collection authority (Title III, FISA, NSL, Search Warrant, Grand Jury Subpoena, Administrative Subpoena) throughout the data lifecycle.

· AI/ML Foundation: Establish data architecture, metadata schemas, and feature extraction capabilities that enable deployment of super intelligence and machine learning models for accelerated threat identification, entity correlation, and investigative lead generation.

· Organizational Consolidation: Support consolidation of data management functions currently dispersed across four divisions, six sections, and twelve units into a unified Data Management Section with end-to-end accountability for ingestion, storage, transformation, metadata, APIs, applications, and infrastructure.

Technical Objectives

Overall Architecture Objectives The contractor shall design and implement a centralized data architecture that achieves the following technical objectives:

· Cross-Enclave Standardization and Portability:

· Usage of common metadata schema that supports new fields without requiring enclave-specific modifications

· Standardized ETL framework enabling new data ingestion processes to be developed once and deployed consistently across all enclaves

· Version-controlled codebase with enclave-agnostic configuration management, allowing code developed and tested in one enclave to be packaged and deployed to other enclaves with minimal adaptation

· Schema evolution strategy that maintains backward compatibility and provides clear migration structure across enclaves when metadata structures change

Ingestion Layer Objectives The contractor shall design and implement a centralized ingestion layer that achieves the following technical objectives:

· Support ingestion from diverse sources including but not limited databases, REST/SOAP APIs, file systems (local and networked), manual uploads, collection systems, and external data feeds from commercial providers and interagency partners.

· Process multiple data formats including but not limited to JSON, XML, CSV, Parquet, Avro, ZIP, TAR, GZIP, SQLite databases, Microsoft Office documents, PDF (including non-OCR), multimedia files, and proprietary mobile device extraction formats.

· Implement real-time streaming capabilities for time-sensitive data sources including commercial provider feeds and other government agency data streams using pub/sub and queue-based notification mechanisms (e.g., AWS SNS/SQS, GCP Cloud Pub/Sub).

· Provide batch processing capabilities for large dataset uploads including manually acquired data from case teams, with support for resumable uploads and parallelized processing of archive files containing thousands of individual items.

· Incorporate automated data validation including schema validation, data type checking, hash verification, and consistency checks when moving data between processing stages, with detailed error logging and automated retry mechanisms for transient failures.

· Implement legal validation and routing logic based on collection authority metadata, court-authorized rules, and business logic to ensure data is routed to appropriate storage zones with correct access controls and retention policies applied at ingestion.

· Achieve ingestion layer horizontal scalability to process concurrent ingestion requests from multiple sources without performance degradation, with auto-scaling based on queue depth and processing load.

· Provide user-facing dashboards displaying summary statistics of incoming data processed or queued for processing, including success/failure status, estimated processing completion times based on established Service Level Agreements (SLAs), and historical ingestion metrics.

· Normalize ingested data using FBI enterprise standards and apply standardized metadata tags to facilitate tracking and compliance in downstream systems, producing both evidentiary copies preserving original data in unaltered form and normalized working copies for analysis.

Storage Layer Objectives The contractor shall design and implement a centralized storage layer that achieves the following technical objectives:

· Implement separate storage solutions for raw evidentiary copies (preserving original data in unaltered form with cryptographic hash verification), working copies (transformed or processed versions used for analysis), and metadata (information about data sources, formats, timestamps, transformation histories, legal authority, etc.).

· Utilize scalable distributed storage solutions such as Hadoop Distributed File System (HDFS), Amazon S3, Google Cloud Storage, or Azure Blob Storage capable of storing petabyte-scale datasets with sub-second retrieval times for frequently accessed data and cost-optimized tiered storage for archival data.

· Enforce encryption for all data at rest using validated cryptographic modules (approved for use with national security data) and encryption in transit, with key management integrated with FBI enterprise key management infrastructure.

· Implement role-based access controls (RBAC) that restrict data access based on user roles, clearance levels, and legal authority under which data was collected, with integration to FBI enterprise identity and access management systems.

· Provide automated data lifecycle management implementing retention policies, archival to lower-cost storage tiers based on access patterns and age, and deletion based on legal authority-specific retention requirements, with detailed audit trails of all lifecycle actions.

· Develop robust backup and recovery strategy including geographically distributed replicas, point-in-time recovery capabilities, and tested disaster recovery procedures ensuring Recovery Time Objective (RTO) of less than 4 hours and Recovery Point Objective (RPO) of less than 1 hour for mission-critical data.

· Provide case manager dashboards displaying high-level summaries of all data associated with their cases, indicating which systems contain the data, storage locations, access logs, and corresponding purge dates based on legal authority requirements.

Metadata Layer Objectives The contractor shall design and implement a metadata management layer that achieves the following technical objectives:

· Define and implement standardized metadata schemas capturing essential information including but not limited to: Global Product ID (unique identifier for originating data), Product ID (unique identifier for each derivative), MD5/SHA256 hash values, upstream product relationships, product lineage (full chain of derivative products), case numbers and participants, data collector, collection authority, docket number, collection facility/selector, data provider and source, product type, workflow markings, minimization markings, timestamps (sent, intercepted, loaded), file metadata (extension, size), network metadata (source/destination IP), extracted selectors with data types, and dissemination/view flags.

· Implement automated data lineage tracking recording all transformations and movements of data from origin to current state, enabling identification of all downstream derivative products when purge requirements arise and supporting legal discovery and audit requirements.

· Provide entity management capabilities allowing association of multiple selectors (phone numbers, email addresses, IP addresses, physical addresses, usernames) to custom entity labels, enabling tracking of subjects and associates across different identifiers and data sources.

· Develop search and discovery tools enabling keyword searches, faceted navigation, filters based on metadata attributes (date ranges, collection authority, case number, data type, etc.), and Boolean query construction for complex searches across the metadata catalog.

· Ensure metadata interoperability with Intelligence Community (IC) data standards and ISO metadata standards, facilitating data exchange and integration with interagency partners and supporting future system integrations.

· Implement version control for metadata tracking changes over time and maintaining history of updates, with audit trails showing who modified metadata, when modifications occurred, and what changed.

Transformation Layer Objectives The contractor shall design and implement a data transformation layer that achieves the following technical objectives:

· Provide automated data cleaning and preprocessing including handling missing values, removing duplicates, correcting encoding errors, and standardizing data representations to ensure consistency across the enterprise.

· Support format conversion between different data representations (JSON to CSV, XML to Parquet, proprietary formats to open standards) to meet requirements of various downstream applications and analytical tools.

· Implement aggregation and summarization functions including time zone conversions to UTC, calculation of statistical measures (totals, averages, distributions), and generation of summary records for high-volume data sources.

· Develop data enrichment capabilities integrating additional context from external sources or internal databases where legally permissible, such as geolocation data from IP addresses, carrier information from phone numbers, or known entity associations from investigative databases.

· Build scalable Extract, Transform, Load (ETL) processes automating extraction from source systems, transformation into FBI enterprise standard formats, and loading into target storage solutions, with monitoring, alerting, and auto-recovery capabilities.

· Provide interfaces for custom transformations by FBI technical personnel using scripting languages (Python, R, Scala) or graphical workflow builders to accommodate case-specific analytical requirements without requiring contractor engineering support for routine transformations. Output of custom transformations should be retained in the system and maintain appropriate data lineage tracking.

· Ensure all transformation processes maintain data lineage metadata linking transformed products to their source data and recording transformation logic applied, supporting audit requirements and enabling reproduction of analytical results.

· Provide a virtual environment for ad-hoc data management including viewing, enrichment, and ETL pipeline creation/deployment. The environment should enable output data to be pushed back into the enterprise storage layer while preserving the necessary metadata of input data and ETL code used to generate the output data.

Feature Extraction Layer Objectives The contractor shall design and implement a feature extraction layer that achieves the following technical objectives:

· Implement automated extraction of key identifiers including phone numbers (all format variations), email addresses, IP addresses (IPv4 and IPv6), physical addresses, Social Security Numbers, credit card numbers, URLs, usernames, and other relevant selectors from structured and unstructured data sources.

· Perform Optical Character Recognition (OCR) on image files and non-searchable PDFs to extract text content, making previously unsearchable documents discoverable through text-based queries.

· Generate vector embeddings for textual content using state-of-the-art natural language processing models, enabling semantic similarity searches, topic clustering, and machine learning model training for investigative applications.

· Perform audio transcription and speaker diarization (identifying and separating different speakers) for audio intercepts and multimedia files, with timestamped transcripts linked to original audio for verification.

· Extract image metadata (EXIF data including geolocation, camera model, timestamps) and generate image tags using computer vision models identifying objects, scenes, text within images, and faces (where legally authorized).

· Apply dimensionality reduction techniques (Principal Component Analysis, t-SNE, UMAP) to high-dimensional feature sets while preserving essential information, enabling visualization and analysis of complex datasets.

· Provide feature engineering tools enabling creation of composite features from existing data through mathematical transformations, aggregations, and domain specific calculations relevant to investigative analysis.

· Integrate feature extraction outputs with enterprise AI/ML applications including AJAE (Artificial Intelligence Powered Joint Analysis Environment), ensuring seamless data flows and standardized feature formats for model training and inference.

· Store extracted features in dedicated feature stores optimized for low-latency retrieval by machine learning models and analytical applications, with versioning to track feature extraction methodology changes over time.

API Layer Objectives The contractor shall design and implement an API layer that achieves the following technical objectives:

· Develop RESTful APIs supporting standard HTTP methods (GET, POST, PUT, DELETE, PATCH) for Create, Read, Update, Delete (CRUD) operations on datasets, metadata, and system configuration, with JSON request/response formats and comprehensive error handling.

· Implement robust authentication using OAuth2 or similar industry-standard protocols and authorization using role-based access control (RBAC) integrated with FBI enterprise identity management, with token-based session management and automatic token refresh.

· Enforce rate limiting to prevent abuse and ensure fair usage across different users and applications, with tiered rate limits based on user roles and application priority, and graceful degradation under high load conditions.

· Provide comprehensive API documentation including endpoint descriptions, request/response schemas with examples, authentication methods, error codes with resolution guidance, usage examples in multiple programming languages (Python, Java, JavaScript), and interactive API explorers (Swagger/OpenAPI).

· Implement API versioning strategy (URL-based or header-based) managing changes and updates without disrupting existing integrations, with deprecation notices and migration guides for version transitions.

· Support JDBC (Java Database Connectivity) and ODBC (Open Database Connectivity) interfaces for direct database connections by authorized administrators and system-to-system integrations, enabling integration with business intelligence tools and analytical platforms.

· Implement API analytics and monitoring tracking usage patterns, performance metrics (response times, error rates), and security events (authentication failures, suspicious access patterns), with dashboards for API administrators.

· Provide WebSocket or Server-Sent Events (SSE) endpoints for real-time data streaming to client applications requiring live updates of ingestion status, search results, or system alerts.

Application/Visualization Layer Objectives The contractor shall design and implement application and visualization capabilities that achieve the following technical objectives:

· Enable rapid deployment of ad-hoc and cross-enclave applications leveraging centralized metadata and standardized data schemas, allowing FBI developers to build mission-specific tools without re-implementing ingestion, transformation, or storage logic.

· Integrate with business intelligence tools used by the FBI, such as Microsoft Power BI, for advanced reporting and visualization capabilities, with pre-built connectors and data source configurations.

· Integrate with FBI enterprise AI tools, providing seamless data flows and consistent user experiences across analytical platforms.

· Allow reingestion of metadata from legal compliance tools in upstream applications including application of minimization markings, workflow markings, and dissemination caveats based on collection authority metadata, with query logging for audit requirements and writeback capabilities updating metadata when analysts mark products or change workflow status.

· Provide interfaces for users to create custom parsing and visualizations using scripting languages (Python, R) or drag-and-drop graphical interfaces for non-technical users.

· Provide search interfaces implementing automatic format normalization for identifiers (phone numbers, IP addresses) ensuring searches in any format return complete results regardless of how data was originally stored, while also supporting quoted literal searches when exact format matching is required.

· Provide a basic viewing interface that allows raw/transformed data to be reviewed and allows users to apply tags and compliance markings as necessary. This includes the addition of minimization markings, workflow markings, and dissemination caveats based on collection authority metadata, with query logging for audit requirements and writeback capabilities updating metadata when analysts mark products or change workflow status.

Infrastructure Management Layer Objectives The contractor shall provide infrastructure management services that achieve the following technical objectives:

· Provision and orchestrate compute resources (virtual machines, containers, serverless functions), storage volumes (block, object, file), and networking components (VPCs, subnets, security groups, load balancers) as needed for data ingestion, transformation, storage, and application workloads, with infrastructure-as-code implementations enabling repeatable deployments.

· Configure and maintain role-based access controls (RBAC) for infrastructure resources, network segmentation isolating data classified at different levels or collected under different authorities, and security group rules enforcing least privilege access principles.

· Deploy centralized logging aggregating logs from all system components (ingestion, transformation, storage, APIs, applications) and metrics collection monitoring ingestion throughput, error rates, storage utilization, API response times, and resource utilization, with alerting on anomalies and threshold violations.

· Implement redundancy strategies including multi-region replication for critical data, automated failover for compute resources, and load balancing across multiple availability zones, ensuring high availability and disaster recovery capabilities.

· Conduct end-to-end testing of data transfer workflows from field offices through upgraded network infrastructure to centralized ingestion systems, validating throughput meets requirements and identifying any remaining bottlenecks in the data path.

· Develop and enforce configuration standards for ingestion nodes, transformation clusters, and application servers, with automated compliance scanning detecting configuration drift and automated remediation returning systems to compliant state.

· Manage high-throughput data transfers using optimized protocols (IBM Aspera, QUIC, UDP/SRT, Signiant) significantly outperforming traditional TCP-based transfers for large file movement across wide area networks.

· Schedule and execute patching and software updates for operating systems, middleware, databases, and application dependencies, with testing in nonproduction environments before production deployment and rollback procedures for failed updates.

· Perform capacity planning monitoring growth trends in data volume, user counts, and query loads, projecting future resource requirements and proactively scaling infrastructure before performance degradation occurs.

· Manage hardware and software lifecycle including tracking end-of-life dates for components, planning migrations to current versions, and decommissioning deprecated systems with appropriate data archival and disposal procedures.

Service Level Agreement (SLA) Objectives

The contractor shall establish and maintain Service Level Agreements for data ingestion and transformation based on priority and complexity tiers:

Priority Tiers

· Priority 1 (Critical): Data directly blocking analysis for exigent investigative requests, critical agency operational needs, or mandated regulatory compliance requirements.

· Priority 2 (High): Data significantly impacting active case productivity, downstream machine learning model performance, or cross-office analytical requirements.

· Priority 3 (Standard): Data supporting exploratory analysis, operational dashboards, or low-urgency internal tooling. Priority 3 requests may be addressed by either enterprise data management teams or field office technical personnel with appropriate training.

Complexity Tiers

· Tier 1 (Standard Sources): Data from previously encountered providers in known formats requiring only configuration changes to existing ingestion pipelines.

· Tier 2 (Semi-Custom Sources): Data from new providers or in variant formats requiring custom feature extraction logic but using established transformation patterns.

· Tier 3 (Complex/Novel Sources): Data from entirely new sources requiring deep research and development (R&D) for schema discovery, reverse engineering of proprietary formats, or development of new transformation algorithms.

SLA Response Timeframes The contractor shall develop a framework and implement a system for adhering to the following response timeframes measured from request validation to production deployment:

The contractor shall implement intake and automated triage processes for validating requests and performing compliance checks, conduct exploratory R&D profiling data structures and designing transformation logic, build scalable ETL pipelines and extract baseline features, and perform quality assurance testing and validation before production deployment.

Legal Compliance and Governance Objectives

The contractor shall implement governance and compliance capabilities achieving the following objectives:

· Authority-Specific Controls: Implement automated enforcement of retention periods, access controls, minimization procedures, dissemination restrictions, and notification requirements specific to each legal collection authority including, but not limited to, Title III wiretaps, pen registers, National Security Letters, FISA orders, FISA Section 702, criminal search warrants, grand jury subpoenas, and administrative subpoenas. This should include flexibility for modification of these rules as regulatory and policy requirements change.

· Data Segregation: Architect storage and access control mechanisms ensuring data collected under different authorities remains logically or physically segregated as required by legal authority, preventing inadvertent commingling that could violate dissemination restrictions or minimization procedures. This should include flexibility for modification of these rules as regulatory and policy requirements change.

· Audit Trails: Maintain comprehensive audit logs recording all access to data (who accessed what data, when, from what system, what actions were performed), all modifications to data or metadata, all product lineage including downstream and upstream products, all disseminations outside the system, and all data lifecycle events (ingestion, transformation, archival, destruction).

· Automated Retention and Destruction: Implement automated retention schedules based on collection authority metadata and Court orders, with automated alerts when data approaches destruction deadlines, and automated destruction processes with verification and audit logging when retention periods expire. This should include flexibility for modification of these rules as regulatory and policy requirements change.

· Minimization Enforcement: For FISA-acquired data, implement automated minimization marking application based on user actions, enforce access restrictions based on minimization markings, and maintain audit trails of minimization decisions for FISC oversight requirements.

· Policy Compliance: Ensure system design and operations comply with applicable FBI policy directives and policy guides including but not limited to:

0615DPG (Health Care Fraud) 0752DPG (Legal Review of Intelligence Information Reports) 0775DPG (Counterterrorism) 0863PG (Confidential Human Source) 1015PG (Foreign Dissemination of Classified Information) 1113PG (Privacy) 1285PG (Storage, Handling, and Processing of Electronic Surveillance Evidence) 1388PG (Electronic Evidence) 1404PG (FISA and Standard Minimization Procedures) 1440PG (Digital Evidence) 1471PG (Field Evidence Management)

· Statutory Compliance: Ensure system design and operations comply with applicable federal statutes governing specific data types and legal authorities as specified in Appendix H of the Enterprise Data Ingest White Paper.

Migration and Parallel Operations Objectives

The contractor shall manage migration from current systems to enterprise architecture achieving the following objectives:

· Dual-Routing Implementation: Implement dual-routing of new data to both legacy applications and new enterprise storage beginning in FY2028, ensuring continuity of operations while new systems are validated and users are trained on new interfaces.

· Historical Data Migration: Migrate historical data from legacy systems to enterprise storage, preserving data integrity, metadata, and audit trails, with validation that migrated data is complete and accessible through new interfaces.

· Application Migration: Develop and deploy new applications utilizing enterprise APIs and data stores, with pilot deployments to test offices in FY2029 for validation before enterprise rollout, and phased enterprise deployment in FY2030.

· Legacy System Deprecation: Plan and execute deprecation of legacy storage and applications after validation that all required data has been migrated, all user communities have been transitioned to new applications, and no operational dependencies on legacy systems remain.

· Rollback Capabilities: Maintain rollback capabilities to legacy systems during parallel operations period in case critical issues are discovered with new systems, with clearly defined criteria and procedures for rollback decisions.

Performance Metrics and Reporting Objectives

The contractor shall establish performance measurement and reporting achieving the following objectives:

· Ingestion Metrics: Track and report data volume ingested (TB/month by source), ingestion success/failure rates, average processing time by data type and complexity tier, and SLA compliance rates by priority and complexity tier.

· Storage Metrics: Track and report total storage utilization by data type and legal authority, storage growth trends, backup success rates, and recovery time/point objectives validated through testing.

· Performance Metrics: Track and report query response times (percentiles: p50, p95, p99), API response times by endpoint, system availability (uptime percentage), and concurrent user capacity.

· User Adoption Metrics: Track and report number of active users by application, query volumes and search patterns, user-reported issues and resolution times, and user satisfaction scores from surveys.

· Compliance Metrics: Track and report retention policy adherence (percentage of data with automated destruction schedules), audit trail completeness, access control violations detected and remediated, and data lineage tracking coverage.

· Reporting Cadence: Provide weekly operational status reports during implementation phases, monthly performance reports including all metrics categories, quarterly executive summaries highlighting trends and issues requiring leadership attention, and ad-hoc reports as requested for specific investigations or compliance audits.

· Metrics Reporting: Create a metrics dashboard and automated reporting (at user specified intervals) for continued monitoring of trends at and beyond prototype creation.

Constraints and Assumptions Legal and Policy Constraints

· The contractor shall design all system components to accommodate storage and processing of data collected under multiple legal authorities with conflicting retention, access control, and notification requirements as specified in Section 2.5.

· The contractor shall coordinate with FBI Office of General Counsel (OGC) on technical design decisions impacting legal compliance, with designated OGC representatives addressing ingestion, storage, metadata, transformation, feature extraction, API, application, and infrastructure management layers.

· The contractor shall support FBI coordination for legal and ethics approvals of vector embedding and automated selector extraction applied to data.

· The contractor shall implement a flexible and modifiable rules engine that is editable by the FBI in the future as policies and laws change.

· The contractor shall comply with all applicable FBI policy directives and policy guides and federal statutes as specified in Section 2.5 and detailed in Appendix H of the Enterprise Data Ingest White Paper.

Technical Constraints

· The contractor shall design systems to operate within FBI enterprise network security architecture including network segmentation, firewall rules, VPN requirements, and encrypted communications (TLS 1.2 or higher for data in transit, FIPS 140-2 validated encryption for data at rest).

· The contractor shall integrate with FBI enterprise identity and access management systems for authentication and authorization, implementing single sign-on (SSO) where available and role-based access control (RBAC) aligned with FBI organizational structure.

· The contractor shall utilize FBI-approved cloud service providers and services, adhering to FBI cloud security requirements and data sovereignty constraints. Cloud storage, compute, and application requirements should be designed in such a way that they are vendor agnostic, giving the FBI the ability to migrate between cloud service providers or operate redundant cloud solutions across multiple cloud service providers as needed. This includes robust documentation of solutions.

· The contractor will create a system that is interoperable with existing FBI systems including Sentinel (case management and access controls), Guardian (lead management), Virtual Academy (training requirements), enterprise identity management, and others as identified during requirements refinement.

· The contractor shall design ingestion workflows accommodating current bandwidth limitations, adjusting timeline as necessary to align with finalized FBI network upgrade timelines.

Operational Constraints

· The contractor shall maintain continuity of operations throughout the implementation period, with no disruption to current investigative data access. Parallel operations of legacy and new systems will be required during transition period spanning FY2028 through FY2031.

· The contractor shall coordinate implementation activities with ongoing FBI operations, scheduling major changes (network equipment installation, application cutovers, data migrations) during approved maintenance windows to minimize operational impact.

· The contractor shall provide 24/7 support for production systems once operational, with tiered support structure providing immediate response for critical issues (system unavailability, data loss risks) and prioritized response for high and standard priority issues based on operational impact.

· The contractor shall support FBI personnel locations including on-site presence at FBI Headquarters and designated field offices as required for implementation activities, with remote support capabilities for distributed operations and maintenance activities.

· Once operational, the contractor will provide certain approved FBI personnel with the ability to add ad hoc parsing requirements as part of the data ingest pipeline.

Programmatic Assumptions

· FBI Director-level support and organizational commitment to enterprise data management modernization will be maintained throughout the four-year implementation period.

· Funding will be available over four years as detailed in Appendix I of the Enterprise Data Ingest White Paper, with initial FY2027 funding supporting planning activities and RFP processes, FY2028-FY2029 funding supporting development and piloting, and FY2030 funding supporting enterprise rollout.

· Plan for volume estimates of 1,500 TB/month ingestion and an estimated 50 PB total storage. Actual requirements may be higher as comprehensive metrics are gathered during planning phase, and contractor shall design for scalability accommodating volume growth.

DELIVERABLE

The contractor shall deliver a capabilities paper to include a cover letter and technical approach as shown below.

A. Cover Letter The cover letter shall include the following information:

Part I:

· Company name

· Company address

· Company phone number

· Company email address

· Company business size

· Company POC for technical questions

· Company POC for contractual questions

· Confirmation company is active in SAM

· Company UEID

· Company NAICS Codes

· Does the company have a facility clearance and what is the company’s clearance level

· All contractor personnel requiring access to FBI facilities or data shall possess appropriate security clearances (Secret or Top Secret as required by specific data and system access) and shall comply with FBI personnel security requirements.

· The contractor shall comply with all applicable FBI information security requirements including FBI IT Security Policy, National Institute of Standards and Technology (NIST) Special Publications (particularly NIST SP 800-53 security controls), Intelligence Community Directives (ICDs) applicable to handling intelligence information, and Federal Information Security Management Act (FISMA) requirements.

· The contractor shall implement security controls including encryption, access controls (multi-factor authentication, role-based access control integrated with FBI enterprise IAM), network security (segmentation, firewalls, intrusion detection/prevention), logging and monitoring (centralized logging, security information and event management), vulnerability management (regular scanning, patching, penetration testing), and any other data security standards required by law/policy.

· The contractor shall participate in FBI security authorization processes including development of System Security Plans, Privacy Impact Assessments, and supporting documentation for Authority to Operate (ATO) decisions.

· The contractor shall report security incidents to FBI security personnel immediately upon discovery, cooperate with FBI incident response activities, and implement remediation as directed.

· Does the company have a GSA Federal Supply Schedule (FSS)? If so, provide the number

· Is the company on a Best-in Class (BIC) for a similar effort? If so, provide the contract vehicle information

· Is the company currently on another Government agency contract (DOJ, DOW, NASA) for a similar effort? If so, provide the agency and contractual POC.

· Identification of whether subcontracting would be required; if so, specify the estimated percentage

· Disclosure of any anticipated conflicts of interest if awarded this effort

· Estimated period of performance to complete this effort

· Estimated cost to complete this effort

· Recommended contract type (FFP, T&M, LH, Cost plus) and why

· Recommended CLIN structure

· The Government is seeking unlimited rights of all intellectual property/data. Please state any concerns your company may have and why

B. Technical Approach The technical approach shall include the following information:

· Identify whether a commercial product currently exists that meets the Government’s needs. Provide product description, capabilities, alignment with the Government’s requirements, manufacturer or vendor information, and relevant product literature and performance data

· Proposed enterprise data management architecture addressing all eight layers (ingestion, storage, metadata, transformation, feature extraction, API, application, infrastructure management) with architecture diagrams, technology stack selections, and rationale for design decisions.

· Modular rules engine, modifiable by FBI, for legal compliance requirements including authority-specific access controls, retention management, audit capabilities, and data segregation strategies, with specific attention to FISA and Title III data handling requirements.

· Security architecture including encryption approaches (at rest and in transit), access control mechanisms, network segmentation strategy, and integration with FBI enterprise security infrastructure.

· Migration strategy addressing dual-routing implementation, historical data migration approach with data integrity validation, application migration and pilot deployment approach, and legacy system deprecation criteria and processes.

· AI/ML enablement approach including feature extraction methodologies, vector embedding generation, feature store design, and integration with FBI enterprise AI applications.

· Implementation timeline addressing FY2027 planning phase deliverables (organizational assessment, implementation roadmap, governance framework, budget analysis), FY2028 infrastructure buildout and dual-routing implementation, FY2029 historical data migration and pilot application deployment, and FY2030 enterprise rollout and legacy deprecation.

· Risk management approach identifying technical risks (performance, scalability, integration), programmatic risks (funding, approvals, organizational change), and operational risks (migration failures, user adoption), with mitigation strategies and contingency plans.

· Quality assurance approach including testing strategies (unit, integration, system, user acceptance), performance testing validating scalability claims, security testing, and compliance validation.

· Knowledge transfer and training plan addressing FBI technical personnel training on architecture and operational procedures, end-user training on new applications and workflows, and documentation deliverables (system documentation, operational runbooks, user guides).

· Provide any alternative approaches or solutions

The contractor shall provide the following:

· All labor necessary to achieve objectives, including, but not limited to: program management, architecture and engineering, software development, data engineering, security engineering, infrastructure engineering, testing and quality assurance, training development and delivery, and operational support.

· Cloud infrastructure including compute resources (virtual machines, containers, serverless functions), storage (object, block, file), networking (VPCs, load balancers, VPNs), and managed services (databases, message queues, analytics platforms) sized appropriately for FBI requirements.

· Software licenses for commercial off-the-shelf (COTS) products included in proposed solution, including operating systems, databases, middleware, development tools, monitoring and logging platforms, and end-user applications.

· Development and test environments separate from production, with capability to replicate production configurations for testing major changes before deployment.

· Tools and equipment necessary for development, testing, and operational support activities not furnished by the FBI.

· Documentation including system architecture documentation, detailed design documents, interface specifications, data schemas and metadata dictionaries, operational runbooks, disaster recovery procedures, security plans and configurations, user guides and training materials, and as-built documentation reflecting production configurations.

· Training delivery including development of training curriculum, instructor-led training sessions for technical personnel and end users, hands-on practice exercises, and train-the-trainer sessions enabling FBI personnel to conduct future training.

COMMUNICATION

The Contracting Officer (CO) shall be the only point of contact for official communications regarding this announcement.

CO: Marie Agrinzoni Email: Meagrinzoni@fbi.gov

RFI SUBMITTAL INSTRUCTIONS

All submissions shall be unclassified. Respondents are encouraged to provide concise, relevant information that directly addresses the objectives outlined in this RFI.

Questions Questions regarding this announcement shall be submitted by e-mail to the CO no later than 1:00 pm, CT, November 10, 2026.

Questions will be formatted with subject line identifying the RFI Title. Verbal questions will NOT be accepted. Questions will be answered by posting answers to the SAM.gov website by amendment to this RFI; accordingly, questions shall NOT contain proprietary or classified information. The Government does not guarantee that all questions will be answered.

Capabilities Paper Capabilities paper must be received by the CO prior to 1:00 pm, CT, November 19, 2026.

Request for Information (RFI) image1.jpg image2.jpg image3.png