2026-10-19 RFI - CIC Software_as_Service Platform Services ATTACHMENT A.docx

REQUEST FOR INFORMATION (RFI)

Communications and Information Capabilities (CIC) Branch Secure Software-as-a-Service (SaaS) Data Platform Support Services

ATTACHMENT A – VENDOR COMPANY DATA

1. VENDOR COMPANY DATA

Company Name

Company Address

Company Website

Address:

E-mail:

Phone:

Address:

E-mail:

Phone:

Unique Identity ID (from SAM.gov)

Cage Code

No:

Socio-Economic Status (Check all that apply.)

Small Business:

Small Disadvantaged Business:

8(a) Business:

HUB Zone Business:

Service-Disabled Veteran-Owned Small Business:

Veteran-Owned Small Business:

Woman-Owned Small Business:

Large Business:

Reseller:

GSA MAS Contract Number

NAICS

Additional Focus Instructions:

Vendors or Industry to provide the following:

1. Capability statement A description of the respondent’s SaaS data-platform and managed-support capabilities relevant to this requirement.

1. Relevant experience Up to three examples of comparable work, including scope, scale, outcomes, security/compliance environment, and lessons learned.

1. Technical approach A recommended approach for implementation, operations, security, data integration, data governance, and user support.

1. Security and compliance posture Identify available authorizations, certifications, assessments, and ability to support DHS security authorization and continuous monitoring.

1. Commercial model Describe licensing, subscription, consumption-based, managed-service, and implementation pricing models. Provide rough order-of-magnitude cost ranges if feasible.

1. Staffing model Identify suggested labor categories, skill sets, staffing levels, onshore/offshore approach, and key personnel qualifications.

1. Service-level recommendations Recommend availability, support hours, incident response times, recovery objectives, and performance metrics.

1. Data portability and transition approach Describe how Government data can be exported in usable, non-proprietary formats and how transition-out would be supported.

1. Risks and assumptions Identify key dependencies, risks, limitations, and Government decisions needed for successful implementation.

1. Feedback on the draft SOW/PWS (Attachment B) Identify unclear, overly restrictive, missing, or commercially impractical requirements. Recommend revisions that would improve competition, reduce costs, or improve outcomes.

Additional RFI Response Instructions

Ask vendors to address the following HSIN-specific topics:

1. Describe your experience integrating commercial SaaS platforms with HSIN or comparable Federal information-sharing environments.

1. Describe the proposed technical approaches for supporting authorized data exchange between the SaaS platform and HSIN, including APIs, file exchange, data feeds, dashboards, content repositories, identity federation, or other approaches.

1. Identify the proposed approach for ensuring that data shared through HSIN-related capabilities is available only to authorized users, organizations, and communities.

1. Describe how your platform supports:

3. Role-based access control;

3. Least-privilege access;

3. User lifecycle management;

3. Multi-factor authentication;

3. Single sign-on or identity federation;

3. Audit logging; and

3. Periodic access review.

1. Describe your approach to preventing unauthorized data sharing, cross-tenant access, cross-community access, bulk exports, or use of Government data for unauthorized commercial or artificial-intelligence purposes.

1. Identify any existing Federal security authorizations, independent security assessments, or relevant compliance artifacts that could support an HSIN-related integration.

1. Describe the documentation, testing, and security evidence your organization would provide before implementation of an HSIN integration.

1. Describe your operational support model for HSIN-related interfaces, including monitoring, incident response, escalation, maintenance windows, and change management.

1. Describe how Government data and content can be exported, transferred, retained, archived, or disposed of at the Government’s direction, including at contract transition or termination.

1. Identify assumptions, dependencies, limitations, or Government-furnished services required to support HSIN integration.