RFI- 842469153 - AI_ML Questions - Responses F_.pdf

RFI - 842469153 - AI/ML Questions & Answers

Questions MP Responses Would it be possible to update “c.”

to be more inclusive of all the approaches

(04/05/2024): In response to your inquiry to change the verbiage on the RFI, the verbiage will remain as-is

Who in the DISA Small Business Office is overseeing this engagement, from a small business advocacy perspective?

Carlen Capenos

Would you be able to share the appropriate name and contact information?

Carlen Capenos Carlen.l.capenos.civ@mail.mil do you (government) have any thoughts on how you plan to release the future RFP associated with this RFI along with the timing of its release?

N/A

Is there any incumbent for this opportunity? N/A

If there is an incumbent then why you are looking for other companies? Are you not happy with them?

N/A

If there is an incumbent then are they bidding for this opportunity?

N/A

What is the allocated budget for this

RFI?

N/A

What specific types of cyber data does DISA currently collect and analyze for DCO purposes?

DISA uses commercial tools and sensors for cyber defense.

Could you provide more details on the volume, velocity, and variety of the data sources available for analysis?

Not in the intended scope of this RFI.

Are there any specific security or compliance requirements that AI/ML models must adhere to within DISA's environment?

Not in the intended scope of this RFI.

Are there any restrictions or preferences regarding the deployment environment (on-premises, cloud, hybrid)?

No preference

Are there any specific requirements or preferences regarding model monitoring, updates, and versioning?

Vendor defined

Will this effort include procurement of the tools or services as well as

Not in the intended scope of this RFI.

services? Services anticipated include ongoing model development and refinement, tool/service integration, as well as the operations and maintenance.

In order to facilitate model development and training/re-training does DISA anticipate having a development environment in addition to a production environment?

Yes.

Is there an expectation to have a fully accredited tool?

Not in the intended scope of this RFI.

What networks and/or cloud environments does the tool need to operate on?

Vendor Defined

Where is the data currently housed? Not in the intended scope of this RFI.

Are there any interoperability requirements?

Not in the intended scope of this RFI.

Will the government please describe the kind of data available that could be leveraged for model training?

DISA uses commercial tools and sensors for cyber defense.

Does the government have a preferred cloud vendor?

No.

What government networks would desired AI/ML tools run in?

To be determined.

What AI/ML tools are the government currently using? If this cannot be specified, descriptions of general use cases would be appreciated.

DISA is interested in getting information of new AI/ML tools.

Does the customer want an open-source option, or is proprietary solutions acceptable?

Vendor Defined.

Does the customer want it to be set up with a search engine interface, do you want dashboards?

Vendor Defined.

Does the customer want specific machine learning approaches? Require a LLM solution?

Vendor Defined.

Would customer accept third party LLMs that we did not create ourselves but fine-tuned or optimized for cyber data?

Yes.

Does the customer require a GOTS solution that does something the COTS solutions don't do?

Vendor Defined.

Is there any specific types of training data sets or attack corpuses they want to consider?

DISA uses commercial tools and sensors for cyber defense.

Which languages/APIs are you planning to use (ex.: Python, R, PySpark, etc.)?

Vendor Defined.

Which IDEs are you planning to use? (ex.: Jupyter, JupyterLab, RStudio)?

Vendor Defined.

What model types are you planning to build (SparkML, scikit-learn, Keras, TensorFlow, PMML, etc.)?

Vendor Defined.

Are you planning to work with images (ex.: deep learning models)?

Vendor Defined.

What SIEM tools are used to collect data in DCO? Is DCO using Azure Sentinel, Splunk, or any other SIEM tools?

DISA uses commercial tools and sensors for cyber defense.

When building and training AI/ML models, are we allowed to extract data from the SIEM tools?

Vendor Defined.

Can we use cloud-based computing and storage resources for ETL, training, and deployment of AI/ML services? If so, are there any restrictions, and are there any security guidelines we must adhere to?

Vendor Defined.

Where is the place of performance? Not in the intended scope of this RFI.

What is the security clearance requirement?

Not in the intended scope of this RFI.

Please confirm type size in diagrams and illustrations can be smaller than 12pt as long as it is legible.

Confirmed

Will the data be labeled? Vendor Defined.

Will the data be structured, semi-structured, unstructured, or all of the above?

Vendor Defined Approach.

How much data is expected to be processed?

Not in the intended scope of this RFI.

Which impact level environment(s) will the tool be used in (e.g.

IL4/IL5/IL6)?

Not in the intended scope of this RFI.

Will there be notional data of similar structure available outside of the closed area?

Not in the intended scope of this RFI.

Will the environment that the tool/solution is used in be air-gapped?

Not in the intended scope of this RFI.

Will the tool we provide be integrated with any current tools used by the customer? If so, can you provide a list of tools that our AI/ML tool will be used in correlation with?

Vendor Defined Approach.

Does the customer currently utilize a particular cloud solution (e.g. AWS GovCloud, Azure Government, Oracle Cloud)?

Not in the intended scope of this RFI.

Can the response include a cover page that does not count against page count?

Yes.

Can headers, footers, charts, tables, and graphics include font smaller than 12 point font?

Yes.

Will the Government clarify if the intended scope of this effort is to procure standalone AI/ML capabilities in the form of models, tools, and services, or if the Government is looking for a development platform/environment with which to facilitate development of AI/ML capabilities?

Vendor Defined Approach.

To accurately respond to 4.4, d., what is the Government’s intended NAICS code for this effort?

N/A

Has the Government considered requirements for training the workforce on how to use the AI models and platform?

Not in the intended scope of this RFI.

Would the Cover Page and Table of Contents be included in the 10-page limit?

No.

If we propose a SaaS solution, what are the minimum-security requirements? FedRAMP? IL?

Would DISA consider a Commercial Off The Shelf (COTS)-based, on-premises/hybrid cloud security suite platform purpose-built for the cyber analyst that includes the following AI/ML-enabled functions: Federated search, data acquisition, correlation, advanced log analytics, AI-powered alert triage, automated threat investigation, and threat hunting?

Prior to data acquisition and processing (data pedigree), how will DISA identify, classify, and protect sensitive data in cloud workloads and SaaS applications?

Does DISA currently employ, or would they consider a Data Security Posture Management (DSPM) approach that automatically identifies, classifies, and secures the authenticity of pedigree data and post-generative AI output from unauthorized access with NIST 800- 53r5 access controls during the entire AI/ML model lifecycle?

How will DISA leverage their existing COTS-based cybersecurity tool investments and third-party integrations with the desired solution?

Is the plan to adopt and acquire existing COTS to augment existing DCO capabilities or is the intent to build a separate, custom AI/ML solution that allows for the free exchange of platform developed AI/ML models across the Department of Defense?

Can we capitalize on existing SaaS services currently available with DISA? (i.e. aws.gov)

Will DISA accept joint submissions?

Yes.

Does the scope include earlier stages of the AI process, including data acquisition and normalization? Or is it strictly focused on AI model generation and use cases?

Vendor Defined Approach.

Does scope include file analysis?

Vendor Defined Approach.

Will investigations include streams of files coming from enclaves?

Vendor Defined Approach.

Is there an exact contract number to provide?