RFI A068763_Next Generation SOAR_Questions and Answers 9.17.26.xlsx
XLSX spreadsheet 18 KB Posted
- Attached to
- Request for Information (RFI) - Next-Generation Security Orchestration, Automation, and Response (SOAR)
- Solicitation number
- A068763
About this file
This is a Questions and Answers document for RFI A068763, a Request for Information issued by the Air Force Life Cycle Management Center (AFLCMC) Defensive Cyber Systems Branch to conduct market research on Next-Generation Security Orchestration, Automation, and Response (SOAR) solutions. The RFI deadline for questions was September 10, 2026 at 8:00 AM CST, with responses limited to 10 pages in accordance with the RFI letter. The Government explicitly stated this is for market research and acquisition planning purposes only, with no final solicitation structure, evaluation criteria, or acquisition strategy established at the time of the RFI. Technical demonstrations, capability briefings, scenario-based evaluations, and follow-up discussions are not planned as part of this market research phase.
The Government specified mandatory integration requirements including Elastic SIEM for case generation, Elastic Defend for EDR, Recorded Futures for threat intelligence, ICAM for identity authentication, AWS/ELICSAR for data lake services, Tanium for endpoint actions, and KeyCloak for RBAC integration. The SOAR platform must support a vendor-agnostic architecture capable of operating independently of specific vendor ecosystems while supporting standards-based APIs and integrations. Multi-tenancy requirements focus on operational and training environment separation within a shared instance using RBAC configurations, with case-view isolation as the primary requirement. Tactical offline deployment specifications include 48 CPU cores, 192GB RAM, 256GB boot disk plus 1.8TB storage, and optional 3TB NFS backup. The platform must achieve 100 percent synchronization between reconnected enclaves and the global platform upon reconnection, with all results, cases, indicators, evidence, and threat intelligence transferred while configuration changes require validation. Security requirements mandate FIPS 140-2 or FIPS 140-3 Level 1 compliance with NIST CMVP validation for cryptographic modules, CAC authentication via Air Force ICAM, and encryption for data at rest and in-transit supporting Impact Level 5 operations. While vendors questioned whether the 300-plus integration target was mandatory for out-of-the-box deployment, the Government clarified that both a large initial integration catalog and demonstrated ability to build new API integrations are required for platform completeness and ongoing performance.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI - Next-Generation Security Orchestration Automation and Response _SOAR.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 RFI NO: Next-Generation Security Orchestration, Automation, and Response (SOAR) Subsystem Integration Sources Sought A068763
| Vendor | Question Title | Section Number | Question Detail | Government Response | |
| 1 | Alliance Global Tech Inc | Vendor-Agnostic Architecture | Section 2 / EC 3 | Please clarify how the Government defines “vendor-agnostic” for this requirement. Is the expectation that the SOAR platform must operate independently of any specific SIEM, EDR, cloud, or threat-intelligence vendor ecosystem, while supporting standards-based APIs and integrations? | "Vendor-agnostic" in this context is a reference to not being Splunk/Palo Alto/Any other vendor/product specific support SMEs. Most of the SOAR support provded by this contract is on the edge of the products, assisting with integrations between the product platform and the underlying infrastructure. i.e. Investigating AI capabilities and the integration between Cloud Provider services and product provided services, building 3rd party integrations such as Tanium or Threat Intel. Should we decide to pivot away from current vendor solutions the engineer should be able to pivot as well thus "vendor-agnostic". |
| 2 | Alliance Global Tech Inc | Tactical Offline Resource Requirements | EC 1 | For the required lightweight tactical deployment, what are the Government’s target or maximum CPU, RAM, storage, and network resource constraints for a fully functional offline SOAR node? | CPU: 48 Cores |
Memory: 192GB Disk: 256 GB boot + 1.8 TB Optional NFS backup: 3 TB
| 3 | Alliance Global Tech Inc | Multi-Tenancy and Data Isolation | EC 1 | Please clarify the expected level of multi-tenancy and isolation. Must cases, indicators, playbooks, integrations, credentials, audit records, and dashboards be independently segregated between teams/tenants within a shared SOAR instance? | Multi-tenancy in the case of the SOAR is looking at a long term training solution for the operational community. A second tenant within the production environment would allow us to create a fenced in training environment within the production environment, allowing trainees of the system to create/update/delete cases without accidentally affecting the live operational production cases. The only portion that would require isolation would be the case view. i.e. An operational "view" of the system and a training "view" of the system with seperate cases, based on an RBAC configuration, all else being shared. |
| 4 | Alliance Global Tech Inc | Integration Marketplace Requirement | EC 3 | The RFI identifies more than 300 active integrations as a target. Does the Government require 300+ currently supported out-of-the-box integrations at the time of deployment, and are there specific SIEM, EDR, identity, network, cloud, or security-tool integrations that should be considered mandatory? | SIEM -Case generation |
EDR - Autiomated response actions via playbook ICAM - AFNET Authentication Platform KeyCloak - Intergration with ICAM for authentication and RBAC Tanium - Endpoint/Network Actions Recorded Futures - Threat Intel Cloud1 - Cloud Service Providers services C5ISR - Cybersecurity Service Provider brokerd by Cloud1 Unified Deployment System - Deployment Platform
| 5 | Alliance Global Tech Inc | Native Threat Intelligence Management | EC 3 | Please clarify whether the Government expects all threat-intelligence aggregation, de-duplication, scoring, indicator lifecycle management, enrichment, and distribution capabilities to be native to the SOAR platform, without dependence on a separate external TIP. | Multiple systems throughout the IDCS pipeline will conduct threat intel actions during an ongoing investigation. From the EDR adding evidence and threat indicators to the Tier 1 Voltrn+ Kits conducting enrichment actions. All of this will be aggregated into the Global SOAR case management system with no current dependance on a seperate external TIP. Future integrations may change as the system develops |
| 6 | Alliance Global Tech Inc | Disconnected Operations and Synchronization | EC 5 | For disconnected or latency-challenged enclaves, please clarify the required synchronization model when connectivity is restored, including playbook results, cases, indicators, evidence, configuration changes, and threat-intelligence updates. | The goal for disconnected ops is a full 100% synchronization between the reconnected enclave and the global platform upon reconnection outside of configurations changes. All results, cases, indicators, evidence, and threat intel would be transferred to the global platform. Configuration changes would require validation before acceptance and integration into the Cloud Platform |
| 7 | Alliance Global Tech Inc | Security and Authentication Standards | EC 4 | Please clarify the required level of FIPS compliance and whether FIPS-validated cryptographic modules are mandatory. Additionally, should PKI/CAC authentication support integrate with existing DoD identity infrastructure such as Active Directory/LDAP or other local identity providers? | For Department of War (DoW) and Department of Defense (DoD) applications operating in secure environments—specifically up to Impact Level 5 (IL5)—the minimum level of FIPS compliance depends heavily on the specific application architecture and deployment scenario. The standard baseline requires at least FIPS 140-2 or FIPS 140-3 Level 1 (note that FIPS 140-2 is being set to historical on 9/21/26) compliance for standard software-based cryptographic modules (such as TLS implementations, web servers, and database encryption). The actual software or hardware module implementation performing the encryption should hold an active validation certificate from the NIST Cryptographic Module Validation Program (CMVP). The organization has a requirement to provide encryption for data at rest and in-transit. |
CAC Authentication is enabled via Air Force ICAM and subsequent Active Directory integrations.
| 8 | Alliance Global Tech Inc | Event Processing and Scalability | EC 5 | The RFI states that the solution should process hundreds of thousands of events daily. Please provide the expected peak event rate, concurrent playbook executions, number of analysts/users, and anticipated number of deployed SOAR nodes to support sizing and performance evaluation. | This answer remains unknown as the solution is currently in use as a singular cloud platform within the greater IDCS solution. The environmnet will scale drastically with the integration of Voltrn+ Kits, CPTs, MDTs, and CVAH platforms so the ability to process a large amount of events ensures full functionality during operations. |
| 9 | Alliance Global Tech Inc | AI/ML-Assisted Analyst Workflows | EC 6 | Please clarify which AI/ML capabilities are considered required versus desired, particularly automated playbook recommendations, incident ownership assignment, phishing detection, and recommended mitigation actions. Is the Government expecting an integrated AI capability or will approved external AI services be acceptable? | At this time the Global SIEM/SOAR team has received no request for AI/ML capabilities. Panned for future Program Increments via Lead Engineer/Architect |
| 10 | Alliance Global Tech Inc | Collaborative Case Management | EC 7 | Please clarify whether all identified collaboration capabilities ChatOps, interactive CLI within the incident view, real-time multi-analyst editing, evidentiary action tracking, and reusable SOP/task workbooks are required as native platform capabilities. | ChatOps, multi-analyst, action tracking, and rereusable SOPs/Workbooks are all required for a collaborative investigation platform. |
| 11 | Alliance Global Tech Inc | Federal Contract Vehicle Availability | EC 2 | Please clarify whether availability through DoW ESI, GSA, SEWP, or another Federal contract vehicle is a mandatory condition for consideration, or whether the Government will consider commercially available solutions that can be acquired through an appropriate future contract vehicle. | Availability through DoW ESI, GSA, or SEWP or another Federal contract vehicle is not mandatory for responding to this RFI. The Government seeks to understand all commercially available solutions to determine the most effective acquisition strategy. |
| 12 | Alliance Global Tech Inc | Response Format and Evaluation Process | Section 4 / Section 5 | Please confirm whether there is a page limit, prescribed font/format, or required response template for the RFI white paper. Also, will the Government conduct technical demonstrations, capability briefings, or follow-up discussions with respondents as part of the market research? | In accordance with the RFI letter the page limit will be 10 pages. This RFI is strictly for market research and planning purposes. The Government does not plan to conduct technical demonstrations, capability briefings, or follow-up discussions at this time. |
| 13 | Edge Analytics, LLC | The RFI asks respondents to identify whether more than 300 active integrations are available. Is the Government primarily seeking a large catalog of existing integrations, or the demonstrated ability to securely integrate, orchestrate, and exchange data with the systems required for Air Force defensive cyber operations? | Both though this would heavily lean on the latter in this case. SOAR platforms do a bulk of the work throuhg the use of API keys to utilize integrations with 3rd party capabilities. A large initial bulk of integrations and available APIs allows for a faster delivery of capabilities at the time of development but the ability to build/field new API integrations with a wide variety of solutions is also paramount to a complete SOAR platform and ongoing performance. | ||
| 14 | Edge Analytics, LLC | Will the Government identify the priority SIEM, EDR, threat-intelligence, identity, data-lake, communications, and defensive cyber systems that constitute the required integration baseline? | SIEM - Elastic |
EDR - Elastic Defend Threat Intel - Recorded Futures Identity - ICAM Data-Lake - AWS/ELICSAR Endpoint Actions - Tanium
| 15 | Edge Analytics, LLC | Would the Government consider using a common, scenario-based demonstration as part of a future source-selection evaluation so that proposed solutions can be assessed against the same operational requirements and mission threads | This RFI is strictly for market research and planning purposes. The Government does not plan to conduct scenario-based demonstration as part of a future source-selection evaluations at this time. |
| 16 | Edge Analytics, LLC | Could such a demonstration measure alert-ingestion latency, enrichment accuracy, playbook execution, analyst intervention, evidentiary traceability, disconnected operation, recovery following interruption, and synchronization after connectivity is restored? | This RFI is strictly for market research and planning purposes. The Government does not plan to conduct scenario-based demonstration as part of a future source-selection evaluationns at this time. |
| 17 | Edge Analytics, LLC | Would the Government consider requiring offerors to create, test, and deploy a new integration within a defined period as a measure of platform extensibility, rather than evaluating extensibility principally through the number of integrations already contained in a vendor’s catalog? | This RFI is issued solely for market research and planning purposes. No final solicitation structure, evaluation criteria, or acquisition strategy has been established. |
| 18 | Edge Analytics, LLC | What processor, memory, storage, power, networking, and physical-form-factor constraints should respondents assume for a fully functioning offline node deployed on the V+ tactical platform architecture? | Duplicate of Question #2 |
CPU: 48 Cores Memory: 192GB Disk: 256 GB boot + 1.8 TB Optional NFS backup: 3 TB
| 19 | Palo Alto Networks | Multi-Tenancy vs. Multi-Instance Management: | Does the Air Force require a single, natively multi-tenant software deployment to manage disparate MAJCOMs and enclaves, or is a multi-instance architecture governed via a centralized management layer acceptable for enterprise command and control? | A single multi-instance architecture governed via a centralized management layer is the currently acceptable solution for cooperation and AFCYBER unit collaboration. |
| 20 | Palo Alto Networks | Open Standards & Model Context Protocol (MCP) | Does the Air Force prioritize open interoperability frameworks, such as Model Context Protocol (MCP), to allow the SOAR orchestration engine to interface natively with external DoD-owned AI models and third-party tools? | This RFI is for market research and acquisition planning purposes only. Specific technical standards and protocol mandates have not been finalized. |
| 21 | Palo Alto Networks | AI Governance & Classified Enclaves | Does the Air Force plan to allow cloud-hosted frontier AI models (via FedRAMP High / GovCloud boundaries) to perform natural-language playbook generation and triage for unclassified/IL5 networks, or is a local, on-premise model required for all enclaves? | This RFI is for market research and planning purposes only. The Government’s technical architecture and deployment strategy for this requirement have not been finalized. |
| 22 | Palo Alto Networks | DevSecOps & Zero-Touch Deployment Pipelines | For DevSecOps pipeline compliance across garrison and cloud environments, does the Air Force require 100% API-driven / GitOps automated deployment for correlation, parsing, and automation rules into production, or are governed UI administrative workflows permitted? | This RFI is for market research and planning purposes only. The final DevSecOps deployment and configuration management requirements have not been finalized. |
| 23 | Palo Alto Networks | Tactical Edge Lifecycle & Supportability | For disconnected edge weapon systems (e.g., CVA/H kits), what is the Air Force’s required software support lifecycle window for on-premise execution nodes that cannot receive frequent cloud updates? | In the case of disconnected operations and an inability to receive frequent cloud updates the window would constitute the soonest available disconnected update to the weapon system to retain Cybersecurity/System Hardening/ATO compliance. |
| 24 | Concourse Tech | What production classification, DoD Cloud Computing Security Requirements Guide Impact Level, FedRAMP authorization level, FIPS validation, and Authority to Operate requirements does the Government anticipate for enterprise, garrison, and tactical-edge deployments? | For Department of War (DoW) and Department of Defense (DoD) applications operating in secure environments—specifically up to Impact Level 5 (IL5)—the minimum level of FIPS compliance depends heavily on the specific application architecture and deployment scenario. The standard baseline requires at least FIPS 140-2 or FIPS 140-3 Level 1 (note that FIPS 140-2 is being set to historical on 9/21/26) compliance for standard software-based cryptographic modules (such as TLS implementations, web servers, and database encryption). The actual software or hardware module implementation performing the encryption should hold an active validation certificate from the NIST Cryptographic Module Validation Program (CMVP). The organization has a requirement to provide encryption for data at rest and in-transit. | |
| 25 | Concourse Tech | Please provide planning estimates for the number of analysts, tenants, enclaves, disconnected tactical nodes, daily events, concurrent playbook executions, and required data-retention periods expected for an initial deployment and eventual enterprise scale. | This answer remains unknown as the solution is currently in use as a singular cloud platform within the greater IDCS solution. The environmnet will scale drastically with the integration of Voltrn+ Kits, CPTs, MDTs, and CVAH platforms so the ability to process a large amount of events ensures full functionality during operations. | |
| 26 | Concourse Tech | Is the reference to more than 300 active integrations an anticipated minimum threshold, and can the Government identify the SIEM, EDR, data-lake, identity, threat-intelligence, ticketing, and network-security products that must be supported out of the box? | SIEM -Case generation |
EDR - Autiomated response actions via playbook ICAM - AFNET Authentication Platform KeyCloak - Intergration with ICAM for authentication and RBAC Tanium - Endpoint/Network Actions Recorded Futures - Threat Intel Cloud1 - Cloud Service Providers services C5ISR - Cybersecurity Service Provider brokerd by Cloud1 Unified Deployment System - Deployment Platform
| 27 | Concourse Tech | What maximum duration of disconnected operation, synchronization behavior, conflict-resolution rules, and recovery objectives should respondents assume for tactical nodes, and how does the Government expect these capabilities to be validated? | The goal for disconnected ops is a full 100% synchronization between the reconnected enclave and the global platform upon reconnection outside of configurations changes. All results, cases, indicators, evidence, and threat intel would be transferred to the global platform. Configuration changes would require validation before acceptance and integration into the Cloud Platform |
| 28 | Concourse Tech | Section 5 states that questions are due September 10, 2026 at 8:00 AM CST but also states that answers are not guaranteed for questions received after September 9; please confirm the controlling deadline for timely questions. | Questions are due September 10, 2026. |
File details come from the government source that posted it. Updated .