RFI - Next-Generation Security Orchestration Automation and Response _SOAR.pdf

REQUEST FOR INFORMATION

Air Force Life Cycle Management Center (AFLCMC)

Defense Cyber Operations (HNCD)

Next-Generation Security Orchestration, Automation, and Response (SOAR) Subsystem Integration

1. GENERAL INFORMATION

This Request for Information (RFI) initiates market research under Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) Part 10 to support planning for the Air Force Life Cycle Management Center (AFLCMC), Defensive Cyber Systems Branch (HNCD), Joint Base San Antonio–Lackland, TX. This notice is for information and planning purposes only to assess industry capabilities and market potential. This RFI does not constitute an invitation for Bids, Request for Proposal (RFP), Request for Quote (RFQ), or solicitation. No solicitation document exists currently. This RFI constitutes no Government obligation to procure these items or issue a solicitation. The Government does not have an obligation to pay for information responding to this RFI and will not accept any responses as offers. Vendors should mark any proprietary information clearly and appropriately.

2. PURPOSE

This is a Request for Information for the Air Force Life Cycle Management Center (AFLCMC) Defensive Cyber Systems Branch (HNCD). The purpose of this RFI is to conduct market research to identify commercial sources capable of providing a Next-Generation, Vendor- Agnostic Security Orchestration, Automation, and Response (SOAR) software solution.

The program office is seeking industry feedback on software solutions that meet or exceed the capabilities of enterprise orchestration platforms like Palo Alto Cortex XSOAR. The desired platform must avoid vendor ecosystem lock-in, support highly extensible modular open architectures, and be capable of deployment across enterprise cloud, garrison, and localized tactical edge environments on standard commercial-off-the-shelf (COTS) computing baselines (referred to as the V+ platform architecture).

The government intends to evaluate solutions that offer robust, decentralized orchestration, a vast open-integration marketplace, native threat intelligence lifecycle management, and advanced Machine Learning (ML)-assisted analyst workflows.

3. SYSTEM OVERVIEW AND OPERATIONAL CONTEXT

The SOAR subsystem serves as the central coordination plane for defensive cyber operations.

The subsystem must seamlessly ingest security alerts from diverse Security Information and

Event Management (SIEM) systems and data lake repositories, automatically trigger defensive playbooks, and enrich raw data.

Core Operational Targets (Cortex XSOAR Class or Better):

• Open, Dynamic Integrations: Immediate bidirectionality with hundreds of third-party products without requiring custom development of connector code.

• Unified Threat Intelligence Management (TIM): Native aggregation, scoring, indicator extraction, and distribution of threat feeds directly integrated with the SOAR playbook engine.

• Collaborative Incident Response: Live interactive workspaces (e.g., collaborative Command-Line Interface/CLI and ChatOps) that preserve evidentiary actions automatically.

• Tactical Micro-Footprint: Lightweight containerized deployment optimized to execute playbooks offline at the tactical edge.

3. TECHNICAL SPECIFICATIONS & NEXT-GEN CAPABILITY REQUIREMENTS

Respondents must detail how their proposed SOAR solution addresses the following seven core Evaluation Criteria (ECs):

EC 1: Lightweight Containerization & Multi-Tenancy

• The platform must be fully containerized (OCI-compliant, orchestrated via Kubernetes/K8s) to fit localized and small form factor tactical deployment profiles.

• Detail the minimum RAM, CPU, and storage requirements for a fully functioning offline node. Priority is given to platforms that utilize system resources efficiently and scale dynamic workers on demand.

• Provide native logical isolation and granular Role-Based Access Control (RBAC) to allow multiple independent teams to share an instance while strictly segregating cases, indicators, playbooks, and integrations.

• EC 2: Enterprise Supportability, Software Sustainment, and Training Readiness

• Outline the solution’s availability via Department of War (DoW) Enterprise Software

Initiative (ESI) contracts, GSA schedules, or other federal program vehicles to streamline integration.

• Describe how the solution aligns with standard COTS product update cycles. Detail your process for sustaining engineering, specifically how you deliver modular, versioned updates and patches to limit operational interruption across a distributed pipeline.

• Detail structured training pipelines, certification paths, and resources available to quickly transition cyber operators (e.g., those experienced with Splunk SOAR or open-source tools) to the proposed platform.

EC 3: Universal Orchestration & Native Threat Intelligence

• The platform must feature comprehensive REST APIs. Detail how it ensures open interoperability without requiring proprietary SIEM or EDR ecosystems.

• Detail the scale of your out-of-the-box (OOTB) integration ecosystem (specify if >300+ active integrations are available). Explain how developers can build, package, and deploy custom integrations via a standard Software Development Kit (SDK).

• Native Threat Intelligence Management (TIM): Explain how your platform aggregates, de-duplicates, scores, and expires Threat Intelligence Indicators. Playbooks must be able to auto-extract, auto-enrich, and take action on indicators in real-time without relying on external threat intelligence platforms (TIPs).

EC 4: Data Integrity & Security Controls

• Address the security safeguards built into the platform, specifically around data validation, error handling, and transaction reliability within automated playbooks.

• Define support for data encryption in transit and at rest, Federal Information Processing

Standards (FIPS) compliance, and integration with local identity providers (e.g., PKI/CAC authentication).

• Detail how the tool preserves evidentiary data integrity throughout the lifecycle of a security incident.

EC 5: High Availability & Tactical Disconnected Operations

• Detail how the platform maintains high-availability and scales to process hundreds of thousands of events daily.

• Describe the solution's ability to operate in highly latency-challenged or completely disconnected, environment-level enclaves and sync playbook runs and intelligence updates back to central/cloud zones once connectivity is restored.

EC 6: Visual Playbooks, Python Scripting, and ML-Assistance

• Detail the visual drag-and-drop playbook design interface.

• Explain support for executing custom scripts (e.g., Python or JavaScript) directly within playbooks, enabling complex mathematical operations or customized host queries.

• Detail any built-in ML models or AI virtual assistants that analyze historical analyst decisions to automatically suggest playbooks, assign incident owners, detect phishing behaviors, or recommend specific mitigation actions.

EC 7: Interactive Collaborative Case Management

• Describe the collaborative case workspace (equivalent to or better than a virtual "War Room"). Detail features like ChatOps, interactive CLI tooling inside the incident view, and real-time multiplayer analyst editing.

• Explain how standard operating procedures (SOPs) are codified into flexible, reusable task workbooks that guide analysts.

• Detail OOTB dashboards for tracking crucial metrics, such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and playbook ROI (hours saved).

4. REQUESTED INFORMATION & VENDOR RESPONSE GUIDELINES

To support our engineering assessment, please structure your response according to the following outline:

1. Corporate Overview: Company name, address, point of contact, CAGE code, UEI number, business size status, and available government contract vehicles (e.g., DoD ESI, GSA, SEWP).

2. Technical Approach: A detailed description of how the proposed product fulfills the technical specifications in Section 4 (specifically answering EC 1 through EC 7).

3. Enterprise SOAR (Palo Alto Cortex XSOAR) Comparison: Explicitly explain how your platform compares to, differs from, or outperforms Palo Alto Cortex XSOAR across the following vectors:

• Orchestration and API-first ecosystem openness.

• Playbook development speed and execution power.

• Real-time incident collaboration and documentation.

• Native threat intelligence lifecycle automation.

4. MOSA Compliance Alignment: Document how your platform implements Modular Open Systems Approach (MOSA) principles, highlighting open standards, accessible APIs, and decoupled modular components.

5. Deployment History & Case Studies: Highlight successful, scaled implementations within the DoW, intelligence community, or federal cyber operations domains.

5. SUBMISSION PROCESS

Questions regarding this announcement shall be submitted in writing via email to the Contract Specialist, Sean Danzy, sean.danzy@us.af.mil and the Contracting Officers, Kyle Braunlich, email: kyle.braunlich@us.af.mil and Diana Sapp, email: diana_rose.sapp.3@us.af.mil no later than Thursday, 10 September 2026 at 8:00AM CST. Verbal questions will NOT be accepted.

Questions shall NOT contain proprietary or classified information. The Government does not guarantee that questions received after 9 September 2026 will be answered.

Responses shall be submitted to the Contract Specialist, Contract Specialist, Sean Danzy, sean.danzy@us.af.mil and the Contracting Officers, Kyle Braunlich, email:

kyle.braunlich@us.af.mil and Diana Sapp, email: diana_rose.sapp.3@us.af.mil no later than Friday, 18 September 2026 at 8:00AM CST.

mailto:sean.danzy@us.af.mil mailto:kyle.braunlich@us.af.mil mailto:diana_rose.sapp.3@us.af.mil mailto:sean.danzy@us.af.mil mailto:kyle.braunlich@us.af.mil mailto:diana_rose.sapp.3@us.af.mil

6. PROPRIETARTY INFORMATION

Proprietary information, if any, should be minimal and MUST BE CLEARLY MARKED. To aid the US Government, please segregate proprietary information. Please be advised that all submissions become US Government property and will not be returned. If any Responders do not currently possess a Proprietary Data Protection Agreement (PDPA) that would permit the AFLCMC/HNCD support contractors listed below to review and evaluate white papers submitted in response to this RFI, please coordinate with POCs listed in section 5.

The highest classification of the responses will be no higher than CONTROLLED

UNCLASSIFIED INFORMATION (CUI).

7. SUMMARY

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify industry sources that can provide AFLCMC/HNCD capabilities. This RFI is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. The information provided in the RFI is subject to change and is not binding on the Government. The Air Force has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as a commitment or as authorization to incur cost for which reimbursement would be required or sought. Further, the Air Force is not at this time seeking proposals and will not accept unsolicited proposals. All submissions become Government property and will not be returned. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.