A655 RMF Area of Interest - RFI - 1 May 26.docx

REQUEST FOR INFORMATION (RFI)

Risk Management Framework (RMF) Process Efficiencies

Issuing Organization: 764 ESS RFI Number:

Posting Date: 1 May 2026 Response Due Date: 27 May 2026 Considered NAICS Code: 541512 – Computer Systems Design Services Considered PSC Code: DA01 – IT and Telecom – Business Application/Application Development Support Services Classification: UNCLASSIFIED

1.0 PURPOSE

This Request for Information (RFI) is issued by the 764th ESS Contracting Squadron on behalf of USAFE-AFAFRICA/A6 for planning and market research purposes only. This RFI is NOT a Request for Proposal (RFP), Request for Quote (RFQ), or an Invitation for Bid (IFB), and does not commit the Government to issue a solicitation, award a contract, or pay any costs incurred in the preparation of a response. All information submitted in response to this RFI is voluntary.

The Government seeks information from industry on potential solutions to address the requirements identified within this RFI. Of particular interest are commercial solutions, particularly automation and AI solutions that drive both process improvements and mature technologies to deliver efficiencies in the Risk Management Framework (RMF) process while maintaining full compliance with NIST SP 800-53 Revision 5 and DoDI 8510.01.

2.0 BACKGROUND

Without question, Europe has been a crucible of innovatively dynamic and deadly adversarial threats, a fact that was driven home by Russia’s invasion of Ukraine in 2022, an evolution of warfare on that has been on display for the whole world to see. North Atlantic Treaty Organization (NATO) countries race to rapidly respond to these threats with technology underpinning countermeasures. Technology has inherent cybersecurity risk, which the Department of War (DoW) mitigates via the Risk Management Framework (RMF) process (NIST SP 800-53 Revision 5; DoDI 8510.01).

DoW Problem The RMF's multi-step process, with its numerous tasks, roles, and documentation requirements, can be highly complex and perceived as overly bureaucratic. This complexity can lead to a lengthy and cumbersome process, making it difficult for organizations to navigate and implement effectively. Additionally, the detailed nature of each step, while thorough, can create a significant administrative burden, exacerbated by the transition from NIST SP 800-53 Rev 4 to Rev 5, as well as the US Air Force mandating 720 baseline controls for every system seeking a new or renewed authority to operate (ATO). However, those are just baseline controls, and the reality is that NIST SP 800-53 has over 1,100 controls that could apply to a system.

The diagram below is a notional 12-month timeline to secure an ATO. Information Systems Owners (ISOs), as well as the AODR/SCA team collaborate and work together on the Plan step (Step 0). ISOs and their teams are primarily responsible for Steps 1-3 (orange) but receive significant assistance from the AODR/SCA team throughout the steps. The AODR/SCA Team are almost solely responsible for Step 4 but can engage the ISO and security team as needed. Step 5 is mostly preparing the decision brief and documents, while Step 6 is a whole-team effort.

The RMF's detailed and often lengthy process portrayed above is not always well-suited for today's fast-paced and dynamic environments, particularly those that embrace agile development methodologies and fielding technology at the speed of need. The time required to complete the full RMF cycle for a new system, for an authorized system to make a significant change, or for an authorized system to connect to another system--the latter two situations resulting in more analyses and paperwork--can be a major drawback, hindering innovation and rapid deployment of new technologies.

Specific to USAFE-AFAFRICA (U-A), the war in Ukraine, kinetic and non-kinetic weapon development of adversaries, and developmental testing of Air Force Research Lab capabilities, demanded that U-A have its own Authorizing Official (AO) boundary. Operation EPIC FURY only further drove home the need for U-A to expedite its own capability development and implementation. As a result, U-A’s AO boundary is growing at a rate unsustainable by the current way U-A manages the RMF process. Since August 2024, U-A’s AO Boundary grew from 8 approved systems to 17 approved systems, with another three systems that are working toward approval (one of which still isn’t approved after 17 months). This rate of growth coupled with the Rev 4 to Rev 5 transition milestones set by SAF/CN, required the AODR/SCA team to nearly completely focus on the status quo, and hindered U-A’s cybersecurity program to dedicate the manpower needed to scrutinize existing processes, develop efficiencies, and pilot new automation and/or AI technologies organically.

3.0 NEED STATEMENT

USAFE-AFAFRICA/A6 seeks commercial solutions to prototype and operationally demonstrate efficiencies in all steps of the RMF process while adhering to NIST SP 800-53 Revision 5 and DoDI 8510.01. This includes both process improvements (non-technological), and technological innovations that can speed up the RMF process without sacrificing quality of work. The end goal is for the Authorizing Official Designated Representative (AODR) to provide an accurate cybersecurity risk that the AO can weigh against operational risk. Based on the operational urgency, prototype/pathfinder nature, and 12-month implementation window, the Government is considering a layered acquisition approach to utilize Commercial Solutions Opening (CSO). However, the Government will consider Industry input in its market research on how to address this requirement.

4.0 SCOPE & GOVERNMENT EXPECTATIONS

This multi-phased approach seeks to identify efficient process improvements, as well as mature commercial technologies that will demonstrate end-to-end objectives within no more than 12 months. This is an operational pathfinder in concert with U-A’s AODR, the Security Control Assessment team, system owners and their support teams (e.g. PgMs, ISSOs, ISSMs), and requirement owners.

Contingent on the quality and completeness of the white papers the Government receives, and should the government choose to execute a contract supporting this effort, the Government expects the vendor to fully implement process improvements and technical capabilities within 12 months from contract award. In turn, the Government is willing to dedicate reasonable time to provide vendors with access to U-A personnel involved in navigating RMF to help vendors better understand the local processes. The Government expects the vendor to examine and analyze each step of the RMF process and deliver process improvements and a functional technology/tool that streamlines each step. Doing so allows both the system owner’s team and the AODR/SCA team to benefit from gained efficiencies, rather than limiting benefits to a single entity by focusing on just one RMF step. The Government expects the vendors to address systems that are unclassified, SECRET, and SECRET//REL (TOP SECRET systems are authorized by a different AO). The Government expects vendors to propose technology that either already meets NIST standards via an ATO or interim authority to test (IATT), a technology that currently possesses a Common Criteria for Information Technology Security Evaluation, or technology that is in the process of being evaluated by a competent and independent Common Criteria licensed laboratory. Technology that does not possess an ATO or Common Criteria certificate will be addressed on a case-by-case basis. While vendors may utilize consultants for process mapping, as mentioned earlier in this paragraph, the primary deliverables must be fully implemented within 12 months of contract award.

5.0 COMPELLING SOLUTION CHARACTERISTICS

Required Attributes

- Address all steps of the RMF process

- Include an analysis of all 720 baseline controls and what can be standardized by a template

- Be novel in capability, responsiveness, and delivery accuracy

- Be capable of reducing Step 4 from 90 days to no more than 45 days

- Be mature and ready to demonstrate to key stakeholders, to include U-A’s AO

- Be ready to fully implement within no more than 12 months

- Be adaptable to various types of systems (kinetic, non-kinetic, COTS, GOTS, etc.)

- Incorporate automation and/or AI

- Be cost-effective and friendly to supply chains

Desired Attributes

- A system and/or processes that thoroughly reviews RMF artifacts submitted by the program owners

- A system and/or process that can output results with applicable references (e.g. explain why a control was partially satisfied or failed)

- A system and/or process that can output results in a way the SCAR can easily review the results and make recommendations to the SCA

- A system and/or process that can handle increased load and surge without degraded performance

- A system that is simple to operate and can evolve over time without major cost implications and training requirements

- A system that guarantees confidentiality, integrity, and availability of its data

- A system that offers a consistent user experience and provides a consistent output.

6.0 INFORMATION REQUESTED FROM INDUSTRY

Responses should be limited to 12 pages (excluding cover page and capability statements) and address the following:

Company Information:

- Company name, CAGE code, UEI, address, POC (name, phone, email)

- Business size and applicable socioeconomic certifications

- Contract vehicles currently held (GSA MAS, GWAC, IDIQ, OTA consortia memberships, etc.)

Technical Solution Overview

- Description of proposed solution (process, technology, or hybrid)

- Mapping of solution capability to each of the six RMF steps

- Approach to standardizing/templating the 720 USAF baseline controls

- Description of automation/AI components and underlying models/architecture

- Approach for reducing Step 4 from 90 to ≤45 days

Maturity & Compliance

- Technology Readiness Level (TRL)

- Existing ATO status (Issuing AO, boundary, classification, expiration) OR

- Common Criteria certification status (EAL level, Protection Profile, lab)

- FedRAMP status (if cloud-based)

- DoD IL level (IL2/4/5/6) supported

- Past performance on similar DoD/Federal RMF efforts

Implementation Approach

- A brief description of how the vendor would conduct a live technical demonstration or pitch (using synthetic/dummy data)

- A proposed milestone schedule that shows how the vendor would achieve full implementation in 12 months (e.g. ## days for analyses, ## days for prototype delivery, ## to pilot prototype, etc.)

- Personnel/access required from the Government

- Use of consultants/subcontractors (if any)

- Risks and mitigation strategies

Pricing Construct (ROM)

- Rough Order of Magnitude (ROM) cost estimate

- Pricing model (FFP, T&M, subscription/SaaS, hybrid)

- Identification of any contract vehicles through which the solution can be procured

Recommended Acquisition Approach -Vendor recommendation on acquisition pathway (FAR-based contract, OTA, CSO, SBIR/STTR, etc.)

- Recommended contract type and rationale

7.0 SUBMISSION INSTRUCTIONS

Interested parties are requested to respond to this RFI with a white paper. White papers are due no later than 27 May 2026, 1400 CEST. Responses shall be submitted via e-mail to Mr. Corey Chopko at corey.chopko@us.af.mil, Ms. Ina Hemmer at ina.hemmer.de@us.af.mil, and Capt Kevin Sheedy at kevin.sheedy.3@us.af.mil as described for the below sections. Proprietary information, if any, should be minimized and MUST BE CLEARLY MARKED. To aid the Government, please segregate proprietary information. Please be advised that all submissions become Government property and will not be returned.

U-A representatives may or may not choose to meet with potential Offerors. Such discussions would only be intended to get further clarification of potential capability to meet the requirements, especially any development and certification risks.

Questions regarding this announcement shall be submitted in writing via e-mail to Mr. Corey Chopko at corey.chopko@us.af.mil, Ms. Ina Hemmer at ina.hemmer.de@us.af.mil, and Capt Kevin Sheedy at kevin.sheedy.3@us.af.mil by 13 May 2026, 1400 CEST. Verbal questions will NOT be accepted. Questions will be answered by posting answers in response to this RFI; accordingly, questions shall NOT contain proprietary or classified information. The Government does not guarantee that questions received after 13 May 2026, 1400 CEST, will be answered.

The information provided in the RFI is subject to change and is not binding the Government. The Government has not made a commitment to procure any of the items discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.

image1.png