ACME-RFI-001.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER

HANSCOM AIR FORCE BASE MASSACHUSETTS

20 August 2026

FROM: AFLCMC/HNJJ Kill Chain Integration

11 Barksdale Street, Bldg 1614 Hanscom AFB MA 01731

SUBJECT: Automated Classification Management Environment (ACME) Request for

Information (RFI)

1. This is a Request for Information (RFI) for the Automated Classification Management Environment (ACME), the program name for the effort identified as Battering Ram in the Department of the Air Force (DAF) Fiscal Year (FY) 2027 President's Budget. The Government is seeking information from potential vendors who can demonstrate the technical maturity and core competencies required to solve the challenges for the ACME/Battering Ram effort, which are further elaborated in the problem statement below. The Government welcomes responses from vendors outside the Defense Industrial Base (DIB) to provide solutions to a similar problem that may exist in an industry outside the Department of War (DoW).

2. Background: The Government requires an automated classification capability to support Joint All Domain Command and Control (JADC2) operations. The current manual classification infrastructure hinders the ability of the DoW to share data at speeds relevant to the end user. The ACME program will manage the end-to-end lifecycle of Executive Order (EO) 13526, 32 CFR Part 2001, associated DoW policy, and any digital classification/declassification guidance. The public funding profile and cost categories are not a statement of intended contract value, number of awards, scope, set-aside decision, or acquisition method.

3. Program Overview: The program is responsible for modernizing classification management to transition the DoW from a fragmented, manual framework to a unified, AI-driven automated enterprise. Classification management is the lifecycle management of classified national security information from original classification to declassification. This includes classification, declassification, releasability processes, compliance/adherence to security classification guides, and the oversight processes that govern these. This digital security infrastructure has multi-level security requirements including, but not limited to, Unclassified, Controlled Unclassified Information (CUI), Confidential (C), Secret (S), Top Secret (TS), Sensitive Compartmented Information (SCI), and Special Access Required (SAR), operating in cloud-based, connected, and air-gapped environments. This capability will eventually serve as the single, digital authoritative system of record to manage, track, and support the personnel authorized to make original classification decisions. This program will employ an agile development methodology and will remain postured to rapidly prototype and integrate emergent capabilities.

4. Problem Statement: The DoW is operating a 21st-century warfighting enterprise constrained by mid-20th-century information security framework, tools, and operational apparatus. For over 70 years, the classification, declassification, and releasability of national security information has relied on manual, human-intensive processes governed by static, document-centric guidance.

This analog approach is fundamentally incompatible with the massive volume, speed, scale, and complexity of the digital age. To ensure vendors understand the scale of the required modernization, the ACME program seeks to resolve the following challenges:

a. Financial and Labor Strain: Classification management is challenged by lack of interoperability and codified institutional knowledge, resulting in incomplete reviews of information and exasperated by slow, untraceable, serial coordination with other agencies via legacy systems.

b. Static and Deficient Guidance: Approximately 500 DoW Original Classification Authorities

(OCAs) manage more than 4000 Security Classification Guides (SCGs) that exist only in static formats (PDF, Word, Excel), which requires a human to manually cross-correlate and update the document when guidance changes. This creates a gap between desired consistent guidance and documented guidance, presenting a risk to programs relying on that documentation to be up to date and accurate.

c. Massive Derivative Footprint: There are currently over 5.6 million derivative classifiers generating more than 54 million derivative classification determinations across the U.S.

Government annually. Relying on manual searches of static SCGs leads to high error rates, degraded data integrity, and frequent over-classification. This can be also explained as a large distributed workforce must consistently apply complex, evolving business rules to a massive and growing volume of digital data, where errors can lead to significant organizational risk.

d. Insurmountable Records Backlog: The DoW has approximately a 140-million-page hardcopy record backlog awaiting Automatic Declassification Review (ADR). In other words, a need exists for high-throughput digitization and automated analysis of a large corpus of legacy physical records to extract, structure, and apply current business rules for future use.

5. Desired Outcomes/Capability Gaps: ACME will replace the fragmented, manual framework with a unified, AI-driven, automated enterprise solution to modernize the classification, declassification, and releasability procedures. It will include machine-readable data infrastructure and AI tools to automate classification, declassification, and releasability activities. The ACME program will include phased implementation resulting in enterprise-wide tool and process adoption. The following represents the most common friction points. How would you approach this problem space?

a. Modernizing Original Classification to transition DoW to a centralized, AI-enabled automated environment for original classification decisions1.

b. Modernizing the classification lifecycle management of classified national security information from original classification to declassification including OCA delegation and

1 Declassification Decision Support Engine: Triages record corpuses, instantly processing low-risk historical material for automated declassification while routing complex, sensitive cases to human experts.

management through new classification guidance development compliant to the DoDM 5200.45 and rescinded, but maintaining knowledge contained within, obsolete SCGs.

c. Address accountability and visibility gaps in the classified national security information lifecycle including tools for managing OCA delegation, accountability, and required training.

d. Managing stakeholder inputs across functional authorities, users, the ACME Program

Management Office (PMO), and other vendors.

e. Build on initial work to establish a foundation, accountability, and auditing through the ingestion and digitization of existing static SCGs into an initial repository as a permanent system of record.

f. Streamline Derivative Classification to transition derivative classification from a manual, subjective exercise into a responsive, AI-guided workflow.

g. Build on successes of previous actions involving locating and interpreting relevant classification guidance from the DoW’s SCGs, as well as applying specific classification markings to newly generated material with proper source citations.

h. Coordinate with user groups across the DoW and coordinate with other interested stakeholders to follow a prescribed phased approach to iteratively develop and expand AI capabilities.

i. Enhance Release Determinations through the application of AI decision support to increase throughput in disclosure, foreign release, and sharing processes.

j. Improve upon, reduce redundancies, and expedite all phases of the current manual and complex release determination process with shared functional authority and a broad base of policy owners and users.

k. Conduct an AI-assisted pre-review of current classification to identify specific disclosure constraints before the equity review process is engaged to identify all applicable DoW and interagency or foreign partner stakeholders who must approve the release.

l. Engage in the referral and coordination process, followed by sterilization and redaction, secure dissemination, and decision capture and archiving.

m. Automate the current manual declassification process, including reviewing large numbers of SCG declassification guidance to identify and solve conflicting statements, determining if information warrants continued protection, and improving interoperability and traceability to meet requirements outlined in Executive Order 13526 and detailed in DoDM 5200.01 V1-3.

n. Automate the current manual extraction, redaction, and sanitization processes, including reviewing large numbers of SCG classification guidance to identify and solve conflicting statements, determining if information warrants continued protection, and improving interoperability and traceability to meet requirements outlined in Executive Order 13526, 32 CFR Part 2001, DoDM 5200.01 V1-3 and NIST SP 800-88.

o. Transition the DoW from a manual, line-by-line human review process to an AI-augmented automated framework.

p. Improve the Systematic and Automatic Declassification Review (SDR and ADR) process, the Discretionary Declassification Review (DDR) process, and the Mandatory Declassification Review (MDR) process.

q. Coordinate across the DoW, the Intelligence Community, and the National Archives.

r. Maintain flexibility to meet future iterations of ACME, which will shift focus toward continuous, enterprise-wide life cycle optimization including establishing secure, interoperable data exchanges with the National Archives and Records Administration (NARA) for seamless transition of permanently valuable historical records across agency boundaries without the need for manual processing or physical media transfers.

6. Notional Acquisition Approach: The Government is requesting feedback on several acquisition strategies being considered. These strategies are designed to maximize competition, prevent vendor lock-in, and leverage commercial innovation. The Government welcomes industry feedback, critiques, and alternative suggestions to ensure rapid deployment and long-term sustainment.

a. Acquisition Approach 1: The Government views the desired capabilities as two (2) distinct functions, notionally structured into two (2) separate contract vehicles related to the functions as detailed below:

(1) Function 1 - Integrator (Single-Award Integration Contract): Vendors responding to

Function 1 must demonstrate their capability and past performance in serving as an enterprise platform and security integrator for highly secure systems. Integrators will participate in Governance activities performed by the Government and Government-chosen entities, including Governance meetings and development of Government-owned Application Programming Interfaces (APIs). The Integrator will be responsible for platform architecture, knowledge management common services (secure file storage and exchange, identity and credential management, access control, classification data analytics), security accreditation, cross-domain coordination, and release engineering.

(a) Key integration areas of interest include:

Authoritative Cross-Domain Machine-Readable Repository: Experience establishing secure, centralized repositories with version control, integrating a validated Cross-Domain Solution (CDS) to securely filter and push classification guidance down from high to low security domains.

Zero-Trust and Identity Governance: Directly integrating platform services with enterprise Identity, Credential, and Access Management (ICAM) and Role-Based

Access Control (RBAC) to enforce continuous verification and prevent data spillage.

Third-Party Application Onboarding: Defining open APIs and data schemas that allow independently developed Function 2 applications to be added, modified, or replaced without platform redesign.

Secure DevSecOps & Disconnected Deployment: Orchestrating automated deployment, testing, patching, and rollback pipelines across multi-level security domains including but not limited to Unclassified, Controlled Unclassified Information (CUI), Confidential (C), Secret (S), Top Secret, (TS), Sensitive Compartmented Information (SCI), and Special Access Required (SAR), for connected, cloud, and air-gapped systems.

Records & Information Management (RIM) User Interface/User Experience (UI/UX) Development: Closed-loop user feedback design and implementation.

Software deployment and sustainment: Ability to deploy software to multiple environments and sustain capability. This includes patching, cyber defense, and help desk.

Identifying and solving conflicting classification statements

(2) Function 2 (Multiple Award App Development IDIQ): Multiple Award Indefinite Delivery/Indefinite Quantity (IDIQ) contract vehicle. Vendors responding to Function 2 must highlight their capabilities in agile specialized software development, algorithm design, commercial-off-the-shelf (COTS), or Government-off-the-shelf (GOTS) software products that can be deployed as modular "plug-and-play" mission applications within the Function 1 Integrator platform for any or all of the capability areas described in this section.

(a) Key software capability areas aligned with ACME include, but are not limited to:

Original Classification & Guidance Authoring: Collaborative drafting interfaces, step-by-step digital workflows, automation, and other technologies to cross-check draft SCGs against existing guides to prevent conflicting instructions.

Reduce manual burden of guidance identification & recommendation/streamlining derivative classification

Enhancing release determinations Declassification Triage: Digitization engines to structure legacy rulesets and decision-support tools that instantly process low-risk records, flagging highly sensitive or complex records for human expert adjudication.

User document digitization workflows CDS ruleset generation Potential real-time data classification labeling for machine-to-machine data Capability to ingest classification of preexisting unique document and data libraries

b. Acquisition Approach 2: A contract vehicle(s) is identified that satisfies Function 1 and/or 2 and the effort is awarded on that vehicle.

7. Government Questions for Industry: To help the Government assess technology maturity, commercial availability, and optimal contracting structures, please address the following questions in your response, as applicable, based on the function(s) to which you respond:

a. Data and Software Rights

(1) What is your approach to Government data rights? State your standard licensing models and clarify how you protect Government-owned data, rulesets, and classification policies from proprietary lock-in.

(2) Would you still be interested in this effort if, to ensure long-term operational readiness and seamless system integration, the Government sought Government Purpose Rights (GPR) on all your continuously generated/short lifetime software from the outset through the duration of the effort? This framework allows the Government to sustain and update the system over its lifecycle while fully preserving your proprietary ownership and exclusive rights to commercialize the technology in the private sector.

b. Information Assurance & Security-by-Design

(1) Describe your experience in enforcing continuous verification, data isolation, and zero-trust segmentation across all (or multiple) classification and handling levels. Address how your architecture prevents lateral movement by malicious actors and contains potential breaches within a centralized policy repository.

(2) How will you ensure algorithmic and data integrity? (Required for respondents to App

Development Function) How do you protect AI models and rule engines against training-data poisoning, prompt-injection, or subtle adversarial manipulations aimed at forcing incorrect classification or declassification outcomes?

(3) What is your experience with continuous adversarial validation (Red Teaming)?

Describe how your development and deployment workflows incorporate active, automated, and human-in-the-loop penetration testing to identify vulnerabilities prior to operationalization.

c. Acquisition & Contracting Approach

(1) What are your suggestions or alternative recommendations for the planned acquisition approach? Do you recommend a different strategy for breaking out or combining contracts for integration and application functions? Please explain how the Government can structure contracts to lower the barrier of entry for specialized, small, and non-traditional defense businesses.

8. Disclaimers: This RFI is for Market Research purposes only, as defined in Revolutionary FAR Overhaul (RFO) part 10, and any response is strictly voluntary. This is not a solicitation, nor does it commit the Government to a future solicitation. The information provided is subject to change and is not binding on the Government. The U.S. Government does not intend to award a contract as a result of this RFI. Not responding to this RFI does not preclude participation in any future solicitation, if any is issued. Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted. Issuance of this RFI does not obligate or restrict the U.S. Government to an eventual acquisition approach. The Government may use a variety of tools, including federal-compliant Generative AI applications, to assist in analyzing and summarizing responses to this RFI. All proprietary, CUI, or classified information will be handled IAW DoW security protocols and will not be processed by unauthorized applications.

9. Costs: The U.S. Government will not pay for any information or administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested party’s expense.

10. Consent: Information received from this RFI will be used for planning and market research purposes. As such, any response submitted to this RFI constitutes consent for that submission to be reviewed by military personnel, Government civilians, and embedded AFLCMC/HNJJ Engineering, Professional, and Administrative Support Services (EPASS) Advisory and Assistance Services (A&AS) contractors. The responses may be forwarded to other Government entities in consideration for applicability to other programs. Government civilians, embedded DoW contractors, FFRDCs, and/or UARCs may be involved in program management, process analysis, requirements generation, prototyping, independent vendor evaluation, operationalization on government networks, and interoperability standards for the awarded effort.

11. Responses: The Government is seeking comprehensive feedback from qualified vendors based on demonstrated capabilities, core competencies, and technical maturity. Please note, vendor responses should address the RFI questions to contribute directly to market research. The Government is not requesting/reviewing marketing material or general capability descriptions.

The Government is tentatively planning to hold in-person Industry Days at the end of September/beginning of October in the National Capital Region (NCR). All information related to the potential Industry Days will be posted on sam.gov.

a. Respond to Function 1 (Integrator) and/or Function 2 (Mission App Development), depending on expertise and technological offerings. The Government does not expect interested vendors to have the capacity or expertise to bid to every “mission app” requirement in Function 2.

b. Page Limitations: Responses are strictly limited to three (3) pages per function. If a vendor responds to both functions, the total narrative submission must not exceed six (6) pages. In addition to the narrative page limits, all respondents must complete and submit the attached spreadsheet (Attachment 1 – ACME-RFI-001 Vendor Q&A), which does not count against the page limits.

c. Submission Format:

(1) Searchable PDF format, portrait layout, 8.5 by 11 inches.

(2) Margins of at least 0.5 inches on all sides.

(3) Font size no smaller than 10-point (Arial, Calibri, Aptos, or equivalent) across all sections, including tables, footnotes, and diagrams.

(4) No cover pages, corporate brochures, appendices, or resumes are requested.

(5) All proprietary, CUI, or classified material must be clearly marked.

d. Submit responses via email to the Contracting Officer, Ms. Meredithe Sweeney at meredithe.sweeney@us.af.mil and the Contract Specialist, Mr. Leo Quinn at leo.quinn@us.af.mil, with SUBJECT: ACME-RFI-001 RESPONSE. Classified submissions must be coordinated in advance with the Contracting Officer.

12. Responses due no later than 5:00PM EDT 04 September 2026.

13. Thank you for your interest in and feedback on this requirement.

//signed//

MEREDITHE L. SWEENEY

Contracting Officer

AFLCMC/HNJ

Attachment:

ACME-RFI-001 Vendor Q&A