DAF ICAM Enterprise III RFI.pdf

Request for Information (RFI) for

Department of the Air Force (DAF) Identity, Credential, and Access Management (ICAM)

Enterprise III

Version 1.0

4 December 2025

1. INTRODUCTION

1.1 Purpose

This Request for Information (RFI) is issued by the Department of the Air Force (DAF) to conduct market research and identify a single, highly qualified vendor capable of providing comprehensive, end-to-end services for the DAF Identity, Credential, and Access Management (ICAM) program, encompassing both platform operations and application enablement. This RFI seeks information on industry capabilities, viable options, and innovative approaches for the ongoing operations, sustainment, and evolution of the DAF ICAM platform, and for the seamless onboarding of over 3,300 DAF applications.

1.2 Scope of Services:

The DAF is seeking a single vendor solution that encompasses a full range of services for the DAF ICAM program, including:

1.2.1 DAF ICAM Platform Operations and Enhancement:

Operations, maintenance, cybersecurity, service desk support, and enhancements to the DAF ICAM infrastructure to ensure functionality, stability, and ongoing evolution, including meeting evolving requirements.

1.2.2 Application Enablement:

Providing specialized ICAM professional application enablement services to DAF application owners to support the rapid and scalable enablement of 3,300+ applications to the DAF ICAM platform, enhancing security and streamlining access management. This includes providing architectural and configuration guidance, playbooks, troubleshooting guides for service desk and integration assistance, as well as supporting applications through User Acceptance Testing (UAT) and ensuring compliance with all applicable government regulations, policies, and documentation requirements.

1.2.3 Post-Enablement Application Support:

Ongoing support to DAF application owners after applications are enabled with the ICAM platform. This covers issue resolution, platform guidance, workflow implementation support, documentation, and proactive communication.

1.3 Current DAF ICAM Environment:

1.3.1 Current Technology Stack:

• Okta for Identity Provider (IdP) services, Single Sign-On (SSO), Multi- Factor Authentication (MFA), and as the Attribute Data Aggregator (ADA) via Okta Universal Directory (Okta UD)

• SailPoint IdentityIQ (IIQ) for Identity Governance and Administration (IGA) hosted in AWS GovCloud through Air Force Cloud One

1.3.2 Identities Managed:

The DAF ICAM platform manages identities for a vast user base, encompassing both persons and Non-Person Entities (NPEs). This includes over 750,000 full-time CAC-enabled personnel (Military, Civilian, and Contractor), an estimated 5 million non-CAC holders (Retirees, Spouses, Dependents), and 5 million NPEs.

This comprehensive platform supports over 3,300 DAF applications across various network environments, from fully connected NIPRNet to Contested, Degraded, and Operationally Limited (CDO-L) bandwidth or disconnected scenarios.

2. SYSTEM REQUIREMENTS

2.1 Secure Infrastructure Operations and Maintenance:

Ensure the day-to-day functionality, stability, and security of the DAF ICAM infrastructure, including hardware, software, and network components. This encompasses proactive monitoring, performance optimization, incident response, vulnerability management, security monitoring, compliance with relevant security policies and regulations (e.g., NIST, Department of War (DoW) regulations), and system upgrade and maintenance.

2.2 Test Management and Quality Assurance:

Implement and adhere to rigorous verification processes throughout the system lifecycle to provide objective evidence that the DAF ICAM platform and its components fulfill specified requirements and characteristics, while conforming to the required quality assurance standards.

2.3 External Systems Interoperability:

Develop interoperable solutions that support federated identity and access management capabilities with other DoW components, enabling seamless and secure access to resources across organizational boundaries. Integrate new data sources into the DAF ICAM infrastructure, ensuring proper data mapping, transformation, and synchronization with both internal and external services.

2.4 Identity Management for All Entities:

Establish and maintain a robust and secure system for managing Non-Person Entities (NPEs) within the DAF ICAM framework, ensuring proper authentication, authorization, and lifecycle management.

2.5 Access Management in Degraded Environments:

Designing, implementing and managing mechanisms to minimize and quickly resolve instances of Contested, Degraded, and Operationally Limited ICAM solution on NIPR and SIPR.

2.6 DAF ICAM Platform Evolution and Enhancement:

Develop, test, and implement enhancements to the DAF ICAM infrastructure, including new features and capabilities in COTS products, based on evolving business needs, security requirements, and technology advancements. These upgrades will be planned and implemented through requirements analysis, roadmaps design, development, testing, and deployment.

2.7 Emerging Technology Integration:

Rapidly prototype, test, and integrate new and emerging technologies into the DAF ICAM environment, aligning with DoW and DAF mission needs. This process includes evaluating viability, developing proof-of-concepts, recommending adoption strategies (considering security, scalability, cost, and user experience), supporting demonstrations, and documenting findings to inform future DAF ICAM investments.

2.8 Application Enablement:

Specialized ICAM professional services to enable DAF application owners to seamlessly integrate their applications with the DAF ICAM platform. These services must ensure compliant, rapid, and scalable enablement of over 3,300 applications. This includes providing expert guidance and assistance with integration tasks, user acceptance testing (UAT), and adherence to all applicable government regulations, policies, and documentation requirements.

2.9 Post-Enablement Application Support:

Provide specialized and ongoing support to DAF application owners following ICAM enablement. This includes:

• Expert guidance and best practices for leveraging the DAF ICAM platform within their applications.

• Assistance with workflow implementation and modifications related to ICAM integration.

• Proactive communication about platform updates, security advisories, and potential impacts.

• Clear escalation paths to Tier 2/3 support for platform-related issues.

2.10 Tiered Service Desk Support:

Provide comprehensive technical support through a tiered service desk model.

This includes:

• Seamless integration with the DAF Enterprise IT as a Service (EITaaS) Tier 1 Service Desk.

• Tier 2 advanced technical support to users experiencing issues with DAF ICAM services and working with DAF networking and cyber teams to escalate complex issues, troubleshooting problems, and implementing solutions in a timely manner.

• Coordinating Tier 3 support with solution technology vendors such as Okta and SailPoint.

2.11 Stakeholder Engagement

Development and execution of a comprehensive communication strategy that includes stakeholder analysis, tailored content creation, and multi-channel dissemination to engage application owners and other external stakeholders.

This includes developing engaging materials to support outreach to application owners and supporting them through the enablement process. Tools include videos and presentations, along with robust training resources and job aids to support various user roles, all accessible through a dedicated DAF ICAM website.

2.12 Service Catalog and Knowledge Management:

Maintain and update the service catalog to accurately reflect available DAF ICAM services, including descriptions, service level agreements (SLAs), and request procedures. Actively manage and expand the knowledge base to enable efficient self-service and issue resolution for users and application owners.

3. REQUEST FOR INFORMATION QUESTIONNAIRE

3.1 Enterprise Operations & Enhancement (Approx. 3 pages)

3.1.1 Company Background & Experience:

Provide a concise description of your company's experience implementing, sustaining, and enhancing enterprise ICAM solutions, with a specific focus on DoD/Federal environments. Quantify the scale of your experience by indicating the number of users supported, applications integrated, and transactions processed daily/monthly in similar environments. Highlight your proven capabilities and experience with Okta and SailPoint in a unified, global platform. For at least two brief examples, detail your specific role in the integration process, including the percentage of code directly developed or modified by your team. Address your specific experience enabling ICAM in CDO-L environments, detailing approaches that ensure resilience and maintain security posture, and quantify the number of applications integrated in such environments. Elaborate on the architectural choices you made to address these challenges, including decisions related to data replication, local caching, authentication mechanisms, and authorization policies.

3.1.2 Operational Resilience & Agile Development:

Describe your strategy for ensuring high availability, disaster recovery, business continuity, and data integrity for an enterprise ICAM platform.

How does your DevSecOps approach ensure continuous improvement and secure integration of ICAM capabilities? What is your company's current Capability Maturity Model Integration (CMMI) maturity level (if applicable)?

Briefly describe how your CMMI-based processes contribute to delivering high-quality, reliable ICAM services and successful application onboarding.

3.1.3 Enterprise Integration & NPE Management:

Describe your approach to integrating with existing DAF enterprise services (e.g., ITSM, SIEM, network access controls) to maximize value and efficiency. Provide specific examples of successful integrations in similar environments. Detail your strategy for lifecycle management, authentication, and authorization of Non-Person Entities (NPEs), addressing security considerations and potential integration challenges with existing DAF systems.

3.2 ICAM Enablement & Integration (Approx. 4 pages)

3.2.1 Mass Enablement Strategy:

Outline your comprehensive strategy to onboard over 3,300 applications within a three-year period. Your response should cover:

• Methodology for application assessment and categorization (including complexity scoring). Describe in detail the factors considered for complexity scoring (e.g., code base size, integration points, data sensitivity, user base size, existing documentation).

• Approach to providing clear and actionable guidance to application owners (developers and testers)

• Strategy for integrating applications without pre-existing connectors, including risk mitigation

• Prioritization and phasing methodology, considering application criticality and dependencies

• How the strategy scales across a distributed environment, ensuring consistency and control

• Proposed Key Performance Indicators (KPIs) to track progress and success

• Staffing plan (FTEs and roles) required for successful execution. Detail the team structure you will employ for application onboarding, including roles, responsibilities, and relevant expertise (e.g., Okta specialists, SailPoint specialists, developers, security engineers). What tools and technologies will your team leverage to streamline the onboarding process (e.g., automation scripts, configuration management tools, CI/CD pipelines)?

• Change management and communication strategies to facilitate adoption)

Additionally, please provide specific feedback on how incentives should be implemented to ensure your team achieves these goals.

3.2.2 Enablement Rate & Resources:

What is the maximum sustained monthly application onboarding rate you have achieved for Okta and SailPoint deployments in a DoW environment?

Quantify the duration of this rate and provide a brief description of the key processes and automation employed.

• Provide a detailed breakdown of the types of applications onboarded to achieve this rate, categorized by complexity score and key characteristics (e.g., web applications, legacy systems, cloud-native applications, applications with sensitive data).

• What level of 'white glove' support was required and for what types of applications? Justify the 'white glove' approach for each application type by explicitly linking it to specific complexity factors. How does your team adapt its approach for applications of varying complexities to optimize the onboarding process?

3.3 Technical Approach to Enablement (Approx. 2 Pages)

3.3.1 Zero Trust Enablement:

Describe your approach to ensuring applications meet the DoD Zero Trust Execution Roadmap and Policy requirements through the DAF ICAM enablement process. Provide specific examples of how you would implement Zero Trust principles (e.g., least privilege, microsegmentation, continuous monitoring) during application onboarding. Specifically, how will you mitigate the risk of introducing new security vulnerabilities, and what tools and processes will you use to identify and address potential vulnerabilities?

3.3.2 Playbooks & Guided Enablement:

Describe your strategy for developing scalable, instructional playbooks to enable application owners to self-enable DAF ICAM. How will you facilitate Attribute-Based Access Control (ABAC) redesign during enablement? What existing connectors would you leverage, and what is your approach to developing new connectors when required? How will you ensure application owners have sufficient training and support to use the playbooks effectively and avoid errors that could lead to application downtime or security breaches?

3.3.3 Application Support & Training:

Outline the technical support and enablement training you would provide to application owners. Describe the types of user guides you would develop and your approach to ensuring their effectiveness in facilitating successful self-enablement. How will you measure the effectiveness of your training program in reducing the need for support and preventing application enablement issues?

3.3.4 Outreach and Stakeholder Engagement

Describe your approach to stakeholder engagement and leveraging feedback to drive user adoption of the DAF ICAM solution. Specifically:

• What tools and methods will you utilize to develop targeted messaging, engage application owners, educate them about DAF ICAM, and track their progress throughout the enablement journey?

• What are your capabilities for creating content and developing and maintaining a user-friendly DAF ICAM website that effectively serves as a central hub for program information, leadership messaging, progress updates, and readily accessible training materials?

3.4 Performance and Management (1 Page)

3.4.1 Management Approach:

Describe your management approach, focusing on how you will ensure project success through effective:

• Project status reporting (frequency, content, format).

• Risk management (identification, mitigation, escalation).

• Quality assurance (based on SAE AS9100 principles).

• Communication with stakeholders (methods, frequency, escalation paths).

• Database tracking for enablement progress and reporting.

3.4.2 Transition Plan:

Outline your process for developing a detailed transition plan that facilitates seamless cooperation and collaboration with existing contractors, and conversely, your plan for ensuring a smooth transition to a subsequent contractor at the end of the contract period. How will you ensure a qualified and stable workforce throughout the contract period?

What Government Furnished Information (GFI) or Government Furnished Property (GFP) is critical to your success, and why? What measurable outcomes would you recommend to track the success of the transition?

3.5 Service Delivery & Performance (Approx. 2 pages)

3.5.1 NIPRNet Service Desk & Operational Readiness Support:

Describe your proposed approach to implementing NIPRNet service desk capabilities for the DAF ICAM solution. How will you maximize automation for efficiency in Tier 2 and Tier 3 user support, and how will you integrate with the existing EITaaS Service Desk to provide seamless Tier 1 support?

Propose a Service Level Agreement (SLA) framework for the NIPRNet service desk and describe how your approach will support the long-term transition to operational readiness and monitoring by stakeholders like Air Forces Cyber (AFCYBER).

3.5.2 Quality Assurance & Service Level Management:

Provide an overview of your Quality Assurance plan. Propose specific, measurable Service Level Agreements (SLAs) for key tasks and deliverables.

3.5.3 Communication & Cost Control:

Briefly describe your strategy for effective coordination and information sharing of program status among all stakeholders. Outline your approach to cost control and budget management, including specific examples of cost-saving measures you have implemented in similar projects.

3.6 Contractual and Transition Planning (Approx. 2 pages)

3.6.1 Contracting Approach Recommendation:

Recommend the most effective contracting approach (e.g., contract type, pricing model, award mechanism) to support DAF ICAM operation, sustainment, enhancement, and application enablement. Identify specific existing DoD contract vehicles that could be leveraged. Should DAF ICAM operation/evolution be separated from application onboarding into separate agreements, potentially with different vendors? Justify your recommendation, considering the potential benefits, challenges, risks, and incentives for collaboration. Additionally, please provide your opinion on whether the DAF should consider utilizing a Commercial Solutions Opening (CSO) as a contracting vehicle for this requirement. Explain the potential advantages and disadvantages of using a CSO in this context.

3.6.2 Contractual Incentives & Risk Management:

Describe how your recommended contract type and pricing model would specifically incentivize performance, cost-efficiency, innovation, and customer satisfaction, and explicitly describe the types of contractual incentives you recommend to achieve these goals. Explain how these incentives would be structured to encourage desired behaviors and mitigate potential risks to successful program execution. Provide examples of incentive structures you have successfully implemented in similar projects.

4. RESPONSE FORMAT

4.1 Document Requirements:

The Government requests written responses to this RFI in a Microsoft Word document not to exceed 15 pages in length (cover page not included)

Formatting Requirements:

• Page Size: 8.5" x 11.0"

• Margins: 1" on all sides

• Font: Times New Roman, no smaller than 12 point

4.2 Cover Page Requirements

Respondents should identify the following information on the cover page of its submission:

• Company Name, Address, and Point of Contact

• CAGE Code

• NAICS Code, size of pursuant business

• Large Business or Small Business designation

• Company Ownership: Domestic or Foreign (indicate country of ownership)

• GSA Schedule(s)/GWAC(s)/Other Ordering Vehicles held that could be applicable to this requirement

4.3 Submission Guidelines

• The company name should appear clearly on every page of the submittal

• Proprietary information must be clearly marked

• To the maximum extent possible, please provide non-proprietary information

• Please identify any information that might be identified as Controlled

Unclassified Information (CUI) or proprietary and ensure it is transferred through an appropriate medium

• No classified information shall be submitted

4.4 Questions and Inquiries

Any questions regarding this RFI must be submitted via email within 5 business days of this posting to:

• Contracting Officer: kurtavius.brown@us.af.mil

• Contract Specialist: darnita.mcbride@us.af.mil

All questions and their answers will be posted with this RFI for all interested parties to access.

mailto:kurtavius.brown@us.af.mil mailto:darnita.mcbride@us.af.mil

5. DISCLAIMER

5.1 Important Notice

This is a Request for Information (RFI), as defined in Federal Acquisition Regulation (FAR) 15.201(e). Any information submitted by respondents to this request is strictly voluntary. This is not a Request for Proposal (RFP), Request for Quotation (RFQ), or Invitation for Bid (IFB); nor does its issuance obligate or restrict the U.S. Government to issue an RFP, RFQ, or IFB in the future. The U.S.

Government does not intend to award a contract or order based on responses from this RFI.

Not responding to this RFI does not preclude participation in any future RFP, RFQ, or IFB, if any are issued.

5.2 Cost and Payment Policy

Respondents are advised the U.S. Government shall not pay for any information provided, the use of such information, the preparation of such information, travel expenses, nor any administrative costs incurred in response to this RFI. All costs associated with responding to this RFI will be solely at the interested parties’ expense.

5.3 Information Usage and Review

Information received from this RFI will be used for planning and market research purposes. As such, any response submitted to this RFI constitutes consent for that submission to be reviewed by military personnel, Government civilians, imbedded AFLCMC/HNI DoD contractors, and Federally Funded Research and Development Corporations (FFRDCs) or University Affiliated Research Corporations (UARC). Supporting this requirement are Applied Research Solutions, Astrion, and the MITRE Corporation. The responses may be forwarded to other Government entities in consideration for applicability to other programs.

5.4 Proprietary Information Protection

Any proprietary information submitted should be identified as such and will be properly protected from disclosure. All DoD contractor and FFRDC personnel reviewing RFI responses will have signed non-disclosure agreements and understand their responsibility for proper use and protection from unauthorized disclosure of proprietary information. The U.S. Government shall not be liable for damages related to proprietary information that is not properly identified.

Proprietary information will be safeguarded in accordance with the applicable U.S. Government regulations.

5.5 Additional Disclaimers

Respondents are advised that the Government is under no obligation to provide feedback with respect to any information submitted.

Issuance of this RFI does not obligate or restrict the U.S. Government to an eventual acquisition approach.