DT RFI Secure Content Management and Collaboration Platform.pdf

SBU - CONTRACTING AND ACQUISITIONS

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC TECHNOLOGY (DT)

OFFICE OF INFORMATION TECHNOLOGY ACQUISITION (ITA)

REQUEST FOR INFORMATION (RFI)

for

SECURE CONTENT MANAGEMENT AND COLLABORATION

PLATFORM

PART 1:

REQUEST FOR INFORMATION BACKGROUND AND OBJECTIVES

1.0 PURPOSE

This Request for Information (RFI) is issued as market research to determine industry’s capabilities to provide a secure content management and collaboration platform solution that will support the Department of State’s (State) global diplomacy mission and business processes.

The Government does not commit to award a contract on the basis of this RFI, or reimburse any costs associated with the preparation of responses.

This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.

Responses to this RFI will assist the Department in determining the potential level of interest, competition adequacy, and technical capabilities of commercial vendors to provide the required products and/or services. The Government does not guarantee any action beyond this RFI.

The results of this market research will contribute to determining the acquisition plan and the method of procurement. The anticipated North American Industry Classification System (NAICS) code assigned to this procurement is 513210 and Product Service Code (PSC), 7A21.

2.0 BACKGROUND

The Department's mission is to advance the interests of the American people, their safety, and economic prosperity by leading America’s foreign policy through diplomacy, advocacy, and assistance. The mission of the Bureau of Diplomatic Technology (DT) is to provide effective management of State’s technical infrastructure, digital assets, and deployment of crucial technologies at home and around the globe to enable diplomacy at the physical and digital edge.

To do this, DT requires a cloud-based solution that enables the secure creation, collaboration, sharing, storage, and management of digital content, both internally and with trusted external partners, to ensure that Department personnel can share, access, and control the information they need, when they need it, from anywhere in the world. The platform must support controlled, role-based access to content, facilitate real-time collaboration, enable digital signature workflows, and provide centralized governance over documents, records, and other digital assets throughout their lifecycle.

To this end, DT is seeking input from industry to provide market-leading solutions capable of meeting the full breadth of functional requirements outlined in this RFI.

The Department requires access to a fully integrated platform that is compliant with current federal security requirements, is easy to use, flexible, scalable, customizable, and configurable to meet specific Department requirements as further detailed below.

3.0 REQUEST FOR INFORMATION OVERVIEW

As further detailed in Section 4, the Department is seeking to identify capable and interested partners able to provide the products and/or services required to meet the full range of functional capabilities outlined in this RFI. Viable partners should have demonstrated experience deploying the solutions and delivering the ongoing support required to maintain, expand, and upgrade the solution over time for an organization of similar size, global scope, and mission complexity as the Department of State.

Information requested in this RFI includes the following categories:

• Company Information (Section 1) - Identification of interested vendors, socio-economic status, and potential acquisition vehicles to inform the Department’s potential acquisition strategy options.

• Capability Assessment Against Functional Requirements (Section 2) - Description of vendor’s proposed technical solution and ability to fully meet all stated functional requirements.

• Past Experience (Section 3) - Past project example(s) demonstrating vendor’s experience implementing their proposed solution to address the needs of an organization of similar size, global scope, and mission complexity as State.

4.0 SUBMISSION INSTRUCTIONS

All written responses should be submitted in Microsoft-compatible formats (e.g., Word) or PDF.

Responses must use 12-point font and 1-inch margins, including all text, tables, and graphics. Additional attachments, brochures, or other marketing materials are not requested and will not be considered as part of the response. Response page limit(s) by section are noted below.

• Section 1 - 1 Page

• Section 2 - 10 Pages

• Section 3 - 5 Pages

Please submit all materials to Guio Jacobs at JacobsG@state.gov no later than Friday, April 24, 2026 at 12:00 p.m. EST (Eastern Standard Time).

The Government will not accept questions after Monday, April 20, 2026. Please submit questions to Guio Jacobs.

The Government will post the questions and responses on SAM.gov with sufficient time for contractors to complete their responses.

Please be advised that all submissions become Government property and will not be returned.

UNDER NO CIRCUMSTANCES SHOULD ANY RESPONDENT

CONTACT ANY DEPARTMENT PERSONNEL REGARDING THIS

NOTICE.

PART 2: REQUESTED INFORMATION

Respondents are asked to provide the information requested below in accordance with the instructions outlined in Part 1, Section 4.0 above.

Section 1 - Company Information

Please provide the following details regarding your organization:

• Company name.

• Company’s point of contact (POC) name.

• Company’s POC phone number.

• Company’s POC email address.

• Company’s URL/web address.

• Company’s Cage Code.

• Company’s Unique Entity Identifier (UEI) Number.

• Company federal socioeconomic classification(s), if any, based on NAICS

Code that applies to the proposed solution.

• List General Services Administration (GSA) schedule, Government-wide

Acquisition Contracts (GWACs), or other federal Indefinite Delivery/Indefinite Quantity (IDIQs) or contracts your company holds that are accessible by the Department and where the full proposed solution can be procured, including corresponding schedule number/or contract number.

Section 2 - Functional Requirements Assessment

The Department’s functional requirements for the solution are outlined below.

Respondents are asked to provide a structured response that meets the following format requirements:

• Response should be structured and annotated to clearly map the detailed description of the proposed solution’s capabilities to the numbered requirements captured in the sections below.

• Response narrative content should provide sufficient details regarding the proposed solution’s specific technical capabilities to demonstrate that the solution is capable of fully satisfying requirements.

2.1 General Requirements

Proposed solutions must meet all of the following general requirements, in addition to the detailed technical requirements outlined in subsequent sections to be considered viable for State’s needs. Vendors should assess these requirements carefully and fully describe their ability to meet them:

a. Solution shall provide a proven, enterprise-grade commercial-off-the-shelf (COTS) cloud platform with demonstrated experience successfully deploying and operating in the federal environment. Custom-built or unproven solutions will not be considered.

b. Solution shall be deployed as a single, FedRAMP High authorized platform operating within one security boundary and one unified user interface, delivering all core capabilities through native platform functionality and configuration, without reliance on custom development, third-party overlays, or separate add-on products.

c. Solution shall provide substantial out-of-the-box functionality with rapid no-code configuration for features such as workflow automation, document processing, and content portals.

d. Solution shall possess and maintain FedRAMP High authorization. The solution shall also demonstrate alignment with, and the ability to support customer compliance with, applicable federal and industry standards, regulations, and certifications below:

Authorizations / Certifications:

o Department of Defense Level 4 (DoD IL4) o International Organization for Standardization (ISO) 27001/27018 o Payment Card Industry (PCI) Data Security Standard

Regulatory and Compliance Framework Support:

o International Traffic in Arms Regulations (ITAR) o Internal Revenue Service Publication 1075 (IRS 1075) o Financial Industry Regulatory Authority/Securities and Exchange Commission Rule 17a-4 (FINRA/SEC 17a-4) o National Archives and Records Administration (NARA)-compliant records management o Health Insurance Portability and Accountability Act (HIPAA) o Health Information Technology for Economic and Clinical Health Act

(HITECH)

Vendors shall describe how the platform enables compliance with these requirements, including relevant controls, data handling capabilities, auditability, and any supporting attestations or third-party validations.

e. Solution shall include professional services to support the architecture, integration, configuration, pilot deployment, and phased enterprise rollout.

2.2 Core Platform, Scale, and Administration

State requires an enterprise collaboration platform that supports secure, governed collaboration across organizational boundaries, including with foreign governments, international organizations, other U.S. Government agencies, contractors, and other external mission partners.

f. Solution shall support global, enterprise-scale operations with elastic scalability across users, transactions, and content volumes, without storage limits, archival tiers, or incremental storage costs.

g. Solution shall not impose per-external-user or per-transaction licensing constructs that would restrict mission operations.

h. Solution shall support browser-based access without requiring client installation and enable access from non-government devices where authorized.

i. Solution shall provide native in-browser preview and interaction for 150 or more file types, including multimedia (audio files, video files, RAW camera formats), specialized formats such as 3D/CAD models, and native PDF annotation, markup, and redaction capabilities without requiring users to download files or install separate desktop applications.

j. Solution shall provide centralized administration for configuration, policy enforcement, user and group management, and system‑wide controls across the enterprise, including centralized configuration of security, sharing, watermarking, retention, and workflow policies for internal and external collaboration.

k. Solution shall provide administrative dashboards and reporting capabilities to monitor usage, adoption, security posture, compliance, and operational performance. Dashboards shall support security incident investigation, policy violation monitoring, and compliance reporting.

2.3 Secure External Collaboration, Identity, and Access Control

State is seeking a solution that enables secure collaboration across internal and external stakeholders, including non-federal and international partners. State requires that the solution provide robust identity integration, granular access controls, and a seamless user experience while maintaining strong security and risk-based access enforcement.

l. Solution shall enable secure collaboration with internal and external users, including international and non-government partners, without requiring external users to be provisioned in Department-managed identity systems.

m. Solution shall support seamless external user onboarding and secure content exchange, including account-free submission capabilities for inbound data collection.

n. Solution shall provide granular access and sharing controls, including role-based and attribute-based access control, domain and geographic restrictions configurable without custom development. Please list the total number of native permission levels your solution offers for external collaborators.

o. Solution shall enforce persistent, content-centric protections such as access expiration, download restrictions, watermarking, and access revocation for externally shared content.

p. Solution shall integrate with Department identity services, including Common Access Card (CAC) / Personal Identity Verification Card (PIV) for internal users, and support risk-based multi-factor authentication for external users.

q. Solution shall provide phishing-resistant multi-factor authentication for sensitive signature workflows using existing government-issued credentials.

r. Solution shall support rapid creation and lifecycle management of secure collaboration workspaces for cross-organizational and time-sensitive operations.

s. Solution shall provide a consistent and intuitive user experience for internal and external users across collaboration, content management, workflow, and signature activities.

2.4 Security, Governance, and Compliance

State requires a solution that provides integrated, content-centric security and governance capabilities to protect sensitive information and enforce policy across the full lifecycle of content. State requires that the solution support automated protection, threat detection, auditability, and compliance with applicable federal standards.

t. Solution shall provide native data loss prevention and content classification capabilities to automatically identify and protect sensitive data, including Personally Identifiable Information (PII) such as Social Security numbers, passport numbers, driver's license numbers, financial data, healthcare information, and other regulated information using built-in and customizable data types.

u. Solution shall support policy-driven security controls based on content classification, user identity, device posture, and access risk, including restrictions on sharing, downloading, and external access.

v. Solution shall provide content-centric threat detection, including built-in malware scanning, deep scanning of files, identification of anomalous behavior, suspicious access patterns, and ransomware indicators, with automated response capabilities, without requiring separate add-on products.

w. Solution shall maintain a comprehensive, immutable audit trail across the full content lifecycle and support monitoring, investigation, and compliance reporting.

x. Solution shall provide centralized governance capabilities including retention policies, legal hold, and defensible disposition applied consistently across all content.

2.5 Digital Signature, Workflow Automation, and Artificial Intelligence (AI)

State is seeking a solution that enables digital-first operations through integration automation, electronic signature, and artificial intelligence capabilities. State requires that these capabilities operate within the same secure, governed environment as the underlying content and support enterprise-scale adoption without usage-based limitations, performance constraints, or incremental transaction-based costs.

y. Solution shall provide integrated electronic signature capabilities, including CAC/PIV based signing, routing, and audit tracking, within the same platform used for content and collaboration.

z. Solution shall support high-volume signature transactions for internal and external users without per transaction pricing constraints.

aa. Solution shall provide configurable workflow automation using low-code or no-code capabilities, enabling business users to design and manage workflows without custom development.

bb. Workflow automation shall operate within platform security and governance controls, ensuring enforcement of access restrictions, retention, and data protection policies.

cc. Solution shall provide native AI capabilities, including search enhancement, summarization, metadata extraction, and content analysis, within the same FedRAMP High environment.

dd. Solution shall support multiple approved AI model providers with centralized governance, auditability, and unlimited end user AI queries included in base platform licensing with no per query, per token, or per user incremental fees.

ee. Solution shall support real-time collaboration, including concurrent editing, commenting, tasking, and version control, with interoperability across common productivity tools.

2.6 Integration, Training, and Operational Support

State is seeking a solution that integrates seamlessly with existing enterprise systems while enabling mission-critical operations across a wide range of

Department use cases. State requires that the solution support interoperability, user adoption, and operational effectiveness in both routine and high-risk environments.

ff. Solution shall provide standard, non-proprietary Application Programming Interface (APIs) and integration capabilities to support interoperability with Department systems, including identity, security, and records management platforms.

gg. Solution shall support a large catalog of at least 1,500 pre‑built integrations, with leading enterprise systems such as Salesforce, ServiceNow, Microsoft Office, and Google Workspace, to minimize custom integration development.

hh. Solution shall provide comprehensive training and onboarding resources tailored to user roles, including administrators, security personnel, records managers, and legal staff.

ii. Solution shall support Department operational scenarios including crisis response, international collaboration, and high-threat environments requiring secure, time-sensitive information exchange.

jj. Solution shall provide reporting capabilities to support mission tracking, accountability, and alignment with federal modernization initiatives, including digital transformation and cybersecurity objectives.

3.0 PAST PERFORMANCE

The Department is seeking a cloud-based secure content management and collaboration solution provider that has a proven track record in the U.S. federal space with demonstrated experience supporting agencies of similar size, global scope, and mission complexity as the Department. Such experience is critical to ensure that the solution has a proven record of providing and maintaining a secure content management and collaboration platform within the federal environment.

Please provide the following information regarding your experience deploying your solution for federal customers.

3.1 Federal Past Performance (Last Three Years Only)

Please list all federal agencies where you have successfully deployed your solution in the last three years. For each experience noted, in a single table, please provide:

• Agency and organization name.

• Period of performance.

• Solutions provided to the agency.

• Schedule, GWAC, or contract used for the requirement.

• State whether your company was a prime or subcontractor.

3.2 Past Performance Description (Two Projects)

For at least two, but not more than three projects, of the federal implementations provided in Section 3.1 above, please provide the detailed information requested below to further demonstrate relevant past experience.

• Dollar value of contract (across full period of performance).

• Period of performance dates.

• Description of how the past performance demonstrates ability to meet the requirements outlined in this RFI, particularly for customers requiring a global footprint for deploying the solution and/or an ability to support the handling of sensitive information.

Disclaimer: This RFI Notice is for information gathering purposes only as a means to identify interested and capable sources that can provide a solution that fully meets all requirements outlined in Part 2 of this notice. The information provided in this Notice is subject to change and is not binding on the Government.

The Department has not made a commitment to procure any of the items/services discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur costs for which reimbursement would be required or sought. State will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential. All submissions become Government property and will not be returned.