Final-TSC RFI for Password Management SW.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION (RFI) TEMPLATE

Attachment AS - Request for Information (RFI) Template

Version 1.2 Page 1

Acquisitions Administrative Unit

According to FAR 15.201, requests for information (RFIs) may be used when the government does not presently intend to award a contract but wants to obtain price, delivery, other market information, or capabilities for planning purposes.

Responses to these notices are not offers and cannot be accepted by the government to form a binding contract. There is no required format for RFIs.

Version 1.2 Page 2

REQUEST FOR INFORMATION (RFI)

TSC Authentication Management Software Requirement

8/19/2025

Version 1.2 Page 3

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL

OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO

THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified manufacturers capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the Threat Screening Center (TSC).

The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The TSC conducts its screening mission through the development of technology initiatives for watch-listing and encounter information that is shared with Federal, State, local and international law enforcement, and national security partners.

To carry out its mission, the TSC requires an authentication management software solution. This software would be considered commercial, and this effort will not be consolidated with previous efforts.

In accordance with NIST 800-53 revision 5 related to security control IA-05 (01) Authenticator

Management: Password-based authentication, information systems must have the requirements below met.

Information Systems must:

1. Maintain a list of commonly used, expected, or compromised passwords and update the list immediately and when organizational passwords are suspected to have been compromised directly or indirectly.

Version 1.2 Page 4

2. Verify, when users create or update passwords, that the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-5(1)(a).

3. Transmit passwords only over cryptographically protected channels.

4. Store passwords using an approved salted key derivation function, preferably using a keyed hash.

5. Require immediate selection of a new password upon account recovery.

6. Allow user selection of long passwords and passphrases, including spaces and all printable characters.

7. Employ automated tools to assist the user in selecting strong password authenticators.

8. Enforce the following composition and complexity rules: a case sensitive 12-character mix of upper-case letters, lower-case letters, numbers and special characters in including at least one of each.

The TSC requires a software solution to help it meet these requirements above.

CONTRACTOR QUALIFICATIONS

This RFI is open to small and large businesses for market research only to request input from potential providers of search software solutions.

1. Company name and business size.

2. Provide evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience). Information provided shall be succinct and related to the requested information in this RFI. All submissions must be unclassified.

3. The Government would like to know which firms can provide the search software solutions for this contemplated requirement by identifying themselves and responding to this RFI. The

Government requests the following information: Company name and business size.

4. Provide evidence to show that your company can provide the requested services and/or products required (i.e. technical ability, personnel, and experience). Information provided shall be succinct and related to the requested information in this RFI. All submissions shall be unclassified.

5. Address whether your company has a GSA Schedule and if they are capable of providing these services on schedule. If able to provide the services on schedule, provide the schedule and SIN.

6. Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

Version 1.2 Page 5

Required Information:

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract:

CONTEMPLATED REQUIREMENT

FBI's Threat Screening Center (TSC) Information Technology Unit is issuing this Request for Information (RFI) to:

- Gather industry information on the enclosed requirements.

- Request information on any industry changes or improvements that the FBI should consider when looking to achieve products and capabilities that meet requirements and are compatible with the commercial environment.

- Request information on potential barriers to obtaining solutions that meet objectives needed to accomplish stated requirements. The areas of interest for contemplated requirements and scenarios are addressed below.

DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION AS A RESULT OF

THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL AND PLANNING PURPOSES AND

DOES NOT CONSTITUTE A SOLICTIATION. IN ACCORDANCE WITH FAR 15.201(e), RESPONSES

TO THIS NOTICE ARE NOT OFFERS AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO

Version 1.2 Page 6

FORM A BINDING CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES

NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY

THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS

UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO

FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT.

ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS

STRICTLY VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE

1. All interested parties shall submit capability packages in response to this notice.

2. Do submit succinct, thoughtful responses to the requirements/questions listed in this

RFI.

3. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

4. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the

FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS:

Interested companies are requested to submit their responses to the Contracting Office addressing all requirements of this RFI. Submissions shall be provided in Word, Excel or PDF searchable format 8 ½ x 11-page size, no more than 25 pages (includes cover page) in length, single spaced, 12-point font, one-inch margins, Times New Roman Font, demonstrating ability to meet the FBI’s requirements. Any terms and conditions applied to test licenses shall be provided as a separate file, not included as part of the page limitation. Any questions related to this RFI shall be sent via email, in excel format to the contracting officer no later than 9/9/2025

Version 1.2 Page 7 at 5:00pm Eastern Time. The documentation must include as part of the response an introductory page outlining the below information. This RFI shall be submitted to the contracting officer, Brandon James (bmjames@fbi.gov), no later than 9/30/2025 at 5:00 pm

Eastern Time.

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

UEID Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract: