Request for Information (RFI) RFI-ARMY-DTSPO-2026-0420.docx

Request for Information (RFI) for Enterprise Governance, Data Tagging, and Records Management Solution for Microsoft 365

1. GENERAL INFORMATION

· Notice Type: Request for Information (RFI) / Sources Sought

· RFI Number: RFI-ARMY-DTSPO-2026-0420

· Issuing Office: Army Contracting Command – Aberdeen Proving Ground, Huachuca Division, Bravo Branch

· NAICS Code: 541512 - Computer Systems Design Services

· Date Issued: 20 April 2026

· Response Due Date: 28 April 2026, 4:00 PM Arizona Time DISCLAIMER: This Request for Information (RFI) is issued solely for information and planning purposes. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service whatsoever. The Government will not pay for any information or administrative costs incurred in response to this RFI. All information received in response to this RFI that is marked “Proprietary” will be handled accordingly.

2. BACKGROUND

The U.S. Army operates one of the largest and most complex Microsoft 365 (M365) environments in the world, presenting significant challenges for governance, security, and compliance. The Government requires a technical solution to enforce policy, automate administrative and records management tasks, provide hierarchical visibility and control, and empower a delegated administration model across Major Commands (MACOMs) and subordinate organizations. The solution must seamlessly integrate with and enhance the native capabilities of the M365 platform while scaling to meet the Army's performance demands.

3. SCOPE OF REQUIREMENT

The Government is seeking a mature, scalable Commercial-Off-The-Shelf (COTS) solution to meet requirements across several key functional areas, including Enterprise Governance, Data Sensitivity and Security (Data Tagging), Automated Records Management, SharePoint & Teams Management, and Storage Optimization. The solution must be a configurable, vendor-supported platform, not a custom software development effort.

4. INFORMATION REQUESTED

Interested parties are requested to provide a response that addresses the following sections.

PART I: CORPORATE INFORMATION

· 1.1 Company Name & Address:

· 1.2 Point of Contact: (Name, Title, Email, Phone Number)

· 1.3 CAGE Code & Unique Entity Identifier (UEI):

· 1.4 Business Size & Socio-Economic Status: (e.g., Large Business, Small Business, 8(a), WOSB, SDVOSB, etc.)

· 1.5 Federal Contract Experience: Briefly describe your experience providing IT solutions to DoD or other Federal agencies. Include relevant contract vehicles you currently hold (e.g., GSA MAS, SEWP, ITES-SW2).

· 1.6 Subcontracting: Does your approach for this requirement require subcontracting?

PART II: SOLUTION OVERVIEW

· 2.1 Solution Name & Description: Provide the name of your potential proposed COTS solution and a brief, high-level overview of its architecture (e.g., Software as a Service (SaaS), on-premises virtual appliance, hybrid).

· 2.2 Federal Security Compliance: Describe your potential solution's current security posture. Is it FedRAMP authorized? At what level (Low, Moderate, High)? Does the solution operate in Azure Government Cloud at DoD Impact Level 5 (IL5)?

· 2.3 Maturity: How long has the potentially proposed solution been commercially available?

PART III: CAPABILITY & TECHNICAL QUESTIONS

Please provide a direct response to each of the following questions regarding your potentially proposed solution.

1. How do you integrate with other capabilities? Particularly MS Purview and SharePoint Online.

2. What Admin permissions or API permissions required for the software to function?

3. How are admin permissions managed within the software?

4. How are logs handled?

5. How are reports and alerts managed? Are they customizable?

6. What administrative roles or service accounts from your solution require permissions within the Army’s Microsoft 365 (A365) tenant?

7. Do any components require tenant-wide administrative permissions (e.g., Global Admin, SharePoint Admin, Compliance Admin)? If so, how are these used?

8. Does the product use Azure Entra ID app registrations, and what Application Programming Interface (API) permissions are required?

9. Does the solution require any vendor access to Army M365 data or your solution’s supporting infrastructure during normal operations or troubleshooting?

10. Describe which functions of your solution run inside the Army M365 tenant versus within your hosted environment.

11. Does any processing leverage vendor-managed Artificial Intelligence/Machine Learning (AI/ML) models, and can AI/ML analytics be performed without exporting sensitive content or metadata?

12. What is the expected volume of API calls per day, and does the solution require elevated throttling limits?

13. Does your solution support Common Access Card/Personal Identity Verification (CAC/PIV), conditional access, and Entra ID-based identity?

14. What access (if any) do your personnel or systems require to Army M365 data or to your solution’s supporting infrastructure (e.g., SaaS back end, support tools, logs), including during troubleshooting, and what authentication/authorization controls govern that access?

15. Can the solution operate with zero vendor access after deployment, and can all vendor access be disabled or audited by Army Network Enterprise Technology Command (NETCOM)?

16. Identify whether any Army data (including metadata, logs, labels, or content) is copied, stored, or processed outside the M365 boundary. Include any dependencies on vendor-managed infrastructure, hosting outside Department of Defense (DoD) IL5, or use of non-U.S. regions or subcontractors.

17. If your solution includes SaaS or vendor-hosted components, identify the compliance level of those environments (e.g., FedRAMP High, DoD IL5) and status of any relevant authorizations (e.g., DISA Provisional Authorization for IL5).

18. How does your solution enforce Army-aligned delegated administrative scoping, and are all administrative actions fully audit-logged with the ability to export logs to Army Security Information and Event Management (SIEM) tools in near real time?

19. Where are audit logs, telemetry, and analytics data stored, and can all such data remain entirely within the Army’s M365 tenant? If any logs reside in vendor systems, identify what data elements are stored, for how long, and in what regions or environments.

20. How does the solution ensure compliance with National Archives and Records Administration (NARA) retention rules when performing:

· Redundant, Obsolete, and Trivial (ROT) cleanup

· lifecycle actions

· metadata remediation

· bulk operations

21. Does any processing leverage vendor-managed AI/ML models outside the Army environment?

22. Does your backup capability require extraction of data outside Microsoft’s boundary, and (if so) are backups stored in environments certified at IL5?

23. Can data restores be performed without violating retention or legal hold constraints?

24. Provide a complete list of all administrative actions your system can take on Army content or configuration, including:

· Where the logic runs (tenant / vendor / hybrid)

· Required permissions

· How actions are validated and logged

· Whether actions can be restricted by MACOM or command

25. What guardrails exist to prevent accidental or malicious bulk changes?

5. SUBMISSION INSTRUCTIONS

· Format: Responses shall be submitted in PDF format.

· Submission: All responses must be submitted electronically to the points of contact below no later than the Response Due Date.

· Name: Contracting Officer, Walter L. Carbajal

· Email: walter.l.carbajal.civ@army.mil

· Subject Line: "Response to RFI RFI-ARMY-DTSPO-2026-0420

· Questions: Any questions regarding this RFI shall be submitted via email to the same points of contact no later than 23 April 2026, 4:00 PM Arizona Time.