RFI_DCSA PSAM_RFI_20260914.docx
DOCX document 34 KB Posted
- Solicitation number
- DCSAPSAMRFI2026001
About this file
This file is a Request for Information (RFI) questionnaire issued by the Defense Counterintelligence and Security Agency (DCSA) seeking vendor input on Security Information Event Management (SIEM) and Security Operations Center (SOC) platform capabilities for personnel security operations. The RFI, referenced as DCSA-PSAM-RFI-2026-001, has a response deadline of September 22, 2026 at 1:00 PM ET, with submissions directed to Lindsay Weindruch via email. DCSA explicitly disclaims that this RFI is for informational and planning purposes only, does not commit the Government to any award, and will not result in payment for information provided. Vendors are instructed not to include classified information in responses, though proprietary information will receive legal protection to the extent permitted by law.
DCSA seeks to address high-volume alert processing challenges within its Continuous Vetting (CV) program by identifying commercial solutions that can ingest and normalize 40+ structured and unstructured data sources, correlate alerts to individual subjects using privacy-preserving techniques, apply explainable AI/ML risk scoring aligned with federal adjudicative guidelines, automate low-value alert handling through configurable business rules, and route alerts through tiered human-in-the-loop workflows prioritized by assessed risk. Additional required capabilities include integration with authoritative case-management systems via documented open-standard APIs (OpenAPI 3.1 and REST), near-real-time dashboards displaying key performance metrics, continuous improvement feedback loops, support for IL5 and classified IL6 environments, and avoidance of vendor lock-in through nonproprietary data formats and open APIs. The questionnaire requires vendors to detail company profile information, assess existing versus adaptable capabilities against the specified requirements, identify integration and open-standards support status with remediation approaches and timelines, and provide prototype demonstration timelines, technical assumptions, identified risks, and cost considerations.
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
DCSA PSAM Vendor Questionnaire Company: [insert name]
REQUEST FOR INFORMATION (RFI)
Personnel Security Alert Management (PSAM) Platform Defense Counterintelligence and Security Agency (DCSA)
| RFI Reference: |
| DCSA-PSAM-RFI-2026-001 |
| Response Instructions: |
| Due Date: September 22, 2026 @ 1:00pm ET |
Vendors shall fill out the questionnaire and submit it via email to Lindsay Weindruch: lindsay.a.weindruch.civ@mail.mil
Disclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.
1. Purpose DCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.
DCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.
2. Problem Statement DCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise. Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.
3. Desired Capability DCSA seeks a solution that will incorporate the following capabilities:
· Ingests and normalizes 40+ structured and unstructured data sources—including APIs, databases, PDFs, and open-source information—into a unified alert stream.
· Correlates alerts to individual subjects using privacy-preserving tokenization, enabling cross-source analysis without unnecessary exposure of personal data.
· Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelines—such as financial considerations, criminal conduct, and foreign influence—rather than generic threat categories. Analyst-facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method).
· Automates low-value alert handling through configurable business rules that suppress duplicates, auto-clear qualifying low-risk alerts, and reduce false positives.
· Routes alerts through tiered, human-in-the-loop workflows for validation, investigation, and adjudication. The system must prioritize alerts by assessed risk—not age—and immediately escalate critical or high-risk alerts.
· Supports continuous improvement by feeding adjudicator outcomes back into the rules engine and AI/ML models, subject to appropriate oversight and validation.
· Integrates with—not replaces—authoritative case-management systems of record through documented, open-standard APIs, including OpenAPI 3.1 and REST. The capability must generate upstream triage signals rather than create a parallel case-management silo.
· Provides leadership and operational dashboards showing key performance measures, including time to detect, time to respond, false-positive rate, and backlog by priority, with near-real-time visibility into detection, response, and workload status.
· Avoids vendor lock-in. Proprietary data formats or closed APIs are disqualifying.
· Can operate in controlled IL5 and classified IL6 environments appropriate for intelligence-derived derogatory information and consistent with Department of War cross-domain security requirements.
DCSA PSAM Vendor Questionnaire
1. Company Profile
| Item |
| Vendor Response |
Company name
CAGE code
Socioeconomic status
Facility clearance, if held
Available contract vehicles
Relevant SIEM/SOC or comparable customer experience
2. Capability Checklist For each capability, check one column: Existing Capability if the capability can support the CV use case without material modification; or Adaptable for CV if configuration, integration, extension, or development is needed. Use the notes column to summarize the adaptation approach, relevant cybersecurity example, and any material dependencies or limitations.
| Capability |
| Existing Capability |
| Adaptable for CV |
| Brief Notes / CV Adaptation Approach / Relevant Cybersecurity Example |
| Ingest and normalize 40+ structured and unstructured data sources into a unified alert stream | |
| ☐ | ☐ |
| Correlate alerts to a common subject across inconsistent identifiers | |
| ☐ | ☐ |
| Protect personnel-security data and PII through privacy-preserving tokenization, pseudonymization, or equivalent controls | |
| ☐ | ☐ |
| Score, prioritize, and escalate alerts by assessed risk rather than alert age, using configurable risk factors and rules | |
| ☐ | ☐ |
| Support adjudicative-guideline-based scoring or similar policy-driven risk models | |
| ☐ | ☐ |
| Correlate, deduplicate, suppress, or auto-clear qualifying alerts | |
| ☐ | ☐ |
| Support validation, investigation, escalation, and adjudication workflows with required human decision points | |
| ☐ | ☐ |
| Provide explainable AI/ML outputs for analysts | |
| ☐ | ☐ |
| Monitor AI/ML performance and mitigate bias or model drift | |
| ☐ | ☐ |
| Operate when labeled or classified training data are limited, using approaches such as synthetic data, transfer learning, rules-based methods, or human-feedback loops | |
| ☐ | ☐ |
| Provide near-real-time dashboards for alert volume, backlog by priority, time to detect, time to respond, and false-positive rate | |
| ☐ | ☐ |
| Use outcomes or dispositions to improve rules or models | |
| ☐ | ☐ |
| Support controlled IL5 and classified IL6 deployment, including identification of cross-domain dependencies or limitations | |
| ☐ | ☐ |
3. Integration & Open Standards For each item requiring adaptation or not currently supported, identify the proposed remediation approach and indicative timeline. For grouped standards, identify the support status for each individual standard in the notes column.
| Item |
| Supported Now |
| Planned / Adaptation Needed |
| Brief Notes / Remediation Path / Indicative Timeline |
| Integrate with—not replace—authoritative systems of record | |
| ☐ | ☐ |
| Bidirectional data exchange and write-back | |
| ☐ | ☐ |
| Synchronization, latency, reconciliation, and failure handling | |
| ☐ | ☐ |
| API interface: Documented REST APIs / OpenAPI 3.1 | |
| ☐ | ☐ |
| Data exchange: NIEM 6.0, JSON-LD, or STIX 2.1 | |
| ☐ | ☐ |
| Access Control: OAuth 2.0, CAC/PIV, ABAC, or XACML 3.0 | |
| ☐ | ☐ |
| Data portability and nonproprietary export | |
| ☐ | ☐ |
| AI-model portability, such as ONNX or equivalent | |
| ☐ | ☐ |
| Explainability methods, such as LIME, SHAP, or equivalent | |
| ☐ | ☐ |
| Audit, provenance, and chain-of-custody logging such as W3C PROV-O; SYSLOG RFC 5424 | |
| ☐ | ☐ |
4. Prototype Considerations
| Item |
| Vendor Response |
Indicative timeline to demonstrate a prototype or pilot
Key technical assumptions and dependencies
Principal technical or integration risks
Major cost drivers or pricing considerations
Rough-order total cost of ownership
File details come from the government source that posted it. Updated .