RFI - Identity Proofing_FINAL.docx

REQUEST FOR INFORMATION (RFI)

Identity Proofing

1.0. Description

1.1. The Defense Counterintelligence and Security Agency (DCSA) Procurement Solutions (PRS) is releasing this Request for Information (RFI) on behalf of the Department of War (DOW), DCSA, Industrial Security Capabilities Portfolio Office (ISP). The purpose of this RFI is to conduct market research in accordance with Federal Acquisition Regulation (FAR) Part 10 to identify industry partners with viable solutions to support the National Industrial Security System (NISS) Increment 2 (NI2) System.

1.2. Request For Information (RFI) Only. This RFI is issued solely for information gathering and planning purposes – it does not constitute a Request for Proposal (RFP), a solicitation, or an obligation to issue a future solicitation. This RFI does not commit the Government to contract for any supply or service whatsoever. The Government is not requesting proposals and will not accept unsolicited proposals. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the responding party’s expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

2. Background

DCSA administers the National Industrial Security Program (NISP) to provide direct support to Defense Industrial Base (DIB), essential defense supply chain activities, and to enable the protection of classified and controlled unclassified national security information and related technology. Industrial Security (IS) mitigates threats by providing entity vetting, risk identification and integrated personnel, physical and information system cyber oversight against adversary actions eroding national security capabilities. DCSA administers the National Industrial Security System (NISS) on behalf of the DoW and 35 other federal agencies.

There are approximately 12,500 contractor facilities that are cleared for access to classified information under DCSA’s security oversight responsibilities. DCSA provides field personnel, Government Contracting Activities, and cleared contractors with timely, consistent policy guidance to provide effective interpretation of the NISP. IS mitigates threats by providing entity vetting, risk identification and integrated personnel, and physical and information system cyber oversight against adversary actions eroding national security capabilities. The ISP is developing the NI2 system to achieve this goal and has a need to provide identity-proofing for persons, domestic and foreign, with or without a Department of War Common Access Card (CAC) who require access to the system.

The NI2 application is a DIB enablement service that must support both U.S.-based and foreign-based entities (including entity representatives residing overseas) in submitting the Standard Form 328 (SF-382) Foreign Ownership, Control, or Influence (FOCI) assertions. SF-328 submissions function as official entity representations that inform government FOCI assessment activities and can materially influence clearance-related actions and timelines. However, the system cannot rely on self-asserted identities and requires actions be taken to vet persons prior to gaining access to the NI2 application.

A proofing or enrollment failure, where an impostor establishes or takes over an account for that company, could enable targeted impersonation and the submission or alteration of sensitive proprietary assertions (e.g., ownership, control relationships, and foreign affiliations). The resulting harm is more than minor inconvenience. It can create significant operational disruption, legal and contractual exposure, and reputational damage to the entity, while also increasing adjudication workload and risk to the Government. Accordingly, NI2 requires NIST Identity Assurance Level 2 (IAL2) proofing for DIB users. IAL2 provides the appropriate assurance for this mission context by requiring stronger identity evidence and more rigorous validation and verification during enrollment, reducing susceptibility to realistic identity attacks such as basic document fraud and social engineering. This level also supports equitable access for the full DIB population, including foreign and domestic entities and geographically distributed users, by enabling remote proofing methods while still establishing accountable, high-confidence linkage between the individual user and the identity attributes used to represent their Entity in SF-328 submission workflows.

2.1. Implementation Date: The Government anticipates a potential need for identity proofing solutions in Calendar Year 2026.

2.2. Cybersecurity Requirements: A potential solution shall be able to meet the following objectives:

2.2.1. Integrate with Identity Management (IDM) solutions and an OpenID Connect (OIDC) broker.

2.2.2. Be deployable and operational within Department of War (DoW) cloud environments at Impact Levels (IL) 2, 4, and 5, at a minimum.

2.2.3. Support various multi-factor authentication (MFA) solutions.

2.3. Security Clearance:

For a potential future contract, it is anticipated that contractor personnel may require eligibility for access to classified information up to the Top-Secret level. All contractor employees assigned to a potential future contract must be U.S. citizens. Data and solutions may be subject to International Traffic in Arms Regulations (ITAR) requirements.

2.4 Customer Support: A viable solution should provide 24/7, U.S.-based customer support.

2.5 Certification: A viable solution performing documentation-based identity proofing should demonstrate it has been evaluated and certified by an accredited third-party organization as meeting NIST SP 800-63A Identity Assurance Level 2 (IAL2) requirements.

3.0. Requested Information

DCSA ISP Office seeks information from industry for Commercial-Off-the-Shelf (COTS) identity proofing solutions. The government seeks to learn what technical capabilities are available in the commercial marketplace, under what business models and cost structures they are offered, how flexibly they can be deployed, and how secure they are and/or what would be involved in hardening them.

DCSA ISP requests that industry partners complete the corporate overview and corporate experience tables, feedback per para. 3.2.4. and provide a whitepaper (5-page limit) to identify existing vendor solutions that can support both U.S.-based and foreign-based entities (including Entity representatives residing overseas) in submitting SF-328 Foreign Ownership, Control, or Influence (FOCI) assertions. DCSA ISP is primarily interested in vendors who can offer a variety of methods to accommodate a diverse user base, such as automated online verification, video chat verification, in-person verification, biometric verification, etc.

Interested parties should respond to all aspects of the RFI by completing the following tables and describing corporate capabilities in the form of a response addressing the elements outlined in Section 2.0. Industry partners may respond individually or partner with multiple vendors to provide a joint response.

3.1 RFI Responses: RFI responses shall be in Microsoft Word or Adobe PDF format, Times New Roman, no smaller than 11pt font, and are due no later than 4:00 PM Eastern Time, Wednesday, April 1, 2026. The whitepaper narrative response is limited to five (5) single-sided pages. Other page limitations are described below. Responses shall be submitted via e-mail only to the Government Point of Contact (POC) identified below.

· Primary POC: John Moua, Contract Specialist, john.t.moua.civ@mail.mil

· Secondary POC: Cindy Hocott, Contracting Officer, cynthia.l.hocott.civ@mail.mil

Questions for Industry:

1. Capability Summary: In a single paragraph, describe what your solution does and its primary function.

2. Deployment Model: Describe your solution’s deployment model (e.g., SaaS, on-premises software) and its specific compatibility with AWS GovCloud at IL2, IL4, and IL5.

3. Technology & Supply Chain: Describe your approach to software supply chain risk management (SCRM). Identify the major components of your solution and whether they are proprietary, licensed from third parties, or based on open-source projects.

4. Integration: Describe your technical approach for integrating the solution with a Government system, including the typical level of effort (in hours or weeks) and the APIs or standards used.

5. Organizational Experience: Describe your company's direct experience in providing IAL2 identity proofing services to U.S. Federal Government customers.

6. Intellectual Property: Describe your standard licensing model and data rights assertions for a federal government customer (e.g., Government Purpose Rights, Limited Rights, COTS license).

7. Differentiators: What are the key technical or business differentiators of your solution compared to other identity proofing services in the market?

8. NIST Compliance: Provide evidence of your solution’s certification against NIST SP 800-63A IAL2 requirements from an accredited Conformity Assessment Body (e.g., Kantara Initiative).

Proprietary information, if any, should be kept to minimum and MUST BE CLEARLY MARKED. To aid the Government, segregate proprietary information. Please be advised that all submissions become Government property and will not be returned. If any respondent does not currently have a Proprietary Data Protection Agreement (PDPA) that would permit the Government’s personnel to review and evaluate the submitted response to this RFI, the respondent should request to sign PDPAs with the Government.

3.2. Tables. Respondents are requested to complete the tables below. The tables shall not be included towards the page count of the response.

3.2.1. Corporate Overview: Submit responses using Table 1 as a guide. The response shall be no longer than one page per industry partner in length

Table 1: Corporate Overview Name of Company Name of Business Unit Responding to the RFI (if applicable)

Phone #:

Email:

Unique Entity ID (UEI):

CAGE Code

Corporate Address

Website URL

Provide NAICS Code(s) applicable to this RFI

Type of Small Business, if applicable (e.g., Woman-Owned, Service-Disabled Veteran Owned, 8(a), HUBZone)

Identify Government Acquisition Vehicles and schedule numbers, if any (NASA SEWP, GSA, Army CHESS, NIH, etc.)

□ NO

□ NO

□ NO

Other, please specify (fill-in if applicable).

3.2.2. Customer References: Submit responses using Table 2 as a guide. The response shall be no longer than one page per industry partner in length

Table 2: Customer References Name of Government Agency or Company

Phone #:

Contract Number

Dollar Value

Number of Users

Government Agency or Company Name

Phone #:

Contract Number

Dollar Value

Number of Users

Government Agency or Company Name

Phone #:

Contract Number

Dollar Value

Number of Users

3.2.3. Rough Order of Magnitude (ROM) and Cost Drivers:

Provide a Rough Order of Magnitude (ROM) for a representative scenario of 10,000-25,000 users per year. The ROM should not be a binding quote. Describe the primary cost drivers for your solution (e.g., per-user fees, licensing model, support tiers, integration services). DO NOT PROVIDE A DETAILED PRICE PROPOSAL.

Table 3: Materials and Equipment with Cost Drivers

3.2.4. Industry Feedback and Recommendations for Government Consideration.

The Government invites respondents to provide feedback on this RFI to assist in the development of a potential future solicitation. This section is an opportunity for industry to identify and comment on aspects of the draft requirement that may be unclear, unintentionally restrictive, or could be improved by aligning with commercial best practices.

Please note, the Government will not provide direct responses to questions or comments submitted in this section. This feedback is intended solely for Government market research and planning purposes to create a more effective future solicitation. There is no page limit for para. 3.2.4. responses.

Respondents are encouraged to provide commentary on the following topics:

· Clarity and Feasibility: Are there any requirements in Section 2 that are ambiguous, unclear, or may be technically infeasible to implement as described?

· Alternative Approaches: Are there alternative technical solutions, deployment models, or commercial best practices that could meet the Government’s objectives more effectively or efficiently?

· Potential Challenges: Please identify any potential risks, challenges, or major cost drivers that the Government should consider based on the information provided.

· Evaluation Factors: For a potential future competitive solicitation, what technical evaluation criteria would you recommend to effectively differentiate between the capabilities of competing solutions in this market?

Please structure your feedback in a simple question/comment and rationale format.

4.0. Meetings and Discussions

The Government may choose to hold one-on-one sessions with respondents to ask clarifying questions about their submissions. These sessions will be for informational purposes only.

5.0. Summary

This RFI is only intended for the Government to identify Commercial-Off-the-Shelf capabilities that can fulfill the desired foundational capabilities as described within Section 2, specifically Identity Proofing Requirements. The information provided in this RFI is subject to change and is not binding to the Government. The Government has not made a commitment to procure any of the RFI requirements discussed, and release of this RFI should not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. All submissions become Government property and will not be returned.