RFI_RMF_Reform (002).pdf

Subject: Request for Information (RFI) – Risk Management Framework (RMF) Revamp

Background: The DoD Chief Information Officer (CIO) is the Principal Staff Assistant (PSA) and senior advisor to the Secretary and Deputy Secretary of Defense for information technology (IT), including national security systems (NSS) and information resources management (IRM).

The CIO oversees all matters related to information, IT, operational technology, Zero Trust, and the broader DoD information environment—encompassing command, control, and communications (C3), electromagnetic spectrum operations, network operations, IT portfolio management, cybersecurity, and positioning, navigation, and timing (PNT). In addition, the DoD CIO is responsible for developing and enforcing enterprise-wide IT and cybersecurity policies, ensuring alignment with technical standards and strategic priorities. The role includes oversight of key DoD agencies such as the Defense Information Systems Agency (DISA) and coordination with entities like the NSA’s Cybersecurity Directorate. The CIO also influences IT budget decisions and leads interagency and international coordination on technology and cyber matters, especially in support of defense missions and crisis response efforts.

The Risk Management Framework (RMF) is the Department of Defense's structured approach for managing cybersecurity risk across its systems. It is closely aligned with the National Institute of Standards and Technology (NIST) guidelines, which are used across the federal government, promoting consistency and interoperability in cybersecurity practices. Although RMF enhances security through continuous monitoring and risk-based decision-making, it’s often seen as slow and cumbersome. To meet the urgent demands of modern cyber threats and accelerate innovation, the DoD is working to streamline the RMF process—aiming for greater efficiency without compromising on security.

Purpose: This RFI is issued solely for market research and planning purposes in accordance with FAR Part 10. This RFI does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or a Request for Quote (RFQ), and does not commit the Government to issue a solicitation or award a contract.

The Government is seeking input from industry to better understand current capabilities, innovative solutions, and business practices that can support Revamping RMF to streamline the approval process for operational capabilities, ensuring expedited deployment for the Warfighter.

Scope: The Department of Defense (DoD) Chief Information Officer (CIO) is requesting industry input on strategies to accelerate the delivery of capabilities to the warfighter. This initiative aims to streamline the Risk Management Framework (RMF) while simultaneously enhancing the cybersecurity posture of DoD systems through a comprehensive RMF modernization effort.

Objective: The Department of Defense (DoD) Chief Information Officer (CIO) is seeking industry input on innovative approaches to modernizing the Risk Management Framework (RMF) to enhance cybersecurity resilience, accelerate secure technology deployment, and improve risk assessment efficiency. This Request for Information (RFI) aims to identify emerging technologies, best practices, and operational methodologies that streamline cybersecurity risk assessment, reduce redundant compliance efforts, and improve reciprocity across DoD components. Key areas of interest include AI-driven cybersecurity tools, security control inheritance, artifact reuse, continuous monitoring solutions, proactive cyber defense mechanisms, security testing frameworks, and risk assessment models that support rapid integration of automation, monitoring, and active threat mitigation within cybersecurity programs. Industry responses will inform policy adjustments, optimize risk management strategies, and contribute to a more agile and resilient cybersecurity posture, ensuring the delivery of mission-critical capabilities to the warfighter.

Requested Information: The government requests industry’s input regarding the set of questions below as it pertains to the objectives of this RFI.

1. Provide a detailed overview of the methodologies and safeguards applied during the design phase to ensure the seamless integration of critical operational functions, robust cybersecurity protections, and comprehensive cyber survivability measures. Define the integrated set of requirements necessary to develop a functional and secure capability, including risk assessment frameworks, security-by-design principles, and cyber survivability strategies. Describe how these elements are incorporated to mitigate vulnerabilities, enhance resilience, and support mission-critical operations while maintaining compliance with evolving cybersecurity standards.

2. Provide a detailed overview of the methodologies and tools your organization employs to assess and test system functionality, security, and resilience during the build phase.

Specifically, how do these approaches ensure early defect detection, risk mitigation, and compliance with established cybersecurity frameworks.

3. Provide a detailed overview of the methodologies and tools your organization employs for system testing, Continuous Monitoring, vulnerability remediation, and penetration testing where applicable. Specifically, how do these approaches support proactive risk management, compliance with industry standards, and continuous security improvement.

Additionally, does your organization utilize dashboards or other centralized reporting mechanisms to collect and analyze testing results.

4. Provide a detailed overview of the cybersecurity assessment methodologies applied during the onboarding to connect new systems to the network. Specifically, how does your organization ensure vulnerability management, and compliance with established cybersecurity frameworks.

5. Provide a detailed overview of your organization's Continuous Monitoring strategy and implementation. Specifically, how does your ISCM approach support real-time threat detection, vulnerability management, and compliance with established cybersecurity frameworks. Additionally, what technologies and automation tools are leveraged to enhance visibility into security risks and streamline remediation efforts.

6. Provide a detailed overview of the cybersecurity assessment and mitigation tools your organization employs. Specifically, how do these tools integrate automation technologies to enhance risk identification, threat mitigation, and overall cybersecurity resilience.

Additionally, how does your approach align with industry best practices and regulatory frameworks.

7. Provide information on risk assessment algorithms capable of performing near-real-time risk calculations on large data sets. Specifically, describe scoring methodologies for risk assessment, key variables such as threat levels and system impact, algorithmic tracking of risk deviations, and approaches for identifying and managing essential data elements, including retention times.

Format: Responses to this RFI request should reference " Risk Management Framework (RMF) Revamp" and shall include the following information in this format:

Company name, DUNS/UEI, CAGE Code, and point of contact

Capability statement demonstrating relevant experience

Proposed Solutions: Industry recommendations for streamlining risk assessments.

Technology Integration: How AI, automation, and cybersecurity tools can enhance RMF efficiency.

Best Practices: Lessons learned from other sectors or government agencies.

Feedback on the feasibility of the work described

Potential risks, challenges, or innovations

Past performance examples (if applicable)

Rough Order of Magnitude (ROM) cost information

Firms must respond using the format outlined in this RFI. There is a maximum page limitation of thirty (30) typed pages that are single spaced using 12-inch Times New Roman font within an 8.5 by 11 paper.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Response Due Date: All responses to this RFI are to be submitted by 12:00 P.M Eastern Standard Time (EST), on 24 July 2025. Responses will be accepted via electronic means only to: whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.