RFI_TBCA_Step 2 Feb 10.docx

Subject: Request for Information (RFI) – Automated Zero Trust (ZT) Threat-Based Cyber Assessment (TBCA) Solutions Background: The Zero Trust Portfolio Management Office (ZT PfMO) within the DoD Chief Information Officer (CIO) is the office responsible for the overall DoD ZT lead to coordinate, synchronize, and advance the DoD Enterprise into a ZT cybersecurity architecture, modernizing the DoD’s ability to prevent malicious actors from exploiting DoD data and resources. Current methods for assessing cybersecurity posture are often manual, time-consuming, and lack the agility to keep pace with the evolving threat landscape. To meet the urgent demands of evolving cyber threats and make assessments more effective, the DoD is working to move beyond traditional, compliance-based assessments to a continuous, automated, and threat-based approach that provides dynamic insights into real-time risk.

Purpose: This RFI seeks information from industry on automated ZT Threat-Based Cyber Assessment solutions. The DoW Zero Trust Portfolio Management Office (ZT PfMO), the central office responsible for accelerating ZT implementation and orchestration, is conducting market research to understand available solutions, capabilities, and implementation considerations. This RFI is for market research purposes only and does not constitute a solicitation.

Objective: The DoW seeks industry perspectives on leveraging and scaling solutions that emulate adversarial activities to assess the state of ZT implementations on UNCLASSIFIED and SECRET networks. Solutions must:

· Validate that an environment meets DoW Target Level ZT activity outcomes as outlined in the DOD Zero Trust Strategy.

· Reduce time and costs associated with post-TBCA Purple Team assessments by providing technical data for preparation and analysis.

· Support continuous TBCAs to validate the 91 Target level Zero Trust Activities. and monitor for configuration drift.

Scope: The ZT PfMO is seeking automated ZT TBCA solutions applicable to various environments (on-prem, cloud, hybrid, etc.). Solutions applicable to specific environments will also be considered. The solution must:

· Run within a Component’s environment to execute emulated adversarial activities.

· Be ready for use in production/ATO environments by the end of Q2 FY26.

· Be a solution that DoD Components are able to procure.

Requested Information: The Government seeks Industry input regarding the following questions:

1.What is your recommended strategy to accelerate onboarding the proposed solution at the DoW?

2. What Impact level should the tool have access to in order to perform an effective automated threat assessment? Why? (E.G. IL2, IL4, IL5, IL6).

3. What available threat frameworks (e.g., MITRE ATT&CK) are suited to map to and assess zero trust efficacy?

4. In what ways can automated threat-based cyber assessments aid Purple/Blue/Red teams?

5. How can TBCA tooling evolve to eventually replace 90+% of manual color team assessment activities?

6. Do you have an existing government sponsor environment where your solution is currently being tested or deployed? If so, please provide details.

7. Provide an estimate of the total cost of ownership for your solution, including initial implementation, ongoing maintenance, and potential scaling.

8. While not the primary focus, does your solution have the capability to remain in a DoW Component’s environment to conduct continuous analysis and configuration drift monitoring? If so, please elaborate on these features.

9. Does your solution take into consideration Advanced level ZT activities? If so, how does it assess and validate these activities?

10. Realistically, what is the earliest timeframe your solution could be ready for use in production/ATO environments within a DoW Component, given the ambitious target of deployment in Q2 FY26?

11. Describe the reporting capabilities of your solution, including the types of reports generated, the level of detail provided, and the mechanisms for data sharing and collaboration with stakeholders.

Format: Responses to this RFI must be unclassified and marked with appropriate proprietary information. The Government is not liable for consequential damages for proprietary information not properly identified.

· Responses are limited to ten (10) pages, single-spaced, Times New Roman 12-point font with one-inch margins.

· Submittals must be in MS Word or in PDF format.

· Include a proprietary information statement (if applicable).

· Reference Zero Trust (ZT) Threat-Based Cyber Assessment TBCA.

· Include:

· Company name, DUNS/EUI, CAGE Code, and point of contact.

· Responses to the requested information.

· Feedback on feasibility; and

· Potential risks, challenges, or innovations.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Response Due Date: All responses to this RFI are to be submitted by 12 PM Eastern Time (ET), on Feb. 10, 2026. Responses will be accepted via electronic means only to: whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.