RFI-User Activity Monitoring and Behavioral Analytics Solution.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

USER ACTIVITY MONITORING AND BEHAVIORAL

ANALYTICS SOLUTION

REQUEST FOR INFORMATION (RFI)

USER ACTIVITY MONITORING AND BEHAVIORAL ANALYTICS SOLUTION

Due Date 10/6/2025 by 10am ET

Request for Information (RFI) Page 2

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR PROPOSAL

OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE

GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO

THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the User Activity Monitoring and Behavioral Analytics Solution. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The Federal Bureau of Investigation (FBI) seeks to enhance its Insider Threat Program (InTP) to protect national security information and ensure personnel and partner safety. This requires advanced User Activity Monitoring (UAM), and User and Entity Behavior Analytics (UEBA) solutions tailored for classified and air-gapped environments, compliant with Executive Order 13587 and Committee on National Security Systems Directive 504 (CNSSD 504). These mandates require continuous user activity monitoring and anomaly detection to mitigate insider threats.

The UAM capability will be the FBI’s primary tool for workstation-level monitoring, providing real-time alerts, audit logs, and reports to Insider Threat Office (InTO) analysts, enabling risk identification and supporting FBI, Department of Justice, and partner investigations with robust forensic evidence. The UEBA capability will provide anomaly detection and behavioral baselining, covering users, devices, and applications. Both solutions must be capable of operating either as a standalone and as a fully integrated suite. In addition, both capabilities must demonstrate ability to operate deterministically and independently of any AI/ML

Request for Information (RFI) Page 3 functionality, as well as demonstrate ability to seamlessly integrate AI/ML into processes and workflows.

Capabilities must balance interconnectivity for data integration and threat intelligence sharing with operational independence in air-gapped Secret and Top Secret/SCI networks, supporting federated frameworks while adhering to EO 13587, EO 14028, NIST SP 800-53, and ICD 503.

Solution must have no foreign nexus, include governance controls, and prioritize data minimization for privacy and security.

PURPOSE:

The objective of this RFI is to poll the market for commercial software and services from commercial entities for the implementation of a UAM/UEBA Solution capable of providing the requirements as described in Attachment 1. The FBI is looking for information regarding companies and products that are proven leaders in the areas of UAM and UEBA implementation.

CONTRACTOR QUALIFICATIONS:

This RFI is open to small and large businesses and are based in the United States for market research only to request input from potential providers of UAM and UEBA solutions in an air-gapped/classified environment. No foreign companies will be considered. Additionally, the Company must possess a Top Secret (TS) facility clearance with eligibility to receive access to Sensitive Compartmented Information (SCI).

The Government is seeking information on which firms can provide the attached requirements by identifying themselves and responding to this RFI. The Government requests the following information:

1. Company name, Business Size, Facility Clearance Level, Duns Number, Cage Code etc.

(Please see chart below)

2. Provide demonstrated evidence that proves your company can successfully provide the requested services and/or products required (i.e. technical ability, personnel, and experience) in an air-gapped/classified deployment. Information provided shall be succinct and related to the requested information in this RFI. All submissions shall be unclassified.

Request for Information (RFI) Page 4

3. Address whether your company has a GSA Schedule and if they are capable of providing these services on schedule. If able to provide the services on schedule, provide the schedule and SIN.

4. Address staffing experience and approach for projects located in Huntsville, AL.

Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

Required Information:

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract:

CONTEMPLATED REQUIREMENT:

FBI's Insider Threat Office is issuing this RFI to:

Gather industry information on the enclosed requirements in Attachment 1.

Request information on any industry changes or improvements that the FBI should consider when looking to achieve products and capabilities that meet requirements and are compatible with the commercial environment.

Request for Information (RFI) Page 5

Request information on potential barriers to obtaining solutions that meet objectives needed to accomplish stated requirements. The areas of interest for contemplated requirements and scenarios are addressed below.

DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION AS A RESULT OF

THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL AND PLANNING PURPOSES AND

DOES NOT CONSTITUTE A SOLICTIATION. IN ACCORDANCE WITH FAR 15.201(e), RESPONSES TO

THIS NOTICE ARE NOT OFFERS AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO FORM A

BINDING CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES NOT

CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE

GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS

ARE AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY

INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY

VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE:

All interested parties shall submit technical packages in response to this notice.

1. Do submit succinct, thoughtful responses to the requirements/questions listed in this

RFI.

2. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

3. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the

FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

Request for Information (RFI) Page 6

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not submit questions or comments not related to this RFI.

Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS:

All responses are limited to no more than 10 pages using 12-point Times New Roman or Ariel Font. All responses shall be submitted in either Microsoft Word or PDF. No pamphlets or brochures will be accepted. All responses shall be submitted to Meredith Mcie via email at mkmcie@fbi.gov by 10am ET on 10/6/2025. No extensions will be granted. Email Subject line shall read – User Activity Monitoring and Behavioral Analytics Solution RFI (Company Name).

Financial Obligation: The cost of responding to the RFI shall be exclusively borne by the organization submitting the information. No costs will be reimbursed by the Government. The FBI makes no implied or in fact contract by issuing this RFI.