RFI 26-047_Unstructured Data Environment Scanning.pdf

P R I N C E T O N P L A S M A P H Y S I C S L A B O R A T O R Y 1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

PRINCETON PLASMA PHYSICS LABORATORY

April 17, 2026

Sources Sought / Request for Information (RFI) 26-047

Unstructured Data Environment Scanning

This is a Sources Sought Notice ONLY. This notice is issued solely for market research and acquisition planning purposes; it does not constitute a Request for Quote (RFQ), Invitation for Bid (IFB), or Request for Proposal (RFP), nor does it promise a future solicitation. Responses are strictly voluntary, and no reimbursement will be provided for costs associated with responding to this notice. Princeton Plasma Physics Laboratory (PPPL) is under no obligation to award a contract or expend appropriated funds based on this inquiry.

1. Background and Objective

Princeton Plasma Physics Laboratory (PPPL), a Department of Energy (DOE) National Laboratory, is soliciting information from qualified sources regarding Unstructured Data Environment Scanning solutions. The goal is to identify solutions capable of scanning, discovering, analyzing, and classifying unstructured data across enterprise repositories.

Interested vendors must be prepared to address functional, security, and compliance requirements and may be invited to participate in technical demonstrations to show how their solution satisfies PPPL’s needs.

2. Small Business and Socioeconomic Consideration

PPPL is seeking capability statements from all interested parties, including Large Businesses, Small Businesses, and all socioeconomic categories (SDB, 8(a), WOSB, SDVOSB, EDWOSB, HUBZone), as well as HBCU/MIs. This information will be used to determine the appropriate level of competition and establish small business subcontracting goals. PPPL reserves the right to consider specific set-asides based on the responses received.

3. Submission Requirements

Interested firms are requested to submit a Capabilities and Qualifications Statement and must address the Technical Capabilities Questions. This document must be UNCLASSIFIED and provide more than generic marketing brochures. Please include:

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

A. Administrative Information

• Firm Name and Address.

• Business Size and Status: (Large, Small, SDB, 8(a), WOSB, SDVOSB, EDWOSB, HUBZone, or HBCU/MI).

• Affiliate Information: Parent company, joint venture partners, and potential teaming partners.

• Role: Indicate whether your firm would perform as a prime subcontractor or a lower-tier subcontractor.

B. Technical Capability Questions

1. Company Profile: An organizational overview highlighting expertise in large-scale unstructured data scanning, discovery, classification, and migration. Please include relevant client references from similar engagements.

2. Technical Response: A detailed explanation of how the solution fulfills the functional and compliance requirements. This must cover capabilities for identifying sensitive data (PII/CUI), detecting ROT data, and mapping data ownership, access, and risk.

3. Deployment Model: A description of available architectures (e.g., SaaS, on-premises, or hybrid) and the solution’s ability to scan diverse repositories, including network shared drives, cloud environments (e.g., Google Drive), and endpoints.

4. Security & Compliance: Documentation of security controls, data protection protocols, and relevant certifications (e.g., FedRAMP). Please specify how the solution maintains the integrity and confidentiality of sensitive data during the analysis phase.

5. Demonstration Availability: Confirmation of the vendor's ability to participate in a virtual demonstration showcasing end-to-end discovery, classification, and reporting within a realistic environment.

6. Pricing & Licensing:

i. Published Pricing: Current catalogs or price lists, including costs for any necessary add-on modules, integrations, or configurations.

ii. Licensing Overview: A breakdown of the licensing structure (e.g., per user, by data volume, or subscription-based) and how costs scale as data volume or environment complexity increases.

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

4. Response Instructions

All responses must be submitted electronically via email to Cheryl Colan at ccolan@pppl.gov.

• Deadline: Wednesday, May 6, 2026, by 4:30 PM (EST).

• Reference: Please include "RFI 26-047–Unstructured Data Environment Scanning" in the subject line.

• Inquiries: All technical and procurement questions should be directed to the Point of

Contact (POC) listed above.

5. General Information

Responses will not be returned, and respondents will not be notified of evaluation results. The information obtained may be used to develop an acquisition strategy and future RFP. If a solicitation is released, it will be posted on www.SAM.gov. It is the responsibility of potential offerors to monitor SAM.gov for any amendments or official solicitation documents.

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

REQUIREMENTS DOCUMETATION:

Unstructured Data Environment Scanning

Functional and Technical Requirements & Vendor Demonstration Scope

1. Purpose and Objective

The purpose of this Request for Information (RFI) is to evaluate solutions capable of scanning, discovering, analyzing, and classifying unstructured data across enterprise repositories.

This RFI is intended to gather information on available solutions, assess market capabilities, and support future procurement activities related to unstructured data governance, compliance, and lifecycle management.

2. Environment Overview

Princeton Plasma Physics Laboratory (PPPL) maintains approximately 4.5 petabytes of unstructured data across enterprise shared drives, user home drives, and cloud-based collaboration platforms (e.g., Google Workspace).

This environment includes:

● Official records subject to federal records management requirements

● Controlled Unclassified Information (CUI)

● Personally Identifiable Information (PII)

● Operational and scientific data

Data is distributed across repositories with:

● Limited ownership visibility

● Inconsistent classification practices

● Varying alignment with retention requirements

3. Project Context

PPPL’s unstructured data environment has expanded significantly due to the widespread use of enterprise shared drives, individual user home drives, and cloud-based collaboration platforms.

Data is distributed across multiple repositories with varying ownership, inconsistent classification practices, and limited alignment to retention requirements. User home drives, in particular, often

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0 contain a mix of official records, working files, and legacy content that has accumulated over time without systematic review.

Manual approaches to managing and reviewing unstructured data do not scale effectively to the size and growth rate of this environment. Significant staff time is required to locate information, validate content, and support audits, FOIA requests, and discovery activities. At the same time, unmanaged data growth contributes to rising infrastructure and administrative costs and increases the effort required to apply governance controls and execute defensible disposition.

A scanning capability is required to establish enterprise-level insight into data content, classification, and governance characteristics. This capability supports compliance with U.S.

Department of Energy (DOE) requirements, reduces operational inefficiencies, and provides a foundation for controlling long-term data growth and associated costs.

4. Vendor Submission Requirements:

To ensure a comprehensive evaluation, respondents must submit the following information:

1. Company Profile: An organizational overview highlighting expertise in large-scale unstructured data scanning, discovery, classification, and migration. Please include relevant client references from similar engagements.

2. Technical Response: A detailed explanation of how the solution fulfills the functional and compliance requirements. This must cover capabilities for identifying sensitive data

(PII/CUI), detecting ROT data, and mapping data ownership, access, and risk.

3. Deployment Model: A description of available architectures (e.g., SaaS, on-premises, or hybrid) and the solution’s ability to scan diverse repositories, including network shared drives, cloud environments (e.g., Google Drive), and endpoints.

4. Security & Compliance: Documentation of security controls, data protection protocols, and relevant certifications (e.g., FedRAMP). Please specify how the solution maintains the integrity and confidentiality of sensitive data during the analysis phase.

5. Demonstration Availability: Confirmation of the vendor's ability to participate in a virtual demonstration showcasing end-to-end discovery, classification, and reporting within a realistic environment.

6. Pricing & Licensing:

o Published Pricing: Current catalogs or price lists, including costs for any necessary add-on modules, integrations, or configurations.

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0 o Licensing Overview: A breakdown of the licensing structure (e.g., per user, by data volume, or subscription-based) and how costs scale as data volume or environment complexity increases.

5. Vendor Qualifications:

Qualified vendors for unstructured data scanning and analysis must provide a secure, scalable, and high-accuracy solution capable of discovering, analyzing, classifying, and migrating data across diverse enterprise repositories.

Core Functional Requirements:

• Sensitive Data Identification: Robust detection of PII, CUI, and other sensitive information.

• Data Lifecycle Management: Accurate identification of Redundant, Obsolete, and Trivial

(ROT) data.

• Actionable Intelligence: Clear visibility into data ownership, access permissions, and overall risk profiles.

• Compliance: Any solution interacting with PPPL data in a cloud environment must be

FedRAMP certified, as applicable.

Preferred Experience: Preference will be given to vendors with a proven track record of supporting Federal Entities of similar scale, complexity, and data volume as PPPL.

6. Vendor Demonstrations & Evaluation (By Invitation)

Qualified firms may be invited to conduct a 3–4-hour virtual demonstration to showcase their solution’s performance in a realistic environment using representative datasets.

If invited, the demonstration must provide an end-to-end walkthrough of the following:

• Comprehensive Data Discovery & Classification: Automated identification of sensitive data (PII, CUI) and the categorization of Redundant, Obsolete, and Trivial (ROT) information.

• Risk & Distribution Visibility: Utilization of dashboards and reporting tools to map data distribution, assign ownership, and quantify risk.

• Decision Support: Evidence of how system insights inform data governance, retention strategies, and broader management objectives.

A. Technical Discussion: Vendors should be prepared to candidly discuss technical capabilities, system limitations, and the practical application of their solution’s analytics in a production environment.

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

During the vendor demonstration, the vendor must be prepared to discuss the technical requirements and limitations of the product such as:

● Show how the solution discovers and inventories data across multiple repositories

(e.g, shared drives, Google drive , home drives).

● How does the tool identify where data resides and how it is distributed across the environment?

● Demonstrate how the solution identifies ROT data. What criteria or logic is used to classify data as ROT?

● Show how the solution identifies and classifies sensitive data such as PII and CUI.

What methods are used (rules, pattern, matching, AI models)?

● How can classification be validated?

● Demonstrate how the solution determines or infers data ownership.

● How does the tool support assigning accountability to business users or departments?

● Show how insights generated by the tool can be used to support:

○ Data cleanup

○ Retention alignment

○ Governance decisions

● Demonstrate available dashboards and reports. Can reports be exported and used for audit or compliance purposes?

• How does the solution measure and report classification accuracy?

• How does the product handle identification and reduction of false positives and false negatives?

• How does the solution access file content, metadata only, or both?

• How is sensitive data protected during scanning and analysis?

• How is the product obtaining the data?

• Is an agent required to be installed on individual computer systems? If so, what are the hardware and resource requirements of the agent? How often would an agent be scanning each system when in production?

• How does the product limit access to ensure proper handling of data?

• What methods are utilized to identify PII and CUI?

• What protections or considerations are in place when capturing characteristics of files or the actual potential PII and CUI files themselves that are sensitive?

• Where are the results of any discovery stored?

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

B. Implementation & Scalability

• What is the typical system implementation timeline?

• What level of effort is required from PPPL resources?

• What is the ability of the system to integrate with enterprise records management systems to assimilate records that may be identified?

C. General Capability Requirements

The solution must:

● Support read-only discovery and analysis of unstructured data repositories.

● Scale to large volumes of unstructured data distributed across multiple repository types.

● Enable repeatable, defensive analysis suitable for compliance and governance use cases.

● Separate analysis and insight generation from data disposition or remediation.

D. Data Discovery Requirements

PPPL requires the capability to:

● Identify files and associated metadata across designated repositories.

● Support discovery across different repository types and logical groupings.

● Capture and analyze file-level metadata, including at minimum:

○ File name

○ File type

○ File size

○ File ownership

○ Age (date created) and last date modified

○ Directory path

○ Access and permission indicators (where available)

● Support iterative discovery, allowing PPPL to phase analysis by repository, data source, or other PPPL-defined groupings

E. Data Analysis Requirements

The capability must support analytical processing to:

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

● Understand the composition and distribution of unstructured data.

● Identify patterns related to data volume, age, duplication, and general content characteristics.

● Support visibility into how data is organized across repositories and directory structures.

The analysis is intended to provide insight and visibility only and does not include execution of any actions on source data.

F. Retention Alignment

The solution should support:

● Identification of records potentially subject to retention requirements

● Alignment of analysis results with retention schedules (where applicable)

● Support for governance decision-making related to:

● Data classification

● Retention

● Disposition

Final determination of record status and retention applicability remains the responsibility of PPPL Records Management.

G. Reporting Requirements

The capability must provide reporting outputs that:

● Summarize what data exists and where it is located

● Provide visibility into data volumes and characteristics by repository and directory path.

● Enable export of reports and file manifests to support PPPL analysis, review, and planning.

H. Environment Preparation and Configuration

PPPL and the vendor will work collaboratively to prepare the environment required to support unstructured data scanning. PPPL will facilitate access to approved data repositories and identify appropriate points of contact for coordination.

1 0 0 S T E L L A R A T O R R D . • P . O . B O X 4 5 1 • P R I N C E T O N • N J • 0 8 5 4 0

The vendor will be responsible for configuring the scanning environment, validating connectivity to in-scope repositories, and confirming readiness to process both cloud-based and on- premises data sources in alignment with agreed-upon requirements.

I. Review, Validation, and Decision Support

PPPL stakeholders will review discovery results in collaboration with the vendor to validate findings and confirm alignment with project objectives. Review activities will support decisions related to governance, cleanup prioritization, and future remediation planning.

For the proof-of concept component, review activities will focus on evaluating vendor performance, scalability, and capability based on the results of scanning up to 50TB of unstructured data.

J. Refinement and Quality Review

Based on PPPL feedback, the vendor will support refinement of analytical logic and classification criteria to improve accuracy and relevance of results. Refinement activities may include adjustments of feature extraction logic and validation of outputs through targeted review samples.

K. Outcome:

The capability shall enable PPPL to establish a defensible baseline understanding of its unstructured data environment to support informed governance and lifecycle planning decisions.

-end-