RFI4222026.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION |

PROCUREMENT SECTION

Advanced Forensic Capabilities for Identifying

Non-Traditional Insider Data Exfiltration Methods

REQUEST FOR INFORMATION (RFI)

Request for Information (RFI) Page 1

Advanced Forensic Capabilities for Identifying Non-Traditional Insider Data Exfiltration Methods

Due Date 4/22/2026 by 10am ET

Request for Information (RFI) Page 2

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST

FOR PROPOSAL OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND

SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT.

RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER

NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS

ANNOUNCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PREPARATION OF

RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY

RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the solution supporting the Insider Threat Office efforts to mitigate non-traditional data exfiltration. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The FBI Insider Threat Program (InTP) was established in accordance with Federal laws, regulations, executive orders, and policies to deter, detect, and mitigate actions by individuals with authorized access to FBI personnel, facilities, information, equipment, networks, or systems, who may wittingly or unwittingly use their authorized access to threaten the national security of the United States. These threats may include damage to the United States through espionage, terrorism, violent acts against the government or nation, unauthorized disclosure of national security information, workplace violence, or the loss or degradation of the capabilities of the FBI.

Federal standards (e.g., National Insider Threat Policy and Minimum Standards and Committee on National Security Systems Directive 504) and the FBI's own InTP mission needs underscore the requirement for advanced, demonstrable technologies capable of addressing evolving insider threat vectors; particularly non-traditional, low-tech, or stealthy exfiltration methods that evade conventional network-based controls.

Request for Information (RFI) Page 3

PURPOSE:

The objective of this Request for Information (RFI) is to survey the market for mature, commercially available (or proprietary/non-proprietary) technologies from industry providers that can help forensically trace and attribute non-traditional methods of exfiltrating sensitive or classified materials from FBI managed workstations. Examples of such non-traditional techniques include physical screen photography (e.g., photographing monitors displaying sensitive/classified content), covert screen captures (e.g., copy, paste, reformatting of text), or other low-tech/high-stealth physical/digital methods that bypass conventional network-based data-loss prevention controls.

The FBI is particularly interested in solutions that are demonstrable (i.e., existing field-proven technologies, not concepts or future developments) and capable of supporting enterprise-wide deployment, including compatibility with all FBI enclaves (to include air-gapped and classified networks).

The solution must:

Maintain document integrity for discovery purposes (i.e. no rephrasing);

At a minimum, be apply to common file types (e.g. PDF and Microsoft Office files);

Incorporate logging, timestamping, and attribution capabilities for detection events and evidence artifacts, aligned with federal standards such as CNSSD 504 (requiring UAM data to be attributable to a specific user for accountability and investigative support) and related NITTF guidance (emphasizing user-attributable audit trails and chain-of-custody preservation for insider threat detection and authorized investigations).

CONTRACTOR QUALIFICATIONS:

This RFI is open to small and large businesses and are based in the United States for market research only to request input from potential providers of an advanced forensic capability for identifying non-traditional insider data exfiltration methods. No foreign companies will be considered. Additionally, the Company must possess a Top Secret (TS) facility clearance with eligibility to receive access to Sensitive Compartmented Information (SCI).

Request for Information (RFI) Page 4

The Government is seeking information on which firms can provide the requirements by identifying themselves and responding to this RFI. The Government requests the following information:

1. Company name, Business Size, Facility Clearance Level, Duns Number, Cage Code etc.

(Please see chart below)

2. Provide demonstrated evidence that proves your company can successfully provide the requested services and/or products required (i.e. technical ability, personnel, and experience) in an air-gapped/classified deployment. Information provided shall be succinct and related to the requested information in this RFI. All submissions shall be unclassified.

3. Please indicate whether your company holds any federal contract vehicles and whether you are able to provide these services under those vehicles. If so, list the applicable contract vehicle(s), schedule(s), and SINs or equivalent identifiers.

Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

Required Information:

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

DUNS Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract:

Request for Information (RFI) Page 5

CONTEMPLATED REQUIREMENT:

FBI's Insider Threat Office is issuing this RFI to:

Gather industry information

Request information on any industry changes or improvements that the FBI should consider when looking to achieve products and capabilities that meet requirements and are compatible with the commercial environment.

Request information on potential barriers to obtaining solutions that meet objectives needed to accomplish stated requirements. The areas of interest for contemplated requirements and scenarios are addressed below.

DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION AS

A RESULT OF THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL AND

PLANNING PURPOSES AND DOES NOT CONSTITUTE A SOLICTIATION. IN

ACCORDANCE WITH FAR 15.201(e), RESPONSES TO THIS NOTICE ARE NOT OFFERS

AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO FORM A BINDING

CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES NOT

CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT

OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A

CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE

TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY

INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION

IS STRICTLY VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE:

All interested parties shall submit technical packages in response to this notice.

1. Do submit succinct, thoughtful responses to the requirements/questions listed in this RFI.

2. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

3. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the FBI.

Request for Information (RFI) Page 6

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not submit questions or comments not related to this RFI.

Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS:

All responses are limited to no more than 10 pages using 12-point Times New Roman or Ariel Font. All responses must be submitted in either Microsoft Word or PDF. No pamphlets or brochures will be accepted. All responses must be submitted to Meredith Mcie via email at mkmcie@fbi.gov by 10am ET on 4/22/2026.

No extensions will be granted. Email Subject line shall read- Advanced Forensic Capabilities for Identifying Non-Traditional Insider Data Exfiltration Methods RFI (Company Name).

Financial Obligation: The cost of responding to the RFI shall be exclusively borne by the organization submitting the information. No costs will be reimbursed by the Government. The FBI makes no implied or in fact contract by issuing this RFI.