AI RFI_Q and A (Part 2).xlsx
XLSX spreadsheet 17 KB Posted
- Solicitation number
- Not on record
About this file
This document is a Request for Information (RFI) from the Department of the Air Force (DAF) seeking market research on Artificial Intelligence (AI) capabilities that can integrate with Microsoft Office productivity software. The RFI focuses on an AI solution that can perform tasks such as email and message summarization, draft documentation creation, insights extraction from spreadsheets, meeting transcript summarization, and robust API integrations, all while maintaining strict security requirements including IL5 Gov Cloud deployment, role-based access controls, and comprehensive data protection measures.
Key technical requirements include integration with Microsoft 365 tools, ability to reference document libraries, generate various document types, support multi-level confidentiality models, and provide security features like suspicious prompt pattern monitoring and data loss prevention. The DAF is specifically interested in U.S.-based companies and solutions that can operate within an IL5 Cloud environment, with a preference for cloud-based deployment. Responses are due by 1500 Eastern Time on 30 June 2025, and this RFI is purely for market research to understand potential AI capabilities, with no guarantee of future procurement.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| AI RFI_Q and A (Part 1).xlsx | XLSX spreadsheet | |
| Q and A Template.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| ID | Questions | Answers |
| 60 | What specific versions of Microsoft Office 365, Outlook, Teams, and SharePoint are currently deployed in the DAF environment, and are there any planned upgrades within the next 12-18 months? | Microsoft 365 Apps for Enterprise (Current v. 16.0); It's a live update model. |
| 61 | Are there any unique configurations, customizations, or restrictions in the DAF’s Microsoft environment (e.g., disabled features, specific security policies) that the AI solution must accommodate? | DISA STIGs: https://public.cyber.mil/stigs/ |
| 62 | What is the expected scale of integration (e.g., number of users, teams, or departments) for the AI solution across the DAF? | AFLCMC/HNI does not yet have a requirement for a potential pilot or full-scale deployment. This RFI is purely market research to better understand the current marketplace. |
| 63 | What level of contextual awareness is required for email/message summarization and draft generation (e.g., referencing historical email threads, cross-referencing with other data sources like SharePoint)? | The AI solution should be able to reference document libraries within Gov Cloud and SharePoint. |
| 64 | Are there specific templates, tone guidelines, or compliance requirements (e.g., military communication protocols) that generated email drafts must adhere to? | For the purposes of the RFI response, no. |
| 65 | What types of structured and unstructured data sources (e.g., databases, file formats, cloud platforms) should the AI solution reference for creating draft documentation? | Structured and unstructured data sources includes emails, documents such as Word, PDF, presentations, and spreadsheets. |
| 66 | Are there specific document types (e.g., reports, briefings, memos) or formats (e.g., Word, PDF) that the AI should prioritize for draft creation? | For the purposes of this RFI Response, the Government is interested in the capability to generate various documents and file types. |
| 67 | What types of spreadsheets (e.g., size, complexity, data types) are typically used, and what specific insights or trends (e.g., statistical analysis, predictive modeling) are most valuable to DAF users? | The Government does not have a preference at this time, as this RFI is purely for market research purposes to better understand the current marketplace. Information about spreadsheet capabilities may be provided within the RFI response to assist the Government with understanding the pros/cons of each model. |
| 68 | Are there preferred visualization formats (e.g., charts, dashboards) for presenting extracted insights within Microsoft tools? | The Government does not have a preference at this time. |
| 69 | What is the expected volume and format of meeting transcripts and chat conversations (e.g., real-time streaming, stored files, multilingual content) that the AI will process? | The format will be stored files from MS Stream in English. |
| 70 | Are there specific security or privacy requirements for handling and exporting meeting summaries, especially for sensitive or classified discussions? | The data would need to remain within the IL5 Gov Cloud environment, the AI solution would not be for classified information. |
| 71 | What third-party integrations are prioritized for the AI solution, and are there specific API types (e.g., REST, GraphQL) or SDKs that the DAF prefers? | The Government does not have a preference at this time. |
| 72 | What are the expected rate limits, throttling policies, and authentication mechanisms (e.g., OAuth, JWT) for APIs in the DAF environment? | The Government will review API's for rate limits and supports SAML and OIDC for authentication mechanisms. |
| 73 | Which SIEM/SOAR platforms are currently in use by the DAF, and what specific alert formats or protocols (e.g., Syslog, CEF) are required for integration? | ELICSAR and Microsoft Sentinel are currently in use. |
| 74 | Can you provide examples of suspicious prompt patterns, data exfiltration attempts, or policy violations that the AI should monitor, and what level of customization is needed for alert thresholds? | Suspicious prompt patterns is defined as prompts that attempt to bypass security controls either imposed on the LLM or access controls such as exfiltrating data from documents they don't have permissions on. |
| 75 | What are the specific IL4/IL5 security controls or FedRAMP requirements that the AI solution must meet, and are there any DAF-specific cybersecurity policies to address? | The AI solution must meet Moderate security control baselines in the Risk Management Framework. |
| 76 | In what contexts and environments does DAF envision Copilot being utilized? | The DAF is currently conducting market research only with this RFI for the purposes of better understanding the marketplace. The DAF is not specifically looking to procure Copilot, but is interested in an AI product to assist users in contextualizing existing resources and assisting in generating reports and presentations. |
| 77 | What specific outcomes or improvements is the DAF hoping to achieve with the AI solution? | The DAF is interested in capabilities including but not limited to the assistance in generating memos and reports based on previous documentation, assistance in tracking and maintaining personal schedules, and summarizing reports and meetings for easy digestion. |
| 78 | Are there any particular pain points or challenges they are looking to address? | One potential issue is requiring a third party portal or site to upload or ingest data before processing and exporting the data into the application for its use as well as the requirement to manually load all data for use in a RAG model. |
| 79 | Will there be a services/integrator requirement for deployment? | This RFI is purely for market research purposes to understand the current marketplace and a requirement for services for development and integration has not yet been determined. |
| 80 | Does the customer desire to explore use of AI/ML outside of the frameworks of MS productivity software? | This RFI is purely for market research purposes to understand the current marketplace and is interested in any potential solutions. |
| 81 | What's the expected timeframe for the PWS ? | AFLCMC/HNI does not yet have a timeline of a PWS to support this type of requirement. This RFI is purely market research to better understand the current marketplace. |
| 82 | What is the expected overall user volume and peak concurrent usage (e.g., are you anticipating 100s, 1,000s, 10,000s or more)? | AFLCMC/HNI does not yet have a requirement for a potential pilot or full-scale deployment. This RFI is purely market research to better understand the current marketplace. |
| 83 | In terms of user interaction with the solution, do you expect a single solution connected to the other tools (M365, Teams etc), or a solution that would be embedded into those tools ? In other terms, do you expect the different features to be available in a single common GUI, or dispatched into all the other tools (like buttons or actions in the ribbon of Teams, Outlook and others ?) | For the purposes of this RFI, the DAF would prefer a hybrid approach with a central GUI for a quick queries and integrated controls to existing apps for ease of use and rapid utilization. |
| 84 | Are there existing SIEM/SOAR platforms we need to integrate with (Splunk, Sentinel, others) ? | For the purposes of this RFI response, the Government is interested in integration with tools such as ELICSAR and Microsoft Sentinel. |
| 85 | The source data will be mainly text, we also understand there could be videos or audio files. What other types of data should we expect (ex : pictures, datalakes, APIs, IoT data, real-time data) ? | Other data could be images embedded in documents. |
| 86 | In terms of generative AI, you expect mainly text generation (mails, minutes, insights, documents). Is there a need for audio and/or video generation ? | For the purposes of this RFI response, mainly text generation is fine. |
| 87 | Would the Department of the Air Force (DAF) be open to considering solutions developed by outside US companies, or is the intention to prioritize solutions originating from U.S.-based companies only? | For the purposes of this RFI response, the DAF is interested in U.S.-based companies. |
| 88 | Will the DAF allow or require fine-tuning of foundational models on DAF-specific data? If yes, will vendors be provided with that data or access to a secure fine-tuning pipeline? | For the purposes of this RFI response, no. |
| 89 | What deployment models are acceptable for the solution: fully cloud-based, hybrid, on-premise, sovereign cloud, or disconnected tactical environments? | The Government has a preference for cloud-based solutions. |
| 90 | What are the deployment expectations regarding infrastructure constraints (ex : tactical/disconnected operations, sovereign/on-premise cloud, service provider maintenance, and third-party integrations)? | For the purposes of this RFI response, an ai solution would need to be deployed within an IL5 Cloud environment. |
| 91 | Is complete isolation of the LLM model required (as opposed to simple data anonymization)? | For the purposes of this RFI response, yes. |
| 92 | Is compliance with FedRAMP High sufficient, or do you require certification specifically aligned with DoD CC SRG IL5? | For the purposes of this RFI response, the AI solution will need to be aligned with DoD CC SRG IL5. |
| 93 | What are your expectations regarding prompt logging and behavioral monitoring? | The expectation is to report alerts and log them to SOAR solution. |
| 94 | Do you have a prioritization of expected use cases (ex : emails, documents, meetings, Excel analysis), and how do you envision user interaction with the solution (individual, team-based, or enterprise workflows)? | For the purposes of this RFI response, an example use case could be as follows: users start their day by asking for a summary of their meetings for the week. One meeting catches their attention and asks for more details. The user then goes to generate a report draft and the AI pulls data from docs stored in emails and document libraries. User includes a graph generated by the AI solution from data on a spreadsheet that supports the report. They share the report with a co-worker, and the co-worker has the AI reword a paragraph to give the section more energy. The user sends the report with a 3 sentence summary via email. |
| 95 | Do you plan to integrate classified business data to train a proprietary model? | For the purposes of this RFI response, no. Unclassified & CUI only. |
| 96 | Will end users all have the same level of access, or do you require a multi-level confidentiality model to manage varying authorizations? | A multi-level confidentiality model will be needed. |
| 97 | Who are the intended user populations? | For the purposes of this RFI response, assume DAF users would be those that utilize productivity software. |
| 98 | What are the latency and performance constraints for AI operations in an IL5 environment? | At this time, there are no specific requirements or constraints for latency or performance. |
| 99 | Do you prefer a usage-based (token) pricing model, or a per-user/license model? | The Government does not have a preference at this time, as this RFI is purely for market research purposes to better understand the current marketplace. Information about differing pricing models may be provided within the RFI response to assist the Government with understanding the pros/cons of each model. |
| 100 | Are you considering a pilot program (MVP) before full-scale deployment? | This RFI is purely for market research purposes to understand the current marketplace and a requirement for a Minimum Viable Product has not yet been determined. |
| 101 | Are you expecting associated services such as 24/7 support, user training, and change management governance? | This RFI is purely for market research purposes to understand the current marketplace and a requirement for services has not yet been determined. |
| 102 | What are the key expectations in terms of authorization and access control? Including in terms of: |
- Support of role-based access control;
| - Support of multi-factor authentication and single sign-on (SSO) with existing solutions or protocols. | For the purposes of this RFI, the expectations are that the AI solution will Integrate with existing authentication solutions such as SAML and OIDC as well as provide role-based access control. | |
| 103 | What are the key expectations in terms of data protection and privacy control? Including in terms of: |
- Integration with DLP solutions like Microsoft Purview;
- Types of controls over user data including prompts, files, and outputs (e.g., to prevent sensitive information leakage);
- Data stored locally or transmitted externally;
- Encryption of data-at-rest and data-in-transit;
| - Data retention and deletion. | For the purposes of this RFI, the expectations are that integration with DLP solutions, controls to prevent data from leaking from the IL5 environment, encryption of data-at-rest and data-in-transit and data retention and deletion will be incorporated. | ||
| 104 | Which SIEM or SOAR platforms are currently in use or planned for integration? (e.g., Microsoft Sentinel, Splunk, ServiceNow) | For the purposes of this RFI response, the Government is interested in integration with tools such as ELICSAR and Microsoft Sentinel. | |
| 105 | Can you confirm the required cloud hosting environment for this solution? (e.g., Commercial, GCC High, DoD, or Azure Government) | IL5 Approved Gov Clouds. | |
| 106 | Are there any existing customizations or plugins in these applications that the AI solution must be compatible with? | The Government does not have a preference at this time. | |
| 107 | What third-party systems are expected to be integrated (e.g., CRM, ERP, ticketing systems)? | The Government does not have a preference at this time, as this RFI is purely for market research purposes to better understand the current marketplace. | |
| 108 | What authentication methods are required (e.g., OAuth, SAML)? | The Government supports SAML and OIDC. | |
| 109 | Are there specific SDKs or programming languages preferred for integration? | The Government does not have a preference at this time. | |
| 110 | Is the solution expected to be hosted on-premises, cloud, or hybrid? | The Government has a preference for cloud-based solutions. | |
| 111 | Are there specific security certifications required beyond FedRAMP and SOC 2? | The AI solution must meet Moderate security control baselines in the Risk Management Framework. | |
| 112 | What types of data classification policies are currently enforced via Purview? | This RFI is purely for market research purposes to understand the current marketplace. | |
| 113 | Should the AI solution enforce DLP (Data Loss Prevention) policies during content generation or summarization? | For the purposes of this RFI response, yes. | |
| 114 | Are there specific compliance frameworks (e.g., HIPAA, CJIS, GDPR) that access controls must align with? | The AI solution must meet Moderate security control baselines in the Risk Management Framework. | |
| 115 | Regarding 2. Scope: | ||
| What the Government describes here could be designed and built directly within the Government's own IL4/IL5 environment using Cloud-native (Microsoft Azure) services, including well-architected API expansion to third-party integrations. Is such an approach acceptable, or is the Government seeking an external, bolt-on AI technology tool? | For the purposes of this RFI Response, the Government is interested in all potential solutions. | ||
| 116 | If the Government accepts a cloud-native solution designed for and built in the Government's IL4/IL5 Azure environment, is the Government open to a holistic AI Security approach that leverages tenant-level tools such as Entra Suite, Azure Policy, and Microsoft Defender for Cloud (among others) to comprehensively govern the environment and corresponding integrations? | For the purposes of this RFI response, the Government would be interested in this capability. | |
| 117 | What are the specific types of structured and unstructured data that need to be referenced for draft documentation creation? Are there preferred local and cloud storage solutions currently in use? | Structured and unstructured data sources includes emails, documents such as Word, PDF, presentations, and spreadsheets available in IL5 Gov Cloud. | |
| 118 | Is the agency requesting or anticipating licensing support or need to purchase licenses? If so, how many licenses does the agency plan to use? | AFLCMC/HNI does not yet have a requirement for a potential pilot or full-scale deployment. This RFI is purely market research to better understand the current marketplace. | |
| 119 | What third-party integrations are essential for your operations? What specific API types and relevant SDKs are required? | This RFI is purely for market research purposes to understand the current marketplace. | |
| 120 | What types of alerts are you looking to monitor and export to your SIEM / SOAR solutions? | Alerts could include suspicious prompt patterns, data exfiltration attempts, policy violations, authentication failures. | |
| 121 | How customizable do you need these alerts to be, and can you specify examples such as suspicious prompt patterns, data exfiltration attempts, and policy violations? | For the purposes of this RFI response, the alerts should be customizable based on thresholds which will be dynamic. |
Suspicious prompt patterns is defined as prompts that attempt to bypass security controls either imposed on the LLM or access controls such as exfiltrating data from documents they don't have permissions on.
File details come from the government source that posted it. Updated .