RFI_ZTFA_AI 1 Feb 9.docx

Subject: Request for Information (RFI) – Zero Trust Assessments & Artificial Intelligence Background: The Zero Trust Portfolio Management Office (ZT PfMO) within the DoD Chief Information Officer (CIO) is the office responsible for the overall DoD ZT lead to coordinate, synchronize, and advance the DoD Enterprise into a ZT cybersecurity architecture, modernizing the DoD’s ability to prevent malicious actors from exploiting DoD data and resources. Scaling ZT assessments to encompass the entirety of the DoD enterprise, while maintaining accuracy and efficiency, necessitates innovative approaches that leverage automation and advanced technologies. As such, the DoD is interested in understanding how emerging technologies like Artificial Intelligence (AI) and Machine Learning (ML) can be leveraged to automate and enhance the Zero Trust assessment process.

Purpose: This RFI seeks information from vendors on Commercial Off-the-Shelf platforms and services that leverage automation, AI and ML to accelerate and scale ZT assessments across the DoW enterprise. This will address anticipated capacity limitations and support continuous assessment for validating compliance with Target Level Zero Trust milestones. This RFI is for market research purposes only and does not constitute a solicitation.

Objective: The DoW seeks industry perspectives on leveraging automation and AI to accelerate and scale DoW-led ZT Purple Team (a collaborative security assessment approach where the red team, blue team, and system owners work together) evaluations of ZT environments on UNCLASSIFIED and SECRET networks. These evaluations will assess the proper implementation of core Zero Trust requirements for adequacy and efficiency, while identifying limitations, compliance failures, and facilitating continuous assessment requirements for the 91 Target level Zero Trust Activities and the ten Zero Trust Acceptance Criteria (Appendix A). The ultimate goal is to ensure that all DoW IT environments meet Target level ZT as defined by the DOD Zero Trust Strategy by FY27.

Scope: The DoW Chief Information Officer (CIO) is soliciting information on automation and AI tools that can automate DoW ZT Purple Team assessments.

Requested Information: The Government seeks Industry input regarding the following questions:

1. How can automation and AI be used to support ZT Purple Team activities within ZT environments?

2. What are the key obstacles to using automation and AI for ZT Purple Teaming?

3. Which ZT Purple Team tasks are best suited for automation or AI enhancement?

4. How can AI identify and prioritize potential attack paths within a ZT architecture?

5. How can automation and AI simulate realistic attack scenarios to test the effectiveness of ZT controls?

6. How can AI enhance the analysis of detection and alerting effectiveness during ZT Purple Team assessments?

7. How can automation and AI assist with generating comprehensive final assessment reports and recommendations following ZT Purple Team assessments?

8. What data sources are most valuable to enable AI powered ZT Purple Team activities in a ZT environment?

9. What emerging automation and AI trends are likely to impact future ZT Purple Team evaluations?

10. What innovative technologies or approaches are being explored to enhance ZT Purple Team capabilities?

11. What are the potential barriers to entry for AI powered automated ZT assessment tooling?

12. What are the potential points of friction to implement in a DoW environment?

13. What kind of and how much data should be used to train the neural network?

Format: Responses to this RFI must be unclassified and marked with appropriate proprietary information. The Government is not liable for consequential damages for proprietary information not properly identified.

· Responses are limited to ten (10) pages, single-spaced, Times New Roman 12-point font with one-inch margins.

· Submittals must be in MS Word or in PDF format.

· Include a proprietary information statement (if applicable).

· Reference “Zero Trust (ZT) Assessments & Artificial Intelligence (AI).

· Include:

· Company name, DUNS/EUI, CAGE Code, and point of contact.

· Responses to the requested information.

· Feedback on feasibility; and

· Potential risks, challenges, or innovations.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Response Due Date: All responses to this RFI are to be submitted by 12 PM Eastern Time (ET), on Feb. 9, 2026. Responses will be accepted via electronic means only to: whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.

APPENDIX A

Zero Trust Acceptance Criteria:

1. Actor identity is affirmed and non-repudiable – continuous authentication and credentialing.

2. Actor authorization for a role is validated – authorization, verification and validation.

3. Assumed roles are fully specified – attribution and behavioral rules.

4. Resources are fully ascribed with operating characterizations – attribution.

5. Objects/assets (data, etc.) are ascribed with access and use characterizations – attributions – when, where and how information is allowed for use.

6. Policy is sufficiently specified to dictate prescriptive actions – rules.

7. Orchestration of Identity-Based Access Control (IBAC), Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC) and rules are computationally consistent, coherent, complete, congruent and validated.

8. Enforcement Services can apply ZT computational determinations instantly and accurately.

9. Behavioral analytics track and evaluate common and uncommon patterns – ML/AI; and

10. Unanticipated conditions are immediately escalated for accommodation.