Request for Information (RFI) - Next-Generation Security Orchestration, Automation, and Response (SOAR)

The Air Force Life Cycle Management Center (AFLCMC), Defensive Cyber Systems Branch at Joint Base San Antonio-Lackland, Texas is conducting market research through a Request for Information on next-generation Security Orchestration, Automation, and Response (SOAR) software, with responses due by September 18, 2026 at 8:00 AM CST. This RFI is for information and acquisition planning purposes only and does not constitute a solicitation or government commitment to procure.

The Air Force seeks a vendor-agnostic, enterprise-scale SOAR platform meeting or exceeding capabilities of Palo Alto Cortex XSOAR, deployable across enterprise cloud, garrison, and tactical edge environments on standard COTS computing baselines using modular open systems approach architecture. Mandatory integrations include Elastic SIEM, Elastic Defend EDR, Recorded Futures threat intelligence, Air Force ICAM identity authentication, AWS/ELICSAR data lake services, Tanium endpoint actions, and KeyCloak role-based access control. The platform must support lightweight containerization via OCI-compliant Kubernetes, multi-tenancy with operational and training environment separation using RBAC, and disconnected tactical edge operations with 48 CPU cores, 192GB RAM, and 1.8TB storage, achieving 100 percent synchronization upon reconnection. Security requirements mandate FIPS 140-2 or FIPS 140-3 Level 1 compliance with NIST CMVP validation, CAC authentication, and encryption supporting Impact Level 5 operations. The solution must offer more than 300 out-of-the-box integrations, native threat intelligence lifecycle management, drag-and-drop playbook design with Python scripting, machine learning-assisted analyst workflows, and enterprise supportability through Department of War ESI contracts or GSA schedules. Vendor responses must include corporate overview, detailed technical approach addressing all evaluation criteria, explicit comparison to Palo Alto Cortex XSOAR, MOSA compliance documentation, and federal deployment history. Questions were due September 10, 2026; submission directed to Contract Specialist Sean Danzy, Contracting Officers Kyle Braunlich and Diana Sapp.