RFI-User Activity Monitoring and Behavioral Analytics Solution

The Federal Bureau of Investigation's Finance and Facilities Division has issued a Request for Information to conduct market research for a comprehensive User Activity Monitoring and Behavioral Analytics Solution to enhance its Insider Threat Program. The FBI seeks advanced monitoring capabilities specifically designed for classified and air-gapped environments that comply with Executive Order 13587 and Committee on National Security Systems Directive 504, requiring continuous user activity monitoring and anomaly detection to protect national security information. Key requirements include DVR-style session capture, real-time behavioral analytics, deterministic monitoring capabilities independent of AI/ML systems, FIPS 140-2 validated encryption, and integration with enterprise tools like Splunk and Jira. Eligible respondents must be U.S.-based businesses with Top Secret facility clearance and Sensitive Compartmented Information access, capable of deploying solutions in classified environments. Responses are limited to 10 pages and must be submitted electronically to mkmcie@fbi.gov by 10:00 AM Eastern Time on October 6, 2025.

This opportunity does not include any set-aside designations and is open to both small and large businesses that meet the security clearance requirements. The RFI does not identify any incumbent contractors or specify potential award values, as this is strictly a market research initiative with no commitment to issue a solicitation or award a contract. The technical specifications indicate a robust solution requiring support for multiple deployment models including AWS GovCloud and on-premises infrastructure, with stringent requirements including a minimum 25-year data retention period, 72-hour Recovery Time Objective, and 24-hour Recovery Point Objective for disaster recovery. The solution must support scalable deployment across various AWS services and provide comprehensive monitoring capabilities across the FBI's enterprise environment. Companies responding must demonstrate their business size classification, facility clearance level, DUNS number, and proven capability to operate in classified environments with TS/SCI on-site support capabilities.