RFI - DCSA Personnel Security Alert Management (PSAM) Platform

REQUEST FOR INFORMATION (RFI)

Personnel Security Alert Management (PSAM) Platform

Defense Counterintelligence and Security Agency (DCSA)

RFI Reference: DCSA-PSAM-RFI-2026-001

Response Instructions: 

• Due Date: September 22, 2026 @ 1:00pm ET
• Vendors shall fill out the attached questionnaire and submit it via email to
  • Lindsay Weindruch: lindsay.a.weindruch.civ@mail.mil

Disclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.

1. Purpose

DCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.

DCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.

2. Problem Statement

DCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise.  Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.

3. Desired Capability

DCSA seeks a solution that will incorporate the following capabilities:

• Ingests and normalizes 40+ structured and unstructured data sources—including APIs, databases, PDFs, and open-source information—into a unified alert stream.
• Correlates alerts to individual subjects using privacy-preserving tokenization, enabling cross-source analysis without unnecessary exposure of personal data.
• Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelines—such as financial considerations, criminal conduct, and foreign influence—rather than generic threat categories. Analyst-facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method).
• Automates low-value alert handling through configurable business rules that suppress duplicates, auto-clear qualifying low-risk alerts, and reduce false positives.
• Routes alerts through tiered, human-in-the-loop workflows for validation, investigation, and adjudication. The system must prioritize alerts by assessed risk—not age—and immediately escalate critical or high-risk alerts.
• Supports continuous improvement by feeding adjudicator outcomes back into the rules engine and AI/ML models, subject to appropriate oversight and validation.
• Integrates with—not replaces—authoritative case-management systems of record through documented, open-standard APIs, including OpenAPI 3.1 and REST. The capability must generate upstream triage signals rather than create a parallel case-management silo.
• Provides leadership and operational dashboards showing key performance measures, including time to detect, time to respond, false-positive rate, and backlog by priority, with near-real-time visibility into detection, response, and workload status.
• Avoids vendor lock-in. Proprietary data formats or closed APIs are disqualifying.
• Can operate in controlled IL5 and classified IL6 environments appropriate for intelligence-derived derogatory information and consistent with Department of War cross-domain security requirements.