{"canonical":"https://abierto.us/opportunities/dcsapsamrfi2026001","key":"DCSAPSAMRFI2026001","url":"https://abierto.us/opportunities/dcsapsamrfi2026001","title":"RFI - DCSA Personnel Security Alert Management (PSAM) Platform","solicitation_number":"DCSAPSAMRFI2026001","notice_type":"r","open":true,"response_deadline":"2026-09-22T17:00:00Z","first_posted":"2026-09-14","last_posted":"2026-09-14","department":"DEPT OF DEFENSE","subagency":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)","office":"DEFENSE CI AND SECURITY AGENCY","naics":null,"psc":null,"set_aside":null,"place_state":"VA","winner":null,"award_amount":null,"publications":[{"notice_id":"8ff0acae872847959a2c12f284e24ecb","title":"RFI - DCSA Personnel Security Alert Management (PSAM) Platform","solicitation_number":"DCSAPSAMRFI2026001","notice_type":"r","base_type":"r","posted":"2026-09-14","posted_at":"2026-09-14T15:48:25.179Z","due_at":"2026-09-22T17:00:00Z","due_date":"2026-09-22","cancelled":false,"archived":false,"archive_date":"2026-10-07","award_number":null,"awardee_name":null,"amount":null,"link_sam":"https://sam.gov/workspace/contract/opp/8ff0acae872847959a2c12f284e24ecb/view","enriched":true,"history":[{"index":1,"title":"RFI - DCSA Personnel Security Alert Management (PSAM) Platform","action":"publish","latest":true,"deleted":false,"archived":false,"cancelled":false,"posted_at":"2026-09-14T15:48:25.179Z","notice_type":{"code":"r","label":"Sources Sought"},"request_type":"submit","opportunity_id":"8ff0acae872847959a2c12f284e24ecb","solicitation_number":"DCSAPSAMRFI2026001"}]}],"latest_notice_id":"8ff0acae872847959a2c12f284e24ecb","first_type":"r","notices":[{"dates":{"posted":"2026-09-14","posted_at":"2026-09-14T15:48:25.179Z","created_at":"2026-09-14T15:38:43.330Z","modified_at":"2026-09-14T15:48:25.185Z","response_deadline":{"raw":"2026-09-22T13:00:00-04:00","utc":"2026-09-22T17:00:00Z","date":"2026-09-22","time":"13:00:00","timezone":"America/New_York","utc_offset_seconds":-14400}},"links":{"sam":"https://sam.gov/workspace/contract/opp/8ff0acae872847959a2c12f284e24ecb/view"},"naics":{},"title":"RFI - DCSA Personnel Security Alert Management (PSAM) Platform","agency":{"office":{"code":"HS0021","name":"DEFENSE CI AND SECURITY AGENCY"},"subtier":{"code":"97AV","name":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)"},"department":{"code":"097","name":"DEPT OF DEFENSE"},"office_address":{"zip":"22134","city":"QUANTICO","state":"VA","country":"USA"},"organization_id":"500043828","organization_type":"OFFICE"},"status":{"active":true,"latest":true,"deleted":false,"archived":false,"cancelled":false,"publication":"published","archive_date":"2026-10-07","archive_type":"auto15"},"history":[{"index":1,"title":"RFI - DCSA Personnel Security Alert Management (PSAM) Platform","action":"publish","latest":true,"deleted":false,"archived":false,"cancelled":false,"posted_at":"2026-09-14T15:48:25.179Z","notice_type":{"code":"r","label":"Sources Sought"},"request_type":"submit","opportunity_id":"8ff0acae872847959a2c12f284e24ecb","solicitation_number":"DCSAPSAMRFI2026001"}],"contacts":[{"name":"Lindsay Weindruch","role":"primary","email":"lindsay.a.weindruch.civ@mail.mil","phone":"5713204156"}],"base_type":{"code":"r","label":"Sources Sought"},"notice_id":"8ff0acae872847959a2c12f284e24ecb","lineage_id":"8ff0acae872847959a2c12f284e24ecb","provenance":{"detail":{"endpoints":["opportunity","resources","history"],"fetched_at":"2026-09-16T09:23:51.604569676Z"},"extract":{"url":"https://s3.amazonaws.com/falextracts/Contract%20Opportunities/datagov/ContractOpportunitiesFullCSV.csv","etag":"\"3f59209463433eba6899e195a597c64d-29\"","fetched_at":"2026-09-16T07:50:12.777658Z","row_sha256":"b2d5617e8e9ae9c237dd0050d4b1cdfa79b7eeae3600e6e5c19ebe8506f026ec","last_modified":"2026-09-16T03:30:52Z"},"updated_at":"2026-09-16T09:23:51.604569676Z","first_seen_at":"2026-09-15T22:52:52.472456Z"},"description":{"html":"

REQUEST FOR INFORMATION (RFI)

\n\n

Personnel Security Alert Management (PSAM) Platform

\n\n

Defense Counterintelligence and Security Agency (DCSA)

\n\n

RFI Reference: DCSA-PSAM-RFI-2026-001

\n\n

Response Instructions: 

\n\n\n\n

Disclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.

\n\n

1. Purpose

\n\n

DCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.

\n\n

DCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.

\n\n

2. Problem Statement

\n\n

DCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise.  Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.

\n\n

3. Desired Capability

\n\n

DCSA seeks a solution that will incorporate the following capabilities:

\n\n","text":"REQUEST FOR INFORMATION (RFI)\n\nPersonnel Security Alert Management (PSAM) Platform\n\nDefense Counterintelligence and Security Agency (DCSA)\n\nRFI Reference: DCSA-PSAM-RFI-2026-001\n\nResponse Instructions:\n\n• Due Date: September 22, 2026 @ 1:00pm ET\n\n• Vendors shall fill out the attached questionnaire and submit it via email to\n\n• Lindsay Weindruch: lindsay.a.weindruch.civ@mail.mil\n\nDisclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.\n\n1. Purpose\n\nDCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.\n\nDCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.\n\n2. Problem Statement\n\nDCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise. Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.\n\n3. Desired Capability\n\nDCSA seeks a solution that will incorporate the following capabilities:\n\n• Ingests and normalizes 40+ structured and unstructured data sources—including APIs, databases, PDFs, and open-source information—into a unified alert stream.\n\n• Correlates alerts to individual subjects using privacy-preserving tokenization, enabling cross-source analysis without unnecessary exposure of personal data.\n\n• Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelines—such as financial considerations, criminal conduct, and foreign influence—rather than generic threat categories. Analyst-facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method).\n\n• Automates low-value alert handling through configurable business rules that suppress duplicates, auto-clear qualifying low-risk alerts, and reduce false positives.\n\n• Routes alerts through tiered, human-in-the-loop workflows for validation, investigation, and adjudication. The system must prioritize alerts by assessed risk—not age—and immediately escalate critical or high-risk alerts.\n\n• Supports continuous improvement by feeding adjudicator outcomes back into the rules engine and AI/ML models, subject to appropriate oversight and validation.\n\n• Integrates with—not replaces—authoritative case-management systems of record through documented, open-standard APIs, including OpenAPI 3.1 and REST. The capability must generate upstream triage signals rather than create a parallel case-management silo.\n\n• Provides leadership and operational dashboards showing key performance measures, including time to detect, time to respond, false-positive rate, and backlog by priority, with near-real-time visibility into detection, response, and workload status.\n\n• Avoids vendor lock-in. Proprietary data formats or closed APIs are disqualifying.\n\n• Can operate in controlled IL5 and classified IL6 environments appropriate for intelligence-derived derogatory information and consistent with Department of War cross-domain security requirements.","origin":"detail"},"notice_type":{"code":"r","label":"Sources Sought"},"schema_version":1,"solicitation_number":"DCSAPSAMRFI2026001","place_of_performance":{"city":{"code":"64475","name":"Quantico"},"state":{"code":"VA","name":"Virginia"},"country":{"code":"USA","name":"UNITED STATES"}}}],"due_at":"2026-09-22T17:00:00Z","due_date":"2026-09-22","closes_at":"2026-09-22T17:00:00Z","awardable":true,"dept_key":"d-097","dept_name":"DEPT OF DEFENSE","sub_key":"s-97AV","sub_name":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)","office_key":"o-HS0021","office_name":"DEFENSE CI AND SECURITY AGENCY","state":"VA","country":"USA","winner_key":null,"amount":null,"linked_awards":0,"cancelled":false,"archived":false,"updated_at":"2026-09-16T07:31:38.954589Z","principal_notice_id":"8ff0acae872847959a2c12f284e24ecb","description":{"text":"REQUEST FOR INFORMATION (RFI)\n\nPersonnel Security Alert Management (PSAM) Platform\n\nDefense Counterintelligence and Security Agency (DCSA)\n\nRFI Reference: DCSA-PSAM-RFI-2026-001\n\nResponse Instructions:\n\n• Due Date: September 22, 2026 @ 1:00pm ET\n\n• Vendors shall fill out the attached questionnaire and submit it via email to\n\n• Lindsay Weindruch: lindsay.a.weindruch.civ@mail.mil\n\nDisclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.\n\n1. Purpose\n\nDCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.\n\nDCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.\n\n2. Problem Statement\n\nDCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise. Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.\n\n3. Desired Capability\n\nDCSA seeks a solution that will incorporate the following capabilities:\n\n• Ingests and normalizes 40+ structured and unstructured data sources—including APIs, databases, PDFs, and open-source information—into a unified alert stream.\n\n• Correlates alerts to individual subjects using privacy-preserving tokenization, enabling cross-source analysis without unnecessary exposure of personal data.\n\n• Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelines—such as financial considerations, criminal conduct, and foreign influence—rather than generic threat categories. Analyst-facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method).\n\n• Automates low-value alert handling through configurable business rules that suppress duplicates, auto-clear qualifying low-risk alerts, and reduce false positives.\n\n• Routes alerts through tiered, human-in-the-loop workflows for validation, investigation, and adjudication. The system must prioritize alerts by assessed risk—not age—and immediately escalate critical or high-risk alerts.\n\n• Supports continuous improvement by feeding adjudicator outcomes back into the rules engine and AI/ML models, subject to appropriate oversight and validation.\n\n• Integrates with—not replaces—authoritative case-management systems of record through documented, open-standard APIs, including OpenAPI 3.1 and REST. The capability must generate upstream triage signals rather than create a parallel case-management silo.\n\n• Provides leadership and operational dashboards showing key performance measures, including time to detect, time to respond, false-positive rate, and backlog by priority, with near-real-time visibility into detection, response, and workload status.\n\n• Avoids vendor lock-in. Proprietary data formats or closed APIs are disqualifying.\n\n• Can operate in controlled IL5 and classified IL6 environments appropriate for intelligence-derived derogatory information and consistent with Department of War cross-domain security requirements.","html":"

REQUEST FOR INFORMATION (RFI)

\n\n

Personnel Security Alert Management (PSAM) Platform

\n\n

Defense Counterintelligence and Security Agency (DCSA)

\n\n

RFI Reference: DCSA-PSAM-RFI-2026-001

\n\n

Response Instructions: 

\n\n\n\n

Disclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.

\n\n

1. Purpose

\n\n

DCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel-security operations through cybersecurity event correlation, alert triage, risk-based prioritization, and workflow automation.

\n\n

DCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel-security review.

\n\n

2. Problem Statement

\n\n

DCSA's Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low-value noise.  Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era.

\n\n

3. Desired Capability

\n\n

DCSA seeks a solution that will incorporate the following capabilities:

\n\n","origin":"detail"},"contacts":[{"name":"Lindsay Weindruch","role":"primary","email":"lindsay.a.weindruch.civ@mail.mil","phone":"5713204156"}],"place_of_performance":{"city":{"code":"64475","name":"Quantico"},"state":{"code":"VA","name":"Virginia"},"country":{"code":"USA","name":"UNITED STATES"}},"office_address":{"zip":"22134","city":"QUANTICO","state":"VA","country":"USA"},"naics_codes":[],"award":null,"attachments":[{"resource_id":"f895ae18b7834ef0b21bc9caffe9193d","name":"RFI_DCSA PSAM_RFI_20260914.docx","kind":"file","mime_type":".docx","size_bytes":34805,"posted_at":"2026-09-14T15:48:25.179Z","export_controlled":false,"sha256":null,"url":"https://sam.gov/api/prod/opps/v3/opportunities/resources/files/f895ae18b7834ef0b21bc9caffe9193d/download","mirrored":false}],"awards":[],"related":[{"key":"DCSAINNOVATIONCALL01","latest_notice_id":"8edbc404f99d46caa7f41a9bb760f4a9","title":"Unified Application Access and Integration Prototype","solicitation_number":"DCSAInnovationCall01","notice_type":"o","first_type":"o","first_posted":"2026-09-10","last_posted":"2026-09-10","notices":1,"due_at":"2026-09-18T13:00:00Z","due_date":"2026-09-18","closes_at":"2026-09-18T13:00:00Z","awardable":true,"open":true,"dept_key":"d-097","dept_name":"DEPT OF DEFENSE","sub_key":"s-97AV","sub_name":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)","office_key":"o-HS0021","office_name":"DEFENSE CI AND SECURITY AGENCY","naics":"541512","psc":"DA01","set_aside":null,"state":"VA","country":"USA","winner":null,"winner_key":null,"amount":null,"linked_awards":0,"cancelled":false,"archived":false,"updated_at":"2026-09-16T07:31:38.954589Z"},{"key":"A033281","latest_notice_id":"e0d7935b39cd4533b6ab352215c8f097","title":"Industrial Security Support Services (IS3)","solicitation_number":"A033281","notice_type":"r","first_type":"r","first_posted":"2026-09-10","last_posted":"2026-09-14","notices":2,"due_at":"2026-09-21T22:00:00Z","due_date":"2026-09-21","closes_at":"2026-09-21T22:00:00Z","awardable":true,"open":true,"dept_key":"d-097","dept_name":"DEPT OF DEFENSE","sub_key":"s-97AV","sub_name":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)","office_key":"o-HS0021","office_name":"DEFENSE CI AND SECURITY AGENCY","naics":"541611","psc":"R499","set_aside":"SBA","state":"VA","country":"USA","winner":null,"winner_key":null,"amount":null,"linked_awards":0,"cancelled":false,"archived":false,"updated_at":"2026-09-16T07:31:38.954589Z"},{"key":"HS002126CSODCSA","latest_notice_id":"4b4330c5ddff4b16a1e5c99449d2b8dd","title":"DCSA INNOVATION GATEWAY","solicitation_number":"HS0021-26-CSO-DCSA","notice_type":"o","first_type":"o","first_posted":"2026-06-23","last_posted":"2026-09-10","notices":3,"due_at":"2031-06-23T03:59:00Z","due_date":"2031-06-22","closes_at":"2031-06-23T03:59:00Z","awardable":true,"open":true,"dept_key":"d-097","dept_name":"DEPT OF DEFENSE","sub_key":"s-97AV","sub_name":"DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)","office_key":"o-HS0021","office_name":"DEFENSE CI AND SECURITY AGENCY","naics":"541512","psc":"DA01","set_aside":null,"state":"VA","country":"USA","winner":null,"winner_key":null,"amount":null,"linked_awards":0,"cancelled":false,"archived":false,"updated_at":"2026-09-16T07:31:38.954589Z"}]}