US-FED-00000394278 - RFI - DCSA Personnel Security Alert Management (PSAM) Platform - Deadline September 22,2026

REQUEST FOR INFORMATION (RFI)Personnel Security Alert Management (PSAM) PlatformDefense Counterintelligence and Security Agency (DCSA)RFI Reference: DCSA–PSAM–RFI–2026–001Response Instructions:Due Date: September 22, 2026 @ 1:00pm ETVendors shall fill out the attached questionnaire and submit it via email toLindsay Weindruch: [email? redacted]Disclaimer: This RFI is for informational and planning purposes only. It is not a Request for Proposal, does not commit the Government to any award, and responses are not offers the Government can accept to form a contract. The Government will not pay for information submitted. Do not include classified information in responses; proprietary information will be protected to the extent permitted by law.1. PurposeDCSA seeks information from Security Information Event Management (SIEM) and Security Operations Center (SOC) platform vendors on commercial capabilities that can support personnel–security operations through cybersecurity event correlation, alert triage, risk–based prioritization, and workflow automation.DCSA is particularly interested in solutions that can identify, correlate, prioritize, and route cybersecurity alerts and incidents associated with members of the trusted workforce for appropriate personnel–security review.2. Problem StatementDCSA`s Continuous Vetting (CV) program faces high daily detection volumes from many sources, much of it low–value noise. Alerts which are drawn from dozens of criminal, financial, terrorism–screening, foreign–contact, foreign–travel, and public–record data sources are still worked largely first–in–first–out rather than by risk, so high–consequence alerts can wait behind routine, low–risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic–reinvestigation models, it is still triaging risk with case–management approaches built for a lower–volume era.3. Desired CapabilityDCSA seeks a solution that will incorporate the following capabilities:Ingests and normalizes 40+ structured and unstructured data sourcesincluding APIs, databases, PDFs, and open–source informationinto a unified alert stream.Correlates alerts to individual subjects using privacy–preserving tokenization, enabling cross–source analysis without unnecessary exposure of personal data.Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelinessuch as financial considerations, criminal conduct, and foreign influencerather than generic threat categories. Analyst–facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method).Automates low–value alert handling through configurable business rules that suppress duplicates, auto–clear qualifying low–risk alerts, and reduce false positives.