Request for Information - Cloud-Native DRM Solution
Overview
Buyer
Place of Performance
NAICS
PSC
Set Aside
Original Source
Timeline
Qualification Details
Fit reasons
- NAICS alignment with historical contract wins in similar service areas.
- Scope strongly matches core technical capabilities and delivery model.
Risks
- Past performance thresholds may require one additional teaming partner.
- Potential clarification needed on staffing minimums before bid/no-bid.
Next steps
Validate eligibility requirements, assign capture owner, and schedule partner outreach to confirm teaming strategy before submission planning.
Quick Summary
The Library of Congress has issued a Request for Information (RFI) for a Cloud-Native Digital Rights Management (DRM) Solution. This market research aims to identify commercial off-the-shelf (COTS) API-driven DRM solutions that meet federal security standards for securing digital assets, managing metadata, and enforcing usage rights. Responses are due May 20, 2026, at 11:00 a.m. EST.
Purpose & Scope
This RFI is for market research only and does not constitute a solicitation. The Library of Congress (LOC) seeks information on solutions to integrate into its existing application stack to protect approximately 2+ million files (25TB) annually. The solution must support an asset lifecycle including Submission, Review, and Archival/Preserve stages, leveraging ONIX or BIBFRAME metadata standards.
Key Requirements
The desired solution must be:
- Cloud-native, compatible with AWS and Azure environments.
- Integrable with existing custom applications (JAVA, Python, Angular).
- Capable of handling 5,000+ external and 300+ internal concurrent users.
- Support authentication via MS Entra and login.gov.
- Accommodate a wide range of file formats, including individual PDFs and full-length 4K video files.
- Implement a workflow for Ingest, Protect (encrypt/wrap), Storage (cloud), and Access (SSO authentication, DRM client validation).
- Ensure assets remain read-only and maintain integrity, with encrypted files accessible in real-time via approved viewers.
Submission Details
Vendors are requested to provide detailed technical responses, avoiding generic marketing language. Responses should be in PDF format, limited to 25 pages, and submitted in Voluntary Product Accessibility Template (VPAT) format. Specific areas of interest include Company Profile & Compliance (e.g., FedRAMP status, support, SLA), Solution Architecture, API Capabilities, Core DRM Functions, Authentication & Identity, Security & Key Management (including BYOK and data residency), Performance & Reliability, Auditing/Reporting, Pricing Model, and User Interface.
Contract & Timeline
- Type: Sources Sought / Request for Information (RFI)
- Set-Aside: None specified
- Questions Due: May 4, 2026, 11:00 a.m. EST
- RFI Response Deadline: May 20, 2026, 11:00 a.m. EST
- Published: April 21, 2026 (RFI document), May 12, 2026 (Q&A document)
Points of Contact
- Primary: Veronica Price (vprice@loc.gov)
- Secondary: Stefanie Fitte (sfitte@loc.gov)
Additional Notes
FedRAMP authorization is not a mandatory prerequisite for award; however, vendors must work with the LOC to complete the Authority to Operate (ATO) process, providing evidence of security control implementation. The LOC's current custom-built solution is a cloud-native web application hosted in AWS, utilizing Python, JAVA, and React, with RDS databases and ElasticSearch.