RFI USAFE-AFAFRICA/A6 Risk Management Framework (RMF) Process Efficiencies

Questions & Answers / Clarifications

This document contains questions submitted by industry and the Government's answers regarding Risk Management Framework (RMF) Process Efficiencies for USAFE-AFAFRICA.

• Facility Clearance: An active Facility Clearance is not required for a white paper response, but is necessary if the contract is awarded. Phased approaches are permissible, with all phases needing completion within one year of award.
• Acquisition Pathway: The Government is considering multiple acquisition pathways, including Commercial Solutions Opening (CSO) and Other Transaction Agreements (OTAs), but has not confirmed a specific strategy. Industry input on preferred vehicles is welcomed.
• AI Tooling: For unclassified prototype demonstrations, commercial LLMs are acceptable. However, if AI tools require AFNet/AFNet-S access, vendors must secure the Authority to Operate (ATO).
• Cloud Solutions: For systems classified at SECRET and SECRET//REL levels, cloud-based solutions must meet IL6 security measures. Reciprocity for existing authorizations is encouraged but not guaranteed.
• eMASS Integration: Full eMASS replacement is out of scope. Integration with eMASS is expected, and while API access is currently unavailable, the Government may consider bidirectional sync if DISA/DAF allows.
• Personnel Clearances: Vendor personnel are expected to have clearance levels sufficient to access data classified at most SECRET//NOFORN.
• Place of Performance: While in-person access to USAFE personnel is preferred, work can be performed from CONUS. A secure work area at Ramstein AB can be provided for classified information.
• 720 Baseline Controls: The 720 baseline controls are mandated by DAF CISO and deployed in eMASS. Access to the full list and associated overlays will be provided to the awarded vendor.

This Q&A document provides critical details that bidders should consider when preparing white papers or future proposals, particularly regarding security requirements, acquisition strategy, and technical implementation. The Government is using this market research to inform future planning and acquisition strategy.

Request for Information (RFI)

This RFI, issued by the 764th ESS Contracting Squadron on behalf of USAFE-AFAFRICA/A6, seeks information on commercial solutions to improve efficiencies in the Risk Management Framework (RMF) process. The government is interested in automation and AI solutions that enhance process improvements and mature technologies while maintaining compliance with NIST SP 800-53 Rev 5 and DoDI 8510.01. This RFI is for planning and market research purposes and does not commit the government to a solicitation or contract.

The RMF process is complex and can be bureaucratic, leading to lengthy timelines for achieving an Authority to Operate (ATO). This is particularly challenging for USAFE-AFAFRICA due to rapid growth in approved systems and the transition to NIST SP 800-53 Rev 5. The government needs solutions to prototype and demonstrate efficiencies across all RMF steps, including process improvements and technological innovations.

The government seeks solutions that can demonstrate end-to-end objectives within 12 months. Vendors are expected to implement process improvements and technical capabilities within 12 months of contract award. The government will provide access to personnel involved in the RMF process. Solutions should address unclassified, SECRET, and SECRET//REL systems. Proposed technology should ideally have an existing ATO or interim authority to test (IATT), or a Common Criteria certification.

Required attributes include addressing all RMF steps, analyzing 720 baseline controls, novel capabilities, reducing Step 4 from 90 to 45 days, maturity for demonstration, adaptability, incorporation of automation/AI, and cost-effectiveness. Desired attributes include thorough review of RMF artifacts, output with references, ease of review for SCAR, handling increased load, simplicity of operation, and data confidentiality/integrity/availability.

Responses (limited to 12 pages) should include:

• Company Information (CAGE, UEI, size, certifications, contract vehicles)
• Technical Solution Overview (description, mapping to RMF steps, automation/AI approach, Step 4 reduction)
• Maturity & Compliance (TRL, ATO/Common Criteria status, FedRAMP, DoD IL, past performance)
• Implementation Approach (demonstration plan, milestone schedule, personnel needs, use of consultants)
• Pricing Construct (ROM estimate, pricing model, contract vehicles)
• Recommended Acquisition Approach (pathway, contract type)

White papers are due by 27 May 2026, 1400 CEST, submitted via email to Mr. Corey Chopko, Ms. Ina Hemmer, and Capt Kevin Sheedy. Questions are due by 13 May 2026, 1400 CEST, via email to the same contacts.