Military Enlistment Data Access to Lift Student Success (MEDALS)

The Department of Defense, through the Defense Human Resources Activity and Defense Manpower Data Center, is seeking technical and operational input from qualified third-party vendors through the Military Enlistment Data Access to Lift Student Success (MEDALS) Request for Information, identified by solicitation number 2026_MEDALS_RFI. The initiative aims to establish a secure, scalable data intermediary framework that enables the matching of K-12 student graduation records from State Education Agencies with U.S. military enlistment data held by the DoD. This linkage is designed to provide states with verified enlistment indicators for graduates, enabling educational institutions to better inform student career pathways, develop targeted academic plans, and improve postsecondary outcomes for military-bound students. The service must operate as a trusted, unidirectional data processor that securely transmits, matches, deidentifies, aggregates, and returns state-specific results while adhering to strict federal privacy, security, and data governance standards including FERPA, the Privacy Act of 1974, FISMA, NIST SP 800-53, NIST SP 800-88, FedRAMP, and DoDI 8510.01. Data must be encrypted in transit and at rest, stored exclusively within the United States, and destroyed according to NARA and NIST guidelines upon completion or termination. Vendors must demonstrate proven experience as a federal-state data intermediary, particularly with sensitive student and military records, and be capable of implementing robust data matching methodologies that protect personally identifiable information while maintaining accuracy and scalability across multiple jurisdictions. The response must include detailed descriptions of security architecture, governance frameworks, data use agreements, risk mitigation strategies, and operational readiness timelines. The DUA template defines non-negotiable obligations: access is strictly limited to U.S. citizens who meet DoD personnel security requirements, unauthorized disclosure or secondary use of data is prohibited, breach notification must occur within one hour, and contractors assume full legal and financial liability for any compromise. No funding is exchanged under this RFI; the activity is purely for market research and planning purposes, and no contract award is implied. All submissions must address technical compliance, data handling protocols, and governance capabilities without reference to cost or pricing, as this is not a procurement vehicle but a foundational steps toward future contract development. Responses are due by May 22, 2026, with all communication routed through designated points of contact at DMDC in Alexandria, Virginia.