RFI USAFE-AFAFRICA/A6 Risk Management Framework (RMF) Process Efficiencies

The 764th ESS Contracting Squadron, acting on behalf of USAFE-AFAFRICA/A6, has issued a Request for Information (RFI) to gather industry input on potential solutions that enhance efficiencies within the Risk Management Framework (RMF) process, with an emphasis on commercial automation and artificial intelligence technologies. The goal is to enable the Authorizing Official Designated Representative (AODR) to deliver accurate cybersecurity risk assessments while maintaining full compliance with NIST SP 800-53 Revision 5 and DoDI 8510.01. Responses must be submitted as white papers no later than 27 May 2026, at 1400 CEST, via email to designated points of contact. These white papers are limited to 12 pages, excluding cover and capability statements, and must include company information such as name, CAGE code, UEI, address, point of contact, business size, socioeconomic certifications, and any held contract vehicles including GSA MAS, GWAC, IDIQ, or OTA consortia. The technical response must map proposed solutions to all six RMF steps, describe how the 720 USAF baseline controls can be standardized or templated, detail the automation or AI components and their underlying architectures, and provide a clear strategy for reducing Step 4 of the RMF process from 90 days to no more than 45 days. Vendors are required to include a Rough Order of Magnitude (ROM) cost estimate, their preferred pricing model—whether FFP, T&M, subscription/SaaS, or hybrid—and a recommended acquisition pathway with rationale, such as FAR-based, OTA, CSO, or SBIR/STTR. Additionally, vendors must disclose the Technology Readiness Level (TRL) of their solution, any existing Authority to Operate status including issuing authority, classification, boundary, and expiration date, Common Criteria certification details, FedRAMP status if cloud-based, and the applicable DoD Information Security Impact Level supported. All submissions become Government property and will not be returned, and any proprietary information must be minimized, clearly marked, and segregated. The Government will not pay for preparation costs nor is this a solicitation for a contract award; it is strictly for market research and planning purposes, with no obligation to issue a future solicitation. Responses must not contain classified or proprietary information that could be compromised through public posting of answers to industry questions, which must be submitted in writing by 13 May