Army - Clearview AI Facial Recognition Software - MRAS

The General Services Administration (GSA), on behalf of the U.S. Army, is conducting market research to identify potential sources for a facial recognition service. This initiative aims to enhance the Army's capabilities in information collection and retrieval through advanced technology solutions. The overarching goal is to leverage cutting-edge facial recognition tools that comply with stringent security and regulatory standards, thereby ensuring both efficiency and safety in operations.

The work requested involves the provision of an online-based intelligence service utilizing Clearview AI. This service will operate on a cloud database platform, granting users access for a 12-month period. The primary function of this service is to collect and retrieve information from both public domain sources and agency-specific databases, ensuring comprehensive data coverage. A key requirement is the system's ability to maintain a high accuracy rate of 98% or above in facial recognition tasks, as verified by National Institute of Standards and Technology (NIST) methods.

In terms of security and compliance, the solution must adhere to Law Enforcement Sensitive Information Protections standards while also being SOC 2 Type II certified for attestation purposes. Risk management practices are crucial; hence, the system needs TX-Ramp certification and must conform to state-mandated regulations in Texas. Data transmission security is emphasized with requirements for Transport Layer Security (TLS) version 1.2 or higher, along with point-to-point data transfer methods.

Additional technical specifications include annual penetration testing audits covering both cloud databases and source code, with results available under non-disclosure agreements. Continuous vulnerability assessments through software development lifecycle processes are mandatory, alongside static analysis code testing (SAST) and periodic network vulnerability scans using Software Composition Analysis (SCA). To further bolster security measures, continuous external attack surface management (EASM) is required.