DAF Insider Threat Program for User Activity Monitoring (UAM)

Background
The Secretary of the Air Force, Office of Competitive Activities (SAF/OC) is seeking information for the Department of the Air Force (DAF) Insider Threat Program, specifically focusing on User Activity Monitoring (UAM). This initiative is mandated by Executive Order and public law, aiming to enhance user activity monitoring capabilities across both classified and unclassified DAF networks.

The purpose of this Request for Information (RFI) is to gather insights from potential vendors regarding their capabilities and solutions that align with the UAM requirements.

Work Details
The RFI seeks detailed information from vendors about their capabilities related to User Activity Monitoring (UAM) across multiple networks. Specific questions posed to potential vendors include:

1. Licensing structure for commercial software and availability of enterprise licensing.
2. Proposed subcontracting or small business partnerships to support the UAM mission.
3. Clarity of tasks/sub-tasks in the Performance Work Statement (PWS).
4. Recommended contract strategies or vehicles for this requirement.
5. Current holdings on Government-Wide Acquisition Contracts or Multiple Award Schedules.
6. Small business concerns regarding the scope of the requirement, including considerations for small business set-asides versus large business subcontracting plans.
7. Suggested evaluation criteria for source selection based on stated objectives.

Place of Performance
The services are expected to be performed across multiple DAF networks, which include both classified and unclassified environments.

Incumbent Analysis (see Incumbents section for more detail)
This opportunity for DAF Insider Threat Program User Activity Monitoring (UAM) appears to have a confirmed incumbent, with Everfox holding multiple related awards under FA714621DB002, including UAM and analytics support for Fabric 1 and Fabric 2 (e.g., FORCEPOINT DataView/licenses and UAM monitoring/analytics) with periods spanning 08/09/21–08/08/26 and follow-on contracts in 03/16/24–03/15/27. Additional Everfox tasking includes UAM monitoring and analytics for DAF C-INT (Fabric 2) and expansion work tied to the DAF counter insider threat program, which aligns closely with the current RFI’s focus on user activity monitoring across classified and unclassified DAF networks.