Enterprise Inbound Email Retention and Forensic Analysis Solution

                       Enterprise Inbound Email Retention and Forensic Analysis Solution

                                    Sources Sought Notice / Request for Information (RFI)

This is a Sources Sought Notice (SSN) for market research purposes only. This notice is issued solely for information and acquisition planning purposes and does not constitute a Request for Quotation (RFQ), Request for Proposal (RFP), or a commitment to issue a solicitation in the future.

The Internal Revenue Service (IRS) does not obligate itself to contract for any supply or service as a result of this notice. The Government is not currently seeking quotations or proposals and will not accept unsolicited quotations.

The purpose of this notice is to identify potential vendors and commercially available solutions capable of meeting the IRS's enterprise email retention, search, and forensic analysis requirements.

1. BACKGROUND

The Department of the Treasury, Internal Revenue Service (IRS), is seeking information on existing Commercial-Off-the-Shelf (COTS) solutions capable of providing enterprise-wide inbound email visibility, retention, centralized search, and forensic analysis capabilities for both legitimate (clean) and malicious emails.

The IRS currently utilizes Cisco IronPort email security infrastructure and an existing Blind Carbon Copy (BCC) method to receive and retain copies of inbound email messages. The IRS is seeking a solution that can integrate with this existing infrastructure and preserve complete, unaltered copies of inbound emails, including message headers, content, metadata, and attachments.

The IRS requires an enterprise-level solution that operates independently of individual Microsoft Outlook clients and does not rely on Outlook add-ons, plug-ins, or client-side software for enterprise email collection, retention, search, and forensic analysis.

The IRS is interested in commercially available on-premises, virtual, cloud-based, or hybrid solutions. The Government is also interested in alternative technical approaches that can provide equivalent capabilities while meeting applicable federal security and operational requirements.

The IRS does not have a predefined solution or architecture and welcomes information on commercially available products capable of meeting its operational needs.

The results of this market research will assist the Government in identifying potential sources, assessing available commercial capabilities, and determining an appropriate acquisition strategy.

The IRS anticipates a target implementation date of June 2027. Interested vendors should identify their estimated delivery and implementation timelines.

2. TECHNICAL CAPABILITIES

Interested vendors are requested to describe their ability to meet the following anticipated technical and operational capabilities. Vendors should identify any capabilities that cannot be met or would require additional configuration, integration, or development. The Government welcomes information on alternative approaches that achieve equivalent operational outcomes.

A. Cisco IronPort Integration and Email Collection

• Support integration with Cisco IronPort to receive and retain complete, unaltered copies of inbound email messages, including legitimate (clean) and malicious emails, through the existing BCC method or an alternative collection method that provides equivalent functionality.
• Preserve original message headers, content, metadata, and attachments for forensic investigations.
• Provide enterprise-wide email collection independent of Microsoft Outlook add-ons, plug-ins, or client-side applications.
• Identify any additional infrastructure, software, or configuration required for integration.

B. Enterprise Email Volume and Retention

The solution should be capable of supporting the following estimated email volumes:

• Up to approximately 1 million inbound emails per day.
• Peak email volume of approximately 150,000 emails per hour.
• Approximately 22 TB of inbound email data per month.
• Configurable retention periods ranging from 30 to 180 days for both legitimate and malicious emails.

Vendors should describe the scalability, storage architecture, and performance capabilities of their proposed solutions.

C. Email Search and Forensic Analysis

• Provide centralized search and investigation capabilities for both legitimate and malicious inbound email messages.
• Allow authorized analysts to search, retrieve, and review complete email messages, including headers, metadata, and attachments.
• Describe the solution's capabilities for identifying and classifying potentially malicious email messages, including any integration with existing email security tools.
• Describe available quarantine or equivalent isolation capabilities, whether provided directly by the solution or through integration with existing security infrastructure.
• Allow authorized analysts to view and download attachments for forensic investigations.
• Maintain message integrity throughout the retention and investigation process.

D. Third-Party Integration

• Support integration with Splunk for forwarding system logs, events, and email metadata.
• Support integration with Splunk SOAR for investigation and response automation.
• Provide APIs or equivalent interfaces for integration with additional security tools and automated workflows.

E. Administration and System Management

• Provide secure command-line interface (CLI) access or equivalent administrative capabilities.
• Support high availability, redundancy, and automatic failover.
• Provide centralized system configuration, administration, and monitoring.
• For physical on-premises appliances, support IPMI or equivalent out-of-band hardware management.

F. Security and Federal Compliance

The solution must be capable of supporting applicable federal cybersecurity and audit requirements, including:

• IPv6 compatibility.
• Applicable FIPS 140-2 or FIPS 140-3 validated cryptographic modules.
• Encryption of data at rest and in transit.
• Role-based access control (RBAC).
• Audit logging and monitoring.
• Configurable security warning banners.

Secure input validation.

• Secure remote configuration backups.
• Active Directory integration, including LDAP and SAML-based authentication, as applicable.
• For cloud-based solutions, vendors shall identify their FedRAMP authorization status, authorization level, and any limitations or additional requirements associated with federal deployment.

Vendors shall also identify the country of product development, hosting locations, data storage locations, and any applicable federal security or supply-chain considerations.

G. Technical Support and Maintenance

• Provide information regarding 24x7 technical support availability.
• Identify whether technical support can be provided by U.S.-citizen personnel.
• Describe regular software updates, security patches, and vulnerability remediation procedures.
• Identify available maintenance agreements, support response times, and escalation procedures.

3. SUBMISSION INSTRUCTIONS

a) Point of Contact

The point of contact for this notice is:

Contracting Officer: Jessica Camunez
Email: [email protected]

Responses shall be submitted electronically no later than November 25, 2026, at 3:00 PM, Eastern Time.

Vendors shall reference "Enterprise Inbound Email Retention and Forensic Analysis Solution" in the subject line of their response.

The Government is not requesting formal quotations, proposals, or general marketing materials.

b) Requested Vendor Information

The Government requests that interested parties submit the following information:

1. Company name, Unique Entity ID (UEI), business address, point of contact, telephone number, and email address.

2. Business size and socioeconomic status (e.g., large business, small business, small disadvantaged business, HUBZone, woman-owned small business, service-disabled veteran-owned small business).

3. Name and manufacturer of the proposed commercially available solution, including whether the solution is currently available.

4. Describe how the proposed solution addresses the technical capabilities identified in Section 2. For each capability, indicate whether it is currently supported, requires configuration or integration, requires additional development, or is not supported. Identify any alternative approaches that provide equivalent functionality.

5. Describe how the proposed solution integrates with Cisco IronPort using the existing BCC method or an alternative method capable of preserving complete, unaltered inbound email messages.

6. Describe the solution's ability to support the estimated enterprise email volumes, storage requirements, and retention periods.

7. Identify any dependencies on Microsoft Outlook, Microsoft 365, Exchange Online, Microsoft Purview, or other third-party products.

8. Identify applicable federal security certifications, FedRAMP authorization status (if applicable), hosting locations, and availability of U.S.-citizen technical support.

9. Provide an estimated implementation timeline and indicate whether the solution could be delivered and operational by June 2027.

10. Identify available Government contract vehicles, including GSA Multiple Award Schedule contracts, applicable Special Item Numbers (SINs), contract numbers, and suggested NAICS codes.

11. Identify the vendor's level of interest in a potential future requirement: highly likely to submit a quotation or proposal, may submit a quotation or proposal, or unlikely to participate.

12. Provide any additional information regarding alternative products, capabilities, or approaches that may satisfy the Government's requirements.

Responses should be limited to 10 pages, excluding supporting technical documentation.

The Government may contact respondents for clarification or additional information as necessary.

Thank you for your interest.