RFI - DCSA Personnel Security Alert Management (PSAM) Platform

Alerts which are drawn from dozens of criminal, financial, terrorism-screening, foreign-contact, foreign-travel, and public-record data sources are still worked largely first-in-first-out rather than by risk, so high-consequence alerts can wait behind routine, low-risk items and case queues have grown faster than staffing. While CV has made progress in detecting potential risk indicators far faster than legacy periodic-reinvestigation models, it is still triaging risk with case-management approaches built for a lower-volume era. 3. Desired Capability DCSA seeks a solution that will incorporate the following capabilities: Ingests and normalizes 40+ structured and unstructured data sources—including APIs, databases, PDFs, and open-source information—into a unified alert stream. Correlates alerts to individual subjects using privacy-preserving tokenization, enabling cross-source analysis without unnecessary exposure of personal data. Applies explainable AI/ML risk scoring aligned with federal adjudicative guidelines—such as financial considerations, criminal conduct, and foreign influence—rather than generic threat categories. Analyst-facing outputs must provide clear rationale (for example, LIME, SHAP, or an equivalent method). Automates low-value alert handling through configurable business rules that suppress duplicates, auto-clear qualifying low-risk alerts, and reduce false positives. Routes alerts through tiered, human-in-the-loop workflows for validation, investigation, and adjudication. The system must prioritize alerts by assessed risk—not age—and immediately escalate critical or high-risk alerts. Supports continuous improvement by feeding adjudicator outcomes back into the rules engine and AI/ML models, subject to appropriate oversight and validation. Integrates with—not replaces—authoritative case-management systems of record through documented, open-standard APIs, including OpenAPI 3.1 and REST. The capability must generate upstream triage signals rather than create a parallel case-management silo. Provides leadership and operational dashboards showing key performance measures, including time to detect, time to respond, false-positive rate, and backlog by priority, with near-real-time visibility into detection, response, and workload status. Avoids vendor lock-in. Proprietary data formats or closed APIs are disqualifying. Can operate in controlled IL5 and classified IL6 environments appropriate for intelligence-derived derogatory information and consistent with Department of War cross-domain security requirements.