Enterprise Inbound Email Retention and Forensic Analysis Solution
Open — responses due 25 Nov 2026 (11 days left) · No Set aside used · Internal Revenue Service (IRS), Treasury · New Carrollton, MD · NAICS 513210 · Solicitation IT2027-06
Get the AI read before you spend a day on this package. FedSift pulls out the deal-breakers and key risks, each quoted from the document. Free, no account.
Before you spend a day on this package: FedSift reads every document and pulls out what is being bought, the deal-breakers and the key risks — each quoted from the page it came from. Free, no account needed. The result is shared, so the next reader gets it instantly. With a free account it also builds the full compliance matrix.
Track this solicitation
We'll email you if the response deadline moves, an amendment posts, or new documents are added. It closes 25 November 2026. No account needed — one email, unsubscribe in a click.
Description
Enterprise Inbound Email Retention and Forensic Analysis Solution Sources Sought Notice / Request for Information (RFI) This is a Sources Sought Notice (SSN) for market research purposes only. This notice is issued solely for information and acquisition planning purposes and does not constitute a Request for Quotation (RFQ), Request for Proposal (RFP), or a commitment to issue a solicitation in the future. The Internal Revenue Service (IRS) does not obligate itself to contract for any supply or service as a result of this notice. The Government is not currently seeking quotations or proposals and will not accept unsolicited quotations. The purpose of this notice is to identify potential vendors and commercially available solutions capable of meeting the IRS's enterprise email retention, search, and forensic analysis requirements. 1. BACKGROUND The Department of the Treasury, Internal Revenue Service (IRS), is seeking information on existing Commercial-Off-the-Shelf (COTS) solutions capable of providing enterprise-wide inbound email visibility, retention, centralized search, and forensic analysis capabilities for both legitimate (clean) and malicious emails. The IRS currently utilizes Cisco IronPort email security infrastructure and an existing Blind Carbon Copy (BCC) method to receive and retain copies of inbound email messages. The IRS is seeking a solution that can integrate with this existing infrastructure and preserve complete, unaltered copies of inbound emails, including message headers, content, metadata, and attachments. The IRS requires an enterprise-level solution that operates independently of individual Microsoft Outlook clients and does not rely on Outlook add-ons, plug-ins, or client-side software for enterprise email collection, retention, search, and forensic analysis. The IRS is interested in commercially available on-premises, virtual, cloud-based, or hybrid solutions. The Government is also interested in alternative technical approaches that can provide equivalent capabilities while meeting applicable federal security and operational requirements. The IRS does not have a predefined solution or architecture and welcomes information on commercially available products capable of meeting its operational needs. The results of this market research will assist the Government in identifying potential sources, assessing available commercial capabilities, and determining an appropriate acquisition strategy. The IRS anticipates a target implementation date of June 2027. Interested vendors should identify their estimated delivery and implementation timelines. 2. TECHNICAL CAPABILITIES Interested vendors are requested to describe their ability to meet the following anticipated technical and operational capabilities. Vendors should identify any capabilities that cannot be met or would require additional configuration, integration, or development. The Government welcomes information on alternative approaches that achieve equivalent operational outcomes. A. Cisco IronPort Integration and Email Collection Support integration with Cisco IronPort to receive and retain complete, unaltered copies of inbound email messages, including legitimate (clean) and malicious emails, through the existing BCC method or an alternative collection method that provides equivalent functionality. Preserve original message headers, content, metadata, and attachments for forensic investigations. Provide enterprise-wide email collection independent of Microsoft Outlook add-ons, plug-ins, or client-side applications. Identify any additional infrastructure, software, or configuration required for integration. B. Enterprise Email Volume and Retention The solution should be capable of supporting the following estimated email volumes: Up to approximately 1 million inbound emails per day. Peak email volume of approximately 150,000 emails per hour. Approximately 22 TB of inbound email data per month. Configurable retention periods ranging from 30 to 180 days for both legitimate and malicious emails. Vendors should describe the scalability, storage architecture, and performance capabilities of their proposed solutions. C. Email Search and Forensic Analysis Provide centralized search and investigation capabilities for both legitimate and malicious inbound email messages. Allow authorized analysts to search, retrieve, and review complete email messages, including headers, metadata, and attachments. Describe the solution's capabilities for identifying and classifying potentially malicious email messages, including any integration with existing email security tools. Describe available quarantine or equivalent isolation capabilities, whether provided directly by the solution or through integration with existing security infrastructure. Allow authorized analysts to view and download attachments for forensic investigations. Maintain message integrity throughout the retention and investigation process. D. Third-Party Integration Support integration with Splunk for forwarding system logs, events, and email metadata. Support integration with Splunk SOAR for investigation and response automation. Provide APIs or equivalent interfaces for integration with additional security tools and automated workflows. E. Administration and System Management Provide secure command-line interface (CLI) access or equivalent administrative capabilities. Support high availability, redundancy, and automatic failover. Provide centralized system configuration, administration, and monitoring. For physical on-premises appliances, support IPMI or equivalent out-of-band hardware management. F. Security and Federal Compliance The solution must be capable of supporting applicable federal cybersecurity and audit requirements, including: IPv6 compatibility. Applicable FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Encryption of data at rest and in transit. Role-based access control (RBAC). Audit logging and monitoring. Configurable security warning banners. Secure input validation. Secure remote configuration backups. Active Directory integration, including LDAP and SAML-based authentication, as applicable. For cloud-based solutions, vendors shall identify their FedRAMP authorization status, authorization level, and any limitations or additional requirements associated with federal deployment. Vendors shall also identify the country of product development, hosting locations, data storage locations, and any applicable federal security or supply-chain considerations. G. Technical Support and Maintenance Provide information regarding 24x7 technical support availability. Identify whether technical support can be provided by U.S.-citizen personnel. Describe regular software updates, security patches, and vulnerability remediation procedures. Identify available maintenance agreements, support response times, and escalation procedures. 3. SUBMISSION INSTRUCTIONS a) Point of Contact The point of contact for this notice is: Contracting Officer: Jessica Camunez Email: Jessica.r.camunez@irs.gov Responses shall be submitted electronically no later than November 25, 2026, at 3:00 PM, Eastern Time. Vendors shall reference "Enterprise Inbound Email Retention and Forensic Analysis Solution" in the subject line of their response. The Government is not requesting formal quotations, proposals, or general marketing materials. b) Requested Vendor Information The Government requests that interested parties submit the following information: 1. Company name, Unique Entity ID (UEI), business address, point of contact, telephone number, and email address. 2. Business size and socioeconomic status (e.g., large business, small business, small disadvantaged business, HUBZone, woman-owned small business, service-disabled veteran-owned small business). 3. Name and manufacturer of the proposed commercially available solution, including whether the solution is currently available. 4. Describe how the proposed solution addresses the technical capabilities identified in Section 2. For each capability, indicate whether it is currently supported, requires configuration or integration, requires additional development, or is not supported. Identify any alternative approaches that provide equivalent functionality. 5. Describe how the proposed solution integrates with Cisco IronPort using the existing BCC method or an alternative method capable of preserving complete, unaltered inbound email messages. 6. Describe the solution's ability to support the estimated enterprise email volumes, storage requirements, and retention periods. 7. Identify any dependencies on Microsoft Outlook, Microsoft 365, Exchange Online, Microsoft Purview, or other third-party products. 8. Identify applicable federal security certifications, FedRAMP authorization status (if applicable), hosting locations, and availability of U.S.-citizen technical support. 9. Provide an estimated implementation timeline and indicate whether the solution could be…
Go deeper on this solicitation
FedSift reads the full solicitation package — every attachment — and pre-extracts the compliance matrix, evaluation factors, key risks, win themes and deal-breakers, each with a verbatim quote and the exact PDF page it came from. It scores the opportunity against your company profile, tells you whether to bid as prime or sub, and ranks teaming partners who could close your gaps.
Source: this notice on SAM.gov. FedSift republishes public federal procurement data and is not affiliated with the U.S. Government. Always confirm dates and requirements against SAM.gov before responding.
