Attachment 2. D- QA

RFI Number: D-27-DC-91626
Questions and Answers
Question Number

RFP Section

Paragraph

(RFP) Page Number

Question(s)

Answer(s)

Section 7, Response Instructions

Section 7, Response Instructions

Artificial-Intelligence (AI)-Ready
Architecture

The RFI identifies 9,028 internal users and 2,603,659 external users. For ROM purposes, please provide an estimated breakdown of each Please refer to section 3 of the RFI Supplemental Information document. population by anticipated usage: regular, supervisory, and infrequent users. For purposes of developing a SaaS ROM, please clarify the number and types of production and non-production environments, including any Each environment currently has a dev, test, and production environment. sandbox environments, respondents should assume for pricing purposes. RFI responses are due Thursday, November 5, 2026 is 6pm EST. Responses received after the deadline may not Please confirm the RFI submission time on Tuesday, October 20, 2026 is 5pm EST. be considered.
The Government requests that industry responses be limited to 40 pages, excluding cover page, table of Please confirm that the 40 pages is inclusive of the answers to the questions outlined in Section 6. contents. The 40-page limit is inclusive of the respondent's substantive response, industry questions, and Rough Order of Magnitude (ROM) estimates.
Are there any AI platforms/capabilities (i.e., AWS Bedrock, Azure Foundry, Google Gemini, etc.) that are already approved or ATO'd for The Government leverage native AWS and Azure AI services. These services and implementations must be development of production AI use cases?
compliant with Federal, DOJ, and DEA AI policies.

Section 4

Do external users use any other IAM solutions other than login.gov to access DEA systems?

The Government does not use any other IAM solutions other than login.gov at this time.

Appendix A; Section 3

Can DEA provide, for each application listed in Appendix A, the technology stack, hosting environment, ATO status and authorization boundary, annual transaction volume, record counts, and interface inventory?

Technology stack, hosting environment -- Section 1 of the RFI Supplemental Information document. Annual Transaction volume-- section 2 of the RFI Supplemental Information document. Record Counts-- section 7 of theRFI Supplemental Information document. Interface inventory-- section 9 RFI Supplemental Information document. All environments are ATO'd currently, with the exception of DC4, which has an ATP.