AI-Assisted RMF Pre-Adjudication for Research, Development, and Rapid Prototyping Environments

Objective: The Defense Logistics Agency (DLA) seeks to determine whether AI-enabled, human-attested analysis can improve Risk Management Framework (RMF) documentation quality and reduce rework cycles in research, development, and rapid prototyping contexts. R&D teams frequently submit incomplete or inconsistent RMF artifacts, leading to delays and inefficient use of limited cybersecurity assessor resources. The objective is to evaluate the feasibility of an AI-assisted, artifact-centric analysis capability that enables RMF pre-adjudication, allowing project teams to identify and correct deficiencies before formal cybersecurity review without automating authorization decisions or reducing governance rigor. Description: DLA seeks SBIR project opportunities for an AI-assisted pre-adjudication tool that analyzes draft RMF artifacts to assess their readiness for formal cybersecurity review. Proposed solutions should operate on submitted artifacts (e.g., control implementation statements, system architecture documents) as primary inputs rather than relying on conversational user interfaces. The proposed capability should be able to: Identify missing, inconsistent, or weak control implementation statements. Distinguish between the presence of a control narrative and the sufficiency and clarity of supporting evidence. Generate structured, confidence-scored analytical feedback to help R&D teams improve documentation quality. Incorporate an explicit human attestation mechanism to preserve accountability and prevent reliance on unreviewed AI outputs. Proposed approaches should demonstrate familiarity with RMF assessment practices, including how assessors evaluate documentation sufficiency, inherited controls, and architectural maturity in early-stage systems. The goal is to reduce RMF package rejection and rework rates without altering existing RMF authority structures. Keywords: Risk Management Framework (RMF), Cybersecurity, Artificial Intelligence (AI), Automation, Compliance, Governance, Rapid Prototyping CMMC Level: Level 2 (Self)