Federal Procurement: CAI / OSINT Data Due Diligence
A practical checklist for evaluating commercially available information, data brokers, and multi-source OSINT signals, built for contracting, privacy, and mission owners.
Since 2018
Privacy-safe enterprise data
VOSB & SDVOSB
U.S. Veteran-Owned, Service-Disabled
SCC Transfers
EU/UK/CH per privacy policy
GDPR · CCPA · CPRA
Consent-first data sourcing
What this page is for
Procurement teams need a buyer-safe story: provenance, exclusions, use restrictions, and delivery controls. This page turns recent enforcement and policy changes into an evaluation workflow you can run in days, not months.
Documentation you should request
- Provenance summary and source categories by feed.
- Sensitive-category handling and exclusion controls.
- Refresh cadence + change logs for schema and sourcing.
- Security and delivery controls (SFTP, GovCloud paths, shares).
Contract terms that matter
- Explicit use restrictions and downstream sharing rules.
- Retention, deletion SLA, and audit rights.
- Breach notification windows and incident escalation path.
- Representations aligned to applicable privacy frameworks.
Operational diligence checks
- Pilot design with match-rate targets and success metrics.
- Data minimization: only what the mission requires.
- Protected location categories and high-risk use filters.
- Chain-of-custody documentation for delivered files.
Delivery + governance
- FedRAMP-compatible storage and access pathways as required.
- Role-based access and least-privilege handling.
- Logging, revocation, and renewal/refresh governance.
- Clear ownership between mission, privacy, and contracting teams.
Recommended reading
If you’re evaluating location, identity, or device-signal data, start with the buyer guides below, then request a scoped pilot with documented exclusions.
For primes: teaming and subcontracting readiness
Federal work often starts with a prime contractor searching for qualified small-business partners. If you’re a prime building a data-intelligence workstream, this is the minimum information you’ll want in one place.
Business identifiers
- UEI: FP25YKSCN7P3
- CAGE: 918J2
- NAICS (primary): 519190
Delivery posture
- Procurement-ready manifests + provenance artifacts.
- Secure delivery paths (S3/SFTP/Snowflake share) by environment.
- Governance terms: retention, deletion SLAs, incident response.
Fast path
- Start with a scoped matched sample.
- Lock exclusions and permitted uses.
- Move to a production license aligned to mission cadence.