Enterprise Automated Digital Forensics & Incident Response (DFIR) - 26/Pro-0024-S

The purpose of this Performance Work Statement (PWS) is to establish an enterprise-wide, automated digital forensics and incident response (DFIR) capability. This will enable the institution to rapidly collect, preserve, and analyze digital evidence across all endpoints to minimize "dwell time" and ensure legal-grade preservation of evidence during security breaches.

Background: As the University's digital footprint expands, traditional manual forensic collection is no longer scalable. The institution requires a solution that integrates with existing security orchestration to provide "speed-to-evidence," allowing the security team to capture volatile memory and disk artifacts across the network in minutes rather than days.