24-68-A-PMO-OITA RFI QA Document_Final Answers 9.30.2024.docx

34 KB Posted

Attached to
AI Tools for Application Security Scanning and Testing
Solicitation number
24-68-A-PMO-OITA
Issued by

About this file

Written by GovTribe AI ·

This document is a Request for Information (RFI) issued by the Internal Revenue Service (IRS) seeking information on Artificial Intelligence (AI)-based and/or Machine Learning (ML)-based application security testing tools. The IRS is interested in capabilities that can improve upon legacy application security testing tools, such as Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), to support the Continuous Authorization to Operate (cATO) process.

The key details include:

  • The IRS is seeking information on AI/ML-based tools that can provide real-time vulnerability identification, remediation assistance, secure coding recommendations, automated risk analysis, and seamless integration with existing IRS processes and environments.
  • The RFI instructions request two-part responses: Part I on company profile information and Part II on specific capabilities of the AI/ML-based tools.
  • The response due date is October 2, 2024, and the IRS is not soliciting proposals or offers at this time, but rather gathering market research to inform future procurement plans.

View the file

Other files

File Type Posted
24-68-A-PMO-OITA RFI QA Document_9.18.2024.docx DOCX document
RFI_Response Template 24-68-A-PMO-OITA.xlsx XLSX spreadsheet
RFI 24-68-A-PMO-OITA.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Internal Revenue Service (IRS)

24-68-A-PMO-OITA RFI Q&A

AI Tools for Application Security Scanning and Testing Questions and Answers Please submit questions by 9/23/2024 by 5:00pm EDT (Please email Tanya.E.Outland@irs.gov ) Answers to all questions will be posted on SAM.GOV by 9/25/2024 by 12:00noon EDT.

#
Questions
Answers
1
In order to determine the integrations necessary, would you please list the application security testing products that the IRS is currently using?
HCL AppScan for SAST, Qualys for DAST, and Synopsys Seeker for IAST.
2
Similarly, what other testing tools is the IRS planning to adopt in the next year or so?
AI- and/or ML-based application security testing tools
3
Which specific steps or aspects of the cATO process does the IRS consider the highest priority to improve?
· In the Security Scanning Process, the IRS wants to enable regular testing that produces results, reduces false positives, and easily scales to secure many websites so that we can expose vulnerabilities and have greater accuracy which can yield a tangible artifact for a security assessment.

· In the Security Scanning Process, the IRS wants to pre-authorize zero trust templates so if hosting web applications in the cloud, no request approval for scanning is needed in advance so that we can reduce vulnerabilities in advance which can yield a tangible artifact for a security assessment.

· In the Security Scanning Process, the IRS wants to assess applications for compliance with standard controls such as PCI, the OWASP, USA AI Bill of rights, NIST AI 100-01, NIST 800-53,Top 10 and the CWE/SANS Top 25 so that we can detect primary vulnerabilities found in any application which can yield a tangible security assessment having full visibility in the entire security footprint of the given application.

4
Regarding the IRS’s cATO goals, which security/regulatory frameworks, or even particular NIST controls, is the IRS seeking the most assistance to ensure compliance?
· What is the approach by AI scanning tool vendor around integration with our existing IRS CI/CD pipelines on prem and in our various cloud environments?

· Are the proposed AI scanning tools FedRAMP-certified or in the process of being FedRAMP-certified to support application workload deployments in IRS cloud environments?

5
The RFI specifically references application security testing. What other types of testing (e.g., unit testing, integration testing), if any, are within scope?

The IRS has not defined scope nor requirements yet. We will consider all available (and to be available in near future) types of application security testing that is or will be possible (in near future) with AI- and/or ML-based tools.

6
Is the government interested in a solution that leverages an AI /ML model that uses the current vulnerability management suite of tools, or would the government prefer to use standalone AI solutions that don't rely on existing suite of tools?
The IRS is interested in knowing the capabilities of all possible options that can deliver the best results in standalone or combination setup.
7
Is the government open to a combination or mixture of multiple products and services (e.g. DAST, SAST, IAST and LLM) to achieve desired capabilities, or does it need to be a single tool?
The IRS is interested in knowing the capabilities of both a combination of tools and a single tool that can deliver the best results.
8
Can we provide the Services remotely, or the Services need to be Onsite. We have a branch office located in Delaware. Our head office is based in India.
This requirement is in the Market Research phase of procurement. The IRS has not defined any hosting requirements yet.
9
How to download the Tender Documents? Please share the link?
The IRS appreciates your interest and participation with the subject RFI. This requirement is in the Market Research phase of procurement. The contract vehicle, socioeconomic competition, and RFP release date have not been established.
10
I wanted to kindly inquire if there is an anticipated date for posting the Q&A related to Solicitation 24-68-A-PMO-OITA on SAM.gov
COB on September 30, 2024.
11
I would like to request a 30-minute meeting to provide a capability briefing.
The IRS appreciates your interest and participation with the subject RFI. This requirement is in the Market Research phase of procurement. The contract vehicle, socioeconomic competition, and RFP release date have not been established.

We look forward to building/fostering relationships. Therefore, I am inviting you to a 30-minute introduction meeting to share your capabilities with the *IRS Industry Liaison and Engagements (IL&E) Team. This is an informal meeting with Procurement Analysts to discuss the Treasury’s Dynamic Forecast. Please note that there will be no discussion on the details of any RFI, RFQ, or RFP requirements during this meeting.

I invite you to send your capability statement and email to the IL&E Team to schedule: IRS.Industry.Liaison.and.Engagements@irs.gov

If you haven’t done so already, please register for SAM.gov | Home, GSA eBuy!, and NASA SEWP Home to maximize your search for IRS opportunities.

9/30/2024 | 1

File details come from the government source that posted it. Updated .