25RB032 RFI_SD Elements 2025.xlsx
XLSX spreadsheet 26 KB Posted
- Attached to
- FA830725RB032 SD Elements FY25 RFI
- Solicitation number
- FA830725RB032_SD_Elements_RFI
About this file
This is a Request for Information (RFI) seeking potential alternatives to SD Elements software, which is currently used by Platform One for threat modeling and security compliance. The RFI is issued by the Department of the Air Force Materiel Command Lifecycle Management Center at Joint Base San Antonio under solicitation number FA830725RB032.
The RFI requires vendors to provide information about alternative licensing models, pricing, and capabilities that match SD Elements' core functionalities. Key requirements include threat modeling for software applications, customizable security surveys, countermeasures mapping to NIST 800-53 and NIST 800-171 controls, kubernetes deployment capability, RBAC-based project separation, SSO integration, and DevSecOps lifecycle integration. Vendors must detail transition costs, training requirements, and pricing plans, including willingness to enter contracts with a base year plus four one-year options. Responses must be submitted via the provided Excel spreadsheet to specified Air Force personnel, and the RFI is also posted on NASA SEWP under RFI number 337340.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI_SD Elements_v2.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFI Excel version of Word sheet
SD Elements gathers information about various projects and automatically generates threat modeling diagrams. By automating the generation of developer centric software threat models, developers are able to efficiently identify threats and know exactly where to implement required countermeasures. This tool allows Platform One to enable security control compliance, secure app development, and deployment of secure applications across all impact levels and classifications.
SD Elements is delivering mission effects at the speed of relevance , while reducing time lost due to security related events. This software will continue to provide the level of product support as is currently provided by the existing PB environment and is critical to maintaining the operational capabilities that Platform One provides to the warfighter. SD Elements is a critical component of the threat modeling architecture of P1. SD Elements significantly decreases the time, effort, and costs required to create and maintain software threat models and secure compliant code.
| Alternative License Types: | |
| 1 | What alternate licensing models or solutions do you offer for SD Elements? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each licensing option/solution set, please provide how it differs from the listed license.)
2 For each licensing option/solution set, please provide how it is similar from the listed license.
(Specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities)
3 For each licensing option/solution set, please provide how it meets the above requirements.
(Identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license type.)
4 For each licensing option/solution set, clarify how it meets the above requirements for our logging and monitoring needs.
(Please highlight specific ways in which each licensing tier can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.)
| Pricing Information: | |
| 1 | For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.)
2 For each license, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.)
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the different licenses that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses.
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.)
Requirements Capability Sheet
| SD Elements ALTERNATIVE: | [PUT NAME HERE] | ||||
| Instructions: | Please select Y/N | Please select Y if Yes, N if no plans, or N/A if ready on day 1 | Please insert # of days from award to build capability or a date if known | Please insert comments, questions, or concerns for each requirement if needed | |
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Please enter Yes or No requirements that a possible alternative software vendor MUST meet. | This Column is meant for the vendor to have space to answer the questions in more detail. | |||
| Must provide the ability to do threat modeling for software applications | |||||
| Must have ability to provide surveys that allow security personnel to customize threat modeling per application | |||||
| Must provide a system of countermeasures that help security personnel enforce standards across application teams | |||||
| Countermeasures must map to NIST 800-53 and NIST 800-171 controls | |||||
| Must provide some level of automated countermeasure responses/resolutions via integrations with SAST and code quality scanners such as sonarqube and Fortify | |||||
| Must be able to run on a kubernetes host via helm chart deployment | |||||
| Must have ability to separate each application into projects, of which each can be scoped to specific users relying on RBAC | |||||
| Must integrate with SSO protocols such as OIDC/SAML | |||||
| Must be able to Identify and model potential threats throughout the software development lifecycle (SDLC) | |||||
| Must Provide visual representation of attack vectors and security risks (e.g., data flows, trust boundaries) | |||||
| Must be able to provide dynamic threat analysis as application architecture evolves | |||||
| Must be able to integrate with DevSecOps lifecycle |
File details come from the government source that posted it. Updated .