Appgate-SAM.gov RFI.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

14 November 2024

1.0 Purpose. This Request for Information (RFI) is issued in accordance with the Federal

Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for

Planning Purposes - Oct 1997). The document obtains information for the Air Force

Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division

(CCSD), Joint Base San Antonio - Lackland, TX, for market research and planning purposes in support of the Development, Security and Operations (DevSecOps) Infrastructure Value

Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the Department of Defense (DoD).

2.0 Background. THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES.

2.1 There is no bid package or solicitation document associated with this announcement.

Response is strictly voluntary and will not affect a potential offeror’s ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded.

2.2 The United States Government (USG) does not intend to award a contract based on this

RFI or otherwise pay for the information solicited. No entitlement to payment of direct costs, indirect costs, or charges by USG will arise for submissions in response to this

RFI as well as subsequent USG use of information submitted. Submittals will not be returned to the sender. Respondents may be asked to provide clarifying information from initial submittals.

3.0 Description. UP employs Appgate SDP software solutions for ongoing cybersecurity and testing operations. To identify alternative solutions, UP is conducting market research to assess products and services that can fulfill the specific criteria outlined in paragraph “4.0

Salient Characteristics.”

3.1 The organizational objectives of this research are as follows:

3.1.1 Identify and catalog available products and solutions in the market.

3.1.2 Evaluate the features, functionality, and pricing of each alternative to determine its suitability for UP needs.

3.1.3 Assess the level of integration and compatibility of each alternative with the UP

DevSecOps platform, while ensuring compliance with DoD security requirements.

3.1.4 Estimate the level of USG resources required to migrate to a new solution, while maintaining UP current operational capabilities.

4.0 Salient Characteristics. This aligns with the UP mission previously stated in paragraph “3.0

Description.” The list is not comprehensive but does offer the most critical requirements requisite for the UP environment.

4.1 To meet DoD Chief Information Officer (CIO) DevSecOps Reference Design compliance and perform continuous cybersecurity and testing activities, the tool must provide the following features:

4.1.1 Software must be containerized and deployable through helm charts.

4.1.2 Should support Zero Trust Network Access (ZTNA), supporting adaptive Zero

Trust. Verifying and evaluating user Identity, context, and risk.

4.1.3 Should allow rules and policies customization to align with the organization's security standards.

4.1.4 Should provide robust Application Programming Interface (API) integrations put data to work and automate processes.

4.1.5 Support all resources being invisible with single packet authorization

4.1.6 Compliance should support industry standards, such as Open Worldwide

Application Security Project (OWASP) Top 10, SANS Top 25, and Payment

Card Industry Data Security Standard (PCI DSS).

4.1.7 Should provide training and support for resources for setup and installation.

4.1.8 Supports Security Assertion Markup Language (SAML) integration for Single

Sign-On (SSO).

4.1.9 Support multi-tunnel and high availability connectivity with exclusive protocol coverage and full control over network traffic.

4.1.10 Support securing IOT/devices to support BYOD network and systems with agent-based services.

4.1.11 Support least privileged principles and supporting ICAM and RBAC/ABAC systems.

4.1.12 Support possible air-gapped systems and distributed systems with flexible deployment options

4.2 Static application security test and scan (SAST).

4.2.1 Static code analysis.

4.2.2 Source code linting.

4.2.3 Source code test coverage.

4.2.4 CI/CD integration.

4.2.5 Customizable security scanning and reporting.

4.2.6 The tool must integrate with various package managers to provide security testing during the build process and applications, but as a minimum package managers must include the following: Maven, Gradle, NuGet, NPM, and

RubyGems.

4.3 Dynamic Application Security Testing (DAST).

4.3.1 Should scan web applications and APIs to identify security vulnerabilities such as SQL injection, cross-site scripting (XSS), and cross-site request forgery

(CSRF).

4.3.2 Should test all layers of the application stack, including the network, application, and database layers.

4.3.3 Should automate the testing process, reducing the manual effort required to identify security vulnerabilities.

4.3.4 Should provide detailed reports on security vulnerabilities and recommend remediation steps to address them.

4.3.5 Should support a wide range of technologies, including web application frameworks, programming languages, and protocols, to ensure comprehensive coverage of the application stack.

4.3.6 Should scale to handle large web applications and APIs, as well as multiple applications and services.

4.4 UP will consider both commercial and open-source solutions.

5.0 Summary. As indicated in paragraph “1.0 Purpose.” this is Market Research Request.

Contractor responses will be used for planning purposes only.

5.1 Submit any comments and/or questions regarding this RFI in writing through e-mail directly to:

5.1.1 Contracting Officer: Ms. Karin Werner, karin.werner.1@us.af.mil

5.1.2 Program Manager: Ms. Erin Landry, erin.landry.1@us.af.mil

5.2 Response due date is Thursday, 05 December 2024, 0800 CST. Please annotate the subject line of the e-mail as: “Appgate Solution for Unified Platform RFI Response.

Submit replies to the email addresses listed in paragraphs 5.1.1-2. Include your contract vehicle, Commercial and Government Entity (CAGE) code, and Data Universal

Numbering System (DUNS) number in the response.