Customer_References.docx

This is a customer references template document for Sacramento County's Application Security Testing (AST) Platform procurement, issued by the County's Contract & Purchasing Services Division on behalf of the Department of Technology under RFB #2026-RFB-0064. Bidders must submit three company references demonstrating relevant project experience. A mandatory pre-bid meeting is scheduled for July 8, 2026 at 11:00 AM via Microsoft Teams, with bids due July 29, 2026 at 5:00 PM. Award is anticipated August 3, 2026. The contract includes a minimum 12-month warranty following formal final system acceptance, with payment terms of NET/30. Questions regarding the procurement must be submitted by July 15, 2026 at 5:00 PM.

Proposers must demonstrate at least three years of company viability with commitment to Application Security Testing platforms and provide at least three customer references, with at least two from public sector organizations. A 5% local preference applies to Sacramento County and local Sacramento Regional Market Area businesses, and a 2% micro-business preference is available. The County requires minimum $2 million in Commercial General Liability, Professional Liability, and Cyber Liability insurance. The requested AST platform must integrate Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and AI-assisted vulnerability remediation capabilities, with seamless integration to source-code management systems (GitHub, GitLab, Azure DevOps, Bitbucket) and CI/CD pipelines. The solution must support enterprise authentication including SSO with role-based access control and centralized administration. Preference is given to solutions with FedRAMP or GOVRAMP authorization and robust audit, compliance, and operational security reporting capabilities. All responses become public records under the California Public Records Act except information legally justified as confidential.