F3G0CA4317AW01 - Questions and Answers (QnA).pdf
PDF 58 KB Posted
- Attached to
- NTTR Cyber Security Software
- Solicitation number
- F3G0CA4317AW01
About this file
This is a Questions and Answers (Q&A) document for solicitation F3G0CA4317AW01 regarding NTTR Cyber Security Software. The document clarifies technical requirements for source code scanning software, indicating this is a new request (not a renewal) that will support scanning two Visual Studio solutions - one in C# and one in C++ - with 7 developers and 2 test engineers involved.
The customer uses Azure DevOps for continuous integration with local build agents, has no current solutions for assessing open-source components or web applications, and requires implementation by July 2025. The licensing requirements specify either a SaaS model with 6 token subscriptions or an on-premise model requiring two sets of 5-user licenses. The software will be used to identify security vulnerabilities in source code and provide remediation guidance.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
F3G0CA4317AW01 - NTTR Cyber Security Software
Questions and Answers (QnA)
1. Could you please confirm the specific program this request supports and clarify whether it is a new request or a renewal? If it’s a renewal, kindly provide the CSID associated with the previous order.
New Request (Customer). The requested item will be used to scan source code within development software to pinpoint the root cause of security vulnerabilities and provide guidance on how to fix them (99 CONS).
2. To prepare an accurate quote and proposal that is both cost-effective and technically acceptable, we require clarification on the following:
- How many applications (unique code bases) will require scanning?
2 Visual Studio solutions.
- What programming languages are the applications developed in?
1 C#, 1 C++.
- How many developers will be contributing code to the scanned applications?
7 developers.
- How many IA staff or security auditors will be involved in running scans and reviewing findings?
2 test engineers.
- Can a SaaS offering be utilized, or is an on-premise solution necessary?
Not sure. Use cloud based Azure DevOps but have local build agents.
- Are you using a Continuous Integration/Build process that requires integration? If so, which one?
Azure DevOps
- Which solution, if any, is currently in place to assess your open-source software components, libraries, and frameworks (e.g., Sonatype, Snyk, Dependency-Check)?
None.
- Which solution, if any, is used to assess web applications and Web APIs?
None.
- How many web applications need assessment, and how frequently?
None.
- What is the desired timeline for implementing your secure coding program?
July 2025.
Please see below for required license model information provided by the customer (99 CONS).
- SaaS (Software as a Service) Model. Includes 6 token subscriptions.
- On-premise model. 5 users. We would need 2 of these.
File details come from the government source that posted it. Updated .