Product Description RegScale.pdf
PDF 239 KB Posted
- Attached to
- Regscale or Equal for SDN & SDN-S
- Solicitation number
- FA813926Q15618
About this file
This is a Product Description (PD) document for a federal contract procurement by the U.S. Air Force Sustainment Center (AFSC).
The Air Force Sustainment Center seeks to procure RegScale, Inc. Policy & Compliance Software licenses or an equivalent Governance, Risk, and Compliance (GRC) platform under a Firm-Fixed-Price (FFP) contract type. The platform will manage compliance for Software Defined Networking (SDN) and SDN-Secret architectures, supporting major weapon systems and programmatic portfolios including Mission Planning, E3, E7, ATCALS, F-16, and A-10. The procurement aims to transition the AFSC from manual, static compliance processes to an automated, continuous assurance model, enabling continuous authorization (cATO) support, accelerated compliance timelines, reduced audit labor, and improved cyber resilience through real-time control monitoring.
The contractor must provide a GRC platform meeting comprehensive minimum technical requirements, including: API-driven architecture with artificial intelligence and machine-readable data structures; native support for NIST Open Security Controls Assessment Language (OSCAL); automated evidence collection from AWS, Azure, Jira, Tenable, and DevSecOps pipelines; AI-powered control gap analysis and policy parsing; embedded Continuous Compliance Automation in DevSecOps processes; automation of all NIST Risk Management Framework steps to support cATO; quantitative risk analysis using Monte Carlo simulations; third-party risk management capabilities; and immutable audit trails. The contractor shall provide standard commercial warranty on all software licenses. Delivery is required to Air Force Sustainment Center/SWZEC at Tinker AFB, Oklahoma, with primary contact Andrew Clugston and alternate contact Joseph Hopkins.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Sources Sought_RegScale or Equal.pdf | ||
| A15618 - PR25005 - PD.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
i
CUI
PRODUCT DESCRIPTION (PD)
AIR FORCE SUSTAINMENT CENTER (AFSC) ENTERPRISE
REGSCALE, INC. SOFTWARE LICENSES OR EQUIVELANT
U.S AIR FORCE
7/7/2026 Version 1 ii
TABLE OF CONTENTS
1 GENERAL INFORMATION
2 SCOPE
2.1 Operational Objectives & Business Impact
3 TECHNICAL REQUIREMENTS & SPECIFIC TASKS
3.1 Core Platform Capabilities
3.2 Compliance as Code
3.3 Automated Data Collection
3.4 Artificial Intelligence in Control Management
3.5 DevSecOps Integration
3.6 Risk Management Framework (RMF) Automation
3.7 Comprehensive Risk and Exception Management
4 WARRANTY
5 DELIVERY
6 GOVERNMENT REPRESENTATIVES
CUI
1 GENERAL INFORMATION
• Title: RegScale, Inc. Policy & Compliance Software Licenses (or Equivalent
• Requiring Activity: Air Force Sustainment Center (AFSC)
• Contract Type: Firm-Fixed-Price (FFP)
2 SCOPE
This document outlines the minimum technical requirements for a brand name or equal GRC platform. The platform is required for the Air Force Sustainment Center Software Enterprise (AFSC/SW) to manage compliance for Software Defined Networking (SDN) and SDN-Secret (SDN-S) architectures. The objective is to centralize and automate core compliance services to support a diverse array of major weapon systems and programmatic portfolios, including Mission Planning, E3, E7, ATCALS, F-16, and A-10.
2.1 Operational Objectives & Business Impact
The procurement of the GRC platform is intended to transition the Requiring Activity from manual, static compliance processes to an automated, continuous assurance model. The platform must deliver the following operational outcomes:
2.1.1 Continuous Authorization (cATO) Support: Enable a transition from point-in-time authorizations to a Continuous Authority to Operate (cATO) posture through real-time, automated security control monitoring.
2.1.2 Acquisition Velocity: Accelerate compliance timelines (e.g., RMF, FedRAMP) by automating control inheritance and documentation generation.
2.1.3 Audit Efficiency: Minimize manual labor associated with audit preparation by utilizing automated evidence collection and API-driven telemetry.
2.1.4 Exposure Reduction: Improve cyber resilience by providing near real-time alerts on control failures, thereby reducing the window of vulnerability.
3 TECHNICAL REQUIREMENTS & SPECIFIC TASKS
The contractor shall provide a GRC platform that meets the following minimum requirements.
CUI
3.1 Core Platform Capabilities
3.1.1 The platform shall be architected to leverage Application Programming Interfaces (APIs), artificial intelligence, and machine-readable data structures for compliance and risk management.
3.2 Compliance as Code
3.2.1 The platform shall natively support the National Institute of Standards and Technology (NIST) Open Security Controls Assessment Language (OSCAL) to convert regulatory frameworks into machine-readable formats.
3.2.2 The platform shall provide dynamic documentation capabilities, where compliance artifacts are automatically updated in real-time, replacing static document generation.
3.2.3 The platform shall support the mapping of a single control implementation across multiple overlapping regulatory frameworks (e.g., FedRAMP, SOC 2).
3.3 Automated Data Collection
3.3.1 The platform shall integrate with the organization’s technology stack via API to automate the collection of evidence. Supported integrations must include, but are not limited to, AWS, Azure, Jira, Tenable, and DevSecOps pipelines.
3.3.2 The platform shall continuously pull telemetry and security data from integrated systems to provide a real-time view of compliance status.
3.3.3 The platform shall provide an event-driven workflow engine that triggers automated notifications (e.g., via Slack, Microsoft Teams) in response to control failures or compliance drifts.
3.4 Artificial Intelligence in Control Management
3.4.1 The platform shall utilize artificial intelligence (AI) to automatically parse existing corporate policies and generate compliant control implementation statements.
3.4.2 The platform shall provide an automated feature to perform control gap analysis, identify weaknesses, and recommend contextual improvements.
CUI
3.5 DevSecOps Integration
3.5.1 The platform shall embed Continuous Compliance Automation (CCA) directly into DevSecOps processes to enforce security guardrails, ensuring that new products and updates meet regulatory standards by design before production deployment.
3.6 Risk Management Framework (RMF) Automation
3.6.1 The platform must automate all steps of the NIST Risk Management Framework (RMF) process (Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor) to support a state of Continuous Authority to Operate (cATO).
3.6.2 The platform shall support ongoing accreditation through continuous assessment of systems, ensuring compliance status is dynamically synchronized with system posture.
3.6.3 The platform shall provide automated workflows to transition from manual, checklist-based compliance to live, threat-aligned accreditation.
3.7 Comprehensive Risk and Exception Management
3.7.1 The platform shall include a quantitative risk analysis module that utilizes techniques such as Monte Carlo simulations to translate cyber risks into quantifiable financial metrics.
3.7.2 The platform shall provide a Third-Party Risk Management (TPRM) capability for continuous monitoring of vendor and supply chain partner security posture within a centralized dashboard.
3.7.3 The platform must maintain immutable audit trails, recording all changes to compliance records throughout their lifecycle to ensure a transparent and undisputable history.
4 WARRANTY
The contractor shall provide a standard commercial warranty on all software licenses provided.
CUI
5 DELIVERY
Delivery shall be made to the following address.
Air Force Sustainment Center/SWZEC ATTN: Andrew Clugston DoDAAC: F3YCCA 7532 Joint Star Dr., Building 9001
Tinker AFB, OK 73145
6 GOVERNMENT REPRESENTATIVES
Primary Government Representative Alternate Government Representative Name: Andrew Clugston Name: Joseph Hopkins Unit: Air Force Sustainment Center Unit: Air Force Sustainment Center Phone: Phone: 405-736-2597 Email: andrew.clugston@us.af.mil Email: joseph.hopkins.7@us.af.mil
| 1 GENERAL INFORMATION |
| 2 SCOPE |
| This document outlines the minimum technical requirements for a brand name or equal GRC platform. The platform is required for the Air Force Sustainment Center Software Enterprise (AFSC/SW) to manage compliance for Software Defined Networking (SDN) an... |
| 2.1 Operational Objectives & Business Impact |
| 2.1.1 Continuous Authorization (cATO) Support: Enable a transition from point-in-time authorizations to a Continuous Authority to Operate (cATO) posture through real-time, automated security control monitoring. |
| 2.1.2 Acquisition Velocity: Accelerate compliance timelines (e.g., RMF, FedRAMP) by automating control inheritance and documentation generation. |
| 2.1.3 Audit Efficiency: Minimize manual labor associated with audit preparation by utilizing automated evidence collection and API-driven telemetry. |
| 2.1.4 Exposure Reduction: Improve cyber resilience by providing near real-time alerts on control failures, thereby reducing the window of vulnerability. |
| 3 TECHNICAL REQUIREMENTS & SPECIFIC TASKS |
| 3.1 Core Platform Capabilities |
| 3.1.1 The platform shall be architected to leverage Application Programming Interfaces (APIs), artificial intelligence, and machine-readable data structures for compliance and risk management. |
| 3.2 Compliance as Code |
| 3.2.1 The platform shall natively support the National Institute of Standards and Technology (NIST) Open Security Controls Assessment Language (OSCAL) to convert regulatory frameworks into machine-readable formats. |
| 3.2.2 The platform shall provide dynamic documentation capabilities, where compliance artifacts are automatically updated in real-time, replacing static document generation. |
| 3.2.3 The platform shall support the mapping of a single control implementation across multiple overlapping regulatory frameworks (e.g., FedRAMP, SOC 2). |
| 3.3 Automated Data Collection |
| 3.3.1 The platform shall integrate with the organization’s technology stack via API to automate the collection of evidence. Supported integrations must include, but are not limited to, AWS, Azure, Jira, Tenable, and DevSecOps pipelines. |
| 3.3.2 The platform shall continuously pull telemetry and security data from integrated systems to provide a real-time view of compliance status. |
| 3.3.3 The platform shall provide an event-driven workflow engine that triggers automated notifications (e.g., via Slack, Microsoft Teams) in response to control failures or compliance drifts. |
| 3.4 Artificial Intelligence in Control Management |
| 3.4.1 The platform shall utilize artificial intelligence (AI) to automatically parse existing corporate policies and generate compliant control implementation statements. |
| 3.4.2 The platform shall provide an automated feature to perform control gap analysis, identify weaknesses, and recommend contextual improvements. |
| 3.5 DevSecOps Integration |
| 3.5.1 The platform shall embed Continuous Compliance Automation (CCA) directly into DevSecOps processes to enforce security guardrails, ensuring that new products and updates meet regulatory standards by design before production deployment. |
| 3.6 Risk Management Framework (RMF) Automation |
| 3.6.1 The platform must automate all steps of the NIST Risk Management Framework (RMF) process (Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor) to support a state of Continuous Authority to Operate (cATO). |
| 3.6.2 The platform shall support ongoing accreditation through continuous assessment of systems, ensuring compliance status is dynamically synchronized with system posture. |
| 3.6.3 The platform shall provide automated workflows to transition from manual, checklist-based compliance to live, threat-aligned accreditation. |
| 3.7 Comprehensive Risk and Exception Management |
| 3.7.1 The platform shall include a quantitative risk analysis module that utilizes techniques such as Monte Carlo simulations to translate cyber risks into quantifiable financial metrics. |
| 3.7.2 The platform shall provide a Third-Party Risk Management (TPRM) capability for continuous monitoring of vendor and supply chain partner security posture within a centralized dashboard. |
| 3.7.3 The platform must maintain immutable audit trails, recording all changes to compliance records throughout their lifecycle to ensure a transparent and undisputable history. |
| 4 WARRANTY |
| 5 DELIVERY |
| 6 GOVERNMENT REPRESENTATIVES |
File details come from the government source that posted it. Updated .