FA8307_RFI_Palo_Alto_Twistlock_Alternatives (2).docx

***Please submit all responses using the attached RFI Template to geoffrey.bender.1@us.af.mil, elijah.simmons.4@us.af.mil, and julie.mckillip.ctr@us.af.mil.*** Current Software in use by the Government: Palo Alto Twistlock AKA “Prisma Cloud Compute Edition”.

"Prisma Cloud Compute Edition” is the correct name of the current solution; however, many DoD customers still refer to the solution as "Twistlock" and the SKU for the license credits still refer to "Twistlock".

Requirement:

The Government currently uses Palo Alto’s Twistlock to:

· enforce Comply2Connect by running system checks to verify that devices meet standards for secure connection.

· deliver protection against threats across the cloud infrastructure, APIs, and data at runtime while also protecting applications across Virtual Machines, containers and Kubernetes, and serverless architectures.

· authenticate users and devices to provide entitlements to network resources.

· be the default runtime security and Dynamic Application Security Testing (DAST) scanning tool to meet P1’s Party Bus requirements for Continuous Authorization to Operate (cATO).

· integrate with developer tools and environments to identify cloud misconfigurations, vulnerabilities and security risks during the code and build stage.

· check container registries and continuous delivery (CD) workflows to block vulnerabilities, malware and prevent insecure deployments.

· support all of P1’s customers to build and maintain a software development environment that will speed Zero Trust maturity.

· to seamlessly integrate with our CI/CD pipelines, scanning containers and providing real-time insights into vulnerability management compliance based on the latest CVEs and CMMC lists.

· check and report compliance with relevant CVE, NIST, and STIG requirements, which is critical for maintaining security standards.

Please provide information on the following topics. If your company is an approved reseller of Palo Alto Twistlock / Prisma Cloud Compute Edition AND plan on proposing those licenses please fill out Pricing Information and Other Considerations Sections:

Alternative License Types:

· What other licensing/solutions do you offer?

· For each licensing option/solution set, please provide how it differs from the listed license.

· For each licensing option/solution set, please provide how it is similar from the listed license.

· For each licensing option/solution set, please provide how it meets the above requirements.

****Please ensure to highlight***

1. How your alternative solution provides automated vulnerability scanning and compliance enforcement within our containerized environments.

2. How your alternative solution provides the ability to integrate with CI/CD pipelines for continuous compliance checks

3. How long your alternative solution would take to transition (test, compare, and train) from Twistlock

4. How your alternative solution provides assurance that products are consistently scanned and up to date to the vulnerability management teams, cyber and engineering personnel.

Pricing Information:

· For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution?

· For each license, please provide any price plans associated such as monthly, trial, annual.

Other Considerations:

· Are there any additional features or benefits associated with the different licenses that we should consider?

· Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?

We are eager to find a solution that will best support our needs and ensure continued productivity.

Please Note: No award will be made under this RFI. Only a warranted Contracting Officer can obligate on behalf of the United States Government and that will be executed through an official request for quote (RFQ). The Government reserves the right to cancel this RFI. In the event the Government cancels this RFI, the Government has no obligation to pursue procurement or to reimburse an Offeror for any costs.