RFI_SD Elements_v2.xlsx
XLSX spreadsheet 20 KB Posted
- Attached to
- FA830725RB032 SD Elements FY25 RFI
- Solicitation number
- FA830725RB032_SD_Elements_RFI
About this file
This is a Request for Information (RFI) issued by the Air Force Lifecycle Management Center's Cryptologic and Cyber Systems Division seeking market research on alternative software solutions to SD Elements. The RFI focuses on identifying alternative software that can provide threat modeling, security personnel customization, countermeasure enforcement, and integration capabilities across the software development lifecycle. Key requirements include the ability to run on Kubernetes, support role-based access control (RBAC), integrate with SSO protocols, provide visual threat representations, and map to NIST 800-53 and 800-171 controls.
The document requests vendors to complete a detailed spreadsheet describing alternative software options, including licensing types, pricing information, transition costs, training schedules, and specific capabilities that match the outlined requirements. Vendors are asked to provide comprehensive details about enterprise, cloud-managed, and open-source editions, with emphasis on how their solutions can meet the Air Force's operational, security, and compliance needs. The RFI explicitly states that this is for market research purposes only, is not a solicitation, and responses are voluntary, with no guarantee of future contract award.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 25RB032 RFI_SD Elements 2025.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
T&C and Contact Information
| Note: Please read and complete the middle portion. | |
| 1 | This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. |
| 2 | THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals. |
| Company Name: | |
| CAGE/DUNS Code: | |
| Address: | |
| POC Name: | |
| POC E-mail: | |
| POC Phone Number: | |
| 3 | As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC. |
RFI Q&A
Note: This document is only interested in alternative software. All three sheets in this document is to be completed.
| Alternative License Types: | |
| 1 | What alternative software do you offer that is similar to SD Elements? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]
2 For each alternative software option/solution, please provide how it is similar from the listed license.
(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]
3 For each alternative software option/solution, please provide how it meets the above requirements.
(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]
4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).
(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]
| Pricing Information: | |
| 1 | For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]
2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the alternative software that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]
Requirements Capability Sheet
| SD Elements ALTERNATIVE: | [TYPE NAME HERE] | ||||
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Must provide the ability to do threat modeling for software applications | FALSE | FALSE | ||
| 2 | Must have ability to provide surveys that allow security personnel to customize threat modeling per application | FALSE | FALSE | ||
| 3 | Must provide a system of countermeasures that help security personnel enforce standards across application teams | FALSE | FALSE | ||
| 4 | Countermeasures must map to NIST 800-53 and NIST 800-171 controls | FALSE | FALSE | ||
| 5 | Must provide some level of automated countermeasure responses/resolutions via integrations with SAST and code quality scanners such as sonarqube and Fortify | FALSE | FALSE | ||
| 6 | Must be able to run on a kubernetes host via helm chart deployment | FALSE | FALSE | ||
| 7 | Must have ability to separate each application into projects, of which each can be scoped to specific users relying on RBAC | FALSE | FALSE | ||
| 8 | Must integrate with SSO protocols such as OIDC/SAML | FALSE | FALSE | ||
| 9 | Must be able to Identify and model potential threats throughout the software development lifecycle (SDLC) | FALSE | FALSE | ||
| 10 | Must Provide visual representation of attack vectors and security risks (e.g., data flows, trust boundaries) | FALSE | FALSE | ||
| 11 | Must be able to provide dynamic threat analysis as application architecture evolves | FALSE | FALSE | ||
| 12 | Must be able to integrate with DevSecOps lifecycle | FALSE | FALSE |
File details come from the government source that posted it. Updated .