RFI_MicroFocus Fortify_v2.xlsx
XLSX spreadsheet 20 KB Posted
- Attached to
- FA830725RB033 MicroFocus Fortify FY25 RFI
- Solicitation number
- FA830725RB033_Microfocus_Fortify_FY25_RFI
About this file
This Request for Information (RFI) is issued by the Air Force Lifecycle Management Center's Cryptologic and Cyber Systems Division to conduct market research for alternative software solutions to MicroFocus Fortify. The RFI seeks detailed information from vendors about software alternatives for static application security testing (SAST), with specific technical requirements including support for multiple programming languages, containerized and Kubernetes environments, CI workflow integration, and compliance with security standards like NIST, CWE, OWASP Top 10, and DISA STIG.
The RFI requires vendors to provide comprehensive details on alternative software, including licensing types (enterprise, cloud-managed, open-source), transition and training costs, pricing plans, contract flexibility (base year with up to four one-year options), and how their solutions meet 20 specific technical requirements. Vendors are instructed to submit responses using the attached Excel spreadsheet to multiple Air Force contacts, with responses being used solely for market research and planning purposes. The opportunity is posted on NASA SEWP under RFI number 337337, and participation is voluntary with no guarantee of future solicitation or contract award.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 25RB033 RFI MicroFocus Fortify 2025.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
T&C and Contact Information
| Note: Please read and complete the middle portion. | |
| 1 | This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. |
| 2 | THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals. |
| Company Name: | |
| CAGE/DUNS Code: | |
| Address: | |
| POC Name: | |
| POC E-mail: | |
| POC Phone Number: | |
| 3 | As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC. |
RFI Q&A
Note: This document is only interested in alternative software. All three sheets in this document is to be completed.
| Alternative License Types: | |
| 1 | What alternative software do you offer that is similar to MicroFocus Fortify? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]
2 For each alternative software option/solution, please provide how it is similar from the listed license.
(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]
3 For each alternative software option/solution, please provide how it meets the above requirements.
(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]
4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).
(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]
| Pricing Information: | |
| 1 | For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]
2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the alternative software that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]
Requirements Capability Sheet
| MicroFocus Fortify ALTERNATIVE: | [TYPE NAME HERE] | ||||
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Must be able to perform Static Application Security Testing (SAST) | FALSE | FALSE | ||
| 2 | Must have rules that align with NIST, CWE, OWASP Top 10, and DISA STIG | FALSE | FALSE | ||
| 3 | Must be able to run scans in a containerized environment | FALSE | FALSE | ||
| 4 | If there is a server component for analysis, this must also run within a kubernetes stack, using helm charts for deployment | FALSE | FALSE | ||
| 5 | Must have functionality for whitelisting/adjudicating, and providing justification for findings | FALSE | FALSE | ||
| 6 | Must be able to perform taint analysis, | FALSE | FALSE | ||
| 7 | Must be able to run within CI workflows | FALSE | FALSE | ||
| 8 | Threshold for true positive rate as determined by https://github.com/OWASP-Benchmark/BenchmarkJava | FALSE | FALSE | ||
| 9 | Must have integrations with SDElements or other threat analysis tools | FALSE | FALSE | ||
| 10 | Should be able to show a call-graph deduced during taint analysis etc for analyzing source of code security findings | FALSE | FALSE | ||
| 11 | IF there is a server component for analysis/vulnerability management it must integrate into SSO using OIDC or SAML | FALSE | FALSE | ||
| 12 | Code Analysis must be performed in a self hosted environment. Findings/code cannot be sent to a SaaS solution | FALSE | FALSE | ||
| 13 | Server component Must have API for running programmatic calls to retrieve findings, create projects, and potentially manage findings | FALSE | FALSE | ||
| 14 | Must be able to scan the following languages: |
- Java
- Javascript/TypeScript/React
- Python
- Dotnet/C#
- C++
- Ruby
- Golang
| - PHP | FALSE | FALSE | |||
| 15 | Must provide recommendations for remediation | FALSE | FALSE | ||
| 16 | Must allow for tailoring of rulesets and vulnerability levels per organization standards and risk matrices | FALSE | FALSE | ||
| 17 | Must Detect CWE (Common Weakness Enumeration) vulnerabilities | FALSE | FALSE | ||
| 18 | Must Provide detailed compliance reports for audits and governance | FALSE | FALSE | ||
| 19 | Supports custom security policies for industry-specific standards | FALSE | FALSE | ||
| 20 | Must be able to Detect vulnerabilities across both source code and compiled binaries | FALSE | FALSE |
File details come from the government source that posted it. Updated .