RFI_SD Elements_FY26.xlsx
XLSX spreadsheet 28 KB Posted
- Solicitation number
- FA830726RB024
About this file
This is a Request for Information (RFI) issued by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), located at Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. The RFI is not a solicitation, request for proposal, or invitation for bid, and submission is strictly voluntary with no obligation for payment or contract award. The government seeks information regarding alternative software solutions to SD Elements, a threat modeling and application security tool currently in use.
Vendors responding to the RFI must complete all three sheets of the provided Excel template and address specific questions regarding alternative software options. Responses should detail how proposed alternatives differ from and compare to SD Elements across different license types (enterprise, cloud-managed, open-source/community), including feature restrictions, scalability limitations, and support differences. Vendors must also explain how their solutions meet the government's 12 core requirements, which include threat modeling for software applications, customizable surveys for security personnel, countermeasure systems mapped to NIST 800-53 and 800-171 controls, automated countermeasure responses via SAST/code quality scanner integrations, Kubernetes deployment via Helm charts, role-based access control, SSO integration (OIDC/SAML), DevSecOps lifecycle integration, and visual representation of attack vectors. Additionally, vendors must provide estimated transition and training costs, pricing plans (monthly, trial, annual), contract term preferences including willingness to accept a base year with up to four one-year options, and information on value-added services such as advanced analytics, machine learning-based anomaly detection, dedicated account support, and proactive health checks. Responses should be submitted to the listed points of contact; no specific response deadline is indicated in the provided file.
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
T&C and Contact Information
| Note: Please read and complete the middle portion. | |
| 1 | This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. |
| 2 | THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals. |
| Company Name: | |
| CAGE Code: | |
| Address: | |
| POC Name: | |
| POC E-mail: | |
| POC Phone Number: | |
| 3 | As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC. |
RFI Q&A
Note: This document is only interested in alternative software. All three sheets in this document is to be completed.
| Alternative License Types: | |
| 1 | What alternative software do you offer that is similar to SD Elements? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]
2 For each alternative software option/solution, please provide how it is similar from the listed license.
(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]
3 For each alternative software option/solution, please provide how it meets the above requirements.
(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]
4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).
(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]
| Pricing Information: | |
| 1 | For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]
2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the alternative software that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]
Requirements Capability Sheet
| SD Elements ALTERNATIVE: | [TYPE NAME HERE] | ||||
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Must provide the ability to do threat modeling for software applications | FALSE | FALSE | ||
| 2 | Must have ability to provide surveys that allow security personnel to customize threat modeling per application | FALSE | FALSE | ||
| 3 | Must provide a system of countermeasures that help security personnel enforce standards across application teams | FALSE | FALSE | ||
| 4 | Countermeasures must map to NIST 800-53 and NIST 800-171 controls | FALSE | FALSE | ||
| 5 | Must provide some level of automated countermeasure responses/resolutions via integrations with SAST and code quality scanners such as sonarqube and Fortify | FALSE | FALSE | ||
| 6 | Must be able to run on a kubernetes host via helm chart deployment | FALSE | FALSE | ||
| 7 | Must have ability to separate each application into projects, of which each can be scoped to specific users relying on RBAC | FALSE | FALSE | ||
| 8 | Must integrate with SSO protocols such as OIDC/SAML | FALSE | FALSE | ||
| 9 | Must be able to Identify and model potential threats throughout the software development lifecycle (SDLC) | FALSE | FALSE | ||
| 10 | Must Provide visual representation of attack vectors and security risks (e.g., data flows, trust boundaries) | FALSE | FALSE | ||
| 11 | Must be able to provide dynamic threat analysis as application architecture evolves | FALSE | FALSE | ||
| 12 | Must be able to integrate with DevSecOps lifecycle | FALSE | FALSE |
File details come from the government source that posted it. Updated .