SonarQube_RFI_Vendor_Questions.pdf
PDF 101 KB Posted
- Attached to
- SonarQube Alternate Sources
- Solicitation number
- FA830726RB030
About this file
Request for Information (RFI) Summary
This is a Request for Information (RFI) issued by the U.S. Air Force (Reference: FA830726RB030) for market research purposes to identify commercially available alternatives to SonarQube that support Platform One (P1) mission requirements. The Government seeks solutions providing enterprise software code quality analysis, static application security testing (SAST), code vulnerability detection, technical debt analysis, and software compliance support within a government security-compliant DevSecOps environment. The RFI is strictly for informational and acquisition planning purposes and does not constitute a solicitation, request for proposal, or commitment to award a contract. Responses will inform future acquisition strategy decisions and are encouraged from all capable vendors to maximize competition.
Vendor responses must address five key sections: (1) Company Information—including legal name, CAGE Code, UEI, business size, socioeconomic status, and three examples of relevant enterprise implementations; (2) Technical Capability—describing code analysis capabilities (bugs, vulnerabilities, code smells, security hotspots, duplications, technical debt), supported programming languages, alignment to CWE, OWASP Top 10, STIG, and NIST SSDF standards, and CI/CD integrations with API extensibility; (3) Enterprise Capability—stating maximum supported lines of code, multi-tenant and role-based access control (RBAC) capabilities, and reporting/dashboard functionality; (4) Support—describing support model, escalation procedures, dedicated support availability, and confirmation of license key delivery within five business days after receipt of order; and (5) Pricing—indicating availability of base year and option year pricing structures. Responses must be submitted electronically in PDF format with all supporting documentation and technical specifications.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SOO_SonarQube_FY26.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Request for Information (RFI)
Enterprise Code Quality and Application Security Analysis Solution Reference: FA830726RB030
The Government is conducting market research to identify and assess commercially available alternatives to SonarQube in support of Platform One (P1) mission requirements.
This Request for Information (RFI) is issued solely for market research and acquisition planning purposes to evaluate industry capabilities and available solutions that provide enterprise software code quality analysis, static application security testing (SAST), code vulnerability detection, technical debt analysis, and software compliance support within a Government security-compliant DevSecOps environment.
The Government seeks to identify solutions capable of supporting secure software development lifecycle (SDLC) practices, automated code inspection, vulnerability identification, coding standards enforcement, quality gate management, developer workflow integration, and enterprise scalability across Platform One value streams and software delivery pipelines.
Responses to this RFI will assist the Government in identifying qualified sources, evaluating alternative technical capabilities, and informing future acquisition strategy decisions. This RFI is for informational and planning purposes only and does not constitute a solicitation, request for proposal, or a commitment by the Government to award a contract.
The Government encourages responses from all capable vendors and seeks to maximize practicable competition while evaluating solutions that meet or exceed operational, technical, security, and enterprise integration requirements in support of Platform One mission execution.
Request for Information (RFI)
Enterprise Code Quality and Application Security Analysis Solution
Reference: FA830726RB030
Section I – Company Information
1 Provide legal company name, CAGE Code, UEI, business size, socioeconomic status, and primary point of contact.
2 Provide three examples of relevant enterprise implementations supporting secure software development.
Section II – Technical Capability
1 Describe code analysis capabilities (bugs, vulnerabilities, code smells, security hotspots, duplications, technical debt).
2 List all supported programming languages.
3 Describe alignment to CWE, OWASP Top 10, STIG, and NIST SSDF.
4 Describe CI/CD integrations and API extensibility.
Section III – Enterprise Capability
1 State maximum supported lines of code (LOC).
2 Describe multi-tenant and RBAC capabilities.
3 Describe reporting/dashboard capabilities.
Section IV – Support
1 Describe support model, escalation procedures, and dedicated support.
2 Confirm ability to deliver license keys within 5 business days ARO.
Section V – Pricing
1 Do you provide base year & option years.
Explain data ownership, storage, and retention controls for on-prem environments.4
Submission Instructions:
Submit responses electronically in PDF format. Include all supporting documentation, technical specifications, and pricing details. Responses will be used strictly for market research and acquisition planning purposes.
Blank Page
File details come from the government source that posted it. Updated .