RFI_Anchore Analyzers_v2.xlsx

XLSX spreadsheet 23 KB Posted Mar 31, 2025

Attached to: RFI Anchore Analyzers Alternative
Solicitation number: FA830725RB045
Issued by: Department of the Air Force Materiel Command Lifecycle Management Center Joint Base San Antonio

About this file

Written by GovTribe AI · Mar 31, 2025

This document is a Request for Information (RFI) issued by the Air Force Lifecycle Management Center's Cryptologic and Cyber Systems Division seeking alternative software solutions to Anchore Analyzers. The RFI focuses on obtaining detailed information about alternative software products that can generate Software Bill of Materials (SBOMs), perform vulnerability scanning, support configuration and compliance checks, provide reporting and alerting capabilities, and integrate with CI/CD tools.

The comprehensive requirements spreadsheet outlines extensive technical specifications across multiple domains including SBOM generation, vulnerability scanning, policy engines, reporting, integration capabilities, performance scalability, security compliance, deployment options, and potential future roadmap considerations. Vendors are requested to complete three spreadsheet tabs detailing alternative software options, including pricing information, transition costs, licensing models, and how their solutions meet the Air Force's specific operational, security, and compliance needs. The RFI emphasizes that this is solely for market research purposes and does not guarantee a contract award, with responses being strictly voluntary.

View the file

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

T&C and Contact Information

	Note: Please read and complete the middle portion.
1	This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only.
2	THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.
Company Name:
CAGE/DUNS Code:
Address:
POC Name:
POC E-mail:
POC Phone Number:
3	As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC.

RFI Q&A

Note: This document is only interested in alternative software. All three sheets in this document is to be completed.

	Alternative License Types:
1	What alternative software do you offer that is similar to Anchore Analyzers?

(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]

2 For each alternative software option/solution, please provide how it is similar from the listed license.

(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]

3 For each alternative software option/solution, please provide how it meets the above requirements.

(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]

4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).

(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]

	Pricing Information:
1	For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution.

(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]

2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.

(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]

	Other Considerations:
1	Are there any additional features or benefits associated with the alternative software that we should consider?

For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]

2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?

(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]

Requirements Capability Sheet

	Anchore Analyzers ALTERNATIVE:	[TYPE NAME HERE]
	Requirement:	Ready on Day 1	Future Capability	Estimated date of Capability	Comments
	SBOM Generation	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product must support generating SBOMs that comply with accepted industry standards (e.g., SPDX, CycloneDX)	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product must support generating SBOMs for common programming languages and ecosystems (e.g., npm, Maven, PyPI, Go modules, NuGet, RubyGems, Cargo).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product must provide an API and or CLI to generate SBOMs during the build process (CI/CD).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	The product should represent direct and transitive dependencies, including their relationships (e.g., which package depends on which).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
5	Must support scanning container images	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
6	The product must include optional metadata about repository URLs and commit hashes for each component, when available.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
7	Packages listed in SBOMs should also have the PURL format.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Vulnerability Scanning	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The software must integrate with standard vulnerability databases, such as the National Vulnerability Database (NVD), RHSA, GHSA, and other vendor-specific feeds.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product must be able to automatically check the discovered components in the SBOM against known vulnerabilities.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product must map identified vulnerabilities to industry-standard severity metrics (e.g., CVSS scores).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	The product should have mechanisms for users to mark or override false positives and provide context for false negatives.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
5	The software must track changes over time to detect new vulnerabilities that affect older versions of the software.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
6	Vulnernability feed content should be supplemented by custom data from security researchers to minimize false positives, especially when filtering out vulnerabilities that does not apply to containers	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
7	Product need to take a container image as an input and output a vulnerability result for the container image	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
8	Product must be able to consume a container image locally or hosted in a registry for scanning	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
9	Product needs to be able to consume VEX documents to propagate vulnerability context and justifications to minimize false positives	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
10	Product should have malware scanning	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Configuration and Compliance	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	Product should have a policy engine to flag and specific Dockerfile instructions, with the ability to warn and stop based on specific conditions	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	Product should have the ability to lint a Dockerfile for best practices	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	Product should be able to retrieve metadata for files (permisisons, hashes, ownership) and have a policy engine to evaludate warning, passing, and failing conditions based on the metadata	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	Product has a policy engine that can be used to check containers against compliance standards such as DISA STIG and CIS	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
5	Product should have the ability to examine the content of files and evaluate policy rules based on content	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
6	Product should give the user the ability to make custom policies	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
7	Policies should be in structured format (Configuration as Code) and be able to imported via CLI and API	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
8	Product should have a GUI to display compliance standard items (like StigViewer)	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Reporting & Alerts	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The software must generate comprehensive reports listing all identified components, licenses, and known vulnerabilities.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product should provide configurable alert channels (e.g., email, Slack, webhook) when new vulnerabilities are identified in existing SBOMs.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	A dashboard should provide an at-a-glance view of vulnerability statuses, license compliance, and risk posture across multiple projects.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	The product must support export of reports in various formats (HTML, PDF, JSON) to integrate with external systems or auditing tools.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Integration & Extensibility	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product's API and or CLI are compatible with common CI/CD tools like Gitlab CI, Github Actions, and Jenkins	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product should provide a plugin or extension mechanism that allows community-driven or custom vulnerability check modules.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product should allow users to define security policies (e.g., fail builds on critical vulnerabilities)	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Performance & Scalability	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	Product must be horizontally scalable when analyzing containers - we containers should be able to be able to be analyzed in a distributed manner	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	Product should keep a database of vulnerability and compliance reports with images hashes to do quick lookup if the images submitted to be scanned are the same	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Security & Compliance	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product itself must follow secure development lifecycle practices and be regularly tested for vulnerabilities (e.g., using SAST/DAST).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The software must support role-based access control (RBAC), single sign-on (SSO), and secure authentication protocols (OAuth, SAML).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product must encrypt stored vulnerability data and SBOM artifacts at rest and support secure communication (TLS) in transit.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	The product must produce detailed logs of scans, user actions, and configuration changes. Logs should be exportable to SIEM (Security Information and Event Management) systems.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Usability & User Experience	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product should provide an intuitive web interface for non-technical stakeholders to view SBOMs, vulnerabilities, and generate reports.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product should include links to reference material or best practices for handling common vulnerabilities.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product must allow customization of reporting dashboards (e.g., reordering vulnerability lists by severity, adding custom fields) to fit organizational needs.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Deployment & Maintenance	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product should support on-premises, cloud-based (SaaS), and hybrid deployments to fit different organizational policies.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	Product should be deployable in Kubernetes with P1 Big Bang compatible helm charts	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	The product must provide clear instructions and/or automated tools for backing up and restoring configuration, logs, and scan results.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
4	The product should allow seamless upgrades with minimal downtime and maintain backward compatibility where possible.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
5	The product must have clear, up-to-date documentation and offer support channels (e.g., support portal, community forums, or dedicated contact).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
6	Product should have the ability to easily let the user sync vuln feed to a disconnected environment	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Testing & Validation	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	The product must undergo robust automated testing to ensure accuracy of SBOM generation, vulnerability detection, and reporting.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	The product should include UAT cycles with representative end-users to validate usability, reporting accuracy, and integration with real pipelines.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
					This Column is meant for the vendor to have space to answer the questions in more detail.
	Roadmap Considerations	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
1	Incorporate machine learning algorithms for recommending likely vulnerability impact or automated triage.	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
2	Provide advanced license compliance checks (e.g., license compatibility, potential license violations).	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.
3	Support Scanning source code repository	FALSE	FALSE		This Column is meant for the vendor to have space to answer the questions in more detail.

File details come from the government source that posted it. Updated Mar 31, 2025.