RFI_RegScale.xlsx
XLSX spreadsheet 21 KB Posted
- Attached to
- RFI Reg Scale
- Solicitation number
- FA830725RB046
About this file
This document is a Request for Information (RFI) issued by the Air Force Lifecycle Management Center's Cryptologic and Cyber Systems Division, seeking market research on alternative software solutions to RegScale. The RFI targets software vendors to provide detailed information about alternative software options that can meet specific requirements, including cloud-native capabilities, zero-trust security methodologies, compliance with various governing bodies (such as CIS Benchmark, CSA CCM 4.0, SOC 2, NIST standards), and advanced features like dynamic dashboards, API integrations, automated compliance processes, and continuous Authority to Operate (cATO).
The RFI requests vendors to complete a comprehensive spreadsheet with three tabs, covering alternative license types, pricing information, and a detailed requirements capability assessment. Key areas of interest include transition and training costs, pricing plans, contract flexibility (base year with up to four one-year options), advanced features like machine learning-based anomaly detection, and the ability to support Platform One's AWS environment and integration requirements. Responses are voluntary and will be used solely for market research and planning purposes, with no guarantee of a subsequent solicitation or contract award.
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
T&C and Contact Information
| Note: Please read and complete the middle portion. | |
| 1 | This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. |
| 2 | THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals. |
| Company Name: | |
| CAGE/DUNS Code: | |
| Address: | |
| POC Name: | |
| POC E-mail: | |
| POC Phone Number: | |
| 3 | As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC. Response due date is [ENTER DATE]. |
RFI Q&A
Note: This document is only interested in alternative software. All three sheets in this document is to be completed.
| Alternative License Types: | |
| 1 | What alternative software do you offer that is similar to RegScale? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]
2 For each alternative software option/solution, please provide how it is similar from the listed license.
(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]
3 For each alternative software option/solution, please provide how it meets the above requirements.
(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]
4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).
(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]
| Pricing Information: | |
| 1 | For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]
2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the alternative software that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]
Requirements Capability Sheet
| RegScale ALTERNATIVE: | [TYPE NAME HERE] | ||||
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Is your application cloud-native and capable of being fully self hosted within Platform One's AWS environment? | FALSE | FALSE | ||
| 2 | Is your application aligned with zero-trust security methodologies with a robust ability to tailor access control? | FALSE | FALSE | ||
| 3 | Is your application already available as a container image within Iron Bank? | FALSE | FALSE | ||
| 4 | If not already available in Iron Bank, can your application can be containerized and sent to Iron Bank Container Hardening Team (CHT) within 72 hours of receiving a request from P1? | FALSE | FALSE | ||
| 5 | Fully support the following governing bodies for compliance: | FALSE | FALSE | ||
| 5a | CIS Benchmark for AWS | FALSE | FALSE | ||
| 5b | CSA: CCM 4.0 | FALSE | FALSE | ||
| 5c | SOC 2 | FALSE | FALSE | ||
| 5d | OWASP ASVS | FALSE | FALSE | ||
| 5e | OMB M-22-09 | FALSE | FALSE | ||
| 5f | NIST AI RMF | FALSE | FALSE | ||
| 5g | NIST 800-53 Rev 4, Rev 5 | FALSE | FALSE | ||
| 5h | NIST 800-218 | FALSE | FALSE | ||
| 5i | NIST 800-171 | FALSE | FALSE | ||
| 5j | NIST CSF | FALSE | FALSE | ||
| 6 | Does your application provide the ability to create dynamic dashboards pulling from multiple sources of information to provide a comprehensive visualization of the status of various requirements? | FALSE | FALSE | ||
| 7 | Does your application provide layered functionality on top of the core tool modules to improve our compliance productivity and workflows, including APIs for Jira and Palo Alto (Prisma Cloud Compute) integration and automation? | FALSE | FALSE | ||
| 8 | Is your application open source, either fully or partially? | FALSE | FALSE | ||
| 9 | Do licenses of your tool come with initial training to ensure Platform One GRC tool users can effectively use the tool? | FALSE | FALSE | ||
| 10 | Do licenses of your tool come with any level of support in case it is needed? | FALSE | FALSE | ||
| 11 | Does your application support interaction with Platform One's systems, scripts, and processes in real-time using Open APIs based on REST/Swagger? | FALSE | FALSE | ||
| 12 | Does your application provide automated solutions for: | FALSE | FALSE | ||
| 13 | SBOM Generation | FALSE | FALSE | ||
| 14 | Integration into CI/CD | FALSE | FALSE | ||
| 15 | Integrated Incident and Change Management | FALSE | FALSE | ||
| 16 | Compliance as code with NIST OSCAL | FALSE | FALSE | ||
| 17 | Continuous Authority to Operate (cATO) | FALSE | FALSE | ||
| 18 | Automation for every step of the RMF process | FALSE | FALSE | ||
| 19 | Automated issue management | FALSE | FALSE | ||
| 20 | Risk assessments | FALSE | FALSE | ||
| 21 | Security controls and control mapping | FALSE | FALSE | ||
| 22 | Evidence collection | FALSE | FALSE | ||
| 23 | Data entry | FALSE | FALSE | ||
| 24 | Generating risk and compliance reports and dashboards in human-readable, machine-readable (OSCAL/SBOM), and interactive formats | FALSE | FALSE |
File details come from the government source that posted it. Updated .