RFI_SWFT_External Assessment.pdf

Subject: Request for Information (RFI) – Software Fast Track (SWFT) External Assessment Methodologies

Background: The DoD CIO is the Principal Staff Assistant (PSA) and advisor to the Secretary and Deputy Secretary of Defense for information technology (IT), including national security systems (NSS), information resources management (IRM) matters. The DoD CIO is responsible for all matters relating to information, information technology, and the DoD information environment including command, control, and communications (C3), electromagnetic spectrum, network operations, IT portfolio management, information assurance (IA), cybersecurity, and positioning, navigation, and timing (PNT).

In an effort to expedite the Authorization to Operate (ATO) process for the DoD adoption of Software in our environment, we have developed a voluntary procedure in which a company can provide a 3rd party produced Software Bill of Materials (SBOM) along with an independent 3rd party assessment of their software for the Department to evaluate and adopt Software faster.

Purpose: This RFI is issued solely for market research and planning purposes in accordance with FAR Part 10. This RFI does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or a Request for Quote (RFQ), and does not commit the Government to issue a solicitation or award a contract. The Government will not reimburse respondents for any costs incurred in preparation of a response to this notice.

The Government is seeking input from industry to better understand current capabilities, innovative solutions, and business practices that can support accelerating the delivery of capabilities to the warfighter through SWFT initiatives.

The Government encourages responses from “all” sources, including Large Businesses (Other than Small Business) and Small Businesses.

Scope: The Department of Defense (DoD) Chief Information Officer (CIO) is soliciting information and ideas on accelerating the delivery of capabilities to the warfighter, by streamlining risk assessment and authorization processes for software-enabled products and services, through a SWFT initiative.

Objective: DoD seeks industry perspectives that utilize existing external assessment methodologies that can serve the SWFT initiative. These external assessment methodologies must support rigorous software security verification processes and enable DoD-led risk determinations.

Requested Information: The government requests industry’s input regarding the set of questions below as it pertains to the objectives of this RFI.

1. Does your organization currently have an audit function that assesses software security?

a. If yes, is this an internal or external function?

b. Is this assessment performed as part of another compliance regime? Which one(s)?

2. What specific organizational and personnel qualifications and requirements do you recommend for accomplishing external assessment functions within the SWFT Initiative?

3. How could a SWFT external assessment demonstrate technical expertise, cybersecurity, and supply chain risk management (SCRM) experience that is inclusive of sensitive data protection, impartiality, and independence?

4. What collaboration would be required among suppliers, external assessments, and DoD and what are your recommendations for secure information sharing mechanisms?

5. How could an external assessment facilitate assessing the SWFT artifacts to include a supplier’s software bill of materials (SBOM) and for DoD-led risk assessment, and automated information sharing to accelerate and maintain a rigorous software security verification processes?

Format: Responses to this RFI request should reference " Software Fast Track (SWFT) External Assessment Methodologies " and shall include answers to the above questions and the following information in this format:

• Company name, DUNS/UEI, CAGE Code, and point of contact

• Capability statement demonstrating relevant experience

• Recommended contract types, contract vehicles (e.g., GSA MAS, GWACs, etc.), and business size status

• Feedback on the feasibility of the work described

• Potential risks, challenges, or innovations

• Past performance examples (if applicable)

• Rough Order of Magnitude (ROM) cost info

Firms must respond using the format outlined in this RFI. There is a maximum page limitation of thirty (30) typed pages that are single spaced using 12-inch Times New Roman font within an 8.5 by 11 paper.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Response Due Date: All responses to this RFI are to be submitted 12 pm Eastern Daylight Time (EDT), on 20 May 2025. Responses will be accepted via electronic means only to:

whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.

mailto:whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil mailto:leanne.m.condren.civ@mail.mil