RFI_SWFT_SWFT Tools.pdf

Subject: Request for Information (RFI) – Software Fast Track (SWFT) Tools

Background: The DoD CIO is the Principal Staff Assistant (PSA) and advisor to the Secretary and Deputy Secretary of Defense for information technology (IT), including national security systems (NSS), information resources management (IRM) matters. The DoD CIO is responsible for all matters relating to information, information technology, and the DoD information environment including command, control, and communications (C3), electromagnetic spectrum, network operations, IT portfolio management, information assurance (IA), cybersecurity, and positioning, navigation, and timing (PNT).

In an effort to expedite the Authorization to Operate (ATO) process for the DoD adoption of Software in our environment, we have developed a voluntary procedure in which a company can provide a 3rd party produced Software Bill of Materials (SBOM) along with an independent 3rd party assessment of their software for the Department to evaluate and adopt Software faster.

Purpose: This RFI is issued solely for market research and planning purposes in accordance with FAR Part 10. This RFI does not constitute a Request for Proposal (RFP), Invitation for Bid (IFB), or a Request for Quote (RFQ), and does not commit the Government to issue a solicitation or award a contract. The Government will not reimburse respondents for any costs incurred in preparation of a response to this notice.

The Government is seeking input from industry to better understand current capabilities, innovative solutions, and business practices that can support accelerating the delivery of capabilities to the warfighter through SWFT initiatives.

The Government encourages responses from “all” sources, including Large Businesses (Other than Small Business) and Small Businesses.

Scope: The Department of Defense (DoD) Chief Information Officer (CIO) is soliciting information and ideas on accelerating the delivery of capabilities to the warfighter, by streamlining risk assessment and authorization processes for software-enabled products and services, through a SWFT initiative. This RFI focuses on cybersecurity and Supply Chain Risk Management (SCRM) requirements for the SWFT initiative.

Objective: DoD seeks industry perspectives for SWFT risk criteria for consistent, secure, and accelerated risk assessments. The SWFT supply chain risk management (SCRM) requirements will equip DoD authorization officials with product-specific risk information throughout the software development life cycle.

Requested Information: The government requests industry’s input regarding the set of questions below as it pertains to the objectives of this RFI.

1. What specific references or industry standards does your organization leverage when considering secure software development and software supply chain threats and vulnerabilities to a company and its software products?

2. SWFT may assess how a company implements secure software development as identified in the NIST Special Publication (SP) 800-218. Are there obstacles in implementing this guidance and producing an attestation to your implementation?

3. For commercial software products does your company provide a Software Bill of Materials (SBOM) that includes software component (artifact) level of details? If not, what obstacles exist? If yes, what tools support this process?

4. What artifacts does your organization produce to perform risk assessments of software?

Does your organization use automated tools to produce these artifacts?

5. Would these software risk assessment artifacts be sharable with the DoD to enable consistent and secure DoD-led risk assessments? If not, what are your recommendations for the artifacts DoD should require to equip authorization officials with adequate risk information?

6. How could your organization support secure and automated information sharing that accelerate rigorous software security verification processes?

Format: Responses to this RFI request should reference " Software Fast Track (SWFT) Tools " and shall include answers to the above questions and the following information in this format:

• Company name, DUNS/UEI, CAGE Code, and point of contact

• Capability statement demonstrating relevant experience

• Recommended contract types, contract vehicles (e.g., GSA MAS, GWACs, etc.), and business size status

• Feedback on the feasibility of the work described

• Potential risks, challenges, or innovations

• Past performance examples (if applicable)

• Rough Order of Magnitude (ROM) cost info

Firms must respond using the format outlined in this RFI. There is a maximum page limitation of thirty (30) typed pages that are single spaced using 12-inch Times New Roman font within an 8.5 by 11 paper.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Response Due Date: All responses to this RFI are to be submitted 12 pm Eastern Standard Time (EST), on 20 May 2025. Responses will be accepted via electronic means only to:

whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.

mailto:whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil mailto:leanne.m.condren.civ@mail.mil