SAST Security scanning license RFI.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

22 July 2024

1) This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only in support of the Development, Security and Operations (DevSecOps) Infrastructure Value Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the Department of Defense (DoD).

2) THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN

ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror’s ability to submit an offer if a solicitation is released.

Any requests for a solicitation package will be disregarded. The Government does not intend to award a contract based on this RFI or otherwise pay for the information solicited.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of preparing submissions in response to this RFI and the Government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.

3) Our organization is currently leveraging SonarQube for continuous cybersecurity and testing activities. In an effort to identify potential alternatives, we are conducting market research to evaluate products and solutions that can meet the following requirements

The organizational objectives of this research are as follows:

• Identify and catalog available products and solutions in the market.

• Evaluate the features, functionality, and pricing of each alternative to determine its suitability for our needs.

• Assess the level of integration and compatibility of each alternative with our

DevSecOps platform, while ensuring compliance with DoD security requirements.

• Estimate the level of government resources required to migrate to a new solution, while maintaining our current operational capabilities.

4) The following are some of the key characteristics that we are using to meet our organizational objectives, as outlined in paragraph 3. While this list is not exhaustive, it does provide a snapshot of some of the most important requirements for our environment

• To meet DoD CIO DevSecOps Reference Design compliance and perform continuous cybersecurity and testing activities, the tool must provide the following features:

o Static application security test and scan (SAST) o Static code analysis o Source code linting o Source code test coverage o CI/CD integration o Customizable security scanning and reporting

• The tool must support the following programming languages:

o C# o TypeScript o CSS o HTML o Go o PHP o Helm o Java o JavaScript o Python o XML o Terraform o Ruby o Scala o Swift o Objective-C o C o C++ o PL/SQL o T-SQL o VB.NET

• The tool must integrate with the following package managers:

o Maven o Gradle o PyPi o NPM o .NET

• The tool must support multiple application development projects and provide a means to integrate with user authentication and authorization methods such as SAML or OIDC.

5) Our organization will consider both commercial and open-source solutions.

6) As indicated above, this is market research. Contractor responses will be used for planning purposes. Address any comments and/or questions regarding this RFI in writing by e-mail directly to the Contracting Officer, Contracting Officer: Ms. Karin Werner, Email: karin.werner.1@us.af.mil Program Manager: Mr. Stephen Salinas, Email: stephen.salinas.1@us.af.mil

Response due date: Friday, 9 August 2024, 8:00 AM CST. Please annotate the subject line of e-mail responses as: “SAST License Solution for Unified Platform RFI #1 Response-‘contract vehicle”. Responses may be emailed to the addresses listed above.

Include your contract vehicle in the subject line of email response as well as the CAGE and DUNS codes within the message.

mailto:karin.werner.1@us.af.mil mailto:stephen.salinas.1@us.af.mil mailto:karin.werner.1@us.af.mil mailto:stephen.salinas.1@us.af.mil