Twistlock RFI_Sam.gov_4Nov04.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

4 November 2024

1.0 Purpose. This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997). The document obtains information for the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, TX, for market research and planning purposes in support of the Development, Security and Operations (DevSecOps) Infrastructure Value Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the Department of Defense (DoD).

2.0 Background. THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN

ANNOUNCEMENT OF SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR

PLANNING PURPOSES.

2.1 There is no bid package or solicitation document associated with this announcement. Response is strictly voluntary and will not affect a potential offeror’s ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded.

2.2 The United States Government (USG) does not intend to award a contract based on this RFI or otherwise pay for the information solicited. No entitlement to payment of direct costs, indirect costs, or charges by USG will arise for submissions in response to this RFI as well as subsequent USG use of information submitted. Submittals will not be returned to the sender. Respondents may be asked to provide clarifying information from initial submittals.

3.0 Description. UP employs the Palo Alto Networks Twistlock solution for ongoing cybersecurity and testing operations. To identify alternative solutions, UP is conducting market research to assess products and services that can fulfill the specific criteria outlined in paragraph “4.0 Salient Characteristics.”

3.1 The organizational objectives of this research are as follows:

3.1.1 Identify and catalog available products and solutions in the market.

3.1.2 Evaluate the features, functionality, and pricing of each alternative to determine its suitability for UP needs.

3.1.3 Assess the level of integration and compatibility of each alternative with the UP DevSecOps platform, while ensuring compliance with DoD security requirements.

3.1.4 Estimate the level of USG resources required to migrate to a new solution, while maintaining UP current operational capabilities.

4.0 Salient Characteristics. This aligns with the UP mission previously stated in paragraph “3.0 Description.”

The list is not comprehensive but does offer the most critical requirements requisite for the UP environment.

4.1 To meet DoD Chief Information Officer (CIO) DevSecOps Reference Design compliance and perform continuous cybersecurity and testing activities, the tool must provide the following features:

4.1.1 Software must be containerized and deployable through helm charts.

4.1.2 Should support a wide range of programming languages, including popular languages like Java, C++, Python, and JavaScript, as well as C#, TypeScript, CSS, HTML, Go, PHP, Helm, Java, JavaScript, Python, XML, Terraform, Ruby, Scala, Swift, Objective-C, C, C++, PL/SQL, T- SQL, and VB.NET. This broad language support ensures that the tool can be used across different development environments and can identify vulnerabilities in a variety of codebases.

4.1.3 Should integrate with development tools, such as Integrated Development Environment (IDE), other build systems, and Continuous Integration/Continuous Deployment (CI/CD) pipelines.

4.1.4 Should allow rules and policies customization to align with the organization's security standards.

4.1.5 Should provide comprehensive and actionable reports, highlighting vulnerabilities and prioritizing remediation efforts, i.e., should make RestFUL Application Programming Interface (API) calls and trigger code scans then pull down the results.

4.1.6 Compliance should support industry standards, such as Open Worldwide Application Security Project (OWASP) Top 10, SANS Top 25, and Payment Card Industry Data Security Standard

(PCI DSS).

4.1.7 Should provide training and support resources to help developers understand and remediate vulnerabilities.

4.1.8 Should analyze code quickly and efficiently, minimizing the impact on development cycles.

4.1.9 Supports Security Assertion Markup Language (SAML) integration for Single Sign-On (SSO).

4.1.10 Licensing based on the number of lines of code scanned and no restrictions on number of users or frequency of scanning.

4.2 Static application security test and scan (SAST).

4.2.1 Static code analysis.

4.2.2 Source code linting.

4.2.3 Source code test coverage.

4.2.4 CI/CD integration.

4.2.5 Customizable security scanning and reporting.

4.2.6 The tool must integrate with various package managers to provide security testing during the build process and applications, but as a minimum package managers must include the following: Maven, Gradle, NuGet, NPM, and RubyGems.

4.3 Dynamic Application Security Testing (DAST).

4.3.1 Should scan web applications and APIs to identify security vulnerabilities such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).

4.3.2 Should test all layers of the application stack, including the network, application, and database layers.

4.3.3 Should automate the testing process, reducing the manual effort required to identify security vulnerabilities.

4.3.4 Should provide detailed reports on security vulnerabilities and recommend remediation steps to address them.

4.3.5 Should support a wide range of technologies, including web application frameworks, programming languages, and protocols, to ensure comprehensive coverage of the application stack.

4.3.6 Should scale to handle large web applications and APIs, as well as multiple applications and services.

4.4 UP will consider both commercial and open-source solutions.

5.0 Summary. As indicated in paragraph “1.0 Purpose.” this is Market Research Request. Contractor responses will be used for planning purposes only.

5.1 Submit any comments and/or questions regarding this RFI in writing through e-mail directly to:

5.1.1 Contracting Officer: Ms. Karin Werner, karin.werner.1@us.af.mil

5.1.2 Contract Specialist: Mr. William Vallee, William.vallee.1@us.af.mil

5.1.3 Program Manager: Ms. Erin Landry, erin.landry.1@us.af.mil

5.2 Response due date is Thursday, 14 November 2024, 0800 CST. Please annotate the subject line of the e-mail as: “Twistlock Solution for Unified Platform RFI Response. Submit replies to the email addresses listed in paragraphs 5.1.1-2. Include your contract vehicle, Commercial and Government Entity (CAGE) code, and Data Universal Numbering System (DUNS) number in the response.

mailto:karin.werner.1@us.af.mil mailto:William.vallee.1@us.af.mil