FA8307_RFI_Twistlock_Alternatives

The Department of the Air Force Materiel Command Lifecycle Management Center (AFLCMC) is conducting market research to identify alternative solutions for container and Kubernetes security, specifically seeking replacements for Palo Alto Twistlock through a Request for Information (RFI). Platform One (P1) is investigating products that can provide comprehensive security capabilities including runtime security, vulnerability analysis, and compliance scanning for containerized environments. The RFI encompasses detailed requirements across four primary categories: General Requirements, Runtime Security, Vulnerability Analysis, and Compliance Scanning, with vendors expected to demonstrate capabilities in areas such as Kubernetes node defense, machine learning-based anomaly detection, and advanced vulnerability management. Responses are due by December 19, 2024, and vendors must clearly indicate whether capabilities are available immediately or provide implementation timelines. Evaluation criteria will focus on technical capabilities, licensing models, pricing structures, transition costs, and training requirements.

The solicitation is designated as a Total Small Business set-aside, indicating opportunities are reserved for small business entities within the computer-related services sector (NAICS 541519). While no specific incumbent is mentioned, the RFI suggests a desire to replace the current Twistlock solution with a more comprehensive platform that offers enhanced security features. Vendors will need to provide pricing information for a base year with potential four one-year option extensions, though specific budget ranges are not explicitly detailed in the pre-solicitation notice. The procurement will leverage the IT and Telecom - Application Development Software product service code (PSC 7A20), which indicates a focus on perpetual license software solutions. The market research phase suggests the government is exploring multiple alternatives before potentially initiating a formal solicitation, giving potential vendors an opportunity to demonstrate their technological capabilities and alignment with Platform One's security requirements.