FA830726RB019 - SBOM Vulnerability Scanning RFI
Closed Pre-Solicitation Posted
- Solicitation number
- FA830726RB019
- Agency
-
AFLCMC Joint Base San Antonio
Lifecycle Management Center, Department of Defense
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 541519 Other Computer Related Services
- Place of performance
- San Antonio, Texas 78205, United States
- Points of contact
-
- Platform One License Management Team aflcmc.hncx.p1licensemanagement@us.af.mil (210) 925-6490
- Mr. David Garcia aflcmc.hnckp.platformonectr@us.af.mil
Notice details come from SAM.gov. Updated .
About this opportunity
The Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division at Joint Base San Antonio-Lackland, Texas, is conducting market research through a Request for Information (RFI) to identify commercial software solutions capable of Software Bill of Materials (SBOM) generation, container analysis, and vulnerability scanning. The procured solution must provide integrated capabilities for automated SBOM creation compliant with industry standards such as SPDX and CycloneDX, support common programming languages and package managers (npm, Maven, PyPI, Go modules, NuGet, RubyGems, Cargo), and integrate with CI/CD tools including GitLab CI, GitHub Actions, and Jenkins. Key technical requirements include container image scanning with vulnerability mapping to CVSS severity metrics, support for industry vulnerability databases (NVD, RHSA, GHSA), policy engines for compliance checking against DISA STIG and CIS standards, malware scanning capabilities, and deployment flexibility across on-premises, cloud-based, and hybrid environments using Kubernetes and Platform One Big Bang compatible Helm charts. The solution must also provide role-based access control, single sign-on authentication, encryption at rest and in transit, comprehensive logging exportable to SIEM systems, and advanced features such as machine learning-based vulnerability triage and license compliance checking. The RFI response deadline is February 19, 2026, though respondents should note that this is a non-binding information-gathering initiative intended solely for planning and market research purposes, with no obligation for contract award or payment.
This RFI carries no set-aside designation and does not identify any current incumbents or competing contractors. The contract structure calls for a base one-year software license plus four one-year option periods, representing a five-year total contract duration, though no specific budget or award value range is disclosed in this pre-solicitation notice. The solution must support the Air Force's DevSecOps and Platform One operations while complying with DoD cybersecurity requirements, Zero Trust principles, and Executive Order 14028 on software supply chain security. Deliverables include software licenses or subscriptions, implementation and onboarding support, comprehensive documentation and training, CI/CD pipeline integration, ongoing technical support with vulnerability feed updates, and Authority to Operate (ATO) artifacts. The government will evaluate responses to determine the appropriate acquisition strategy and may request additional information from respondents prior to releasing a formal solicitation.
Notice text
This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only.
THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.
GENERAL SCOPE
The government is seeking sources who can provide software licenses with capabilities that meet the requirements of the attached “Draft” Statement of Work (SOW) for Software Bill of Materials (SBOM) Generation & Vulnerability Analysis Solution. All feedback and information received may be used to determine the appropriate acquisition strategy.
PERFORMANCE REQUIREMENTS
The contractor shall:
Provide a base one-year software license plus four (4) One-Year Option Periods.
PRODUCT
The proposed product must be a commercial license that meets the requirements of the Draft Statement of Work attached herein.
DELIVERY
Period of Performance:
Base: 1 Aug 2026 -31 July 2027
Option Year 1: 1 Aug 2027 -31 July 2028
Option Year 2: 1 Aug 2028 -31 July 2029
Option Year 3: 1 Aug 2029 -31 July 2030
Option Year 4: 1 Aug 2030 -31 July 2031
The government requests White Paper responses:
- Company information to include UEI, CAGE Code, Contract Vehicles, POC
- Potential software solution(s) that could meet the government requirements
- Brief Narrative of how software solutions meets the requirements.
- Limit responses to 2 pages, 1-inch margins, 12-point Times New Roman font.
- Submit responses to aflcmc.hncx.p1licensemanagement@us.af.mil & aflcmc.hnckp.platformonectr@us.af.mil by February 20, 2026.
Files
| File | Type | Posted |
|---|---|---|
| AFLCMC_Solicitation_SBOM_Vuln_Scanning_SOW_RFI.pdf |
Similar open opportunities
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity