Request for Information (RFI) -- DAST Tool
Closed Solicitation Posted
- Solicitation number
- 28321326RI0000019
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 513210 Software Publishers
- Points of contact
- More information
Notice details come from SAM.gov. Updated .
About this opportunity
The Social Security Administration seeks information on Dynamic Application Security Testing (DAST) solutions, with responses due May 19, 2026. This is a Request for Information, not a competitive solicitation, and carries no set-aside restriction.
The Web Application Security Team (WAST), operating within the Office of Information Security's cybersecurity program, currently performs static application security testing (SAST) using Checkmarx and software composition analysis (SCA) using Black Duck. Both are white box testing tools that analyze application code during development. SSA now requires a DAST solution to perform black box testing of applications during execution, identifying exploits detectable only through runtime analysis. The procurement aims to bolster FISMA metrics, satisfy external audit and assessment requirements, and support a mandate to conduct penetration testing on all Tier 1 applications and information systems undergoing the Authority to Operate (ATO) process. Funding is required immediately to address workload from multiple federal mandates and to detect exploits early in the development lifecycle, before they reach production and create security breaches.
The NAICS category is 513210, Software Publishers. The PSC code is 7A21, IT and Telecom — Business Application Software (Perpetual License Software). No award value, contract period, or evaluation criteria are specified in this RFI phase.
Notice text
The Web Application Security Team (WAST) performs static code scanning of all SSA applications as part of the Office of Information Security’s (OIS) cybersecurity program. This is accomplished with the static application security testing (SAST) tool called Checkmarx and the software composition analysis (SCA) tool called Black Duck. Both of these solutions are white box testing tools that analyze the application’s code as it's being built. WAST is looking to procure a Dynamic Application Security Testing (DAST) solution to better analyze SSA applications, to bolster FISMA metrics, and to satisfy the requirements from multiple external audits and assessments. The DAST tool would scan applications as they are executed to identify exploits that can only be detected from black box testing. This funding is required immediately to better support the workload of multiple federal mandates and to provide black box testing early in the development lifecycle to stop exploits before they go to Production and potentially cause a security breach. This will also support a new requirement to perform penetration testing on all Tier 1 applications and all information systems going through the Authority to Operate (ATO) process.
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity