SonarQube Alternate Sources
Closed Pre-Solicitation Posted
- Solicitation number
- RFI_HNC_SonarQube
- Agency
-
AFLCMC Joint Base San Antonio
Lifecycle Management Center, Department of Defense
- Responses due
- Set-aside
- No set-aside
Opportunity facts
- NAICS code
- 513210 Software Publishers
- PSC
- Not on record
- Place of performance
- San Antonio, Texas, United States
- Points of contact
Notice details come from SAM.gov. Updated .
About this opportunity
The Department of the Air Force Materiel Command Lifecycle Management Center Joint Base San Antonio is conducting market research to identify potential alternatives to their current use of SonarQube for continuous cybersecurity and testing activities. The key objectives are to catalog available products, evaluate their features and functionality, assess integration and compatibility with the organization's DevSecOps platform while ensuring DoD security compliance, and estimate the resources required to migrate to a new solution. The Pre-solicitation Notice outlines specific requirements such as supporting static application security testing, static code analysis, CI/CD integration, and a wide range of programming languages and package managers. Responses to the associated Request for Information are due by August 9, 2024 at 8:00 AM CST.
This Pre-solicitation Notice does not have a set-aside designation, and the government has not provided any information about potential incumbents or contract values. The NAICS code identified is 513210 - Software Publishers, indicating that the procurement is for software publishing services.
Notice text
Our organization is currently leveraging SonarQube for continuous cybersecurity and
testing activities. In an effort to identify potential alternatives, we are conducting market
research to evaluate products and solutions that can meet the following requirements.
The organizational objectives of this research are as follows:
- Identify and catalog available products and solutions in the market.
- Evaluate the features, functionality, and pricing of each alternative to determine its suitability for our needs.
- Assess the level of integration and compatibility of each alternative with our DevSecOps platform, while ensuring compliance with DoD security requirements.
- Estimate the level of government resources required to migrate to a new solution, while maintaining our current operational capabilities.
The following are some of the key characteristics that we are using to meet our
organizational objectives, as outlined in paragraph 3. While this list is not exhaustive, it
does provide a snapshot of some of the most important requirements for our environment.
To meet DoD CIO DevSecOps Reference Design compliance and perform continuous
cybersecurity and testing activities, the tool must provide the following features:
- Static application security test and scan (SAST)
- Static code analysis
- Source code linting
- Source code test coverage
- CI/CD integration
- Customizable security scanning and reporting
The tool must support the following programming languages:
- C#
- TypeScript
- CSS
- HTML
- Go
- PHP
- Helm
- Java
- JavaScript
- Python
- XML
- Terraform
- Ruby
- Scala
- Swift
- Objective-C
- C
- C++
- PL/SQL
- TSQL
- VB.NET
The tool must integrate with the following package managers:
- Maven
- Gradle
- PyPi
- NPM
- .NET
The tool must support multiple application development projects and provide a means to
integrate with user authentication and authorization methods such as SAML or OIDC.
Files
| File | Type | Posted |
|---|---|---|
| SAST Security scanning license RFI.pdf |
Similar open opportunities
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity