Application Security Testing (AST) Platform

The Sacramento County Contract & Purchasing Services Division is releasing a Request for Bid (RFB) to procure an Application Security Testing (AST) platform capable of supporting secure software development across multiple programming languages and development environments. The solution must provide integrated capabilities for Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and AI-assisted remediation to identify, prioritize, and remediate vulnerabilities throughout the development lifecycle. Key features and requirements of the platform include: • Security & Compliance: FedRAMP Moderate or GovRAMP authorization certification, secure handling of source code and scan artifacts, and support for enterprise authentication (including SSO). • Core AST Capabilities: Integrated SAST, DAST, and SCA scanning, AI-assisted remediation guidance, and vulnerability history tracking. • Development & Pipeline Integrations: Support for CI/CD pipelines, including GitHub, GitLab, Azure DevOps, Bitbucket, and other SCM systems, with pipeline-based automated scanning and APIs, webhooks, and/or CLI tooling for flexible integration. • Deployment Options: County-approved deployment models (cloud, on-premises, or hybrid). • Identity, Access & Governance: Single Sign-On (SSO) and role-based access control, with centralized administration consoles for security staff. • Reporting & Analytics: Dashboards suitable for audit, compliance, and operational security reporting, with export or API-based integrations to County data-lake workflows and reporting automation. • Licensing & Utilization: Licensing models suitable for developer-centric and application-centric usage, with clear definitions of usage limits, concurrency constraints, and entitlements. • Training & Support: Onboarding, administrator training, developer enablement sessions, and on-demand learning resources, with ongoing technical support and defined SLA.