Regscale or Equal for SDN & SDN-S

The U.S. Air Force Sustainment Center is conducting market research under solicitation FA813926Q15618 to identify capable vendors offering RegScale or an equivalent Governance, Risk, and Compliance (GRC) platform to support Software Defined Networking (SDN) and SDN-Secret (SDN-S) environments. The requirement centers on a brand-name-or-equal solution that can automate compliance across major weapon systems and portfolios including Mission Planning, E3, E7, ATCALS, F-16, and A-10, with the goal of transitioning to a Continuous Authority to Operate (cATO) posture. The platform must fully automate all seven steps of the NIST Risk Management Framework—Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor—while integrating via API with technologies such as AWS, Azure, Jira, Tenable, and DevSecOps pipelines. It must also include a quantitative risk analysis module employing Monte Carlo simulations and a Third-Party Risk Management capability to monitor vendor and supply chain security, all while natively supporting NIST OSCAL for machine-readable controls and accelerating FedRAMP and RMF compliance through automation of control inheritance. Responses are due by July 23, 2026, and must be submitted by email to Anthony Dollard at anthony.dollard@us.af.mil as a capability statement divided into two parts: business information and capability survey questions. Offerors must provide their company name, address, point of contact, CAGE/DUNS number, SAM UEI, registration status in SAM, and certify their socioeconomic status under NAICS code 541511, including any applicable small business, woman-owned, HUBZone, 8(a), veteran-owned, or service-disabled veteran-owned certifications. All contractor personnel working within USAF facilities must be U.S. citizens; foreign nationals are prohibited from performing work on-site and foreign ownership is not permitted. The government anticipates a Firm-Fixed-Price, one-time purchase order contract, with performance occurring at S Coffeyville, Oklahoma, though delivery will be made to Tinker AFB. While no formal evaluation factors or pricing structure has been established, the government is seeking detailed descriptions of facility capabilities, key personnel backgrounds, quality assurance processes, and methods for measuring work quality. Subcontracting opportunities are encouraged, joint ventures are welcome under FAR Part 19, and offerors are asked to identify work segments suitable for