Request for Information (RFI) -- DAST Tool

The Social Security Administration’s Office of Information Security is seeking a Dynamic Application Security Testing (DAST) solution to complement its existing static code analysis tools, Checkmarx and Black Duck, which are used for white box testing during the build phase of applications. The DAST tool will enable black box testing by scanning applications while they are running, identifying vulnerabilities that are only detectable during execution, such as runtime exploits and configuration flaws. This acquisition is critical to strengthening FISMA compliance, meeting requirements from multiple external audits, and supporting the new mandate to conduct penetration testing on all Tier 1 applications and systems undergoing the Authority to Operate process. The goal is to integrate this testing early in the development lifecycle to prevent security flaws from reaching production and to reduce the risk of breaches. The request is issued as a Request for Information under solicitation number 28321326RI0000019, posted on May 5, 2026, with responses due by May 19, 2026. The procurement falls under NAICS code 513210 and is managed by the Social Security Administration’s Office of Acquisition and Grants in Baltimore, Maryland. Keelin McGrath is the primary point of contact for inquiries. The funding is urgent to address current workload demands and federal compliance obligations, ensuring that security testing is robust, timely, and aligned with the agency’s broader cybersecurity strategy across all mission-critical systems.