Static & Dynamic Application Security Testing (SAST/DAST) Integration

The contract seeks integration of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools into existing CI/CD pipelines to automate the detection of security vulnerabilities in both source code and running applications. The implementation must align with the OWASP Top 10 vulnerability categories and adhere to applicable compliance standards to ensure consistent, scalable security posture across development workflows. The goal is to shift security left in the development lifecycle, reducing exposure to critical threats by identifying and remediating issues early and continuously during deployment cycles. This subcontract is issued under the NAICS code 541511 for Custom Computer Programming Services and is managed by the DGS: CAPSD - Procurement agency based in California. Responses are due by July 30, 2026, with no set-aside designation specified. The place of performance and point of contact details are not provided, and the solicitation is accessible through an online procurement portal. Contractors are expected to deliver a seamless, configurable solution that integrates with current toolchains without disrupting development velocity, while maintaining auditability and reporting capabilities for compliance and risk management purposes.