Application Security Testing (AST) Platform

The Sacramento County Contract & Purchasing Services Division is releasing a Request for Bid (RFB) on behalf of the Department of Technology to procure an Application Security Testing (AST) platform capable of supporting secure software development across multiple programming languages and development environments. The solution must provide integrated capabilities for Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and AI‑assisted remediation to identify, prioritize, and remediate vulnerabilities throughout the development lifecycle. The platform should offer seamless integration with modern source‑code management systems and CI/CD pipelines, support enterprise authentication (including SSO), and include licensing models appropriate for developer‑centric or application‑centric usage. Preference will be given to solutions with FedRAMP or GOVRAMP authorization and robust reporting suitable for audit, compliance, and operational security functions.

Sacramento County has adopted the NIST Cyber-Security framework and strives to align its practices with those described in the moderate controls of NIST 800-53. Sacramento County is made up of numerous departments and critical services, some of which must comply with external regulatory requirements, including PCI, IRS Pub 1075, HIPAA, CJIS, and other requirements related to critical infrastructure.

Sacramento County continually strives to align its practices with the NIST Cyber-Security framework and looks to procure an Application Security Testing platform to help us improve our overall application security practices.