Application Security Testing Platform

The Vendor is required to provide application security testing (AST) platform capable of supporting secure software development across multiple programming languages and development environments.
- The solution must provide integrated capabilities for static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and AI-assisted remediation to identify, prioritize, and remediate vulnerabilities throughout the development lifecycle.
- The platform shall meet the following requirements:
1. Security and compliance
• Provide fedramp moderate or govramp authorization certification where applicable.
• Support secure handling of source code and scan artifacts with no unauthorized transmission, storage, or replication outside the approved environment.
2. Core AST capabilities
• Deliver fully integrated sast, dast, and sca scanning, including findings triage, severity scoring, developer-friendly reporting, and vulnerability history tracking.
• AI-assisted remediation guidance, including automated patch recommendations and code-fix suggestions.
3. Development and pipeline integrations
• Support CI/CD pipelines, including GitHub, gitlab, azure devops, bitbucket, and other scm systems in use across county development teams.
• Allow for pipeline-based automated scanning that triggers on commit, pull request, merge, or scheduled intervals.
• Include APIs, web hooks, and cli tooling for flexible integration into existing devsecops workflows.
4. Deployment options
• Provide county-approved deployment models (cloud, on-premises, or hybrid).
5. Identity, access and governance
• Support single sign-on (SSO) and role-based access control.
• Provide centralized administration consoles for security staff to view enterprise-wide risk, developer activity, and compliance posture.
6. Reporting and analytics
• Dashboards suitable for audit, compliance, and ongoing operational security reporting.
• Support export or API-based integrations to county data-lake workflows and reporting automation.