RegScale Alternative Sources/Solutions

The Statement of Objectives (SOO) FA83076RB028 outlines the need for RegScale software licenses to modernize and streamline regulatory compliance for the Air Force Life Cycle Management Center (AFLCMC) Crypto and Cyber Systems Division (CCSD) and the Platform One (P1) Program Office (HNCX). RegScale, a scalable platform, utilizes Continuous Controls Monitoring (CCM) and automated workflows to ensure mission-critical systems align with evolving regulatory requirements in real-time. The P1 team requires these advanced Continuous Integration/Continuous Deployment (CI/CD) pipeline tools to institutionalize Development Security Operations (DevSecOps) across the enterprise, migrate legacy Department of War (DoW) portfolios into a cloud-native architecture, reduce sustainment costs, and increase system reliability. The contract provides RegScale Compliance Platform Licenses plus Services Accelerator Pack for a base period from June 2026 to June 2027, with two one-year options extending to June 2029. License keys are to be delivered within five business days of award to specified Air Force email addresses. The contractor must provide a single point of contact for coordination, timely issue identification, root cause remedies, and effective communication regarding license updates and expiration dates.

The Government has issued a Request for Information (RFI) to conduct market research and identify commercially available Regulatory Compliance Automation Platforms. This RFI aims to find alternatives to RegScale to support Platform One’s DevSecOps ecosystem and mission requirements. The Government is looking for solutions that provide Governance, Risk, and Compliance (GRC) automation, continuous compliance monitoring, security control management, risk assessment tracking, audit readiness, and authorization support within a Government security-compliant environment. Key capabilities sought include support for enterprise compliance operations, Risk Management Framework (RMF) activities, continuous Authority to Operate (cATO) sustainment, control inheritance management, evidence collection automation, policy mapping, and security documentation management. The RFI seeks responses from vendors on their capabilities in areas such as Continuous Controls Monitoring (CCM), automated evidence collection, supported regulatory frameworks (NIST 800-53, RMF, FedRAMP, CMMC, STIG), policy-as-code, audit trail retention, native integrations with various platforms, cATO support, compliance drift detection, RBAC models, implementation timelines, support processes, licensing, pricing, and federal customer examples. This RFI is for informational purposes only and does not constitute a solicitation or commitment to award a contract.