Approved Software in Maryland
This inventory pulls every engineering-relevant entry out of the DoIT approved software list and organizes it by function. It exists so Engineering Practice can quickly answer two questions: what can agencies adopt today without a new procurement, and where are the gaps that the procurement runbooks need to address?
Categories below cover source control, CI/CD, cloud, containers, observability, security, identity, password management, issue tracking, collaboration, testing, API management, data and analytics, developer tools, remote access, and browsers. The final section maps the gaps.
A note on the source: the official list mixes baseline approvals (software anyone can use) with agency-specific approvals (one named person at one agency got it through a ticket). For most engineering tools the distinction doesn’t matter much — what matters is that the software has cleared some form of MDDS review. Where the distinction does matter for procurement, the procurement runbooks should address it directly.
Source Control & Code Hosting
| Software | Description | URL |
|---|---|---|
| GIT | Distributed version control system; the foundation of modern source control. | GIT |
| GitHub Desktop | Desktop GUI client for GitHub repositories. | GitHub Desktop |
| GitHub mobile app | Mobile app for reviewing pull requests, managing issues, and viewing repos. | GitHub mobile app |
| Atlassian Bitbucket | Git repository hosting integrated with Jira and Bamboo. | Atlassian Bitbucket |
| BitBucket | (Duplicate entry — same as above.) | BitBucket |
| TortoiseGit | Windows shell extension for Git operations. | TortoiseGit |
CI/CD & Build Automation
| Software | Description | URL |
|---|---|---|
| Jenkins | Open-source automation server for building, testing, and deploying software. | Jenkins |
| CircleCI | Cloud-based CI/CD platform for automated build, test, and deploy pipelines. | CircleCI |
| Azure DevOps | Microsoft’s suite covering boards, repos, pipelines, test plans, and artifacts. | Azure DevOps |
| Delivery Plans extension | Azure DevOps extension for visualizing multi-team delivery roadmaps. | Delivery Plans extension |
| Maven | Build automation and dependency management for Java projects. | Maven |
| Chocolatey | Windows package manager for automating software installation. | Chocolatey |
| Brew | macOS / Linux package manager for developer tools. | Brew |
| PatchMyPC | Third-party application patching for SCCM, Intune, or standalone. | PatchMyPC |
Cloud Platforms
| Software | Description | URL |
|---|---|---|
| MS Azure | Microsoft’s public cloud platform. | MS Azure |
| AWSCLIV2 | AWS Command Line Interface, v2. Programmatic access to AWS services. | AWSCLIV2 |
| Amazon Connect | AWS cloud contact center service. | Amazon Connect |
| Amazon WorkSpaces | AWS managed desktop-as-a-service (DaaS). | Amazon WorkSpaces |
| Azure Virtual Desktop (AVD) | Microsoft’s cloud-hosted virtual desktop and app platform. | Azure Virtual Desktop (AVD) |
| Google Cloud mobile app | Mobile app for monitoring and managing GCP resources. | Google Cloud mobile app |
| Google AI Studio | Google’s hosted environment for prompt design and Gemini model access. | Google AI Studio |
| Cloudflare WARP | Cloudflare’s secure network client for encrypted internet traffic. | Cloudflare WARP |
| Citrix Workspace | Unified workspace for accessing virtual apps and desktops. | Citrix Workspace |
Containers & Orchestration
| Software | Description | URL |
|---|---|---|
| Docker Desktop | Local container runtime and tooling for macOS and Windows. | Docker Desktop |
| Chainguard Containers | Hardened, minimal container images with continuously updated CVE remediation. | Chainguard Containers |
Infrastructure as Code & Configuration
| Software | Description | URL |
|---|---|---|
| Consul - Terraform | HashiCorp Consul paired with Terraform — the only IaC entry on the list. | Consul - Terraform |
Observability & Monitoring
| Software | Description | URL |
|---|---|---|
| Datadog | SaaS observability platform — metrics, logs, traces, APM. | Datadog |
| Splunk | Log management and SIEM platform. | Splunk |
| UniversalForwarder | Splunk’s lightweight log shipper for endpoints and servers. | UniversalForwarder |
| New Relic | SaaS observability platform — APM, infrastructure, and logs. | New Relic |
| ElasticSearch | Distributed search and analytics engine; backbone of the ELK stack. | ElasticSearch |
| Error Monitoring Tool (Rollbar) | Error and exception tracking for production applications. | Error Monitoring Tool (Rollbar) |
| PagerDuty | Incident response and on-call alerting platform. | PagerDuty |
| LogicMonitor | SaaS infrastructure and application monitoring. | LogicMonitor |
| Solarwinds | Network and infrastructure monitoring suite. | Solarwinds |
| Cisco ThousandEyes | Internet and cloud network visibility for hybrid environments. | Cisco ThousandEyes |
Security & Vulnerability Management
| Software | Description | URL |
|---|---|---|
| Veracode Static | Static application security testing (SAST). | Veracode Static |
| Wiz | Cloud-native application protection platform (CNAPP). | Wiz |
| Nessus Agent | Tenable’s vulnerability scanning agent. | Nessus Agent |
| Tanium Client | Endpoint management and security agent. | Tanium Client |
| Anomali | Threat intelligence platform. | Anomali |
| Bitsight | Security ratings and third-party risk monitoring. | Bitsight |
| GreyNoise | Internet scanning intelligence — distinguishes noise from real threats. | GreyNoise |
| Shodan | Search engine for internet-connected devices. | Shodan |
| Wireshark | Open-source network protocol analyzer. | Wireshark |
| Burp | Web application security testing platform from PortSwigger. | Burp |
| Zenmap | GUI for the Nmap network discovery and security scanner. | Zenmap |
| Trellix (McAfee) Agent | Endpoint security agent (formerly McAfee). | Trellix (McAfee) Agent |
| McAfee ENS | Endpoint Security suite — antivirus, firewall, web control. | McAfee ENS |
| Symantec DLP | Data loss prevention across endpoints, network, and cloud. | Symantec DLP |
| BeyondTrust / Privileged Management Platform | Privileged access management (PAM). | BeyondTrust / Privileged Management Platform |
| Microsoft Sentinel | Cloud-native SIEM and SOAR on Azure. | Microsoft Sentinel |
| Drata | Compliance automation (SOC 2, HIPAA, ISO 27001). | Drata |
| Vanta | Continuous compliance and security monitoring. | Vanta |
| Securiti | Data privacy and security automation. | Securiti |
| CISA LME | CISA’s free, open-source log management for security teams. | CISA LME |
| CISA’s CSET | CISA’s Cyber Security Evaluation Tool for self-assessment. | CISA’s CSET |
| Data Sentinel | Data discovery and classification platform. | Data Sentinel |
| Sandbox AQ Post-Quantum Crypt | Quantum-resistant cryptography toolkit. | Sandbox AQ Post-Quantum Crypt |
| Wordfence | WordPress security plugin (firewall and malware scanner). | Wordfence |
| Sonatype Nexus Repository Manager | Universal artifact repository with vulnerability management. | Sonatype Nexus Repository Manager |
| Arnica.io | Code security and supply chain protection for development pipelines. | Arnica.io |
| Oxygen Forensic Detective | Mobile and cloud forensic investigation toolkit. | Oxygen Forensic Detective |
| Passware | Password recovery and decryption for forensics. | Passware |
Identity & Access Management
| Software | Description | URL |
|---|---|---|
| Okta Fastpass | Okta’s passwordless authentication. | Okta Fastpass |
| Cisco Duo | Multi-factor authentication and zero trust access. | Cisco Duo |
| One Login | Identity and access management (SSO, MFA, provisioning). | One Login |
| RSA SecurID Software Token | Soft token for two-factor authentication. | RSA SecurID Software Token |
| Microsoft Authenticator | Microsoft’s MFA app. | Microsoft Authenticator |
| Salesforce Authenticator App | Salesforce MFA app. | Salesforce Authenticator App |
| Yubico Authenticator | OTP and FIDO2 management for YubiKey hardware tokens. | Yubico Authenticator |
Password & Secrets Management
| Software | Description | URL |
|---|---|---|
| 1 Password | Enterprise password manager. | 1 Password |
| KeePass2 | Open-source local password vault. | KeePass2 |
| KeePassXC | Cross-platform fork of KeePass. | KeePassXC |
| GnuPG | OpenPGP implementation for encryption and signing. | GnuPG |
| GPG4Win | Windows distribution of GnuPG with GUI tools. | GPG4Win |
Issue Tracking & Project Management
| Software | Description | URL |
|---|---|---|
| JIRA | Atlassian issue tracking and agile project management. | JIRA |
| Asana | Work management for cross-functional teams. | Asana |
| Monday.com | Customizable work OS for project and operations management. | Monday.com |
| Trello | Kanban-style list and card project management. | Trello |
| ClickUp | All-in-one productivity and project management platform. | ClickUp |
| Click Up/AI | (Duplicate — same product as above.) | Click Up/AI |
| SAM (ServiceNow) | ServiceNow Software Asset Management. | SAM (ServiceNow) |
| Zephyr QA management tool | Test management for Jira. | Zephyr QA management tool |
| WorkOtter | Project portfolio management (PPM). | WorkOtter |
| Smartsheets | Spreadsheet-style work and project management. | Smartsheets |
Documentation & Collaboration
| Software | Description | URL |
|---|---|---|
| Slack | Team messaging and channels. | Slack |
| Notion | All-in-one workspace for docs, wikis, and databases. | Notion |
| Office 365 | Microsoft’s productivity suite (Word, Excel, PowerPoint, Outlook, Teams). | Office 365 |
| Miro | Online collaborative whiteboard. | Miro |
| Figma | Collaborative interface design and prototyping. | Figma |
| LUCID | Lucid Software (Lucidchart, Lucidspark) — diagramming and whiteboarding. | LUCID |
| Loom | Async video messaging for teams. | Loom |
| Obsidian | Markdown-based knowledge management and linked notes. | Obsidian |
| Mentimeter Pro | Interactive presentations and audience polling. | Mentimeter Pro |
| Balsamiq Wireframes | Rapid low-fidelity wireframing tool. | Balsamiq Wireframes |
| Pencil Project | Open-source GUI prototyping and wireframing. | Pencil Project |
| Optimal Workshop | UX research platform (tree testing, card sorts, first-click). | Optimal Workshop |
| Zapier | No-code automation between SaaS apps. | Zapier |
| Sharegate | Microsoft 365 / SharePoint migration and management. | Sharegate |
| AvePoint DocAve Core | SharePoint and Microsoft 365 management. | AvePoint DocAve Core |
| SharePoint Designer | Legacy SharePoint customization tool. | SharePoint Designer |
Testing & Quality Assurance
| Software | Description | URL |
|---|---|---|
| Postman API Platform | API design, testing, and collaboration. | Postman API Platform |
| BrowserStack | Cloud-based cross-browser and device testing. | BrowserStack |
| Sauce Labs | Cloud-based automated and manual testing. | Sauce Labs |
| SoapUI | API testing for SOAP and REST web services. | SoapUI |
| BlazeMeter | Performance and load testing as a service. | BlazeMeter |
| Mailosaur | Email and SMS testing for QA pipelines. | Mailosaur |
| MailCatcher | SMTP server that catches outgoing test emails for inspection. | MailCatcher |
API Management & Integration
| Software | Description | URL |
|---|---|---|
| Anypoint Studios Desktop | MuleSoft’s integration development environment. | Anypoint Studios Desktop |
| Twilio / SendGrid | Programmable messaging (SMS, voice) and transactional email. | Twilio / SendGrid |
| Apex Data Loader (Salesforce) | Bulk import/export between Salesforce and external systems. | Apex Data Loader (Salesforce) |
| Salesforce Dataloader | (Same product as above.) | Salesforce Dataloader |
| Workday Studio | Workday integration development environment. | Workday Studio |
Data Platforms & Analytics
| Software | Description | URL |
|---|---|---|
| Databricks | Unified data and AI platform on cloud. | Databricks |
| Tableau Desktop | Data visualization and dashboarding. | Tableau Desktop |
| Tableau Creator | Tableau license tier for full authoring access. | Tableau Creator |
| Tableau Prep Builder | Visual data preparation and shaping for Tableau. | Tableau Prep Builder |
| Power BI Desktop | Microsoft’s data visualization and BI tool. | Power BI Desktop |
| PBIDesktop | (Same as Power BI Desktop.) | PBIDesktop |
| Power BI Gateway | Bridge between Power BI cloud and on-prem data sources. | Power BI Gateway |
| Power BI AddIn for PowerPoint | Embed live Power BI reports into PowerPoint. | Power BI AddIn for PowerPoint |
| Looker | Google’s enterprise BI platform. | Looker |
| Looker Studio Pro | Google’s free data visualization, Pro tier. | Looker Studio Pro |
| Erwin | Data modeling. | Erwin |
| Informatica ETL | Enterprise ETL and data integration. | Informatica ETL |
| PowerExchange | Informatica’s CDC and bulk data movement for mainframes and databases. | PowerExchange |
| Manta (MantaSetup) | Automated data lineage and pipeline visualization. | Manta (MantaSetup) |
| Qlik | BI and data integration platform. | Qlik |
| NPrinting Designer | Reporting and report distribution for Qlik. | NPrinting Designer |
| MySQL | Open-source relational database. | MySQL |
| PostgreSQL | Open-source object-relational database. | PostgreSQL |
| SOLR | Apache enterprise search platform. | SOLR |
Developer Tools, IDEs & Runtimes
| Software | Description | URL |
|---|---|---|
| Visual Studio | Microsoft’s full-featured IDE (Windows, Mac). | Visual Studio |
| Visual Studio Code | Lightweight, extensible code editor. | Visual Studio Code |
| IntelliJ IDEA | JetBrains’ Java/JVM IDE. | IntelliJ IDEA |
| PyCharm | JetBrains’ Python IDE. | PyCharm |
| Eclipse | Open-source IDE, primarily for Java. | Eclipse |
| Sublime Text | Cross-platform text and code editor. | Sublime Text |
| Notepad++ | Lightweight Windows text editor for developers. | Notepad++ |
| TextPad | Windows text editor. | TextPad |
| UltraEdit | Cross-platform text and hex editor. | UltraEdit |
| VIM | Modal text editor; ubiquitous in terminal environments. | VIM |
| GNU Emacs | Extensible, customizable editor. | GNU Emacs |
| .NET Desktop Runtime 6 / 7 / 8 | Microsoft .NET runtimes for desktop apps. | .NET Desktop Runtime 6 / 7 / 8 |
| .NET Framework 4.8 | Legacy .NET Framework. | .NET Framework 4.8 |
| Java JDK / Java SE 8 | Oracle’s Java development kit and standard edition. | Java JDK / Java SE 8 |
| Python | General-purpose programming language. | Python |
| Anaconda | Python distribution for data science and ML. | Anaconda |
| Node 16.17 | JavaScript runtime. | Node 16.17 |
| PHP | Server-side scripting language. | PHP |
| Perl | Scripting language for text processing and system administration. | Perl |
| Angular CLI | Command-line tooling for Angular applications. | Angular CLI |
| Blazor | Microsoft’s .NET-based web UI framework. | Blazor |
| Apache Tomcat | Java Servlet container and web server. | Apache Tomcat |
| ColdFusion | Adobe’s rapid web application development platform. | ColdFusion |
| SQL Server Management Studio | Microsoft’s SQL Server administration tool. | SQL Server Management Studio |
| SQL Plus | Oracle’s command-line database client. | SQL Plus |
| dBeaver | Universal database GUI for many engines. | dBeaver |
| DbVisualizer | Cross-platform database client. | DbVisualizer |
| Navicat Data Modeler | Visual database design tool. | Navicat Data Modeler |
| DB Browser (for SQLite) | SQLite database GUI. | DB Browser (for SQLite) |
| Redgate SQL Data Compare | Compare and synchronize SQL Server data. | Redgate SQL Data Compare |
| DDEV | Local development environments for PHP projects. | DDEV |
| Sourcebot | Self-hosted code search and navigation across repositories. | Sourcebot |
| Copilot (GitHub) | AI pair programming. | Copilot (GitHub) |
| Gemini CLI | Google’s terminal interface for Gemini models. | Gemini CLI |
| Gemini Pro | Google’s Gemini frontier model. | Gemini Pro |
| Perplexity | AI-powered answer and research engine. | Perplexity |
| Google Colab | Hosted Jupyter notebooks. | Google Colab |
| WSL Ubuntu | Ubuntu on Windows Subsystem for Linux. | WSL Ubuntu |
| BalenaEtcher | USB / SD card flashing tool. | BalenaEtcher |
| PuTTY | SSH and Telnet client for Windows. | PuTTY |
| SecureCRT | Commercial SSH client and terminal emulator. | SecureCRT |
| Tabby | Modern, open-source terminal. | Tabby |
| WinSCP | SFTP / SCP / FTP client for Windows. | WinSCP |
| FileZilla | FTP / SFTP client. | FileZilla |
| 7-Zip | Open-source file archiver. | 7-Zip |
| BeyondCompare | File and folder comparison tool. | BeyondCompare |
| Snagit | Screen capture and annotation. | Snagit |
| Greenshot | Open-source screen capture. | Greenshot |
| ImageMagick | Command-line image processing. | ImageMagick |
| OBS Studio | Open-source screen recording and live streaming. | OBS Studio |
| Fiddler Classic | Web debugging proxy for HTTP traffic. | Fiddler Classic |
Remote Access & VPN
| Software | Description | URL |
|---|---|---|
| Cisco AnyConnect (VPN) | Enterprise VPN client. | Cisco AnyConnect (VPN) |
| Palo Alto GlobalProtect VPN Client | Palo Alto’s enterprise VPN. | Palo Alto GlobalProtect VPN Client |
| Pulse Secure VPN | Ivanti Connect Secure (formerly Pulse Secure). | Pulse Secure VPN |
| OpenVPN | Open-source VPN solution. | OpenVPN |
| FortiClient VPN | Fortinet’s endpoint VPN client. | FortiClient VPN |
| Zscaler | Cloud security platform with VPN replacement (ZTNA). | Zscaler |
Browsers
| Software | Description | URL |
|---|---|---|
| Google Chrome | Google’s web browser. | Google Chrome |
| Mozilla Firefox | Mozilla’s open-source web browser. | Mozilla Firefox |
| Microsoft Edge | Microsoft’s Chromium-based browser. | Microsoft Edge |
| Brave Browser | Privacy-focused Chromium-based browser. | Brave Browser |
Gaps: what’s not on the list
These categories are where the procurement runbooks will deliver the most value. Every row below is a gap where agencies wanting to adopt modern engineering practice will hit a procurement wall.
| Category | What’s missing | Why this matters |
|---|---|---|
| Kubernetes & orchestration | No K8s distribution (EKS, AKS, GKE, OpenShift, Rancher, k3s), no Helm, no Kustomize | Docker Desktop is approved but there’s no path to production container orchestration. Every modernization effort hits this wall. |
| GitOps & continuous delivery | No Argo CD, no Argo Workflows, no Flux, no Tekton, no Spinnaker | Modern GitOps deployment patterns are unsupported. P3’s whole model depends on this category. |
| Source control hosting | No GitLab (self-hosted or SaaS), no GitHub Enterprise Server, no Gitea | Several agencies run self-hosted GitLab today. The CI/CD runbook can’t fully cover GitLab without a procurement runbook addressing this. |
| Modern CI/CD platforms | No explicit GitHub Actions self-hosted runners, no Buildkite, no Harness, no GitLab CI | Jenkins and CircleCI are first-generation. Newer GitOps-friendly tooling not addressed. |
| Container registry | No Harbor, JFrog Artifactory, GitHub Container Registry, Docker Hub Enterprise | Docker Desktop without a registry path is incomplete. |
| Infrastructure as Code | Only “Consul - Terraform” appears. No standalone Terraform/OpenTofu, no Pulumi, no Ansible, no Chef, no Puppet | IaC practice is essentially unsupported at the approval level. |
| Secrets management (enterprise) | No HashiCorp Vault, no AWS Secrets Manager, no Azure Key Vault, no CyberArk | 1Password covers human passwords; machine-to-machine secrets management is missing. |
| Modern test automation | No Cypress, Playwright, Selenium, k6, Gatling, Locust, TestRail | Postman, BrowserStack, Sauce Labs, and SoapUI cover the basics. Modern E2E and load testing are absent. |
| Code quality / SAST | Only Veracode Static. No SonarQube, Snyk, Checkmarx, Semgrep | Agencies that need different tooling have limited options. |
| Dependency scanning | No Snyk, no Dependabot explicitly, no Mend (formerly WhiteSource), no GitHub Advanced Security | Supply-chain security is thin. |
| Error tracking | Only Rollbar. No Sentry, no Bugsnag, no Honeybadger | Limited choice for application error monitoring. |
| Open-source observability | No Grafana, Prometheus, OpenTelemetry, Loki, Tempo, Jaeger | All observability options are commercial SaaS. No self-hosted open-source path. |
| Incident management | Only PagerDuty. No Opsgenie, FireHydrant, Rootly, incident.io | Limited alternatives if PagerDuty isn’t a fit. |
| Feature flags | No LaunchDarkly, Optimizely, Split, Flagsmith, Unleash | Progressive rollouts, A/B testing, and gradual feature releases unsupported. |
| API gateway | Only MuleSoft Anypoint. No Kong, standalone Apigee, AWS API Gateway approval, Tyk | Single-vendor approach to API gateway capability. |
| Service mesh | Nothing approved (Istio, Linkerd, Consul Connect) | Microservices traffic management unsupported. |
| Modern data pipelines (ELT/ETL) | No dbt, Fivetran, Airbyte, Segment, Estuary | BI/visualization layer is strong (Tableau, Power BI, Looker, Databricks). The ELT layer to feed it is missing. |
| Cloud data warehouses | No Snowflake, BigQuery (standalone), Redshift (standalone) | Databricks is the only modern warehouse on the list. |
| NoSQL & specialty databases | No MongoDB, Redis, Cassandra, DynamoDB approval | Only MySQL and PostgreSQL covered. |
| Modern hosting / PaaS | No Vercel, Netlify, Heroku, Render, Fly.io, Railway | Modern web-app hosting paths are absent. |
| Product analytics | No Mixpanel, Amplitude, Heap, PostHog | Behavioral product analytics unsupported. |
| Self-hosted documentation | No GitBook, ReadTheDocs, Docusaurus, MkDocs at the enterprise tier | Engineering documentation tooling is thin outside of Confluence/Notion. |
What to do with this inventory
Three things, ordered by priority:
Write the Kubernetes / GitOps procurement runbook
This is the largest gap and the one Engineering Practice has the deepest expertise in (P3). Every agency wanting to modernize will hit this wall, so the runbook gets reused immediately.
Write a procurement runbook for “how to read the approved software list”
Because the list mixes baseline approvals with agency-specific approvals, with pending requests, with conditional approvals, agency engineers need a guide for how to interpret it. This runbook costs nothing to produce but unlocks adoption of everything already on the list.
Sequence the remaining procurement runbooks by category demand
The gaps table above is sorted roughly by leverage. Once Kubernetes and the meta-runbook exist, the next ones are likely Infrastructure as Code, secrets management, and modern test automation — in that order — because those three unblock the most projects per runbook.
Maintenance
This inventory should be refreshed quarterly and whenever Engineering Practice publishes a new procurement runbook (since a new runbook may shift a row from the gaps table into a category table). Owner: Engineering Practice. Last reviewed: 2026-05-31. Next review: 2026-08-31.