RFI Response_v1.pdf

QUESTIONS AND ANSWERS

RFI Title: Request for Information: Automated Cryptographic Discovery and Inventory (ACDI) Tool

RFI Number: 7571TE26R00001

Issuing Office: Office of Mission Acquisition Solutions (OMAS)

Original RFI Posted: May 21, 2026

Q&A Posted: June 5, 2026

IMPORTANT NOTICES

This Q&A document is issued in response to questions received from industry in connection with the above-referenced RFI. The following applies to all responses contained herein:

1. This RFI is issued for market research and planning purposes only and does not constitute a request for quotes or a commitment by the Government to issue a request for quotes or make an award.

2. The Government is not obligated to and will not pay for any information received in response to this RFI.

3. Responses to this Q&A do not constitute a change to the original RFI requirements.

Any changes to the RFI will be issued via formal amendment on SAM.gov as such.

4. Questions have been paraphrased and/or consolidated where necessary to protect the identity of submitting vendors and to address common themes.

5. All responses reflect the Government's current understanding of the requirement and are subject to change.

QUESTIONS AND ANSWERS

Q1: Will the Government extend the submission deadline to 6/12/26 to allow for a more comprehensive response?

A1: No. The Government will not extend the submission deadline but offerors are still permitted to submit a response to the RFQ even if they did not submit a response to the

RFI.

Q2: What is the approximate scale of the environment to be covered, including number of endpoints and servers, IP addresses, network segments, FISMA systems, and discrete cloud accounts or tenants across the Operating Divisions and Staff Divisions?

A2: As an estimate for scale, HHS operates a large and diverse technology environment consisting of more than 500,000 endpoints and over 900 IT systems. As the RFI is for planning and market research purposes only, these numbers are intended as rough estimates of the size of an enterprise deployment and should not be considered official inventory counts.

Q3: Is the deployment intended to be enterprise-wide beginning in the base year, or phased across Operating Divisions and Staff Divisions over the base and option years? If phased, what is the intended sequence and scope per year?

A3: The goal of an ACDI deployment at HHS would be to provide an enterprise-wide deployment, available and easily integrated with each of the Operating and Staff Divisions, as quickly as is reasonable. This RFI is for planning and market research purposes, and we are seeking information about deployment options from ACDI tool vendors.

Q4: Which environments are in scope at award, including on-premises data centers and specific cloud service providers, and approximately what is the distribution across them?

A4: HHS has critical systems in multiple environments: on-prem, cloud, and hybrid. For this reason, we are requesting information in the Statement of Objectives about ACDI tools in multiple environments. All three categories are strongly represented across HHS, with diversity in the cloud vendors in use.

Q5: Does the government have an anticipated RFP release and award date? Also, do you have an anticipated or preferred contract vehicle in mind?

A5: This RFI is for planning and market research purposes only. This RFI is NOT a Request for Proposal (RFP), Request for Quote (RFQ), or an Invitation for Bid (IFB), and does not commit the Government to issue a solicitation, award a contract, or pay any costs incurred in the preparation of a response. We do not have an anticipated date awarding contracts or specific contract vehicle preferences to share at the current time, as this RFI is focused on market research.

Q6: Will the government consider allowing commercial past performance references in the evaluation criteria?

A6: The RFI is not created for the purposes of evaluating vendors. This RFI is for planning and market research purposes only. This RFI is NOT a Request for Proposal (RFP), Request for Quote (RFQ), or an Invitation for Bid (IFB), and does not commit the Government to issue a solicitation, award a contract, or pay any costs incurred in the preparation of a response. Including past performance is not necessary in this RFI response.

Q7: Will this project be split into two distinct contracts—one covering discovery and remediation tracking, and a second dedicated entirely to the remediation work itself?

A7: This RFI is for planning and market research purposes only. The focus of this RFI is on discovery and inventory (Phase 1 Migration Activities) as opposed to remediation and PQC migration activities.

Q8: Have you identified your high-value assets and high-impact systems to prioritize for PQC migration?

A8: HHS participates in the yearly OMB M-23-02 data call. The current focus of the data call is FISMA High systems, High Value Assets, and other systems of a critical nature which would be impacted by a cryptanalytically relevant quantum computer. These systems at HHS have been identified in compliance with the data call.

Q9: Are you planning for PQC in your upcoming software and hardware purchases to prevent acquiring new 'cryptography-debt' systems?

A9: Many vendors have begun incorporating PQC into their software and hardware, which provides opportunities for HHS to advance their cryptographic security. Progressing towards PQC adoption, and acquiring new technologies with PQC capabilities, is still a work in progress.

Q10: What are your software and hardware vendors' roadmaps for PQC, and are they aligned with NIST standards?

A10: Following NIST guidance, as well as adhering to OMB standards and executive orders, is of critical importance to HHS. The current timeline for PQC migration is 2035, and may be moved to an even earlier date. HHS is making every effort to comply with guidance and requirements. Most vendors are targeting a 2035 PQC adoption date or have set more aggressive goals. Some technologies experience more complexity in the migration process.

Q11: How do you plan to correlate automated technical discovery data with the administrative metadata required by OMB M-23-02, such as FISMA system identifiers and FIPS 199 categorizations?

A11: Thank you for identifying a core concern with any ACDI tool adopted within HHS. We have seen various proposed solutions, such as advanced tagging options, that can ease the burden of identifying the correspondence between cryptographic data and the system identification needed in the M-23-02 templates. We are interested in any vendor insight into this issue.

Q12: Are you planning an industry day?

A12: There are no known plans for an HHS industry data around PQC.

Q13: Do you plan to have a virtual reading room?

A13: There are no known plans for an HHS virtual reading room around PQC.

Q14: Will you be meeting with vendors who submit a response?

A14: We may invite vendors to provide demonstrations for market research purposes following the review and evaluation of the RFI responses.

Q15: Who is your current Security Vendor?

A15: HHS has relationships with a variety of cybersecurity vendors.

Q16: Will this be a new requirement or an extension of work already under contract?

A16: ACDI tools at the enterprise level are a new venture for HHS, which is part of the motivation behind this RFI to capture more information and feedback from vendors with this area of expertise.

Q17: SCOPE QUESTION: Is HHS seeking discovery across only enterprise IT assets or also OT, IoT, medical devices, embedded systems, and laboratory environments?

A17: The RFI is currently seeking information regarding ACDI capabilities to discover, inventory, and assess cryptographic assets, algorithms, and dependencies across enterprise IT systems and network infrastructures.

Q18: SCOPE QUESTION: Does HHS expect discovery of:

oCertificates oKeys oSecrets oHSMs oPKI hierarchies oCryptographic libraries oTLS implementations oCode signing infrastructure?

A18: The Statement of Objectives lists in Section 2.1.1 the current areas in which HHS desires discovery:

2.1.1. Cryptographic Discovery

The solution shall automatically discover cryptographic implementations across enterprise environments and provide support for discovery across:

• Network communications (e.g., Virtual Private Network (VPN), Secure Shell (SSH))

• Transport Layer Security (TLS) version

• Endpoints and servers

• Applications and services

• Cloud environments and containers

• Virtual machines (VMs) (e.g., VMware, Hyper-V, cloud VMs)

• Data-at-rest systems (e.g., databases, storage)

• Firmware and firmware updates

• Source code

• Executable files

• Third-party artifacts

HHS would be interested in a response than includes any additional discovery options from your Scope question, such as HSMs.

Q19: SCOPE QUESTION: Is a Cryptographic Bill of Materials (CBOM) required as a formal deliverable?

A19: As written in Section A. Background, "Office of Management and Budget (OMB) issued Memorandum M-23-02, Migrating to Post Quantum Cryptography, directing federal agencies to comply with NSM-10 by developing a prioritized inventory of their cryptographic systems, also known as a cryptographic bill of materials (CBOM), as a first step in the transition to post-quantum cryptography (PQC)."

Yes, we are interested in a CBOM as part of the deliverables, especially one that meets the OMB requirement listed above.

Q20: SCOPE QUESTION: Are SaaS deployments permitted, or must the solution support sovereign/on-premises deployment?

A20: SaaS deployments are permitted. (If offering a SaaS solution, HHS would be interested in whether the solution has been through FedRAMP.)

Q21: SCOPE QUESTION: What FedRAMP requirements are anticipated?

A21: HHS would like to deploy ACDI tools in environments which would require FedRAMP High certification.

Q22: SCOPE QUESTION: Are classified, air-gapped, or disconnected environments within scope?

A22: HHS is not seeking support for classified or air-gapped networks. HHS does have a federated environment across various Operating Divisions which does not heavily feature centralization.

Q23: PQC QUESTION: Does HHS expect support for:

oNIST PQC algorithms oHybrid certificates oCrypto-agility workflows oMigration planning oAutomated remediation recommendations?

A23: In this RFI for ACDI tools, HHS is looking for tools that can identify PQC algorithms and hybrid cryptography (including within certificates). Crypt-agility workflows, migration planning, and automated remediation are outside of the scope.

Q24: PQC Question: Does HHS envision the ACDI platform as only an inventory capability, or as a migration planning and execution platform as well?

A24: For the scope of the RFI, HHS is interested in ACDI tools for inventory and discovery.

Migration planning and PQC migration are outside of the scope, though we are interested in tools that can help prioritize criticality.

Q25: INTEGRATION QUESTION: Are CDM integrations required?

A25: ACDI tool integration with CDM, as a widely deployed tool within HHS, is highly desirable.

Q26: Will the Government provide any page count or formatting limitations?

A26: No page limits or format. The goal is for vendors to respond to our SOO with additional information we have not considered, refine our scope, and provide ACDI tool capabilities.

Q27: Which enterprise platforms should vendors assume must be integrated:

• Microsoft PKI

• Active Directory

• Azure

• AWS

• GCP

• ServiceNow

• SIEM platforms

A27: At the time of this RFI, HHS does not have available a full list of enterprise platforms which must integrated with an ACDI tool. We are interested in learning from vendors which integrations are supported.

POINT OF CONTACT

All questions regarding this Q&A posting should be directed to:

Contracting Officer: Julie Rodriguez

Email: julie.rodriguez@hhs.gov

Note: All official responses will be issued in writing via SAM.gov.

NEXT STEPS

The Government is continuing to analyze market research responses. No determination has been made regarding a future request for quotes. Interested vendors should continue to monitor SAM.gov for updates.

The question period closed on 6/1/26. No further questions will be answered.

This notice is for informational purposes only and shall not be construed as a solicitation or as an obligation on the part of the Government.