AOI 26-A006 Quantum Cryptography.pdf

Naval Information Warfare Center (NIWC) Atlantic

Rapid Capabilities Office (RCO)

Commercial Solutions Opening (CSO)

N65236-26-S-0001

Prototype Title: Zero Trust Post Quantum Cryptography (PQC) Roadmap

Area of Interest (AOI) Number: 26-A006

Command Focus Area: Battlespace Connectivity

Problem Statement:

The advent of cryptographically relevant quantum computers (CRQCs) poses a direct, existential threat to the security and operational integrity of Department of Navy (DoN) and Marine Corps systems. In accordance with National Security Memorandum 10 (NSM-10) and OMB

Memorandum M-23-02, the DoN must execute a rapid, phased, and strategically coordinated migration to Post-Quantum Cryptography (PQC). To manage risk, coordinate migration, and optimize financial investments, the DoN must first establish a complete, authoritative, and continuous baseline inventory of all cryptographic algorithms, protocols, modules, and implementations currently deployed. Currently, cryptographic baselines rely on resource-intensive, manual processes. The DoN requires an automated solution to accelerate discovery and improve enterprise-wide visibility.

NIWC Atlantic seeks to prototype a rapidly deployable, integrated, and scalable commercial solution capable of automating the discovery, identification, and cataloging of cryptographic assets across all DoN and Marine Corps networks and systems. This includes enterprise IT (on-premise and cloud), mobile systems, operational technology (OT), and tactical/embedded weapon platforms. The ultimate objective is to automate the generation of a Cryptographic Bill of Materials (CBOM) to support central risk reporting, vulnerability assessments, and PQC migration prioritization.

Project Approach:

This project will employ an agile, cloud-centric, and iterative approach to rapidly deliver and transition innovative technical solutions aligned with NIWC Atlantic's mission. This approach leverages collaborative stakeholder engagement, continuous feedback loops, and a strong focus on cloud-based technologies and platform integration to ensure the resulting capabilities are operationally effective, secure, scalable, and aligned with evolving warfighter needs. The project will emphasize seamless integration across classification levels and reciprocity agreements to facilitate collaboration and information sharing.

Desired Solution:

NIWC Atlantic is seeking vendor solutions from the commercial sector that provide a cohesive framework for automated discovery, analysis, and reporting of cryptographic systems and dependencies.

Compelling solutions must address the following:

• Comprehensive Multi-Environment Discovery: Enable comprehensive discovery of cryptographic protocols, algorithms, key lengths, and certificates across enterprise environments, commercial/government cloud, local networks, endpoints, and embedded/tactical assets.

• Hybrid Scanning: Support hybrid passive and active scanning, including passive network protocol sniffing as well as active, authenticated, or agent-based scanning.

• Automated CBOM: Automate the generation of a structured, machine-readable

"Cryptographic Bill of Materials" (CBOM) for each inventory asset.

• Continuous Monitoring: Enable continuous cryptographic monitoring to track, detect, and alert on changes in the cryptographic baseline of target networks.

• Security & Compliance: Comply with relevant security and compliance standards, utilizing robust access control measures and a crypto-agile architecture.

Additional attributes are detailed below that would add more value to a proposed solution.

Primary Attributes (Highly desired):

• Cloud-Native and Scalable Architecture: Features an open infrastructure optimized for deployment in secure cloud environments (e.g., GovCloud) and scalable across multi-level security enclaves

• NIST PQC Standards Compatibility: Recognizes and catalogs legacy asymmetric algorithms as vulnerable, while specifically identifying and tracking the integration of newly standardized

FIPS 203, FIPS 204, and FIPS 205 algorithms.

• DIL Operational Support: Demonstrates the ability to operate discovery tooling in disconnected, intermittently connected, and low-bandwidth (DIL) tactical environments without disrupting mission-critical communications.

• Integration with Centralized Registries: Federates CBOM data directly into designated

Department of Navy authoritative data repositories to minimize duplicate effort.

Secondary Attributes (strongly desired)

Vendor Corporate PQC Roadmap: The vendor itself exhibits corporate commitment to PQC migration, providing documentation and timelines for FIPS 140-3 validations of their own software/cryptographic modules.

• Low Operational Overhead: Scanning, discovery, and inventory procedures minimize processing, memory, and bandwidth utilization on target tactical assets and operational technology.

Prior Demonstration and Fielding:

Preference may be given to companies that can provide evidence of quickly scalable solutions with a minimum Technical Readiness Level (TRL) of 7. Companies must demonstrate their solution in an unclassified environment as part of Phase 2. Proposers are encouraged to highlight prior experience in conducting automated asset discovery, code security analysis, or network vulnerability scanning at enterprise scale.

DOD Contract Security Classification Specification (DD254):

Due to the accelerated nature of the CSO timeline, the Government is requiring offerors to demonstrate the required facility clearance level at time of submission of the Solutions Brief. The contractor shall possess a Secret Facility Clearance to perform under this AOI. Solutions Briefs must contain the Cage Code for the prime contractor that would be identified on any resulting agreement. NIWC Atlantic will use the cage code provided in the solution brief to determine contractor facility clearance requirements are met. Contractors that do not hold the appropriate level will not be considered for a Phase 2 Pitch.

Solutions Briefs:

Interested companies shall submit a solution brief within the Vulcan platform (vulcan-sof.com) no later than 2359 Eastern Daylight Time (EDT) 07 July 2026. Solutions briefs shall not contain

CUI and shall meet the requirements specified in CSO N65236-26-S-0001 paragraph 7.2. In addition, the solution brief shall detail how the nontraditional business participation as defined in

CSO N65236-26-S-0001 paragraph 6.2 will be met. If proposing a teaming partner to meet nontraditional requirements, that teaming partner must be identified by name in the solution brief and their cage code provided for verification. If an offeror is proposing to meet the requirement by providing a cost share this must be explicitly stated in the solution brief.

Solutions Briefs shall be submitted as attachment within the Vulcan Platform in addition to the

Scout card.

Late submissions will not be considered.

The Government reserves the right to limit the number of entities invited to pitch based on the evaluation conducted in accordance with CSO N65236-26-S-0001 paragraph 7.2.2. Solution

Briefs that are chosen for the Phase 2 Pitch will be notified in writing as soon as practicable.

Pitch: The Government anticipates hosting an in person Pitch by NIWC Atlantic in Charleston

South Carolina for this AOI. Tentative dates for the pitches will be 20 through 21 July 2026.

Solution Briefs that are chosen for the Phase 2 Pitch will be notified in writing as soon as practicable. The pitch session will be centered on a demonstration of the solution. The pitch must begin with a brief Solution Overview providing a Bottom Line Up Front (BLUF) of the company's capabilities, their direct relevance to the AOI, and a top-level cost summary.

Following the overview, the vendor is expected to conduct a mandatory live unclassified demonstration of their system actively executing a representative operational scenario of their own choosing. During this demonstration, the vendor is expected to showcase the system's live capability to ingest relevant datasets, detect, track, and process targets, and physically prove the core capabilities outlined in the AOI. The pitch must present a complete solution and outline a credible pathway to address the full problem set.

Questions related to this AOI can be sent to:

Questions related to this AOI can be submitted to Jessie

Rehwoldt at jessie.m.rehwoldt.civ@us.navy.mil. Solutions Briefs emailed directly to Jessie

Rehwoldt will not be accepted for this AOI. Solutions briefs must be submitted via the Vulcan platform to be evaluated.

Potential for Follow-On Production Contract:

Companies are advised that any prototype agreement awarded in response to this AOI may result in the direct award of a follow-on production agreement without the use of further competitive procedures.

Enclosures:

See Enclosure 1 of the RCC CSO N65236-26-S-0001 for the DD254 applicable to this AOI.

mailto:jessie.m.rehwoldt.civ@us.navy.mil