Federal Identity Materials Program (FIMP) Request for Information (RFI)

General Services Administration (GSA) USAccess

Federal Identity Materials Program (FIMP)

Request for Information (RFI)

July 9, 2026

REQUEST FOR INFORMATION (RFI)

1.0 DISCLAIMER

This Request for Information (RFI) does NOT constitute a Request for Proposal and is not to be construed as a commitment, implied or otherwise, by the Government that a procurement action will be issued.

No telephone inquiries will be accepted and requests for solicitation packages will not be honored, as no solicitation is intended at this time. Response to this notice is not a request to be added to a bidders list or to receive a copy of a solicitation.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of the submission of the requested information. No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow up information requests.

Responses to this RFI may be considered in the future determination of an appropriate acquisition strategy for the program. The Government may not respond to any specific questions or comments submitted in response to this RFI or information provided as a result of this request.

Any information submitted by respondents as a result of this notice is strictly voluntary.

2.0 FEDERAL IDENTITY MATERIALS PROGRAM (FIMP)

2.1 Overview

The Federal Identity Materials Program (FIMP), managed by the General Services Administration's (GSA) Identity, Credentials, and Access Management (ICAM) Managed Service Office, supports the USAccess shared service, which provides credential issuance for over 120 federal agencies. The program is responsible for supplying Homeland Security Presidential Directive 12 (HSPD-12) Personal Identity Verification (PIV) cardstock and associated personalization services for a population of over 1.4 million credential holders.

As the current Blanket Purchase Agreement ends in January 2028, the GSA is conducting this Request for Information (RFI) as part of a strategic effort to prepare for a multi-year recompete.. The Government is seeking industry input on capacity, innovation trends, and competitive solutions to modernize credential production, improve operational resilience, and explore alternative credential form factors, ensuring the program's long-term success and seamless integration with government enterprise systems. The FIMP provides various cardstock products and services, such as:

● Blank cardstock

● Personalization services for cardstock

● Test cardstock

● Technical/engineering support relating to cardstock personalization services

1.1 Objectives

The high level objectives of the FIMP requirements include:

● Objective 1: Modernize Credential Production and Lifecycle Outcomes o Deliver secure identity credential products/services that maintain or exceed current HSPD-12 / PIV operational outcomes for ~140 customer agencies, including: Predictable issuance throughput, Quality personalization, Compliance with applicable federal standards, Robust supply chain and continuity, and Improved user and agency experience

● Objective 2: Improve Resilience, Speed, and Cost Effectiveness o Reduce end-to-end cycle time and improve surge capacity and geographic resilience while lowering total cost of ownership

● Objective 3: Expand Innovation Pathways Beyond “Cardstock-as-Usual” o Identify and implement innovations that improve identity assurance and access outcomes, such as: Enhanced card technologies (security features, durability), Improved personalization and proofing, stronger key-management/ceremony support and migration readiness, Alternative credential form factors where permitted (e.g., derived credentials, mobile enablement, or hybrid models), Improved integration patterns (interfaces, automation, telemetry), and Improved shipping/chain-of-custody.

● Objective 4: Maintain Seamless Integration with Government Enterprise Systems o Support system-to-system interfaces for order intake, production status, completion files, and reporting and accommodate periodic system upgrades and standards changes with minimal disruption.

2.0 INSTRUCTIONS TO RESPONDENTS

GSA is requesting market information regarding industry capabilities and emerging technologies pertinent to finalizing acquisition planning. The responses to this RFI will be captured as market research and may contribute to refinement of technical requirements and update of the acquisition strategy.

All submissions shall become Government property and will not be returned. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. The information provided in this RFI is subject to change and is not binding on the Government.

Responses are suggested to be 30 pages or less. Provide answers in the numbered order below. Provide diagrams for architecture/integration and tables for throughput, SLA proposals, and ROM pricing. To ensure readability by the Government, responses must have a minimum font size of 10, and pages must have a 1-inch border at minimum. Respondents are also requested not to provide generic corporate marketing material as this will be discarded.

3.0 INFORMATION REQUESTED FROM RESPONDENTS

4.1. Vendor & Solution Overview

● Provide an overview of your proposed solution(s) for federal identity credential production / personalization and lifecycle support

● Identify which parts of the solution are commercial products, which are services, and which are custom

● Describe your experience supporting Federal HSPD-12 / PIV programs at scale or any other experiences with services that may be relevant (agency count, annual volume, and operations model)

○ Other Gov’t agencies

○ Commercial ICAM

○ SLED (State, Local, Education)

○ Aviation

4.2. Innovation: Improving PIV outcomes

● What innovations do you offer that materially improve security, durability, speed, or user experience compared to standard PIV card production

● Describe any new or emerging card technologies, personalization technologies, anti-counterfeiting features, or QA automation that you recommend

● Describe options to reduce rework/defect rates and improve first-pass yield (proofing, printing, chip personalization validation, etc.)

● Describe options to support modernization paths such as derived credentials, mobile enablement, or hybrid credential models, and how they coexist with physical PIV where required

4.3. Standards & Compliance

● Identify the standards you support (e.g., relevant NIST/FIPS/ISO), and explain how you track and implement changes when standards update

● Describe how your products appear on or comply with required government approval lists (e.g., FICAM APL) and your approach to recertification or upgrades

● Describe your approach to cryptographic module compliance and secure handling of key material where applicable

4.4. Order Model & Operations

● Describe how you would support two order types: (a) inventory replenishment and (b) customer orders processed via a Government system and your production interface

● Provide typical and surge throughput (daily/weekly), and the drivers that constrain throughput (equipment, labor, supply chain, QA, shipping)

● Describe how you ensure accurate real-time inventory and chain-of-custody for blank, personalized, and test stock

● Provide your recommended Service Level Agreement (SLA) structure for delivery timelines and “rush/urgent” order handling

4.5. Systems Integration & Data Exchange

● Describe your production interface approach (data formats, security controls, acknowledgements, completion files, error handling)

● Describe your approach to integrating with a Government order-delivery system that may change every 3–5 years, including testing approach and regression strategy

● Provide a sample integration plan and indicative schedule for interface configuration/testing

4.6. Security, CUI, Privacy

● Describe how you protect CUI and sensitive program data (technical, administrative, and physical safeguards)

● Describe your incident response approach for loss/theft/discrepancy of cardstock or sensitive production data

● Identify where data is created, processed, stored, and who can access it (including subcontractors)

● Describe controls used to prevent leakage of cryptographic keys or sensitive security parameters through side-channel mechanisms (e.g., LED optical leakage, electromagnetic emissions, power analysis, or acoustic signals) in card components, production equipment, or associated systems.

4.7. Facilities, Continuity, and Supply Chain Risk

● Describe your production facility footprint (CONUS primary + backup), continuity plan, and disaster recovery approach

● Describe supply chain risk management for cardstock, chips, laminates, inks, and other consumables

● Describe your organization’s role in the supply chain, e.g. manufacturer, software layer, other value add, etc. As it relates to your solution, include information on how the full supply chain is fulfilled, e.g. manufacturing partners, distribution partners, etc.

● Provide your approach to counterfeit avoidance and quality verification of sourced materials

4.8. Quality Management & Performance Measurement

● Provide your Quality Management approach and metrics you recommend the Government track

● Identify what QA automation you can provide (e.g., image verification, chip personalization verification, defect trend analytics)

● Provide recommended performance objectives and acceptable quality levels (AQLs) that are measurable and enforceable

4.9. Transition and Migration Readiness

● Describe your transition-in approach to avoid disruption and your typical transition timeline

● Describe your transition-out support approach and what artifacts you provide to enable a smooth successor transition

● Describe your approach to implementing a new PIV card version / standards change, including migration planning and key-ceremony support

4.10. Pricing & Contract Considerations

● Provide rough-order-of-magnitude (ROM) pricing constructs: unit pricing, volume discount curves, surge pricing, integration costs, labor categories, and support labor models

● Identify key contract assumptions you would recommend (ordering frequency, forecast windows, minimum order quantities, inventory risk allocation)

● Identify any terms that materially impact price or schedule (e.g., government-furnished shipping accounts, data rights, interface testing environments)

4.11. Risks and Key Government Decisions

● Identify top technical, schedule, cost, and supply chain risks and recommended mitigations.

● Identify decisions the Government must make early (credential form factor strategy, decentralization vs centralized printing, interface ownership model, etc.)

● Identify any policy constraints you believe limit modernization and recommend how to address them

4.12. Post-Quantum Cryptography Innovation

● Detail your firm's roadmap for integrating post-quantum cryptography (PQC) across the PIV card ecosystem (cards, middleware, issuance/management, and relying systems), aligning with current and anticipated NIST PQC standards and federal guidance..

● Identify the post-quantum or hybrid cryptographic approaches your solution currently supports, is testing, or plans to support for PIV-based authentication, digital signatures, and key establishment, and describe how those approaches would interoperate with existing PIV implementations and FIPS-validated cryptographic modules.

● Outline the key technical, operational, and standards challenges of implementing post-quantum cryptography for PIV cards and infrastructure, focusing on constraints like card memory, transaction speed, certificate and key management, lifecycle management, and compatibility with legacy USAccess systems.

● Summarize any relevant testing, prototyping, pilots, standards participation, or implementation experience your firm has related to post-quantum cryptography for smart cards, PIV credentials, or federal identity systems, including views on adoption timelines, implementation dependencies, and standards maturity.

4.13. Artificial Intelligence Applications for PIV Cardstock and Hard-Token Credential Ecosystems

● Describe how your firm currently uses, is testing, or plans to use artificial intelligence, machine learning, advanced analytics, or simulation capabilities to improve PIV cardstock manufacturing, personalization, quality assurance, security, and lifecycle management. Include discussion of any AI-enabled approaches that may improve card body manufacturing yield, chip quality assurance, defect detection, production throughput, counterfeit detection, and long-term credential reliability.

● Identify how AI-enabled tools could strengthen supply chain visibility, component assurance, and risk management for PIV cardstock and hard-token credential ecosystems. Address potential applications such as component sourcing risk analysis, supplier risk scoring, counterfeit or tampered component detection, disruption forecasting, inventory optimization, material availability monitoring, and early identification of vulnerabilities affecting secure credential production.

● Describe how AI-enabled analytics, simulation, modeling, or optimization tools could support cryptographic agility for PIV credentials and related infrastructure.

Include discussion of how such capabilities may assist with migration planning for larger key sizes, new cryptographic algorithms, hybrid cryptographic approaches, and post-quantum cryptographic implementations, while maintaining interoperability with existing PIV cards, middleware, issuance systems, certificate management processes, FIPS-validated cryptographic modules, and relying systems.

● Outline the key technical, operational, cybersecurity, privacy, and governance challenges associated with applying artificial intelligence to PIV cardstock, credential manufacturing, issuance, lifecycle management, and cryptographic modernization. Address constraints such as data availability and quality, model validation, explainability, false positives and false negatives, protection of sensitive manufacturing and credentialing data, integration with legacy USAccess systems, and the need to preserve trust, auditability, and compliance across the credential ecosystem.

● Describe how hard-token credential management may need to evolve to support non-human actors, including autonomous agents, automated systems, service accounts, devices, workloads, or machine identities. Include discussion of whether PIV-like hard-token credentials, secure elements, smart cards, hardware roots of trust, or related credential technologies could support authentication, digital signatures, key establishment, lifecycle management, revocation, and accountability for non-human identities in federal environments.

● Summarize any relevant testing, prototyping, pilots, production implementations, standards participation, research, or operational experience your firm has related to artificial intelligence for smart cards, PIV credentials, secure credential manufacturing, supply chain assurance, cryptographic agility, or non-human identity credentialing. Include your views on adoption timelines, implementation dependencies, data requirements, standards maturity, operational risks, and areas where additional federal guidance or industry coordination may be needed.