For RFI_ZeroTrust_PQC_PWS_v1_1_Rev5_.docx

Zero Trust and Post-Quantum Compute Encryption

VA-FY26-0027030

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Infrastructure Operations (IO)

Zero Trust and Post-Quantum Compute Encryption

Date: June 11, 2026

VA-FY26-0027030

PWS Version Number: 1.1 Disclaimer: The TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. This template is a means to simply assist the requiring activity in developing their requirements. It is the Requiring Activity’s responsibility to ensure the correctness of all requirements within their final Performance Work Statement Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Infrastructure Operations (IO), strives to provide high-quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to Veterans at the point of care, as well as throughout all points of the Veterans' health care continuum, in an effective, timely, and compassionate manner. The VA's ability to deliver on that mission depends on the integrity, availability, and confidentiality of its Information Management and Information Technology (IM/IT) systems, and those properties ultimately rest on the strength of the cryptographic infrastructure that protects them. IO is responsible for operating and securing the enterprise infrastructure, including data centers, networks, cloud platforms, and the cryptographic services layer, that every VA clinical and administrative system relies upon. The VA enterprise relies on Hardware Security Modules (HSMs) as the foundational cryptographic infrastructure for Public Key Infrastructure (PKI), Key Management Services (KMS), digital certificate operations, and third-party application cryptographic processing. The VA's HSM inventory consists of Federal Information Processing Standard (FIPS) 140-3 Level 3-valid, network-attached HSM appliances distributed across VA gateway locations and specialized application environments. These appliances support VA clinical and administrative systems, including the Veterans Health Information Systems and Technology Architecture (VistA), VA Enterprise Cloud (VAEC)-hosted workloads, and virtualization-based infrastructure supporting the VA's national network of data centers. The VA is executing a broad Zero Trust Architecture (ZTA) modernization program consistent with Office of Management and Budget (OMB) Memorandum M-22-09, "Moving the U.S. Government Toward Zero Trust Cybersecurity Principles," and the VA's own Critical Security Controls. HSM operations, encompassing key lifecycle management, partition management, PKI operations, and cryptographic services for all VA endpoints and applications, are designated core components of the VA's Zero Trust encryption posture. This designation places every cryptographic key, every key operation, and every application relying on HSM-backed cryptography within scope of the VA's Zero Trust program. The Contractor must approach this work accordingly, and the specific Zero Trust Critical Security Control requirements applicable to all systems and services delivered under this contract are set forth in Section 6.1.2. Concurrently, the emergence of quantum computing as a credible threat to classical cryptographic algorithms has made post-quantum cryptography (PQC) readiness a non-negotiable enterprise requirement. The National Institute of Standards and Technology (NIST) finalized the first three post-quantum cryptographic standards in August 2024: FIPS 203 (Module-Lattice-Based Key Encapsulation Mechanism, or ML-KEM), FIPS 204 (Module-Lattice-Based Digital Signature Algorithm, or ML-DSA), and FIPS 205 (Stateless Hash-Based Digital Signature Algorithm, or SLH-DSA). The Cybersecurity and Infrastructure Security Agency (CISA) published its initial list of hardware and software product categories supporting post-quantum cryptography in January 2026. All HSM infrastructure supported under this contract must be capable of adopting these standards through in-field firmware upgrades throughout the Period of Performance (PoP). This Performance Work Statement (PWS) establishes the requirements for a Contractor to provide comprehensive managed services, hardware sustainment, lifecycle support, professional services, and PQC upgrade capabilities for the VA's enterprise HSM infrastructure under the Zero Trust encryption program. Given the sensitive and mission-critical nature of this work, which involves direct stewardship of the VA's root cryptographic trust infrastructure, the Government places the highest premium on demonstrated expertise, and the qualifications required of all Contractor personnel reflect that standard. A subset of the VA's Hardware Security Module (HSM) inventory consists of legacy commercial-grade HSMs procured prior to the establishment of government-designated HSM product lines. These legacy appliances operate on firmware architectures that are incompatible with current government-designated HSM platforms, precluding direct cryptographic key migration through standard backup and restore mechanisms. These legacy assets have reached or are approaching vendor end-of-support status and are no longer candidates for ongoing maintenance contract coverage. The VA requires managed transition services to migrate all cryptographic key material off legacy unsupported HSMs to compliant, government-grade platforms prior to decommission, while simultaneously maintaining full continuity of Certificate Authority (CA) and Key Management Service (KMS) operations, including all enterprise CA-integrated certificate issuance and renewal operations, throughout the migration lifecycle.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

“Federal Information Security Modernization Act of 2014” Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019 FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004 FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006 FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974” Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm VA Directive 6102, “Internet/Intranet Services,” August 5, 2019 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”) VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion) VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023 VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”) VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025 VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”) VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 OIT Process Asset Library (PAL), OIT Process Asset Library.

One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024 VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024 VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017 VA Directive 6300, “Records and Information Management,” September 21, 2018 VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010 NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018 NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of Release 5.1.1, November 2023) VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014 OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005 OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019 OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008 Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov)) NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018 NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025 NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019 OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007 Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005 Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025 VA Directive 0057, “VA Environmental Management Program,” October 25, 2022 OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020 Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018 C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026 OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021 NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014 CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019 VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020 E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025 OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025 OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025 OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025 NIST FIPS 203, "Module-Lattice-Based Key-Encapsulation Mechanism Standard," August 2024 NIST FIPS 204, "Module-Lattice-Based Digital Signature Standard," August 2024 NIST FIPS 205, "Stateless Hash-Based Digital Signature Standard," August 2024 NIST IR 8547, "Transition to Post-Quantum Cryptography Standards," as updated National Security Agency, "Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)," including the CNSA 2.0 FAQ, as updated NIST SP 800-131A Revision 2, "Transitioning the Use of Cryptographic Algorithms and Key Lengths," March 2019 NIST SP 800-208, "Recommendation for Stateful Hash-Based Signature Schemes," October 2020 OMB Memorandum M-23-02, "Migrating to Post-Quantum Cryptography," November 18, 2022

SCOPE OF WORK

The Contractor shall provide comprehensive managed services, hardware sustainment, lifecycle support, professional services, and PQC upgrade capabilities for the VA's enterprise HSM infrastructure across the VA's national footprint of data centers, gateway locations, PKI environments, KMS platforms, and VAEC-connected deployments. All HSM solutions, managed service platforms, and associated tooling provided or operated under this contract shall comply with the Salient Characteristics defined in Section 3.1 of this PWS. . . This procurement is issued on a performance specification basis in accordance with FAR Part 11, as amended. . The Contractor shall execute all tasks within the overarching ZTA framework, ensuring that all cryptographic key operations, HSM partition management, certificate authority integrations, and managed services align with the VA's Zero Trust Critical Security Controls and enterprise ZTA program. All HSM hardware, firmware, and software operated or provided under this contract shall support NIST-standardized PQC algorithms, ML-KEM, ML-DSA, and SLH-DSA at a minimum, via in-field firmware upgrades without requiring full hardware replacement for currently deployed VA-owned assets where technically feasible. The qualification requirements for key personnel are detailed in Section 5.1.3 of this PWS. The Contractor shall deliver services across five primary task areas: Task 1, Project Management (Section 5.1); Task 2, HSM Hardware Sustainment and Maintenance (Section 5.2); Task 3, HSM Managed Services and Partition Lifecycle Management (Section 5.3); Task 4, Post-Quantum Cryptography Readiness and Upgrade Services (Section 5.4); and Task 5, Professional Services, Market Research, and Advisory Support (Section 5.5).

HSM Salient Characteristics Any HSM hardware or cloud-hosted HSM managed service platform delivered or operated under this contract shall meet or exceed all of the following minimum salient characteristics. These characteristics define the performance requirements and technical equivalency standards for this procurement.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be twelve months from the date of award, constituting the Base Year, with four twelve-month Option Periods, for a total potential PoP not to exceed sixty months. Each Option Period shall be exercised at the sole discretion of the Government and is contingent upon the availability of appropriated funds and satisfactory Contractor performance as assessed by the COR. Work at Government sites shall not take place on Federal holidays or weekends unless directed in writing by the CO. There are eleven Federal holidays set by law under United States Code (U.S.C.) Title 5, Section 6103 that the VA observes. When any fixed-holiday falls on a Saturday, the preceding Friday shall be observed. When any falls on a Sunday, the following Monday shall be observed.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at both VA facilities and Contractor facilities. On-site work, encompassing hardware installation, configuration, physical maintenance, rack-and-stack activities, on-site disaster recovery testing, and in-person technical reviews, shall be performed at VA-designated data centers and gateway locations within the continental United States (CONUS). Remote and off-site work, encompassing managed service monitoring, remote HSM administration, partition management, firmware upstaging, market research, and report preparation, may be performed at Contractor facilities or via VA-approved remote access methods (for example, Azure Virtual Desktop or VA-approved Virtual Private Network), with prior COR concurrence and in full compliance with VA Handbook 6500 remote access requirements. All remote access to VA systems, networks, and data shall be performed exclusively through VA-approved access methods. No VA data shall be processed, stored, or transmitted outside VA-approved environments without written CO authorization.

TRAVEL

The Government will not reimburse travel under this contract. All travel, transportation, lodging, per diem, and local transportation costs necessary for performance of this PWS, including on-site presence at VA facilities for hardware maintenance, key ceremonies, disaster recovery exercises, and technical reviews, shall be included in the Contractor's firm fixed price. The Contractor determines staff placement and the mix of on-site and remote performance, provided all on-site performance requirements, response times, and service levels of this PWS are met.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that documents the Contractor's approach, timeline, tools, resource plan, risk register, and communication strategy for all tasks under this contract. The CPMP shall address coordination of planned, routine, and ad hoc activities across all five task areas, including hardware maintenance scheduling, managed service Service Level Agreement (SLA) governance, PQC firmware upgrade sequencing, and market research cycles. The CPMP shall take the form of both a written narrative and a graphical schedule displaying milestones, dependencies, risks, and resource assignments. The initial baseline CPMP shall be approved by the VA Program Manager (PM) prior to becoming the controlling program document. The Contractor shall update and maintain the CPMP throughout the PoP and shall present updates to the COR at a minimum of once per quarter.

Deliverables:

A. Contractor Project Management Plan.

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic format. Each report shall reflect data as of the last day of the preceding month and shall address all work completed during the reporting period, work planned for the subsequent period, HSM fleet operational status and availability metrics, partition utilization data, open trouble ticket status and resolution actions, firmware and patch deployment status by device type and location, PQC readiness milestone progress, any staffing changes, and Government Furnished Property (GFP) status. The Contractor shall organize each Monthly Progress Report with discrete, clearly labeled sections corresponding to each task area (Sections 5.1 through 5.5) and each embedded sub-report (including the Firmware and Patch Status Report required under Section 5.2 and the Partition Provisioning and Decommissioning Records required under Section 5.3), so that the COR can review and assess performance by task area without navigating a monolithic document. The Contractor shall identify all problems encountered during the reporting period and shall provide written resolution plans with target completion dates. Where deviations from the CPMP baseline have occurred, the report shall explain the cause, impact, and corrective action plan. The Contractor shall maintain open communication with the VA PM and COR throughout the PoP to ensure issues are surfaced and addressed before escalation becomes necessary.

Deliverables:

A. Monthly Progress Report.

Key Personnel Qualifications and Expertise Requirements The Government recognizes that the successful performance of this contract depends entirely on the expertise of the individuals assigned to it. The HSM environment supporting the VA's enterprise cryptographic infrastructure is among the most sensitive and technically demanding environments in the federal government. Accordingly, the Contractor shall assign only personnel with deep, demonstrated expertise in enterprise HSM operations, federal cryptographic compliance, and PKI or KMS architecture to tasks under this PWS.

The positions identified in this section are designated as Key Personnel under VAAR 852.237-75 and are considered essential to contract performance. Key Personnel shall not be reassigned, replaced, or removed from the contract without at least thirty calendar days' prior written notice to the CO, along with a written justification and a proposed replacement who meets or exceeds the qualifications of the individual being replaced. The Contractor shall submit, with its proposal, detailed resumes and narrative statements of qualifications for each Key Personnel position that affirmatively demonstrate how each individual meets the stated requirements. Resumes alone are insufficient. The Contractor shall provide specific examples of relevant prior work, including the employing organization, scope of engagement, technologies involved, and the individual's measurable contribution.

In addition to the Key Personnel requirements above, all other Contractor personnel assigned to perform technical tasks under this contract, including subcontractor personnel, shall possess credentials and experience commensurate with the specific task to which they are assigned. The Contractor shall include in its proposal a staffing plan that describes the qualifications of all proposed technical staff and shall demonstrate that the proposed team collectively possesses the expertise required to execute all five task areas.

Quality Control Plan The Contractor shall develop, maintain, and execute a Quality Control Plan (QCP) describing the Contractor's own processes for ensuring that all services under this contract meet the requirements of this PWS. The QCP shall define how the Contractor will identify, prevent, and correct defective or nonconforming service before it affects VA operations, including the inspection methods, self-assessment schedule, performance data the Contractor will track against the metrics in Section 6.4, root-cause analysis approach, and corrective-action process the Contractor will use. The QCP is the Contractor's internal quality program and is separate from the Government's surveillance under the Quality Assurance Surveillance Plan. The Contractor shall deliver an initial QCP for VA review within thirty calendar days after award, shall obtain VA Program Manager acceptance before it becomes the controlling quality document, and shall maintain it as a living document throughout the period of performance, updating it when processes, staffing, or service scope change.

Deliverables:

A. Quality Control Plan.

HSM Hardware Sustainment and Maintenance The Contractor shall provide comprehensive hardware sustainment and maintenance services for all VA-owned HSM assets identified in the GFP Inventory List (Attachment A, provided at contract award) across all VA gateway locations and designated data centers. Sustainment under this task encompasses the full range of activities required to keep the VA's cryptographic hardware in continuous, compliant, mission-ready operation throughout the PoP, including break-fix support, preventive maintenance, firmware and software patching, spare parts management, and hardware lifecycle planning.

Hardware Maintenance Coverage The Contractor shall maintain active OEM-backed or OEM-authorized hardware maintenance agreements for all VA-owned HSM assets throughout the PoP. Coverage shall include 24×7×365 hardware break-fix support with a four-hour on-site response time for Priority 1 (P1) critical outages affecting VA production cryptographic operations and next-business-day response for Priority 2 (P2) and Priority 3 (P3) issues. For VA sites designated by the COR as geographically remote, the Contractor shall initiate remote diagnostic remediation within one hour of P1 notification, with on-site follow-up within the next business day. The Contractor shall provide on-site repair or advance hardware replacement using equivalent FIPS 140-3 Level 3-valid replacement units for any failed appliance, maintaining no reduction in partition count, key capacity, or interface compatibility relative to the failed asset. All hardware replacement units shall meet or exceed the Section 3.1 Salient Characteristics.

The Contractor shall provide comprehensive hardware maintenance coverage for the Government furnished HSM fleet identified in Attachment A, Government Furnished Property Inventory, assuming full maintenance responsibility for that equipment, in its as-found configuration and firmware level, upon completion of Transition-In. Coverage shall include the network HSM appliances and their associated backup HSM units and administration kit components at the locations specified in Attachment A.

Maintenance coverage shall operate twenty-four hours a day, seven days a week, with OEM-backed support entitlements, advance parts replacement, and on-site response within four hours for critical hardware failures affecting production cryptographic services. The terms of coverage shall be documented in the Hardware Maintenance Agreements and kept current at each option period exercise.

Defective hardware shall be dispositioned in full compliance with NIST SP 800-88 Rev. 1 media sanitization requirements and the VA's data destruction protocols. Written certificates of destruction shall be provided to the COR within ten business days of disposition. The Contractor shall maintain a VA-approved spare parts and replacement unit inventory sufficient to meet all response time SLAs across all deployment locations and shall document that inventory in each Monthly Progress Report. All maintenance activities shall be executed under formal VA change management approval prior to implementation, coordinated with the VA Information System Security Officer (ISSO) and COR.

Firmware and Software Patching The Contractor shall track, plan, test, and implement all firmware, cryptographic library, and software updates for all VA HSM assets, applying OEM-issued security patches and cryptographic library upgrades within the timeframes established by the VA OIT and consistent with CISA BOD 22-01. Patching response timelines by severity level are as follows: Critical severity patches listed on the CISA Known Exploited Vulnerabilities (KEV) catalog shall be applied within fifteen calendar days of OEM or CISA advisory, consistent with BOD 22-01; Critical severity patches not listed on the KEV catalog shall be applied within thirty calendar days; High severity patches within thirty calendar days; Medium severity patches within ninety calendar days; and Low severity patches at the next scheduled maintenance window unless otherwise directed by the COR. Prior to deploying any firmware or cryptographic library update, the Contractor shall verify the authenticity and integrity of the update package using the OEM cryptographic signature and shall not deploy any package that fails verification.

The Contractor shall coordinate with the VA ISSO and COR through the VA's formal change management process prior to deploying any firmware or software updates to production systems. The Contractor shall maintain a current firmware and software baseline inventory for all VA HSM assets, including active FIPS 140-3 CMVP validation certificate numbers for each device. This inventory shall be updated monthly and included as a discrete section within each Monthly Progress Report. FIPS 140-3 Level 3 compliance shall be maintained for all VA HSM assets throughout the PoP, including after any firmware or software updates.

Hardware Lifecycle Planning At the beginning of each option period, the Contractor shall deliver a Hardware Lifecycle Assessment covering the current condition and firmware status of all GFP assets, remaining OEM support life by asset, FIPS 140-3 CMVP certificate status and any pending recertification timelines, recommended refresh or upgrade timelines with a high, medium, or low priority ranking based on risk to VA cryptographic operations and the salient characteristics in Section 3.1, PQC firmware upgrade feasibility by asset (identifying those that can be upgraded in-field versus those requiring hardware replacement), and fully loaded cost projections for any recommended refreshes. Any hardware refresh proposed under this contract shall meet or exceed all Salient Characteristics in Section 3.1. The assessment shall be prepared by the Lead HSM Engineer and reviewed and signed by the Program Manager before submission.

Legacy HSM Key Migration Services The Contractor shall provide all technical services, planning, tooling, and execution support necessary to migrate cryptographic key material from VA-owned legacy commercial HSMs that are incompatible with current government-grade HSM firmware to compliant, government-designated replacement platforms. Legacy migration scenarios include environments where standard backup and restore mechanisms are unavailable due to firmware version incompatibility between source and destination HSM platforms, and where key material is not flagged as exportable under the source platform's security policy. This task shall be treated as the highest-priority deliverable within Task 2 due to the active operational impact of unsupported legacy assets on VA cryptographic continuity. Migration shall include secure key export, transfer, and import using validated, VA-approved methods. Where the source platform does not permit secure key export, the Contractor shall coordinate re-key or re-issuance with the VA rather than any method that bypasses the source platform's security controls. Any temporary key escrow required during migration shall follow VA-approved federal key-management guidance and shall be time-bound and access-controlled. The Contractor shall conduct pre-migration and post-migration validation testing to confirm key integrity, availability, and correct cryptographic operation before retiring the source key material, and shall provide the results to the COR and VA ISSO.

The Contractor shall:

(a) Conduct a Legacy Migration Feasibility Assessment within 30 calendar days after contract award (DAC) that identifies each legacy HSM asset, documents its firmware baseline, evaluates all available migration pathways, including physical hardware key transport devices, and determines whether additional migration-enabling hardware (e.g., portable backup modules or hardware key transport devices compatible with both legacy commercial and current government-grade HSM platforms) is required to facilitate cryptographic key transfer between incompatible platforms. The assessment shall identify the specific hardware models and connection interfaces (e.g., Universal Serial Bus (USB)-attached backup transport modules) required and shall include a cost and lead-time estimate for each recommended procurement action.

(b) Identify, recommend, and if directed by the Contracting Officer's Representative (COR) in writing, procure or facilitate procurement of any migration-enabling hardware necessary to bridge incompatible HSM firmware environments. All such hardware shall be Trade Agreements Act (TAA)-compliant per Section 6.13.1, shall not introduce proprietary lock-in to any specific HSM manufacturer, and shall be documented in the Government Furnished Property (GFP) inventory upon receipt by the Government.

(c) Execute key migration activities only after written COR and Information System Security Officer (ISSO) authorization, and only after a tested rollback plan, including a verified backup of the pre-migration cryptographic key state, has been documented and approved by the VA Program Manager (PM).

(d) Ensure that the VA's PKI CA and KMS operations, including all enterprise CA-integrated certificate issuance and renewal operations, experience zero service interruption during and after all migration activities. All CA platform integrations operational prior to migration shall be fully validated on the destination platform before the legacy HSM is decommissioned.

(e) Provide written confirmation of key integrity validation on the destination platform and cryptographic key zeroization of each source legacy HSM within 10 business days of each migration event, consistent with National Institute of Standards and Technology (NIST) Special Publication…