FPKI_MRAS_RFIquestions.xlsx
XLSX spreadsheet 13 KB Posted
- Attached to
- Federal Public Key Infrastructure Management Authority (FPKIMA): Request for Information and Source Sought
- Solicitation number
- 47QTCB24N0005
- Issued by
-
GSA Federal Acquisition Service
About this file
This document contains a Request for Information (RFI) and a Sources Sought notice issued by the General Services Administration (GSA) Federal Acquisition Service. The purpose is to gather market information on the capabilities of vendors to provide support and operations for the Federal Public Key Infrastructure Management Authority (FPKIMA).
The key details are:
- The FPKIMA provides centralized operation and support of the Federal Public Key Infrastructure (FPKI) for the federal government.
- The RFI asks vendors 28 detailed questions covering their experience in areas such as PKI operations, certificate management, cybersecurity, and disaster recovery procedures.
- The Sources Sought notice states this is for market research only and does not constitute a Request for Proposal at this time.
- The responses will help GSA understand vendor capabilities to potentially support future FPKIMA requirements.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI_Sources Sought_ FPKI Technical and Operations Support.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Questions for FPKIMA Support Re-compete RFI/MRAS | |
| Technical | |
| 1 | Do you have experience operating and maintaining a PKI? Please describe any experience operating and maintaining a root and/or bridge certificate authority (CA). |
| 2 | Do you have experience developing and implementing a publicly trusted certificate authority (CA) services? If so, please describe the experience. |
| 3 | Do you have experience developing and maintaining a certificate policy (CP) and certificate practice statement (CPS)? Please explain. |
| 4 | Please describe experience with hardware security module (HSM) integrations. |
| 5 | Please describe experience with generating certificate revocation lists (CRLs). |
| 6 | What tools or interfaces would you provide for certificate management? |
| 7 | Do you have any recommendations for how to enhance PKI services and infrastructure? |
| 8 | What emerging technologies or innovative ideas should the Government be considering when developing its PKI support requirements? |
| 9 | How are you planning for post quantum cryptography (PQC)? |
| 10 | What policies, standards, guidelines are you familiar with? |
| HSPD-12? | |
| U.S. Federal Public Key Infrastructure (FPKI)? | |
| CA/Browser Forum? | |
| If not familiar with the identified policies, is this something your company could be familiar with and implement? | |
| 11 | How do you handle key ceremonies and backup key management? |
| 12 | Would your organization have the ability to handle situations that occur after duty hours as this is a 24/7 365 operation? |
| 13 | What is your organization's experience in maintaining a Government Owned, Contractor Operated (GOCO) System? |
| Contract | |
| 14 | Have you been awarded a contract vehicle where your company can provide FPKI support? |
| 15 | Will your company need to subcontract various positions in order to meet the Government's requirements? If so, what percentage will be employees and what percentage will be sub-contractors? |
| 16 | Does your company possess the expertise to ensure a successful contract transition within 180 days of award? |
| Security: | |
| 17 | What cybersecurity tools would be used to monitor the network for cybersecurity vulnerabilities or issues? |
| 18 | Do you monitor the NIST National Vulnerability Database (NVD) to identify any known cybersecurity vulnerabilities or issues? |
| 19 | If a DDoS were to occur, how would your organization respond? |
| 20 | What Supply Chain Risk Management (SCRM) practices are implemented to ensure compliance? |
| 21 | What measures would you take to ensure data integrity in repositories? |
| 22 | How do you protect against unauthorized access to the CA infrastructure? |
| 23 | What is your incident response process for CA-related incidents? |
| 24 | What are your disaster recovery procedures for CA services? |
| 25 | How quickly can you restore services in case of an outage? |
| 26 | Does your company have experience in handling 3-year Authority to Operate (ATOs) based on NIST SP 800-53? If so, briefly explain your process/methodology. |
| 27 | Is your company familiar with managing High Value Assets (HVA’s)? |
| 28 | Do you have experience managing a contract that covers multiple geographically separated locations? |
https://www.dhs.gov/homeland-security-presidential-directive-12https://www.idmanagement.gov/fpki/https://cabforum.org/
File details come from the government source that posted it. Updated .