RFI-USPTO-PQCR-FY25.pdf

Post-Quantum Cryptography Resilience

(PQCR)

Request for Information (RFI)

Table of Contents

INTRODUCTION

DISCLAIMER AND NOTICE REGARDING CONTRACT AWARDS

BACKGROUND

OBJECTIVES…………………………………………………………………………………………….5-7

SUBMISSION REQUIREMENTS…………………………………………………………………………8

INTRODUCTION

The USPTO is conducting market research on potential industry solutions and best-practice approaches to preparing for near-term for Post-Quantum Cryptography (PQC) and surveillance, in alignment with Zero Trust Architecture (ZTA) plans and solutions already underway. Like

Y2K, the world knows that a potentially disruptive future event is inevitable. Unlike Y2K, “Day

Qu” is unknown; the precise day that a cryptographically significant quantum computer (Qubit processor) is available to solve encryption decoding problems in minutes that currently take millions of years.

Also, unlike Y2K, the devastating impacts to data security, national security and business integrity, including the Intellectual Property Protections that the USPTO is required by law and professional integrity to provide, are substantially foreseeable and inevitable for the unprepared.

Accordingly, USPTO endeavors to apply due diligence in establishing and acting upon a near-term roadmap for achieving and maintaining PQC Readiness (PQCR). To do so, there must first be an understanding of the capabilities within the market to satisfy PQC needs at USPTO.

DISCLAIMER AND NOTICE REGARDING CONTRACT AWARDS

The purpose of this RFI is to assist USPTO in conducting market research focused on identifying companies who offer Post-Quantum Cryptography services and products. This document is not a Request for Proposal (RFP) or Request for Quotation (RFQ), or a promise to issue an RFP or RFQ in the future. There is no USPTO commitment or implied agreement or understanding as a result of Government action or inaction taken in response to the RFI or the accompanying documents or attachments. This RFI does not commit the Government to contract for any supply or service whatsoever. The information provided in the RFI is subject to change and is not binding on the Government.

Participation in this process is strictly voluntary. No entitlement to payment will arise as a result of the submission of a response to the RFI or the response to any questions that the

USPTO may ask as a result of the submission. The UPSTO will not incur or reimburse any costs for the submission of responses or activities associated with the preparation or response to this RFI, including responses to any follow-up information or action requested by the Government. Responders are advised that the USPTO is not liable for and will not pay for any information or direct, indirect, or administrative costs incurred in responding to this RFI. The USPTO has not made a commitment to procure any of the items discussed, and release of this RFI may not be construed as such a commitment or as authorization to incur cost for which reimbursement would be required or sought. Response to this RFI is not a request to be added to a bidders list. All submissions become Government property and will not be returned, but will be handled in accordance with applicable proprietary markings.

The USPTO may use the results obtained from this RFI to support one or more future procurements. Additionally, the USPTO may use the results obtained from this RFI to make a small business set-aside determination. This means that if you are a small business and you are able to provide the content described below, your response may be critical in determining whether to set aside any future requirement in part or in total for small businesses. Any small business provider of the content described in this document is strongly encouraged to respond to this RFI.

Background:

USPTO is conducting market research on PQCR offerings to determine the availability, expertise and maturity among both integrators and technology companies to provide comprehensive solution development, design, planning, best-practice consulting. and implementation support to best prepare the USPTO to meet the real-world threats of PQC and related ongoing cyber security vulnerabilities, threats, and mandates.

USPTO’s current efforts are both comprehensive and rapidly maturing, aimed at ensuring a consistent and effective cyber security posture across all enterprise infrastructure and business systems. This includes custom or native cloud services and hosting solutions that support the

USPTO business enterprise, with a particular focus on safeguarding business and personally sensitive data. However, ZTA components, and especially PQC vulnerabilities, span multiple disciplines, service areas, technologies and teams which imposes constraints that result in vertical rather than integrated delivery.

Cryptographic inventories, mandated by OMB and accomplished by government agencies, including the USPTO, have been time-consuming, manual, incomplete and difficult to track. The complexities discovered in addressing legacy cryptography and key management challenges are significant, along with the anticipated rate of change required for PQCR.

The USPTO considers of paramount importance of:

• The agility required for effective continuous discovery, remediation and solution modification and implementation

• The ability to apply solution changes and controls across all current security boundaries serving the USPTO business and IT infrastructure enterprise, regardless of delivery environment.

Based on current understanding of the threat and the activities of NIST and DHS/CISA, the rapid changes ahead seem inevitable and substantial for achieving effective PQCR. Orchestration and agility seem to be inevitable components for both near-term enablement and future scalability, as new methods and standards emerge to meet an escalating challenge.

ZTA efforts, already underway, are likewise best described as incremental and specialized in terms of implementation by a disparity of (mostly) infrastructure teams. A greater degree of integrated solution architecture design and planning, informed by emerging PQCR methods and practices, would benefit the USPTO in aligning its investments, teams and priorities end-to-end.

Objectives:

USPTO seeks feedback to enable construction of a PQCR defensive roadmap. This roadmap would incorporate a comprehensive, integrated solution approach that would enable the effective surveillance, remediation and management of its cyber security operations and controls posture, applying known and emerging best-practices near-term, but also informed by the future capabilities and threats of post-quantum computing.

Please provide your input on the following objectives:

• Diagram(s) within the fifteen (15) page limit as aids to briefly describe your solutions and recommendations.

• If your recommendations include proofs of concepts, prototypes, pilots or similar limited engagements, please indicate the size and duration of such efforts and the expected value to meeting near-term and emerging cyber security threats, mandates and agility goals.

• Please cite any current authoritative mandates (OMB, CISA, etc.) or guidance (NIST, industry sources, university or in-house experts, etc.) your recommendations would enhance or enable in earnest (cyber security vs checkbox compliance).

• Discuss why you believe that your company or partnerships are best suited to advise governments and critical industries on the capabilities and threats of quantum computing, and cite examples of your participation in national or international forums of such caliber.

• Demonstrate how your approach addresses PQCR concerns across traditional verticals

(operational boundaries and technology boundaries), including community engagement.

• Discuss and demonstrate how your solution or approach serves to enhance the effectiveness and consistent implementation or integration of ZTA delivery and controls that legitimately move us beyond layered, often environment or service-dependent perimeter controls and how your recommendations incorporate the agility and scale required to manage changes associated with emerging PQCR practices and standards.

• Include consideration for leveraging and/or orchestrating across the typical management solutions, devices, components, services layers and teams commonly in place or emerging as a result of ZTA priorities and mandates in addition to cyber operations and continuous monitoring (to include cryptography versions deployed)

• Describe how your solution compares with the state of the PQCR industry today, including your basis of analysis; which categories are critical and how you provide coverage (crypto agility, hybrid key exchange, orchestration, quantum surveillance detection and remediation, etc.)

What we are looking for:

We are looking for information on comprehensive recommendations that can meet the above objectives. Please also be sure that your response addresses the following:

1) Cyber “ecosystem” for ZTA/PQCR, leveraged by teams vs. deployed by teams.

2) Describe the shortest path to a PQCR roadmap that enhances ZTA objectives and cyber agility, to include the detection and alerting of quantum surveillance.

3) Migration strategy that includes critical stakeholder engagement and organizational change in addition to adjustments in technologies, methods, practices and potentially investment priorities.

4) Demonstrates the likelihood of cloud vs. hybrid, agency vs. FedRAMP shared service applications, integrations in meeting reasonable (but aggressive) timelines.

5) Assists USPTO in answering potential inquiries on agency PQCR plans, budgets, contract types, pricing and invoicing methods.

6) Given the time-consuming and incomplete nature of cryptographic inventories, mandated by OMB, and the significant complexities in addressing legacy cryptographic and key management challenges, how are you planning to streamline these processes?

Additionally, how do you anticipate managing the required rate of change for Post-

Quantum Cryptography Resilience (PQCR) within your current infrastructure?

Please include as much information as possible about the procurement considerations noted below:

1) Relevant GSA Schedules where your company offers this product, if applicable.

2) Other relevant ordering vehicles where your company offers this product, if applicable. If your product is available through another agency vehicle that does not permit inter-agency ordering please explain.

3) Points of contact for questions.

4) Confirmation of registration in SAM.gov (or an acknowledgement that you are not registered in SAM.gov).

5) Please identify the NAICS code that most closely aligns to your proposed solution and use this

NAICS to define your small business size status as requested above.

6) Please identify any barriers to competition that would prohibit you from competing in this space.

7) If your product is not available on a GSA Schedule or other ordering vehicle, would you consider partnering with a Government-wide ordering vehicle to streamline a potential order?

8) Is the product Section 508-compliant? If not, what steps are necessary in order to become Section 508-compliant?

9) Please identify which objectives can be met by your company alone or if you require teaming/subcontracting with a partner. If teaming/subcontracting is required, please identify which objectives are satisfied by that teaming/subcontractor partnership.

10) Have you partnered with other vendors, research institutions or Federal Agencies in the development or deployment of post-quantum cryptography solutions? Please provide details about these collaborations, including:

□ Roles of each partner

□ Outcomes achieved

□ Solutions developed

11) Describe any post-quantum cryptography (PQC) solutions you have implemented, or are in the process of implementing, for other Federal Agencies. Include specific examples of projects or contracts, the scope of your PQC deployment, the types of cryptographic systems addressed, and any associated challenges or lessons learned.

12) Please select all that apply:

□ Woman-Owned Small Business (WOSB)

□ Economically Disadvantaged Woman Owned Small Business (EDWOSB)

□ Veteran-Owned Small Business (VOSB)

□ Service-Disabled Veteran-Owned Small Business (SDVOSB)

□ Small Business (SB)

□ SBA Certified Small, Disadvantaged Business (SDB)

□ SBA Certified 8(a) Business

□ SBA Certified HUBZone Business

□ Other-than-Small

SUBMISSION REQUIREMENTS

Response Package:

General: The USPTO requests capability statements submitted in one PDF file from vendors who are able to provide products which meet the objectives described below. There is a fifteen

(15) page limit but no formatting or other restrictions on your response other than the cover page, and you may include charts, diagrams, video links, and any other information that you wish in the response. Upon request, the vendor may be invited to demo the product/solution. Please note that a generic capability statement response is not helpful and will not be reviewed. The USPTO seeks Cloud-based commercial off the shelf or custom products and implementation services which satisfy the objectives below.

Cover Page: Please include the following information on your cover page:

• Company name, address, Cage Code, and DUNS number or Unique Entity ID (if you do not have a DUNS please note).

• Company small business status (e.g., WOSB, SDVOSB, 8(a), HUBZone, etc.). If your company is an SBA-Certified 8(a) company, include the date of the SBA 8(a) expiration date. Please include “OTSB” if you are not a small business concern (see NAICS note below).

All questions related to this RFI are required to be submitted via email to the Contracting Officer

Donald Nusbaum at donald.nusbaum@uspto.gov no later than Wednesday, October 23 at

1:00pm ET.

All submissions are required to be submitted via e-mail to the Contracting Officer Donald

Nusbaum at donald.nusbaum@uspto.gov. Responses shall be submitted no later than

Wednesday, November 6 at 1:00pm ET.

Please add the title “RFI-USPTO-PQCR-FY25” in the subject line for all questions and submissions.

mailto:donald.nusbaum@uspto.gov mailto:donald.nusbaum@uspto.gov