RFI-USPTO-PQCR-FY25 Government Response to Vendor Questions.xlsx
XLSX spreadsheet 33 KB Posted
- Solicitation number
- RFI-USPTO-PQCR-FY25
About this file
This document is a Request for Information (RFI) from the U.S. Patent and Trademark Office (USPTO) regarding Post-Quantum Cryptographic Resilience (PQCR). The RFI seeks recommendations and inputs from industry on establishing a roadmap and approach for migrating to post-quantum cryptographic solutions to protect against emerging quantum computing threats.
Key details include:
- The USPTO is looking for guidance on integration with existing Zero Trust Architecture (ZTA) initiatives, balancing quantum surveillance capabilities with traditional cybersecurity measures, managing organizational change, and establishing KPIs to measure the effectiveness of PQCR implementations.
- The USPTO is open to hybrid solutions integrating existing tools with quantum-resistant technologies, and is considering the balance between agency-specific solutions and FedRAMP shared services.
- The USPTO is seeking input on orchestration across infrastructure and security teams, compliance with emerging standards and frameworks, and the importance of Section 508 compliance for PQCR solutions.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI-25-PQCR-FY25 Government Response to Vendor Question 2.xlsx | XLSX spreadsheet | |
| RFI-USPTO-PQCR-FY25.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFI-25-PQCR Vendor Q's
| No. | Questions | Government's Response |
| 1 | Written like a market probe of USPTO vs questions about what we are looking to achieve | These questions are not appropriate for an RFI. |
| 2 | The RFI references "The agility required for effective continuous discovery, remediation and solution modification and implementation". Is it the Government's intent to implement continuous monitoring of cryptography, meaning real time, as apposed to scheduled monitoring? | USPTO is looking for recommendations in the RFI stage, but will generally align with CISA standards / guidance for integration with CDM monitoring and reporting frequencies. |
| 3 | Does USPTO plan to align or incorporate ZTA or PQCR approaches and/or solutions from the Department? | The USPTO will make best use of resources and vehicles available in designing solutions, but this RFI is seaking recommendations for a comprehensive approach to preparing for PQC threats, and establishing a roadmap. You tell us. |
| 4 | How does the USPTO envision integrating PQC efforts with its existing Zero Trust Architecture (ZTA) initiatives, | The primary RFI objective is to seek advice for establishing plans and a roadmap, including integration with / recommendations for planning with ZTA efforts in mind. We don't want to travel a ZTA path that PQC derails. |
| 5 | Are there specific ZTA tools or frameworks currently in use that we should align with in our PQC recommendations? | We believe that emerging PQC standards and CISA's focus on PQC tools may modify ZTA vs the other way around. What framework do you recommend to facilitate PQC and why? |
| 6 | The RFI mentions challenges in addressing legacy cryptographic systems. Can you provide more details on the types of cryptographic systems currently in use at USPTO that will need to transition to PQC? | The challenge that every agency has is identifying and remediating legacy cryptography and/or legacy options in negotiating encyrption methods for key exchange (example). This pattern is already a dynamic challenge to manage, and will only increase with PQC resilience / threat defense. |
But the use of the term "cryptographic system" in the RFI was in the context of you telling us what systems (or methods) you've implemented or supported in the past as a company in order to understand the range of challenges and solutions you have navigated in referencable contracts.
| 7 | Is there a specific roadmap or timeline for migrating these legacy systems to PQC-compliant standards? | A primary purpose of the RFI is to help the USPTO understand urgency, approach …and the advisable roadmap for getting started and remaining current in preparing for and managing the PQC challenge. We are looking for those inputs from industry. We would anticipate that milestones and schedule goals would result from the advice and guidance of an expert contractor or consultant. |
| 8 | The RFI emphasizes the need for quantum surveillance detection. Could you clarify the type of quantum surveillance threats USPTO anticipates and the expected requirements for detection tools? | The government is seeking your input for the kinds of quantum surveillance threats that we should prioritize and the timing and potential tools / methods we might employ against a roadmap and approach that you advise. |
| 9 | How should we approach balancing quantum surveillance capabilities with other traditional cybersecurity measures? | You should be telling us. If this is a good question to ask, the RFI gives industry an opportunity to answer it, citing rationale, trends, experience, capability, etc. |
| 10 | How does USPTO intend to manage the organizational change required to adopt PQC across all divisions? Are there specific internal stakeholders or teams we should consider for early engagement in the roadmap development? | How would you advise us in terms of stakeholder dicovery, classification, prioritization, etc.? |
| 11 | Given the complexities in cryptographic inventories, are there specific tools or platforms currently being used to manage this inventory, or is the USPTO open to adopting new solutions as part of this process? | Crypto agility is very much within USPTO target objectives, and considered an imperative for establishing and maintaining PQC-capable or compliant cryptography, authentication methods and related, preferrably automated discovery, notification and/or remediation. Inventory and change management is largely automated or at least limited to stand-alone tool sets by team. |
| 12 | What is the expected rate of cryptographic updates (i.e., how frequently will changes need to be implemented to maintain compliance)? | This is something we will need to quantify over time, but would be interested in industry estimates, bases of estimates, sources/refernces and rationale. In short, what do you think? |
| 13 | Is the USPTO leaning more toward a cloud-based, hybrid, or on-premises approach for PQC resilience? If hybrid, are there specific integrations or use cases we should focus on? | The USPTO is seeking exactly this kind of input from industry, primarily based on the state of the market and the kinds of changes / capability gaps PQCR is likely to demand. We are asking you… |
| 14 | How does the USPTO intend to navigate the balance between FedRAMP-compliant cloud services and in-house systems when transitioning to post-quantum cryptographic solutions? | This is what a roadmap would guide us in discovering and deciding. Recent FeedRAMP Program policy changes may accommodate emerging capabilities to solve this unique problem, almost certain to be hybrid in nature. But again …this is the opportunity for you to tell us what we should expect and why. |
| 15 | Are there specific Key Performance Indicators (KPIs) or benchmarks the USPTO will use to measure the effectiveness of PQC implementations (e.g., time to detect, response time, reduction in cryptographic vulnerabilities)? | We assume that any measures we have in place now will be inadequate to keep up with the rate of change and disparity of indicators that separate asymetric cryptography methods vs. the duynamic capabilities of latice-based processing in terms of decrypting data and/or key negotiations ...and so on. Show us how you understand the problem and how we should prepare to approach a defensive roadmap. |
| 16 | CNSA 2.0 and CMMC 2.0 provide Governance and industry guidance on moving towards post-quantum digital signatures and cryptography, and ensuring a good framework for cyber resilience. Can you provide USPTO-specific context as to whether PTO will abide these recommendations and timeframes, potentially accelerate them, or perhaps lag them? Are there any additional Government, industry, and other standards and guidelines that USPTO can envision as being particularly important to the types of data and cyber threats that USPTO may face, and are needed to more thoroughly protect proprietary patent data? | The USPTO will consider all sources deemed qualified / relevant in wiething decisions along these lines, but certainly make every effort to align with OMB mandates, CISA and NIST standards and reporting requirements …and so on. Making the case for any decision and associated funding will be very much in scope for initial engagements coming out of research and discovery phases. Tell us how to get started and why / how fast (when is it too late, for what vulnerability, etc.?). |
| 17 | For planning and budgeting, will there be any preference for certain contract types (e.g., fixed-price, T&M) for implementing PQC solutions? | Acquisition strategies will be based largely on our assessment of industry, in part based on tools like the RFI process. How should we evaluate a source or sources? Convince us. |
| 18 | ZTA Alignment: Could you clarify how the USPTO defines success for Zero Trust Architecture (ZTA) when integrating post-quantum cryptography solutions? Are there specific metrics or performance indicators you use to assess the effectiveness of ZTA deployments? | Tell us how we should be thinking about this challenge in terms of measuring and managing effectiveness. Do we have enough PQCR guidance in place to inform ZTA solutions and integration? |
| 19 | Quantum Surveillance Detection: Could you provide more details on the USPTO's expectations regarding quantum surveillance detection? Is there a current framework or toolset you are using, or are you looking for entirely new solutions? | We are simply aware that quantum methods and target patterns of surveillance will differ from those subject to binary processing. NIST is looking into this problem. What is your understanding and advice? |
| 20 | Quantum Data Protection: Could you clarify the types of data the USPTO aims to protect from post-quantum threats—structured, unstructured, or both? Additionally, does the PQCR strategy prioritize data protection at rest, in transit, or across the entire data lifecycle? This would help us better align our recommendations for securing USPTO’s sensitive business and personal data in accordance with your ongoing Zero Trust Architecture (ZTA) efforts. | Our encryption requirements and objectives are based on federal mandates, ZTA certainly modifying legacy requirements. It's not about what we are doing now or think we should do. This is your chance to advise us, provide rationale, cite regulatory statutes or best practice. |
| 21 | Cryptographic Inventory Process: Given the complexity of addressing legacy cryptography and key management, what key pain points has the USPTO experienced with cryptographic inventory that should be specifically addressed in a PQCR solution? | Pain is a measurement of what has become normal. What should we be doing if we are serious about PQCR / defense? |
| 22 | Proof of Concepts: Regarding the submission of proofs of concepts (POCs) or prototypes, is the USPTO open to hybrid solutions (integrating existing tools with quantum-resistant technologies), or are you primarily looking for standalone solutions? | Any proposal for demos and prototypes should be presented in the context of an advisable roadmap, approach, priorities, etc. Tell us what we are solving, why, how we will leverage it going forward, how it helps us accelerate capability, etc. |
| 23 | Agency vs. FedRAMP Applications: Could you provide more insight into how the USPTO envisions the balance between agency-specific solutions and FedRAMP shared services in a PQCR roadmap? Will USPTO be willing to sponsor solutions through FedRAMP? Or will solutions be expected to go through the classic USPTO on-prem ATO process? | Every "system" must be defined and the controls employed docuemented, tested, etc. for approval to operate. Therefore, the system boundary(ies) and the complexity of the challenge will guide our recommendations and decisions. |
We see the PQC challenge as emerging, although we think there are things we could be doing now to harden against and prepare for dynamic changes. We anticipate some uncomfortable decisions along the way in terms of protecting IP / data vs. protecting typical ATO risk assessments and determinations.
| 24 | Stakeholder Engagement: Could you elaborate on the desired level of stakeholder engagement throughout the PQCR deployment? Are you looking for a phased implementation that can be quickly adapted based on changing PQC standards? | Who needs to fund, adopt, change, leverage platforms (by mandate), build into code, when on the roadmap …and so on? We are asking you! |
| 25 | Orchestration Across Teams: Can you specify the degree of orchestration required across infrastructure and security teams? Should the PQCR solutions integrate deeply with existing cybersecurity operations, or is a more modular approach preferred? | We need to improve integration across teams, and preferably automation …all the while keeping in mind the separation of duties. Orchestration and automation ~seem like inevitable methods of ensuring consistency across team and system boundaries, regardless of source solution or repositories. |
| 26 | Compliance Mandates: While the RFI mentions OMB and NIST guidelines, are there any specific emerging standards or frameworks that the USPTO expects the vendors to follow? | We are looking for vendors who are in position to know to recommend governemnt or industry frameworks and practices, in addition to aligning with OMB, CISA and other policy mandates. |
| 27 | Section 508 Compliance: How important is Section 508 compliance in the context of the PQCR solutions you are seeking? Is this a mandatory requirement for all proposals? Given the new emergency of PQCR capabilities, many solutions to not yet have fully robused Section 508 compliance capabilities. What is the tolerance for partial solutions, knowing that such capabilities are roadmapped? | We have asked for information vs. a proposal. If you believe that 508 compliance may be a challenge at this stage of market maturity in terms of products and solutions availability, then advise us accordingly. You tell us in an RFI. |
| 28 | Can you clarify what community engagement means in this section? | It means identifying, prioritizing and communicating with stakeholders such as USPTO product teams, Cyber Security, Program Managers, Budget Managers, Office Directors, CIO/DCIO, CISO, etc. who must either be prepared to authorize or support changes or also do something different within their products and solutions in order to execute the roadmap. |
| 29 | Can you clarify what leveraged vs deployed means. Is it about the ease of deployment and transparency to the end user or something else? | The distinction compares a value-added self-service platform that automates standard configurations and compliance elements vs. every team fending for itself within guardrails, limited to oversight. |
| 30 | On Page 7 of your RFI, there is a sentence- "The USPTO seeks Cloud-based commercial off the shelf or custom products and implementation services which satisfy the objectives below." however, the material following does not seem to list any objectives. Were the objectives accidentally omitted? If so, what are the objectives? | Disregard the last sentence in that paragraph. Please address the objectives presented in the preceding sections. |
File details come from the government source that posted it. Updated .