Software Defined Encryption RFI.docx

Subject: Request for Information (RFI) – Software Based Encryption Background: The Department of War (DoW) is seeking information on commercially available, software-only cryptographic solutions to enhance data protection for its programs of record. This Request for Information (RFI) is issued to identify potential sources and solutions that can meet the Department's requirements for interim data protection measures, which are designed to be consistent with and advance the DoW's migration to post-quantum cryptography (PQC).

As outlined in recent guidance, the DoW is mandated to review programs of record to determine the feasibility of incorporating advanced cryptographic protection. A key constraint of this initiative is that the solution must be software-only and must not require the replacement, modification, or augmentation of existing hardware components such as chips, cryptographic cards, radios, hardware security modules or other physical components.

The desired solution should provide utility-based, data packet-level cryptographic protection that aligns with the government’s PQC migration strategy and implementation plan, scheduled for on or before December 31, 2029.

In accordance with the memorandum of the Chief Information Officer dated November 18, 2025 “Preparing for Migration to Post Quantum Cryptography” and CNSA 2.0, applicable solutions:

a) must ensure cryptographic protection of data

b) must ensure that encryption and decryption keys are cryptographically protected during establishment using asymmetric key encapsulation mechanisms and digital signatures;

c) must ensure that keys are exclusively transported using ML-KEM-1024 encapsulation;

d) must ensure that authentication integration is provided by an authorized PQC digital signature (ML-DSA-87) and else provided through message authentication codes (MAC) established through PQC asymmetric cryptographic approaches.

e) must be capable of integrating with PQC public key infrastructure (PKI);

f) must protect against unknown key access such as third-party storage, management, or access to cryptographic keys;

g) must be authorized for PQC under DoW CIO, namely through the ATLAS process;

h) must not use symmetric key distribution mechanisms or symmetric key distribution protocols;

i) must not use pre-shared or pre-placed secret keys or private keys;

j) must not use access control measures in lieu of cryptographic protections when sending secret keys using NIST standardized ML-KEM for key encapsulation instead;

k) must not use symmetric encryption to protect cryptographic keys, using NIST standardized ML-KEM for key encapsulation instead;

l) must not use policy-based control of cryptography for automated upgrade/downgrade of cryptographic components;

Technology must be capable of advancing data protection capabilities while ensuring the Department retains full control and sovereignty over its data and cryptographic keys.

The purpose of this RFI is to survey the marketplace to identify vendors and solutions that meet the requirements listed in (a)-(d) and can provide the capabilities described in the attached document, including minimally, but not limited to:

(1) advances data protection for the program of record toward the migration to post quantum cryptography on or before December 31, 2029;

(2) uses the CNSA 2.0 ML-KEM1024-based asymmetric algorithm for key establishment within a standardized or otherwise analyzed cryptographic protocol and encrypts data at a security strength of or exceeding Advanced Encryption Standard with a 512-bit key (AES-512);

(3) is capable of using one or more multi-factor authentication (MFA) methods approved by the Department of War, where authentication is directly cryptographically tied to cryptographic user identity management under public key infrastructure (PKI) and can cryptographically guarantee provenance between the sender and the receiver of data;

(4) provides full key custody and control to the data owner within the Department of War, consistent key sovereignty, including no requirement for key escrow, replication, derivation, or retention of cryptographic keys by third-party vendors.

Requested Information: The Government requests industry’s input regarding the following areas. Responses should focus on capabilities and processes that strengthen the Department’s ability to support Presidential and Congressional priorities, and warfighter spectrum requirements.

The following files should be provided following the National Institute Standards and Technology Open Security Controls Assessment Language (OSCAL) Current version (V.1.2.2) and Chief Information Officer dated November 18, 2025 “Preparing for Migration to Post Quantum Cryptography”:

1. Products System Security Plan (SSP),

2. Plan of Action & Milestones (POA&M),

3. Assessment Results (AR),

4. Assessment Plan (AP) and

5. The name of applicable third-party assessors if one has been used for the assessment,

6. Justification of satisfaction of (a)-(l) above.

Within the RFI, please identify the FISMA controls that the product satisfies and can provide as inheritable security controls to any host system or Program of Record that integrates your software, specifically detailing how your solution satisfies the control objectives for families such as Access Control (AC), Identification and Authentication (IA), System and Communications Protection (SC), and System and Information Integrity (SI). Within the RFI, please identify the basic system architecture and how algorithms and protocols are combined to provided PQC-compliance.

Format: Responses to this RFI request should reference “Software Based Encryption” and shall include the responding vendor’s company name in the attachment document title. It shall include the following information in this format:

· Company name, DUNS/UEI, CAGE Code, and point of contact.

· Capability statement demonstrating relevant experience.

· Proposed Solutions to above areas.

· Best Practices: Lessons learned from other sectors or government agencies.

· Feedback on the feasibility of the work described, including ability to complete on accelerated timelines.

· Potential risks, challenges, or innovations.

· Past performance examples (if applicable).

· Rough Order of Magnitude (ROM) cost information.

Firms must respond using the format outlined in this RFI. There is a maximum page limitation of seven (7) typed pages that are single spaced using 12-inch Times New Roman font within an 8.5 by 11 paper.

No hard copy submissions will be accepted. Cover letters and extraneous materials (brochures, etc.) will not be considered. The Government will not consider any submissions to any person other than Ms. Leanne Condren or submissions after the date specified below.

Submissions must be sent as a Word or PDF email attachment. While you may include a brief greeting and a simple statement identifying your submission in the email body, only the attached document will be reviewed. Any proposals, narratives, or extraneous information written in the body of the email will be completely disregarded.

Response Due Date: All responses to this RFI are to be submitted by 12:00 P.M Eastern Time (ET), on 27 September 2026. Responses will be accepted via electronic means only to: whs.mc-alex.ad.mbx.eosd-psb-branch-mailbox@mail.mil and leanne.m.condren.civ@mail.mil.