Statement of Objectives.pdf

Statement of Objectives

Project Title: Automated Cryptographic Discovery and Inventory (ACDI) Tool

A. BACKGROUND

The U.S. Department of Health and Human Services (HHS)1 is the principal federal agency responsible for protecting the health and well-being of all Americans and for providing essential human services, especially to those least able to help themselves. HHS is a federated organization2 with 13 Operating Divisions (OpDivs) and 16 Staff Divisions (StaffDivs). These divisions administer a wide range of health and human services and conduct life-saving research for the nation, protecting and serving all Americans.

The HHS Office of the Chief Information Officer (OCIO) supports the HHS mission by leading the development, modernization, and secure operation of enterprise information technology across the Department; setting strategy and governance for IT, data, cybersecurity, and artificial intelligence;

and delivering shared technology capabilities that enable HHS programs to focus on their unique missions while providing more efficient, effective, and affordable services to the American people.

Within OCIO, the Office of Information Security (OIS), led by the Chief Information Security Officer (CISO) and Executive Director, serves as the central organization for HHS cybersecurity and information security risk management. OIS develops and implements department-wide information security policies and standards; oversees implementation of federal information security and cybersecurity requirements; conducts security operations, continuous monitoring, and incident response; and provides security engineering, guidance, and oversight for HHS systems and networks. OIS also provides leadership for privacy and information management, including collaborating with privacy officials to safeguard sensitive information; coordinating department-wide activities related to information collection under the Paperwork Reduction Act; and overseeing records management policy and guidance for information and IT resources in alignment with applicable law and HHS policy. In addition, OIS supports health sector cybersecurity coordination and information-sharing activities to help protect critical health and public health sector infrastructure.

HHS relies on cryptography to protect sensitive data and systems, including healthcare and insurance information, public health and disease data, and information on vulnerable populations and health disparities. The next major advancement in cryptographic threats comes in the form of quantum computing. Some experts predict that a quantum computer of sufficient size and sophistication, referred to as a cryptographically relevant quantum computer (CRQC), could emerge as early as 2030. This quantum-based computer could potentially break widely used asymmetric algorithms that rely on complex mathematical problems. For federal agencies, this presents a significant vulnerability. To address the risks posed by CRQCs, HHS must begin migrating existing systems to more secure cryptographic technologies, known as Post-Quantum Cryptography (PQC).

National Security Memorandum 10 (NSM 10) of May 4, 2022, Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems, directs the Federal Government to prepare for a transition to cryptographic algorithms that are not vulnerable to a CRQC, with the goal of mitigating quantum risk to the greatest extent feasible by 2035. The

1 https://www.hhs.gov/ 2 https://www.hhs.gov/about/agencies/hhs-agencies-and-offices/index.html https://www.hhs.gov/ https://www.hhs.gov/about/agencies/hhs-agencies-and-offices/index.html

Office of Management and Budget (OMB) issued Memorandum M-23-02, Migrating to Post- Quantum Cryptography, directing federal agencies to comply with NSM-10 by developing a prioritized inventory of their cryptographic systems, also known as a cryptographic bill of materials (CBOM), as a first step in the transition to post-quantum cryptography (PQC).

HHS has established a PQC Working Group, composed of representatives from OpDivs, to support the migration to PQC in response to the requirements outlined in NSM-10 and M-23-02. These efforts focus on identifying and inventorying cryptographic systems, assessing vulnerabilities in current cryptographic implementations, and developing plans to transition systems that rely on quantum-vulnerable algorithms to quantum-resistant alternatives. Through coordination with OpDivs, OIS is helping to establish a structured approach to understanding the agency’s cryptographic landscape, prioritizing high-value and high-impact systems, and preparing for the long-term migration needed to reduce risks associated with the future development of CRQCs.

Currently, cryptographic inventories are collected through manual processes, which are time-consuming, resource-intensive, and prone to incomplete or inaccurate data. This limits HHS’s ability to fully identify vulnerable cryptographic algorithms, understand where they are implemented across systems, and prioritize remediation efforts. To address these challenges, the Government seeks to procure an Automated Cryptographic Discovery and Inventory (ACDI) capability to enable enterprise-wide visibility, risk identification, and coordinated cryptographic modernization.

An ACDI capability would automate the discovery and inventory of cryptographic assets across networks, applications, and devices, enabling continuous and reliable insight into the use of cryptographic technologies.

B. OBJECTIVES

The purpose of this acquisition is to procure an ACDI tool to support HHS’s enterprise efforts to identify, track, and manage cryptographic assets across its Information Technology (IT) environment.

The tool will provide automated capabilities to discover cryptographic algorithms, protocols, certificates, and key management implementations across systems, applications, and network infrastructure. This capability will enable HHS to develop a comprehensive and accurate inventory of cryptographic assets, identify the use of vulnerable or quantum-vulnerable algorithms, and support informed planning for the migration to PQC. By automating the discovery and inventory process, the ACDI tool will improve enterprise visibility, data accuracy, reduce reliance on manual data collection, and strengthen the agency’s ability to manage cryptographic risk and comply with federal guidance such as NSM-10 and OMB M-23-02.

C. PERIOD OF PERFORMANCE

The contract shall consist of a 12-month base period and four (4) 12-month option years (OYs).

Year Period-of-Performance Award Amount Base Year 12-months TBD Option Year 1 12-months TBD Option Year 2 12-months TBD Option Year 3 12-months TBD Option Year 4 12-months TBD

D. AWARD TYPE

This will be a Firm-Fixed-Price (FFP) contract.

E. SCOPE

The contractor shall provide a commercial or commercially available ACDI solution, including software licenses, configuration, deployment support, documentation, and training necessary to support enterprise cryptographic discovery and inventory capabilities.

The solution shall support discovery and analysis of cryptographic implementations across a range of environments including:

• On-premises infrastructure

• Cloud environments

• Applications and software libraries

• Network infrastructure and services

• Data in transit and at rest

The contractor shall ensure the solution aligns with federal cybersecurity requirements and can operate within agency security and authorization requirements.

F. TASKS

The following are the specific tasks the contractor is required to perform under this award:

1. TASK 1: Project Management The contractor shall provide project management support to coordinate and manage all activities performed under this contract. The contractor shall implement project management methods to ensure tasks are completed within established timelines, resources are effectively utilized, and quality control procedures are implemented to meet the objectives of this contract.

The contractor shall manage project activities in coordination with the PQC Program Manager (PM) and the Contracting Officer’s Representative (COR) and shall ensure effective communication, issue resolution, and progress reporting throughout the period of performance.

1.1. Contract Kick-Off Meeting

The contractor shall conduct a Contract Kick-Off Meeting with the PQC Program Manager (PM) and the Contracting Officer’s Representative (COR) within seven (7) calendar days after the contract award. The purpose of the kick-off meeting is to review project objectives, confirm roles and responsibilities, discuss the implementation approach, and establish communication and reporting expectations. The meeting shall include contractor personnel assigned to the project and Government stakeholders as identified by the Government.

The contractor shall be responsible for sending the meeting invite, coordinating the agenda with the Government personnel, conducting the meeting, recording meeting minutes, and distributing meeting minutes to attendees. Meeting minutes shall be delivered to the COR and PQC PM within one (1) calendar day following the meeting.

1.2. Project Management Plan (PMP)

The contractor shall develop and submit a Project Management Plan (PMP) describing the approach for managing and executing all work under this contract. The PMP shall be delivered to the Government within ten (10) calendar days after contract award for Government review and acceptance. At a minimum, the PMP shall include:

• Project governance structure and roles and responsibilities

• Project schedule and milestone tracking

• Communication and reporting procedures

• Risk and issue management approach

• Quality management procedures

• Change management procedures

• Coordination approach with Government stakeholders

• Escalation procedures for project issues

The contractor shall update the PMP as necessary throughout the period of performance to reflect changes in project scope, schedule, or implementation activities.

1.3. Project Meetings and Communication

The contractor shall hold weekly status meetings with the PQC PM and the COR to provide updates on project progress, discuss ongoing activities, and address any issues or risks. These meetings shall take place virtually unless otherwise specified by the Government.

The contractor shall:

• Document meeting discussions, action items, and decisions

• Deliver meeting minutes to the COR and PQC PM within one (1) calendar day following each meeting

The contractor shall maintain a project risk and issue log and review and update the log monthly.

The COR, PQC PM, and designated Government stakeholders may confer with the contractor during normal operating hours. The contractor shall acknowledge Government communications, including emails or phone calls, within one (1) calendar day.

1.4. Technical Documentation

The contractor shall develop and provide comprehensive technical documentation to support the installation, configuration, operation, and maintenance of the ACDI tool. Technical documentation shall include, at a minimum:

• System architecture and design documentation

• Software specifications

• Installation and configuration guides

• Integration instructions

• Security configuration guidance

• Administrative and user manuals

• Operational procedures

• Troubleshooting guidance

Draft technical documentation shall be submitted to the Government within fifteen (15) calendar days after contract award for Government review and comment.

The Government shall provide feedback within five (5) calendar days, and the contractor shall incorporate Government comments and update the documentation accordingly.

Final technical documentation shall be delivered no later than fifteen (15) calendar days prior to ACDI tool deployment.

All documentation shall be delivered in electronic format and updated as needed to reflect system changes or enhancements during the implementation period.

2. TASK 2: Software Specifications and Capabilities The contractor shall provide a technical solution that incorporates the functional and technical capabilities outlined below, along with the associated support documentation described in section

1.4. Technical Documentation.

2.1. Functional Requirements

2.1.1. Cryptographic Discovery

The solution shall automatically discover cryptographic implementations across enterprise environments and provide support for discovery across:

• Network communications (e.g., Virtual Private Network (VPN), Secure Shell (SSH))

• Transport Layer Security (TLS) version

• Endpoints and servers

• Applications and services

• Cloud environments and containers

• Virtual machines (VMs) (e.g., VMware, Hyper-V, cloud VMs)

• Data-at-rest systems (e.g., databases, storage)

• Firmware and firmware updates

• Source code

• Executable files

• Third-party artifacts

The solution shall support both active scanning and passive monitoring techniques.

The solution shall discover both HHS-internal and external-facing (public) cryptographic implementations.

2.1.2. Cryptographic Identification

The solution shall identify cryptographic algorithms, including:

• Symmetric encryption

• Asymmetric/public key cryptography

• Digital signatures

• Cryptographic hash functions

• Protocols and cipher suites

• Key lengths and configurations

• Cryptographic libraries and modules, where feasible

• Instances of hybrid cryptography (combinations of classical and post-quantum cryptography)

The solution shall identify certificates and associated metadata (issuer, expiration, key size, etc.).

2.1.3. Inventory Management

The solution shall maintain a centralized cryptographic inventory repository.

The solution shall associate cryptographic implementations with:

• Internal systems’ Federal Information Security Modernization Act of 2014 (FISMA) identification numbers

• Systems, applications, or services

• IP addresses, hostnames, or system owners (where available)

• Identification of operating systems

The solution shall support:

• Tagging and categorizing assets

• Deduplicating findings

• Tracking historical discovery results

The solution shall allow validation and annotation of inventory data by authorized users.

2.1.4. Risk Assessment

The solution shall identify:

• Deprecated or weak cryptographic algorithms

• Non-compliant configurations

• Quantum-vulnerable cryptography

The solution shall provide contextual risk analysis based on:

• System exposure

• Data sensitivity

• Mission criticality

• Selection of baseline standards (ex: CNSA 2.0)

2.1.5. Prioritization

The solution shall support prioritization of remediation activities based on risk level.

The solution shall enable filtering and ranking of cryptographic findings.

2.1.6. Implementation Support

The solution shall support tracking of remediation and modernization activities.

The solution shall provide visibility into progress of cryptographic updates and migrations.

The solution shall integrate with enterprise workflow or ticketing systems where applicable.

2.1.7. Continuous Monitoring

The solution shall provide continuous or periodic discovery of cryptographic implementations.

The solution shall detect changes in cryptographic usage over time.

The solution shall provide alerts for newly discovered or changed cryptographic assets.

2.1.8. Reporting Capabilities

The solution shall provide dashboards and reporting capabilities showing:

• Cryptographic inventory

• Vulnerable cryptography

• Certificate lifecycle status

• Remediation progress

• TLS version

• Discovery coverage and visibility

• Compliance and policy status.

The solution shall support filtering and search capabilities.

The solution shall export reports in standard formats such as CSV and Excel in compliance with OMB M-23-02 requirements.

The solution shall provide dashboards and analytics to support:

• Executive leadership

• Technical teams

• Audit and compliance purposes

The solution shall provide visibility into cryptographic dependencies, including certificate usage.

2.2. Technical Requirements

2.2.1. Architecture and Deployment

The solution shall support deployment in:

• On-premises environments

• Cloud environments

• Hybrid environments

The solution shall support scalable architecture for enterprise-wide deployment.

The solution shall support distributed scanning across multiple network segments.

The solution is comprised of single-instance, multi-tenant architecture.

The solution shall support both agent-based and agentless discovery methods.

2.2.2. Integration

The solution shall provide Application Programming Interface (API) for integration with enterprise systems, including:

• Asset management or Configuration Management Database (CMDB) systems

• Vulnerability management platforms

• Security Information and Event Management (SIEM) and monitoring tools

• Certificate and key management systems

• Cybersecurity and Infrastructure Security Agency (CISA) Continuous Diagnostics and

Mitigation (CDM)

The solution shall support data exchange with enterprise governance and reporting platforms.

2.2.3. Security

The solution shall enforce role-based access control.

The solution shall support enterprise identity integration (e.g., Single-Sign-On (SSO)).

The solution shall encrypt data in transit and at rest.

The solution shall maintain audit logs for:

• User activity

• Discovery operations

The solution shall support secure credential management. The solution shall safely store, use, and protect sensitive login information so it cannot be exposed, misused, or compromised.

The solution shall be capable of achieving and maintaining an Authorization to Operate (ATO) or FedRAMP High authorization (for SaaS/Cloud) in accordance with the Risk Management Framework (RMF) and applicable federal security requirements.

The solution shall provide evidence of existing authorization (e.g., FedRAMP or agency ATO), or a defined path to obtain authorization.

The solution shall support continuous monitoring and compliance activities.

2.2.4. Performance and Scalability

The solution shall be able to scale to support large and federated enterprise environments.

The solution shall minimize performance impact on production systems during scanning.

The solution shall support configurable scan schedules and policies.

The solution shall provide high availability and reliability.

2.2.5. Operations and Maintenance

The solution shall provide administrative and user documentation.

The solution shall support ongoing updates to cryptographic detection capabilities.

The solution shall provide alerting for newly discovered or modified cryptographic implementations.

The solution shall support tuning to reduce false positives and false negatives.

2.2.6. Governance and Compliance Support

The solution shall support enterprise governance by enabling centralized reporting across decentralized environments.

The solution shall support tracking of remediation and modernization activities.

The solution shall provide evidence and reporting to support compliance with federal cryptographic inventory and transition requirements.

3. TASK 3: Software Deployment and Implementation The contractor shall support the deployment, implementation, configuration, and testing of the ACDI tool within HHS environments. The contractor shall ensure the ACDI tool is properly installed, configured, integrated, tested, and validated to enable cryptographic discovery and analysis across designated systems and environments.

The contractor shall provide a deployment, implementation, and testing schedule to the Government for review and approval within fifteen (15) calendar days after contract award. The schedule shall outline the activities, milestones, dependencies, and estimated timelines required to deploy, configure, integrate, test, and validate the ACDI tool within the HHS environment. Activities may include, but are not limited to, the following:

3.1. Deployment and Implementation

The contractor shall install, configure, and implement the ACDI tool within the HHS enterprise environment. Implementation activities shall include, at a minimum:

• Installation and configuration of the ACDI tool and associated components

• Integration with existing enterprise systems, security tools, or data sources, where applicable

• Initial system configuration and tuning to support cryptographic discovery and reporting capabilities

• Configuration of scanning or discovery capabilities across designated systems and environments

• Support for security authorization processes and security configuration activities required for deployment within the HHS environment

The contractor shall ensure the ACDI tool is deployed and configured in accordance with HHS security policies, architecture requirements, and operational standards.

The contractor shall deploy and configure the ACDI tool within the designated HHS environments according to the Government-approved implementation schedule.

3.2. Testing and Validation

The contractor shall perform testing and validation activities to verify the proper installation, configuration, integration, and operation of the ACDI tool within the HHS environment. Testing activities shall include, at a minimum:

• Verification of successful installation and configuration of the ACDI tool

• Validation of integration with designated systems, networks, and environments

• Functional testing of cryptographic discovery capabilities

• Validation that the ACDI tool can identify cryptographic algorithms, certificates, protocols, and cryptographic libraries within scanned environments

• Verification of reporting and data output functionality to ensure results support agency analysis and reporting requirements

The contractor shall document testing activities and results and provide a Deployment and Testing Validation Report summarizing testing procedures, results, identified issues, and corrective actions taken. Testing shall be completed prior to operational use of the ACDI tool, unless otherwise determined by the Government.

3.3. Operational Readiness

The contractor shall work with the Government to verify that the ACDI tool is fully operational and capable of supporting cryptographic discovery, analysis, and reporting requirements. The contractor shall address any issues identified during testing and validation activities and ensure the tool is functioning properly prior to operational use. The contractor shall provide a report summarizing evidence that the tool is ready for operational use prior to deployment. The report shall include:

• Summary of deployment and configuration activities

• Summary of testing and validation results

• Confirmation that discovery capabilities are functioning properly

• Confirmation that reporting capabilities are operational

• Identification of any remaining issues or limitations

• Mitigation actions taken or planned

• Confirmation that the tool is ready for operational use

4. TASK 4: Reporting The contractor shall provide bi-weekly reporting on cryptographic discovery and analysis conducted using the ACDI tool following its deployment. Reports shall summarize the status of discovery activities across designated systems and environments and shall include, at a minimum:

• Detailed discovery results

• Identified cryptographic implementations

• Algorithms and protocols in use

• Certificates and cryptographic libraries

• Discovery coverage across scanned environments

• Summary findings

• Recommended prioritization for remediation or migration activities

Reports shall also identify potential cryptographic risks and vulnerabilities, including:

• Algorithms considered vulnerable to quantum computing

• Cryptographic implementations inconsistent with current federal cryptographic standards

• Areas requiring prioritization for remediation or migration

The contractor shall produce structured reporting outputs aligned with OMB M-23-02, supporting the agency’s annual submission of cryptographic inventories and cost estimates. Reports supporting OMB M-23-02 shall be delivered in Microsoft Excel (.xlsx) or comma-separated values (.csv) format to support data analysis, aggregation, and submission requirements.

Additional reports developed to support Government analysis, operational planning, or leadership briefings shall be delivered in PDF or Microsoft Word format, as determined by the Government.

5. TASK 5: Training The contractor shall develop, maintain, and deliver training materials and support documentation necessary for Government personnel to effectively install, configure, operate, administer, and maintain the solution. Support documentation shall include, at a minimum, system architecture documentation, installation and configuration guides, administrator and user guides, security configuration documentation, reporting guidance, operations and maintenance procedures, and troubleshooting guidance.

5.1. Draft Training Documentation for Government Review

Within fifteen (15) calendar days of the contract award, the contractor shall submit draft training materials and support documentation to the Government for review and comment. The Government will review the materials and provide feedback within five (5) calendar days. The contractor shall address Government comments and update the documentation accordingly.

5.2. Final Training Documentation

The contractor shall submit final training materials and support documentation no later than fifteen

(15) calendar days prior to the scheduled training session and prior to the tool deployment.

5.3. Training Delivery

The contractor shall conduct training to designated Government personnel covering system administration, configuration, operation, reporting capabilities, and maintenance procedures of the tool. The training session shall be conducted no later than five (5) calendar days prior to the tool deployment. Training may be delivered virtually or in person, as determined by the Government.

All documentation and training materials shall be delivered in electronic format and shall become Government property upon delivery. All deliverables shall be subject to Government review and acceptance to ensure compliance with contract requirements.

G. DELIVERABLES TABLE

Task No.

Description Due Date

1.1. Contract Kick-off meeting Within seven (7) calendar days after contract award

1.1. Contract Kick-off meeting minutes One (1) calendar day following the meeting

1.2. Project Management Plan Within ten (10) calendar days after contract award

1.3. Project communication meetings Weekly

1.3. Project communication meeting minutes One (1) calendar day after meeting

1.3. Risk and issue log Updated monthly throughout the

period of performance

1.4. Draft technical documentation Fifteen (15) calendar days after contract award

1.4. Final technical documentation Fifteen (15) calendar days prior to

ACDI tool deployment

3.0. ACDI tool deployment, implementation, and testing

schedule Fifteen (15) calendar days after contract award

3.2. Deployment and testing validation report Prior to operational use of the ACDI tool

3.3. Operational readiness report Prior to operational use of the ACDI tool

4.0. Discovery reports Bi-weekly

4.0. Leadership and analytical reports As requested by the Government

5.1. Draft training documentation Fifteen (15) calendar days after contract award

5.2. Final training documentation Fifteen (15) calendar days prior to the scheduled training session and prior to the tool deployment

5.3. Training session delivery No later than five (5) calendar days prior to the tool deployment