ZeroTrust_PQC_RFI_CoverSheet_DRAFT.docx

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology, Infrastructure Operations

REQUEST FOR INFORMATION (RFI)

Zero Trust and Post-Quantum Compute Encryption Enterprise Hardware Security Module Managed Services and Lifecycle Support Solicitation / Notice Number: 36C10B26QXXXX Issued through the Technology Acquisition Center (TAC) Date: June X, 2026

1. Introduction This is a Request for Information (RFI) issued for planning and market research purposes only. Do not submit a quote, an offer, or a proposal. This notice is not an Invitation for Bid, a Request for Quotation, or a Request for Proposal, and it is not a commitment by the Government to issue a solicitation or to award any contract. The Government will not reimburse any cost incurred in preparing or submitting a response, and no funds have been authorized, appropriated, or obligated for this effort.

Information submitted in response will be used to refine the Government's acquisition strategy, requirements, and the draft Performance Work Statement (PWS), and may inform any set-aside determination. Responses are voluntary. Any information submitted becomes the property of the Government and will not be returned. Respondents are responsible for marking proprietary, restricted, or competition-sensitive material on each page that contains it. Product literature and part numbers may be included within the page limit stated in Section 4.

2. Background VA Office of Information and Technology, Infrastructure Operations operates one of the largest and most complex information technology environments in the federal government, spanning on-premises data centers, private cloud infrastructure, and public cloud services delivered through the VA Enterprise Cloud (VAEC). At the cryptographic foundation of that environment sits VA's enterprise Hardware Security Module (HSM) fleet, which provides the cryptographic backbone for VA's Public Key Infrastructure (PKI), Key Management Services (KMS), digital certificate operations, and cryptographic processing for a broad portfolio of clinical and administrative systems, including the Veterans Health Information Systems and Technology Architecture (VistA) and VAEC-hosted workloads.

The Government-furnished fleet consists of ten production network-attached HSM appliances, eight Luna Network HSM T-5000 and two Luna Network HSM T-2000, at firmware version 7.11, deployed across four geographically distributed CONUS gateway data centers, together with partition capacity licenses, HSM administration kits, and backup HSM components. The fleet is described at the gateway and metropolitan-area level in the attached sanitized Attachment A; system identifiers, serial numbers, and facility street addresses will be provided with the solicitation. The Contractor would assume full maintenance and managed-service responsibility for this equipment in its as-found configuration upon completion of transition-in.

VA is executing an enterprise Zero Trust modernization program consistent with its Critical Security Controls. Under that program, all HSM operations, including key lifecycle management, partition management, PKI operations, and cryptographic services for VA endpoints and applications, are core components of VA's Zero Trust encryption posture. In August 2024, the National Institute of Standards and Technology (NIST) finalized its first post-quantum cryptographic standards, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), making post-quantum cryptography (PQC) readiness a mandatory enterprise requirement for all HSM infrastructure. The Government is seeking industry feedback on technical approach, the salient characteristics, the staffing and key personnel model, the planned transition to Government operation, acquisition strategy, and pricing to inform its procurement planning.

3. Requirement Overview The full requirement is described in the attached draft PWS. The Government contemplates a single performance-based contract organized into six task areas: project management; HSM hardware sustainment and maintenance; HSM managed services and partition lifecycle management; post-quantum cryptography readiness and upgrade services; professional services and advisory support; and transition and knowledge transfer. The anticipated period of performance is a twelve-month base period with four twelve-month option periods, for a total not to exceed sixty months, with each option period exercised at the sole discretion of the Government.

The Government intends a predominantly firm-fixed-price structure with a labor-hour advisory pool on a not-to-exceed basis, a phased post-quantum migration paced to NIST and CNSA Suite 2.0 milestones, and transition of full operation of the HSM environment to Government personnel at the end of the period of performance rather than award of a successor operations contract. Travel is not separately reimbursed; respondents should assume that travel, transportation, lodging, and per diem are included in fixed pricing. The salient characteristics in Section 3.1 of the draft PWS define the technical and performance equivalency standards for any platform proposed, whether a network-attached appliance or a FedRAMP-authorized cloud-hosted HSM-as-a-Service offering.

4. Response Instructions Responses are limited to fifteen pages, exclusive of the vendor information table in Section 4a. The Government will not review material beyond the fifteen-page limit. Do not submit marketing materials or generic capability statements; they will not be reviewed. Number your responses to correspond to the question numbers in Section 4b. Acceptable file formats are Microsoft Word or Adobe PDF, and the total email size shall not exceed five megabytes.

4a. Vendor Information Provide the following information at the front of your submission.

Company Name

Address

Point of Contact (name and title)

Telephone

Email

Unique Entity Identifier (UEI)

Business size and socioeconomic status

SDVOSB or VOSB SBA certification status (if applicable)

NAICS code(s) your firm uses for this work

Any existing and current applicable FSS contracts or GWAC’s that this order would be able to be made under

The anticipated primary NAICS code for this requirement is 541519, Other Computer Related Services, with a small business size standard of $34.0 million. Codes that may also apply include 541512, Computer Systems Design Services, and 541513, Computer Facilities Management Services. If you believe a more appropriate NAICS code applies, provide that recommendation with your rationale.

4b. Questions for Industry Address the following questions, in addition to a general statement of capability. Where a question references the draft PWS, the corresponding section is identified to help you locate the requirement.

HSM Platform Capability and Salient Characteristics

1. Describe your capability to provide enterprise HSM managed services for a large federal agency. Identify the specific HSM hardware platform or platforms, or the FedRAMP-authorized cloud-hosted HSM-as-a-Service offering, you would propose; describe how each meets or exceeds the salient characteristics in Section 3.1 of the draft PWS; and provide the current NIST Cryptographic Module Validation Program (CMVP) certificate number for each FIPS 140-3 Level 3 module you would operate. For any cloud-hosted component, confirm FedRAMP authorization status and baseline, Moderate or High.

1. The Government-furnished fleet in Attachment A is a fielded set of Luna Network HSM appliances at firmware version 7.11 across four CONUS gateway locations. If you would operate this fielded fleet under a managed-services model, describe your OEM-authorized support relationship for that platform. If you would propose an alternative or additional platform, describe how partitions, key material, and PKI and KMS integrations would carry across without service interruption.

1. Section 3.1 requires, among other characteristics, at least twenty isolated partitions per appliance, active-active or active-passive clustering with no single point of failure, defined RSA-2048 and ECC P-256 throughput minimums, and at least 100,000 asymmetric key objects per appliance. Identify any salient characteristic your proposed platform does not meet today and any that, as written, would limit the field of capable offerors to a single source. Where you identify such a constraint, recommend alternative language that preserves the Government's security and performance intent while broadening competition.

Legacy HSM Key Migration

1. Section 5.2.4 of the draft PWS designates legacy HSM key migration as the highest-priority sustainment deliverable. Describe your demonstrated capability to migrate cryptographic key material from legacy commercial HSMs whose firmware is incompatible with current government-grade HSM platforms, specifically where standard backup and restore is unavailable and where source key material is not flagged exportable under the source platform's security policy.

1. For non-exportable key material, describe your approach to re-key or re-issuance coordinated with the Government as an alternative to any method that would bypass the source platform's security controls, and identify any migration-enabling hardware, such as hardware key-transport or portable backup modules, you would recommend bridging incompatible HSM firmware environments. Address how you would maintain zero interruption to enterprise PKI Certificate Authority and KMS operations during migration, and how you would validate key integrity and sanitize source key material consistent with NIST SP 800-88 Rev. 1.

Managed Services, Partition Management, and Key Lifecycle

1. Describe your approach to delivering 24x7x365 managed HSM services at a minimum fleet availability of 99.9 percent per calendar month, including your high-availability and failover architecture, disaster recovery configuration, and your ability to meet a four-hour Recovery Time Objective and a one-hour Recovery Point Objective for critical cryptographic operations.

1. Describe your approach to partition lifecycle management in a multi-tenant federal environment, including provisioning within five business days of an approved request, secure decommissioning with independently verified zeroization, and elastic partition scaling without procurement of additional full appliances. Explain how your licensing or subscription model supports partition scaling without introducing single-vendor lock-in.

1. Describe your key lifecycle management practices, including documented and witnessed key-generation and key-ceremony procedures under M-of-N quorum authentication, dual control, and split knowledge, so that no single individual can generate, export, or restore key material. Address how these practices extend to the custody and restoration of backup key material.

1. Describe your integration capability with enterprise PKI Certificate Authority environments, including Microsoft Active Directory Certificate Services, with KMS platforms, and with the PKCS#11, Microsoft CNG and Key Storage Provider, Java JCE and JCA, and REST API cryptographic interfaces, as well as VAEC-hosted workloads in AWS GovCloud and Microsoft Azure Government. Describe your SIEM integration for HSM audit logging, including log tamper-evidence, the formats you support such as Common Event Format or equivalent, and your experience forwarding HSM audit streams to a federal SIEM.

Post-Quantum Cryptography Readiness, Validation, and Upgrade

1. Describe your current capability and experience with post-quantum cryptography transition for HSM environments, including your familiarity with FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), and your approach to delivering in-field PQC firmware upgrades for HSM appliances already in a federal inventory without hardware replacement.

1. Section 3.1 requires that a proposed module's ML-KEM, ML-DSA, and SLH-DSA implementations hold NIST Cryptographic Algorithm Validation Program (CAVP) validation at award, with the FIPS 140-3 module validation incorporating those algorithms either complete or actively in the CMVP queue. State the current CAVP validation status of the post-quantum algorithms in your proposed platform and the position and expected timeline of any FIPS 140-3 module re-validation incorporating PQC. If no validated post-quantum module is available today, describe what is realistically achievable by the anticipated award and over the period of performance.

1. Section 3.1 does not fix a post-quantum operation rate at award, in recognition of the higher computational cost of these algorithms. State the sustained ML-KEM and ML-DSA operation rates of your proposed platform under representative production load and describe how you would sustain the 99.9 percent availability service level and committed response times while post-quantum or hybrid algorithms are in use.

1. Section 5.4.1 requires a PQC Readiness Assessment within sixty calendar days of award. Describe your methodology for conducting this assessment across a multi-site federal HSM fleet, including how you would determine which assets can be upgraded in-field versus replaced, and how you would assess the cryptographic middleware, PKCS#11 and CNG library, and application-layer upgrades required for full-stack readiness beyond the HSM hardware itself. Confirm whether sixty days is achievable for a fleet of the size described in Attachment A and identify any dependencies.

1. Describe your approach to hybrid classical-and-post-quantum operation during the transition period, consistent with NIST guidance on hybrid key establishment and digital signatures. Describe your pre-upgrade testing and post-upgrade validation methodology, including algorithm conformance and integration regression testing with PKI, KMS, and application interfaces at the production level, and your ability to roll an asset back to a known-good, post-quantum-capable baseline within four hours of a failed upgrade so that no asset remains in an indeterminate state.

Post-Quantum Certificate Authority and Root-of-Trust Migration

1. Section 5.4.4 requires migration of the VA PKI hierarchy, including its root and issuing certificate authorities, to post-quantum or hybrid cryptography by standing up a parallel hierarchy rather than disrupting production. Describe your experience standing up parallel post-quantum or hybrid certificate authority hierarchies, supporting issuance and validation of hybrid or composite certificates, and providing cross-certification and trust-anchor distribution to relying parties during a transition.

1. Describe how you would handle the operational effects of the substantially larger key and signature sizes of post-quantum algorithms on certificate revocation handling, online certificate status checking, and enrollment protocols, and how you would conduct production-scale testing before relying on any post-quantum certificate authority operation, given that the supporting standards and protocol implementations are still maturing.

Crypto Agility and Cryptographic Inventory

1. Describe your approach to crypto agility, the technical and organizational capability to adopt newly standardized or revised cryptographic algorithms without redesigning systems or replacing compliant hardware, and how your approach aligns with NIST IR 8547 and CNSA Suite 2.0 transition timelines. Address algorithm sunset and deprecation planning, and how your migration would address symmetric encryption and hashing, for example AES-256 and SHA-384 or stronger, as well as asymmetric algorithms.

1. Section 5.4.3 requires a machine-readable Cryptographic Bill of Materials aligned with a recognized standard such as CycloneDX. Describe your tooling and methodology for discovering and inventorying cryptographic algorithms, key types and lengths, certificates, and protocols across HSM-dependent systems, and how you would use a harvest-now-decrypt-later risk analysis to prioritize migration of the highest-risk, longest-confidentiality-life systems first.

Zero Trust Architecture Integration and Federal Compliance

1. Describe how you align HSM managed services with Zero Trust principles, including least-privilege access, role-based access control, PIV and CAC-enforced multifactor authentication at Authenticator Assurance Level 3 for privileged administration, mutually authenticated and encrypted client-to-HSM channels, and continuous tamper-evident audit logging. Describe how you would phase Zero Trust control maturity across a base period and option periods consistent with the CISA Zero Trust Maturity Model.

1. Optional Task 1 in the draft PWS would integrate the HSM management plane with the Government's policy decision point and Identity, Credential, and Access Management environment so that access to privileged HSM operations is evaluated dynamically against identity, device posture, and risk signal, and can be stepped up or revoked while a session is in progress. Describe your experience integrating risk-scoring or conditional-access capabilities with enterprise identity and policy-enforcement services, and any Government dependencies you would expect.

1. Describe your experience supporting federal Authority to Operate processes and Risk Management Framework activities under NIST SP 800-37 and producing FIPS 140-3 compliance documentation and CMVP evidence for cryptographic infrastructure. Based on comparable federal authorizations, provide a realistic timeline for achieving and maintaining an Authority to Operate for a managed HSM service of this scope.

Key Personnel and Staffing

1. Section 5.1.3 identifies Key Personnel and minimum qualifications for the Program Manager, Lead HSM Engineer, PKI Cryptography and Zero Trust Architect, HSM Managed Services Engineer, Post-Quantum Cryptography Specialist, and VA Cybersecurity and Compliance Specialist. Provide feedback on whether these qualifications, including years of experience, certifications, and the requirement to furnish specific prior-work examples, are achievable in the current market; whether any are unnecessarily restrictive or insufficiently rigorous; and whether the Key versus non-Key designations are appropriate for an effort of this scope and sensitivity.

1. Describe the depth of available talent for professionals who combine federal HSM operations experience, FIPS 140-3 expertise, and applied post-quantum cryptography knowledge. For the Program Manager, Lead HSM Engineer, and PKI Cryptography and Zero Trust Architect positions, provide representative summary qualifications, not full resumes, demonstrating how proposed individuals would meet the Section 5.1.3 requirements.

1. Describe how you would sustain continuity of Key Personnel over a potential sixty-month period of performance in a market where cryptographic expertise is in high demand, including the specific contractual, financial, or organizational mechanisms you use to retain staff.

Transition, Knowledge Transfer, and Government Operation

1. This contract is structured for the Government to assume full operation of the HSM environment with its own personnel at the end of the period of performance rather than to award a successor operations contract. Describe your approach to progressively building Government self-sufficiency across all task areas, including the staged model in the draft PWS in which Government personnel move from observing, to performing under supervision, to performing independently, and the final reverse-shadowing period during transition-out.

1. Describe how your knowledge-transfer and training approach would address both traditional HSM operations and emerging post-quantum transition practices, and how you would keep operational runbooks, standard operating procedures, configuration baselines, and architecture documentation current in a government-controlled repository throughout the period of performance.

Acquisition Strategy and Contract Structure

1. Identify the Government-wide Acquisition Contract, Federal Supply Schedule, or other existing contract vehicle through which you could deliver the platform and services described in the draft PWS. Confirm whether a single vehicle can carry both hardware sustainment and managed services and identify any vehicle-specific limitations that could affect performance.

1. The Government intends to acquire hardware sustainment, managed services, post-quantum upgrade services, and professional and advisory support as integrated task areas under a single contract spanning a base year and four option periods, predominantly firm-fixed-price with a labor-hour advisory pool and a phased post-quantum migration. Comment on whether this structure is sound, whether any task area is better acquired separately, and identify any components for which firm-fixed-price pricing is not practicable, with rationale.

Market, Competition, and Pricing

1. Describe the current commercial market for enterprise HSM managed services meeting the FIPS 140-3 Level 3, FedRAMP, and post-quantum-readiness requirements in the draft PWS, including the number of vendors you believe can meet all Section 3.1 salient characteristics simultaneously today.

1. Provide rough order of magnitude pricing ranges for each major task area, namely hardware sustainment and break-fix support; managed services inclusive of partition management and SIEM integration; post-quantum upgrade services; and professional and advisory services, to support Government budget planning. Describe how you would structure pricing across the base and option periods given the phased migration and the expectation that migration level of effort declines as systems reach full operational capability.

1. Provide up to three past-performance references for contracts of similar scope and complexity performed within the last five years, preferably federal. For each, provide the contract number, agency, period of performance, total value, a brief description, and confirmation of whether HSM operations, PKI or KMS integration, or post-quantum transition services were in scope.

1. For Service-Disabled Veteran-Owned and Veteran-Owned Small Business respondents, indicate whether at least fifty percent of the cost of contract performance would be expended on employees of your concern or of other eligible SDVOSB or VOSB concerns, and provide your Small Business Administration certification status.

Draft PWS Feedback and Performance Standards

1. Review the performance standards in the draft PWS, including 99.9 percent monthly availability, four-hour on-site response for critical hardware failures, five-business-day partition provisioning, the four-hour Recovery Time Objective and one-hour Recovery Point Objective, the four-hour post-quantum firmware rollback, and the patch timelines tied to the CISA Known Exploited Vulnerabilities catalog. For each, confirm achievability, identify any conditions or caveats, and recommend modifications based on your experience.

1. Identify any concerns, risks, or recommendations regarding the requirements in the draft PWS, with particular attention to the practicability of the sixty-day PQC Readiness Assessment, the achievability of in-field post-quantum firmware upgrades for fielded assets, the hardware lifecycle assessment cadence, the feasibility of the five-phase post-quantum migration across the base year and four option periods given the maturation of NIST and IETF standards, and any prerequisites or dependencies that should be resolved before contract award.

Proposed Contract

1. The Government preference is for a fully FFP action, however if there are elements or unknowns that would lend themselves to a hybrid contract format with cost elements or a separate NTE Optional Task CLIN; please provide along with rational to help inform the Governments final contact format.

1. Please provide a Rough Order of Magnitude (ROM) cost estimate with your RFI response that is broken up by PWS task.

5. Submission and Points of Contact Submit responses electronically no later than 2:00 PM Eastern Time, [DATE], 2026, by email to the Technology Acquisition Center points of contact below. Include "Zero Trust and Post-Quantum Compute Encryption RFI" in the subject line. Mark proprietary or competition-sensitive material on each page that contains it and ensure the total email size does not exceed five megabytes.

Contract Specialist: Clark, Justin B., Justin.Clark2@va.gov Contracting Officer: Long, David, David.Long4@va.gov

6. General Provisions This requirement may be amended, delayed, canceled, or revised at any time. Issuance of this RFI does not obligate the Government to any course of action, and the Government may use the information provided to make a set-aside or other acquisition determination. Notice of the Governments intended course of action will be posted as an amendment to this RFI once a decision is made; however at a minimum an update will be provided at the location of the RFI no more than approximately a month after the RFI response period has closed and no direct contact of the submission points of contact is needed for updates. Attachments to this RFI are the draft Performance Work Statement and the sanitized Attachment A, Government Furnished Property Inventory.

RFI 36C10B26QXXXX | Zero Trust and Post-Quantum Compute Encryption Page 1 of 2