Zero Trust Encryption RFI

Request for Information (RFI)

This RFI is issued by the Department of Veterans Affairs (VA) Office of Information and Technology for planning and market research regarding Zero Trust and Post-Quantum Compute Encryption for Enterprise Hardware Security Module (HSM) Managed Services and Lifecycle Support. The VA is seeking industry feedback to refine its acquisition strategy, requirements, and draft Performance Work Statement (PWS). This is NOT a solicitation, and no quotes or proposals should be submitted. The government will not reimburse costs for responses.

• Project Management: Overall program oversight.

• HSM Hardware Sustainment and Maintenance: Support for existing and potentially new HSM hardware.

• HSM Managed Services and Partition Lifecycle Management: 24x7x365 managed services, including partition provisioning, decommissioning, and scaling.

• Post-Quantum Cryptography (PQC) Readiness and Upgrade Services: Transitioning HSM infrastructure to PQC standards (FIPS 203, 204, 205).

• Professional Services and Advisory Support: Technical and strategic guidance.

• Transition and Knowledge Transfer: Preparing the government to assume full operation of the HSM environment.

• Anticipated Period of Performance: Twelve-month base period with four twelve-month option periods (total not to exceed sixty months).

• Contract Structure: Predominantly firm-fixed-price with a labor-hour advisory pool.

• PQC Migration: Phased migration aligned with NIST and CNSA Suite 2.0 milestones.

• Transition Goal: Government personnel will assume full operation at the end of the period of performance.

• Response Limit: Fifteen pages (excluding vendor information table).

• Format: Microsoft Word or Adobe PDF, email size not exceeding five megabytes.

• Deadline: [DATE], 2026, 2:00 PM Eastern Time.

• Submission: Via email to designated points of contact (Clark, Justin B.; Long, David).

• Content: Responses should address specific questions detailed in Section 4b of the RFI, focusing on technical capabilities, PQC readiness, managed services, staffing, and acquisition strategy.

• Anticipated NAICS Code: 541519 (Other Computer Related Services), with a small business size standard of $34.0 million. Other potential codes include 541512 and 541513.

• The RFI includes a draft PWS and a sanitized Attachment A (Government Furnished Property Inventory).

• Responses will inform acquisition strategy, requirements, and potential set-aside determinations.

• Industry feedback is requested on technical approach, salient characteristics, staffing, transition, acquisition strategy, and pricing.

Form / Attachment / Pricing Sheet

This document, Attachment A, provides an inventory of Government Furnished Property (GFP) related to the "Zero Trust and Post-Quantum Compute Encryption" and "Enterprise Hardware Security Module Managed Services and Lifecycle Support" opportunity. It details the hardware assets that will be provided to the contractor.

• Fleet Summary: The government-furnished fleet consists of 10 production network HSM appliances (8 Luna Network HSM T-5000 and 2 Luna Network HSM T-2000), all at firmware v7.11.
• Licenses: Includes 8 licenses for a 20-partition capacity upgrade on T-5000 appliances and 1 license for a T-2000 appliance.
• Support Kits: Thirteen HSM administration kits, each with a backup HSM (5 partitions) and remote administration components, are included.
• Locations: The equipment is deployed across four CONUS gateway data center locations (Chicago, IL; Sterling, VA; Dallas, TX; Santa Clara, CA). Specific system identifiers, serial numbers, and street addresses are withheld for this RFI release but will be provided with the solicitation.
• Contractor Responsibility: The contractor will assume full maintenance and managed service responsibility for this equipment upon completion of Transition-In, as per PWS Section 5.2.1.

This inventory is crucial for bidders to understand the existing hardware infrastructure they will be responsible for managing. It informs potential resource allocation, technical approach, and pricing for maintenance and lifecycle support services. Bidders should note the quantity, type, and location of the HSM appliances and associated licenses and kits to accurately scope their proposals.

Performance Work Statement (PWS)

This PWS outlines the requirements for a contractor to provide comprehensive managed services, hardware sustainment, lifecycle support, professional services, and Post-Quantum Cryptography (PQC) upgrade capabilities for the Department of Veterans Affairs (VA) Office of Information & Technology's (OIT) enterprise Hardware Security Module (HSM) infrastructure. The goal is to support the VA's Zero Trust Architecture (ZTA) program and ensure readiness for post-quantum cryptography.

• Managed Services: Operate and manage the VA's HSM infrastructure as a fully managed service, including monitoring, incident response, performance management, and SIEM integration. Maintain 99.9% fleet availability.

• Hardware Sustainment & Maintenance: Provide 24x7x365 break-fix support, preventive maintenance, firmware/software patching, and lifecycle planning for VA-owned HSM assets. Includes managing legacy HSM key migration.

• HSM Partition & Key Management: Provision, configure, and decommission HSM partitions. Manage the full lifecycle of cryptographic keys (generation, backup, recovery, archival, destruction) in compliance with NIST standards.

• PQC Readiness & Upgrades: Assess PQC readiness, execute PQC firmware upgrades on eligible HSMs, and manage crypto agility. This includes planning and executing migration of the VA's Public Key Infrastructure (PKI) hierarchy to PQC or hybrid cryptography.

• Professional Services: Provide technical consulting, market research, advisory support, vendor/OEM relationship management, and training for VA personnel.

• Transition & Knowledge Transfer: Facilitate transition-in and transition-out of services, and progressively transfer operational knowledge to designated VA personnel to enable independent operation by contract end.

• Availability: Minimum 99.9% HSM managed service availability per calendar month.

• Response Times: Four-hour on-site response for Priority 1 critical hardware outages.

• Patching: Critical severity patches (CISA KEV catalog) applied within 15 calendar days.

• Reporting: Monthly Progress Reports detailing fleet status, availability, partition data, firmware deployment, PQC progress, and issues.

• Period of Performance (PoP): Base Year (12 months) with four 12-month Option Periods, for a total potential PoP of 60 months.

• Place of Performance: VA facilities and Contractor facilities. On-site work in CONUS; remote work via VA-approved methods.

• Compliance: Adherence to FIPS 140-3 Level 3, Zero Trust Critical Security Controls, NIST PQC standards (FIPS 203, 204, 205), VA cybersecurity directives, and other federal regulations.

• Personnel: Key personnel require specific qualifications in IT program management, HSM engineering, PKI/Zero Trust architecture, and cybersecurity compliance. All personnel require appropriate background investigations.

• Security: Strict adherence to VA security and privacy requirements, including PIV/CAC authentication, encryption, and data handling protocols.

• Hardware: HSMs must meet specific salient characteristics, including FIPS 140-3 Level 3 validation, PQC support via in-field firmware upgrades, and PIV/CAC-enforced MFA for administration.

• Travel: All travel costs are to be included in the Contractor's firm-fixed price; no separate travel reimbursement.

• The document emphasizes the critical nature of HSM operations for VA's Zero Trust encryption posture and PQC readiness.

• Specific attention is required for migrating cryptographic keys from legacy, unsupported HSMs.

• The contract aims to build VA's internal capability for independent HSM environment operation by contract end.