Post Quantum Cryptography (PQC) Readiness and Validation Status
Open — responses due 7 Dec 2026 (24 days left) · Unrestricted (full and open) · Federal Acquisition Service, GSA · Washington, DC · NAICS 541519 · Solicitation 1106202612072026
Get the AI read before you spend a day on this package. FedSift pulls out the deal-breakers and key risks, each quoted from the document. Free, no account.
Before you spend a day on this package: FedSift reads every document and pulls out what is being bought, the deal-breakers and the key risks — each quoted from the page it came from. Free, no account needed. The result is shared, so the next reader gets it instantly. With a free account it also builds the full compliance matrix.
Track this solicitation
We'll email you if the response deadline moves, an amendment posts, or new documents are added. It closes 07 December 2026. No account needed — one email, unsubscribe in a click.
Description
https://feedback.gsa.gov/jfe/form/SV_3t6dNlgkS4Vg6iy Federal agencies are preparing for the transition from cryptographic algorithms that may be vulnerable to future quantum computing attacks to quantum-resistant cryptographic algorithms standardized by the National Institute of Standards and Technology (NIST). Public key cryptographic algorithms (i.e. asymmetric cryptography) currently used across Federal information systems, products and services — including Rivest-Shamir-Adleman (RSA), elliptic curve Diffie-Hellman(ECDH), elliptic curve digital signature algorithms (ECDSA), and related mechanisms — will be vulnerable to a future cryptanalytically relevant quantum computer (CRQC). As a result, Federal agencies are expected to identify, prioritize, and migrate quantum-vulnerable cryptographic systems to approved post-quantum cryptographic algorithms. Federal agencies are also required to use validated cryptographic algorithms and modules when cryptography is required to protect Federal information or Federal systems. The NIST Cryptographic Module Validation Program establishes requirements under FIPS 140-2 and FIPS 140-3. FIPS 140-2 and FIPS 140-3 requirements are applicable to U.S. Federal agencies when cryptographic-based security systems are used to provide information security for Federal operations and assets. If cryptography is required for the protection of information or data, then FIPS-validated cryptography is applicable. Non-validated cryptography shall be treated as providing no validated protection for Federal information where validated cryptography is required. Relevant policy, standards, and guidance include, but may not be limited to: NIST Cryptographic Module Validation Program; FIPS 140-2 and FIPS 140-3, Security Requirements for Cryptographic Modules; FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard; FIPS 204, Module-Lattice-Based Digital Signature Standard; FIPS 205, Stateless Hash-Based Digital Signature Standard; NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes; NIST SP 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security Implementations; OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles; Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity; Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks; OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography; and CISA guidance regarding product categories and technologies that use post-quantum cryptography standards. This RFI is intended to collect industry information regarding the availability, validation status, product and service readiness, procurement accessibility, implementation maturity, operational impacts, interoperability, and migration support associated with commercial products and services that support, or plan to support, NIST-approved post-quantum cryptography standards. This Request for Information is issued for market research purposes only. There are no anticipated tasks under this RFI. This RFI is intended to collect information from industry regarding vendor capabilities, products and services availability, cryptographic validation status, contract accessibility, and readiness to support the Federal Government’s migration to post-quantum cryptography (PQC). This RFI does not constitute a solicitation, Request for Proposal, Request for Quotation, Invitation for Bid, or promise to issue a future solicitation. Any contract or order that may result from information received through this RFI will be subject to applicable procurement laws, regulations, and competition requirements. The Government is not responsible for any costs incurred by industry in preparing or submitting responses to this RFI. All costs associated with responding to this RFI are solely at the respondent’s expense. Not responding to this RFI does not preclude participation in any future solicitation, if one is issued. All submissions become Government property and will not be returned.
Version history
SAM.gov has posted 8 notices under solicitation 1106202612072026, oldest first.
FedSift reads the full solicitation package — every attachment — and pre-extracts the compliance matrix, evaluation factors, key risks, win themes and deal-breakers, each with a verbatim quote and the exact PDF page it came from. It scores the opportunity against your company profile, tells you whether to bid as prime or sub, and ranks teaming partners who could close your gaps.
Source: this notice on SAM.gov. FedSift republishes public federal procurement data and is not affiliated with the U.S. Government. Always confirm dates and requirements against SAM.gov before responding.
