Post Quantum Cryptography (PQC) Readiness and Validation Status
Updated
Sources Sought from the Federal Acquisition Service, for work in Washington, District of Columbia. Due Dec 7, 2026, 11:59 PM (UTC-5), 30 days left.
| Solicitation number | 1106202612072026 |
|---|---|
| Agency | Federal Acquisition Service |
| Office | Fc Acquisition Solutions Dev/Idv Acq Management |
| Notice type | Sources Sought |
| Set-aside | None |
| Trade (NAICS) | Other Computer Related Services (541519) |
| Place of performance | Washington, District of Columbia |
| Posted | Nov 6, 2026 |
| Response deadline | Dec 7, 2026, 11:59 PM (UTC-5) (30 days left) |
| Add the deadline to | Google Calendar · Apple / Outlook (.ics) |
Bid documents (1)
Paid members download every document from this page, or buy this bid alone.
Federal prevailing wage rates for this place: District of Columbia Davis-Bacon and SCA wage determinations.
Description
Federal agencies are preparing for the transition from cryptographic algorithms that may be vulnerable to future quantum computing attacks to quantum-resistant cryptographic algorithms standardized by the National Institute of Standards and Technology (NIST). Public key cryptographic algorithms (i.e. asymmetric cryptography) currently used across Federal information systems, products and services — including Rivest-Shamir-Adleman (RSA), elliptic curve Diffie-Hellman(ECDH), elliptic curve digital signature algorithms (ECDSA), and related mechanisms — will be vulnerable to a future cryptanalytically relevant quantum computer (CRQC).
As a result, Federal agencies are expected to identify, prioritize, and migrate quantum-vulnerable cryptographic systems to approved post-quantum cryptographic algorithms. Federal agencies are also required to use validated cryptographic algorithms and modules when cryptography is required to protect Federal information or Federal systems. The NIST Cryptographic Module Validation Program establishes requirements under FIPS 140-2 and FIPS 140-3.
FIPS 140-2 and FIPS 140-3 requirements are applicable to U.S. Federal agencies when cryptographic-based security systems are used to provide information security for Federal operations and assets. If cryptography is required for the protection of information or data, then FIPS-validated cryptography is applicable. Non-validated cryptography shall be treated as providing no validated protection for Federal information where validated cryptography is required.
Relevant policy, standards, and guidance include, but may not be limited to: NIST Cryptographic Module Validation Program; FIPS 140-2 and FIPS 140-3, Security Requirements for Cryptographic Modules; FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard; FIPS 204, Module-Lattice-Based Digital Signature Standard; FIPS 205, Stateless Hash-Based Digital Signature Standard; NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes; NIST SP 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security Implementations; OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles; Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity; Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks; OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography; and CISA guidance regarding product categories and technologies that use post-quantum cryptography standards.
This RFI is intended to collect industry information regarding the availability, validation status, product and service readiness, procurement accessibility, implementation maturity, operational impacts, interoperability, and migration support associated with commercial products and services that support, or plan to support, NIST-approved post-quantum cryptography standards. This Request for Information is issued for market research purposes only.
There are no anticipated tasks under this RFI. This RFI is intended to collect information from industry regarding vendor capabilities, products and services availability, cryptographic validation status, contract accessibility, and readiness to support the Federal Government’s migration to post-quantum cryptography (PQC). This RFI does not constitute a solicitation, Request for Proposal, Request for Quotation, Invitation for Bid, or promise to issue a future solicitation.
Any contract or order that may result from information received through this RFI will be subject to applicable procurement laws, regulations, and competition requirements. The Government is not responsible for any costs incurred by industry in preparing or submitting responses to this RFI. All costs associated with responding to this RFI are solely at the respondent’s expense.
Not responding to this RFI does not preclude participation in any future solicitation, if one is issued. All submissions become Government property and will not be returned.
Contracting contact
- Vivian Panagakis · [email protected]
- Samuel Barksdale · [email protected]
As published on the official notice. Ask questions in writing and before any questions deadline the notice sets.
Is your business small enough?
For NAICS 541519, a business counts as small if it has no more than $34.0 million in average annual receipts (SBA size standard). This notice is not set aside, but the size decides your small business status on it. SBA table, current as of Oct 15, 2026.
Companies that win this kind of work
Federal contractors paid for other computer related services work, who also hold GSA contracts (last 12 months): possible competitors, or partners to team with.
- Four Points Technology, L.L.C. $996.6 million in this trade
- CGI Federal Inc. $578.8 million in this trade
- Minburn Technology Group, LLC $521.7 million in this trade
- NEW Tech Solutions, Inc. $457.9 million in this trade
- Deloitte & Touche LLP $426.1 million in this trade
About the buyer
The General Services Administration awarded $28.7 billion in contracts in the last 12 months; its biggest suppliers were Booz Allen Hamilton Inc, Science Applications International Corporation and CACI, Inc. - Federal. See what GSA is buying now.
Other Computer Related Services contracts right now
There are 91 open government contract opportunities in this trade (NAICS 541519), 29 posted in the last 7 days; 33% are set aside for small businesses. The agencies buying the most are Department of Veterans Affairs, Department of the Air Force and Department of the Navy. Most of the work with a stated place is in District of Columbia, Virginia and Maryland. A notice in this trade gives a median of 14 days from posting to deadline; this one gives 31 days.
All open other computer related services contracts
Coming up in this trade
Planned contracts from the agencies' procurement forecasts, often months before a solicitation. Plans can change.
Recent awards in this trade
- Thundercat Technology, LLC $4.5 million · Department of Veterans Affairs · Oct 30, 2026
- Minburn Technology Group, LLC $455,487 · Department of Veterans Affairs · Oct 30, 2026
- CACI NSS, LLC $1.6 million · Defense Information Systems Agency (DISA) · Oct 29, 2026
- Minburn Technology Group, LLC $301,220 · Department of Veterans Affairs · Oct 28, 2026
- NEW Tech Solutions, Inc. $16,143 · Department of the Navy · Oct 27, 2026
From the award notices agencies publish.