GSA OGP - On Phishing Resistant Authenticator Products - MRAS

The General Services Administration (GSA), through its Office of Government-wide Policy (OGP) and the Federal Identity and Cybersecurity Division (FICS), is conducting market research to explore capabilities in the realm of Phishing Resistant Authenticator Products. This initiative aligns with the GSA's overarching goal to bolster cybersecurity measures across federal agencies by adopting advanced identity, credential, and access management solutions. The FICS Division plays a pivotal role in steering the implementation of ICAM policies that align with federal governance and security standards, ensuring a secure, reliable, and streamlined approach to mission-critical operations.

The scope of work under this Request for Information (RFI) includes identifying qualified contractors who can provide Phishing Resistant Authenticators that meet or exceed existing certification processes such as FIDO2 or Kantara Initiative Assurance Program. These products should be interoperable within diverse technological ecosystems and adhere to NIST 800-63v4 authenticator assurance level requirements. The RFI seeks information on products compatible with various platforms including Linux, Windows, MacOS, Android, as well as mobile devices and browsers. Additionally, these products must comply with federal vetting requirements and be Trade Agreements Act compliant.

As part of its comprehensive cybersecurity strategy, the GSA OGP FICS Division also manages initiatives like the Federal Public Key Infrastructure governance and FIPS 201 Evaluation Program through its Physical Access Control Systems Lab. This lab is instrumental in testing commercial products used in Personal Identity Verification systems. Furthermore, GSA's efforts include experimenting with Post-Quantum Cryptography algorithms to prepare federal infrastructure against emerging threats from quantum computing while maintaining compatibility with current systems.

This RFI serves as a preliminary step towards understanding market capabilities without any immediate award obligations. It aims to gather insights into industry practices and potential sources of supply for future procurements related to phishing-resistant technologies. Vendors are encouraged to submit detailed capability packages that highlight their expertise in providing secure authentication solutions tailored for federal use.