GSA OGP - Post-Quantum Cryptography (PQC) - MRAS

The General Services Administration (GSA) is conducting market research on behalf of its Office of Government-wide Policy (OGP) and the Federal Acquisition Service's Office of Information Technology Category (ITC). The primary goal of this initiative is to assess the current capabilities and readiness of the industry to integrate post-quantum cryptography (PQC) algorithms into existing federal infrastructure. This effort is in response to emerging cybersecurity threats posed by quantum computing, which necessitates updates or replacements of current cryptographic products and protocols that rely on public key algorithms.

The GSA OGP FICS Division plays a crucial role in coordinating identity, credential, and access management policies across government agencies. It manages the Federal Information Processing Standard (FIPS) 201 Evaluation Program, which certifies commercial products used in Personal Identity Verification systems. As part of its mandate, the division has been experimenting with PQC algorithms to ensure that federal infrastructure remains secure against future quantum threats while maintaining compatibility with current systems. These experiments involve testing PQC-readiness using cloud platforms, specialized cards, chipsets, and security tokens.

On the other hand, the GSA ITC is focused on delivering flexible IT solutions and services while ensuring security compliance across government-wide regulations. By leveraging partnerships with private sector IT providers through established contract vehicles, ITC aims to drive innovation and agility in support of agency missions. Recognizing the potential impact of quantum computing on cryptographic standards, ITC emphasizes proactive measures for migrating to post-quantum cryptographic standards as a critical step in safeguarding federal information systems.

This Request for Information (RFI) seeks input from vendors regarding their capabilities in supporting the integration of NIST Standard PQC algorithms into physical access control systems that must remain interoperable with existing PIV credentials. The insights gathered will help inform future strategies for transitioning federal facilities to post-quantum-ready infrastructures while aligning with identity management policies and standards under FICAM Architecture.