Public Key Infrastructure Modernization J&A

The contract modifies the existing PKI Modernization task order HC102824F2000 under the broader contract HC104718D2004, issued by the Defense Information Systems Agency’s Defense Information Technology Contracting Organization at Scott Air Force Base, Illinois, with performance centered in St. James, Maryland. This is a sole-source acquisition justified under FAR 16.507-6(b)(3) due to the unique qualifications of Booz Allen Hamilton, Inc., which holds exclusive access to Red Hat’s proprietary code and has deeply integrated knowledge of the current PKI infrastructure and Government-Owned, Government-Supported (GOTS) codebases, making transition to any other vendor technically infeasible without unacceptable disruption. The effort centers on accelerating the Department of the War’s transition to Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) compliance by 2030, requiring a leapfrog migration from RHEL 7/8 directly to the first PQC-capable RHEL 10 operating system, bypassing standard transitional stages. The contract includes a base period and four one-year option periods, with Option Period 2 already exercised and Plans to exercise Options 3 and 4, resulting in a total life cycle value estimated between $57.9 million and $78.6 million, inclusive of a 35% surge capacity built in to manage unforeseen technical risks during the high-stakes migration. The work supports critical DoD missions requiring continuous authentication, data integrity, and non-repudiation, with all contractor personnel handling Controlled Unclassified Information under strict cybersecurity obligations. No formal competitive evaluation factors, clause listings, packaging requirements, or detailed pricing line items are documented, as the nature of the action precludes competition. The contracting officer and requirements personnel, including Tara Horstmann, Tim Wilson, and Michael Merrick, oversee delivery and certification, while Rachel Arentsen serves as the primary point of contact. Funding is provided through FY2026–FY2028 RDT&E funds and Defense Working Capital Funds, with no specific invoice or payment instructions provided. The modification, issued as P00021 on April 8, 2026, reflects an administrative update to sustain the accelerated timeline and increased resource demands of this mission-critical cryptographic transformation.