Request for Information: Automated Cryptographic Discovery and Inventory (ACDI) Tool

The U.S. Department of Health and Human Services, through the Office of the Chief Information Officer’s Office of Information Security, is conducting market research via a Request for Information (RFI) to identify commercial or commercially available Automated Cryptographic Discovery and Inventory (ACDI) solutions. This RFI, identified by solicitation number 7571TE26R00001 and issued under NAICS code 541519, is solely for planning and informational purposes and does not constitute a solicitation for proposals or a commitment to award a contract. Respondents are invited to submit a capability statement or white paper detailing their ACDI tools, with all submissions due by June 5, 2026, at 12:00 PM ET to designated points of contact. Responses must include the solicitation number and company name in the email subject line, and any proprietary information must be clearly marked, though all submissions will become Government property. Questions must be submitted in writing by June 1, 2026, and no verbal inquiries will be accepted. The Government seeks an ACDI solution capable of automated discovery and inventory of cryptographic implementations across on-premises, cloud, and hybrid environments using both agent-based and agentless methods within a single-instance, multi-tenant architecture. The preferred tool must support comprehensive visibility into applications, software libraries, network infrastructure, and data at rest or in transit, while producing reports in CSV and Excel formats compliant with OMB M-23-02 requirements for executive, technical, and audit audiences. If a contract is awarded, it will be a Firm-Fixed-Price arrangement with a 12-month base period and four optional 12-month renewal periods. Key deliverables include a Project Management Plan within ten days of award, weekly status meetings with accompanying minutes, monthly risk and issue logs, bi-weekly discovery reports, draft and final technical and training documentation, and an operational readiness report prior to deployment. Training for Government personnel must occur no later than five days before tool deployment, and a kick-off meeting with the Contracting Officer’s Representative and PQC Program Manager is required within seven days of contract award. The place of performance is Washington, D.C., and responses will be evaluated for market research only, with no formal scoring or award criteria outlined in this RFI.