USMC Public Key Infrastructure (PKI) Support Services RFP Synopsis

The U.S. Marine Corps has issued a solicitation for Public Key Infrastructure (PKI) Support Services under solicitation number M0026425R0013, with a total small business set-aside intended to reserve the opportunity exclusively for small businesses. The requirement is for comprehensive PKI services including program management, registration authority operations, local registration authority functions, and associated cyber security support, to be performed primarily at Quantico, Virginia. The contract is structured as an indefinite-delivery/indefinite-quantity (IDIQ) vehicle with a minimum value of $5,000 and a maximum ceiling of $49,615,750, spanning five ordering periods over a base period of 12 months, with estimated travel-related costs totaling over $637,000. Proposals must be submitted electronically by 10:00 a.m. ET on October 2, 2025, after an extension from the original September 30 deadline, and are subject to strict format requirements including four clearly separated volumes with a total submission size not exceeding 25MB. Evaluation will be conducted on a best-value tradeoff basis under three factors: Technical, Past Performance, and Price, with Technical and Past Performance significantly more important than Price; proposals receiving Marginal or Unacceptable ratings in Technical or Low or No Confidence in Past Performance will be deemed deficient and ineligible for award. Offerors must hold a current Unique Entity ID and CAGE code and certify their small business status and any applicable socio-economic categories, including WOSB, SDVOSB, or HUBZone eligibility, with joint ventures requiring full partner disclosures. All performance personnel must hold at least a Secret clearance with an adjudicated Tier 5 background investigation, and certain roles require Top Secret/SCI clearances and access to government SCIFs. Contractor staff must use government-issued Common Access Cards for system access and wear visible identification at all times. Substitutions of key personnel are prohibited for the first 120 days post-award unless due to death, illness, or termination, and require prior written approval and justification. The contractor must comply with stringent cybersecurity regulations including DFARS 252.239-7001, prohibit the use of covered telecommunications equipment per the Federal Acquisition Supply Chain Security Act, and adhere to specific documentation standards including the use of DOAACs for payment processing and WAWF for all invoicing. Submitting deliverables