Zero Trust Encryption RFI

The Department of Veterans Affairs is seeking industry feedback through a Request for Information to support the procurement of comprehensive managed services for its enterprise Hardware Security Module (HSM) infrastructure, which forms the cryptographic foundation of its Zero Trust encryption posture. The existing fleet comprises ten network-attached Luna HSM appliances—eight T-5000 and two T-2000 models—at firmware version 7.11—deployed across four geographically distributed CONUS data centers, along with associated partition licenses, administration kits, and backup components. The Contractor will assume full responsibility for sustaining, maintaining, and upgrading this infrastructure in its as-found configuration, ensuring continuous operation of critical systems including VistA and VAEC-hosted workloads. Key requirements include 99.9 percent monthly availability, four-hour on-site response for critical failures, four-hour Recovery Time Objective, and one-hour Recovery Point Objective, alongside mandatory compliance with NIST’s newly finalized post-quantum cryptographic standards FIPS 203, FIPS 204, and FIPS 205, necessitating in-field firmware upgrades, crypto agility management, and migration of certificate authorities and roots of trust. The Government mandates a firm-fixed-price contract structure for a twelve-month base period with four optional one-year extensions, totaling a potential sixty-month performance window. All services must meet strict operational security standards, including compliance with VAAR 852.204-71(d) requiring domestic operations, adherence to OMB M-26-05 regarding third-party software, and full alignment with VA Directive and Handbook 0710 for personnel vetting, which includes background investigations equivalent to those required of VA employees. Contractors must submit detailed staffing plans with credentials for all roles, provide a Quality Control Plan within thirty days of award, and comply with Section 508 accessibility standards. Physical deliveries of hardware must use tamper-evident packaging and U.S. registered mail with chain-of-custody documentation, and all shipments must be labeled with the IFCAP PO number and container counts. Offerors must be certified Service-Disabled Veteran-Owned Small Businesses, with responses limited to fifteen pages excluding a required vendor information table, and must include a Rough Order of Magnitude cost estimate segmented by task area, along with self-certifications for sustainable products and unbiased AI principles if applicable. All intellectual property and source code produced under this contract will be delivered to the Government with unlimited rights, and the Government retains the right to reuse, share,