Justification for Restricting Competition (JRC) Post-Quantum Cryptography and Federal Identity Management Support Services

GSA’s OGP Federal Identity and Cybersecurity Division aligns civilian agency ICAM policy with the FICAM Architecture and manages the FIPS 201 Evaluation Program, which approves PIV and PACS products for the GSA Approved Products List.

OMB M-26-15 directs agencies to migrate to post-quantum cryptography by December 31, 2030, requires GSA to establish an interagency ICAM modernization working group, and tasks the FICAM Office with testing PQC-ready access systems for 2027 pilots.

To support this mandate, the Division requires specialized services in four areas:

1. PQC Testing: Plan and document testing of access systems in an isolated contractor environment aligned with NIST standards.
2. Quantum-Resistant FRTCs: Develop and update FRTCs for PACS, credentials, FIDO2, mPIV, and derived credentials.
3. Governmentwide Guidance: Produce guidance on next-generation digital identity technologies for IDManagement.gov.
4. PKI and FICAM SME Support: Support updates to Federal PKI policies and the FICAM Architecture for PQC readiness, including algorithm transition and hybrid cryptography planning.