Network-Based Encryption Key Recovery Storage Solution Professional Service

Overview

Cybersecurity & Data Privacy

Eatontown, New Jersey, United StatesPosted about 2 months agoDeadline: March 23rd, 2026

Fit Score

Settle Intelligence

Settle helps teams find, evaluate, and respond to public RFPs. We continuously surface new opportunities, score them against your company strengths, and draft proposal responses so you can focus on the work that wins business.

SUMMARY

Professional service sought for a network-based encryption key recovery storage solution, supporting large-scale S/MIME decryption, secure key recovery, strict access controls, and comprehensive auditing.

KEY REQUIREMENTS

Experience providing enterprise on-premises cryptographic or key management software to federal agencies.
Description of encryption key recovery storage system and its functional components, including CA and HSM integration.
Identify existing contract vehicles for product and support services.
Confirm full support for a customer-applied update model in an on-premises, non-cloud environment.
Explain compliance with Federal PKI policy, NIST cryptographic standards, and FIPS 140-2 or 140-3 validated modules.
Provide documentation or references validating compliance claims.
Provide pricing/licensing structure, including perpetual vs subscription, usage metrics, and separate costs for HSM/CA integration or PKI modules.
Describe how all software updates can be provided to VA (e.g., secure download portal, customer portal, offline packages).
Ensure updates can be applied by VA personnel only, without contractor login or remote access.
Explain software maintenance lifecycle for patches, security updates, hotfixes, and major/minor version releases.
Describe approach to ensuring patches and updates do not disrupt operational cryptographic workflows, including offline validation.
Describe technical support offerings, including tiers, response times, availability, and escalation procedures.
Explain how troubleshooting is performed without contractor access to VA networks or systems.
Provide methods for VA-only log collection, diagnostic exports, or offline troubleshooting.
Provide corporate service line experience or expertise with specific examples or references.
Solution must support a minimum of 3.5 million encryption keys.
Fully interoperable with U.S. Treasury SSP PKI issuance environment (VACA1 and VACA2).
Integration with VA enterprise directory services for user lookup and authorization.
All components must operate entirely within VA facilities on VA-owned networks and hardware.
Uses FIPS-validated cryptographic modules (NIST FIPS 140-3 or 140-2).
Supports modern Transport Layer Security (TLS) configurations (TLS 1.2/1.3 per NIST SP 800-52 Rev. 2).
Secure ingestion, cataloging, and recovery of VA user encryption private keys.
Decryption capabilities must maintain metadata and forensic integrity.
Achieve ≥ 95% successful decrypt on eligible items with proper keys, sustaining ≥ 50,000 email items/hour.
Compatible with VA’s Luna T-5000 HSMs and Personal Identification Numbers (PIN) Entry Device (PED)-based key controls.
Role-based access controls with a least-privilege model.
Support services available 24 hours per day, 365 days per year.
Support services must be provided from U.S. based personnel and facilities located within the Continental United States (CONUS).
Support services shall assist with remediation of all vulnerabilities identified through Government security scans.
Original Equipment Manufacturer (OEM) shall provide current versions of all software throughout the maintenance period.
Software and firmware updates, including major releases, point releases, patch management, newly released features, service releases, security releases, and bug fixes.
Provide product documentation and knowledge base documentation.
Generates immutable, exportable audit logs.
Provide Authority to Operate (ATO) support, audit assistance, and evidence collection.
Ensure any Commercial-Off-The-Shelf (COTS) products used are One-VA Technical Reference Model (TRM) approved or achieve TRM approval.
Conform to Section 508 accessibility requirements (Web Content Accessibility Guidelines (WCAG) 2.0 A/AA).
Implement VA Critical Security Controls within any network connected software system or service prior to being authorized for use in the VA (effective July 1, 2025).
Support Social Security Number (SSN) reduction by discontinuing SSN as the Primary Identifier and using Integrated Control Number (ICN).
Solution shall support IPv6-Only based on Office of Management and Budget (OMB) M-21-07 and NIST USGv6 profile.
Contractor is responsible for all software licenses and associated licensing maintenance.
Meet Trusted Internet Connection (TIC) requirements outlined in OMB M-19-26, VA Directive 6513, and TIC 3.0 Core Guidance Documents.
All contractors and subcontractors requiring access to VA information and systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior course (TMS #10176) annually.
Immediately report suspected security/privacy incidents to the VA OIT’s Enterprise Service Desk (ESD).
Information systems designed or developed on behalf of VA must comply with applicable Federal law, regulations, VA policies, FIPS 199/200, and VA Assessment and Authorization (A&A) processes to obtain an ATO.
Comply with OMB M-22-18 and M-23-16 for third-party software, including providing a Software Bill of Materials (SBOM) and self-attestation of secure software development practices.
Comply with Homeland Security Presidential Directive (HSPD) 12 and VA Identity and Access Management (IAM) enterprise identity management requirements (PIV/CAC).
Use VA authorized technical security baseline configurations.
Standard installation, operation, maintenance, updating, and patching of software shall not alter VA approved baseline configuration.
Software developed for VA must be compatible with VA enterprise installer services and install to the default “program files” directory with silent install and uninstall.
Applications designed for normal end users will run in the standard user context without elevated system administration privileges.
Contractor-delivered solutions shall reside on VA approved operating systems.
Design, develop, and implement security and privacy controls in accordance with NIST 800-37, VA Directive and Handbook 6500, and VA Handbook 6517.
Comply with the Privacy Act of 1974 and FAR 52.224-2.
Ensure the security of all procured or developed information systems throughout the life of the contract.
Comply with Code of Federal Regulations (CFR) Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”.
Purchase or acquire equipment from an Original Equipment Manufacturer (OEM) or an authorized reseller.
Establish, implement, and provide documentation for risk management practices for supply chain delivery of hardware, software, and firmware.
Provide a hash conforming to the FIPS 140-2 (or successor) for software or patches.
Use trusted channels to ship procured products, such as U.S. registered mail and/or tamper-evident packaging for physical deliveries.
Demonstrate a capability for detecting unauthorized access (tampering).
Demonstrate chain-of-custody documentation for procured products.
Execute due diligence to ensure all provided software and patches are free of viruses and/or malware.
Document how the cryptographic system supporting the Contractor’s products and/or services protects confidentiality, data integrity, authentication, and non-repudiation.
Use only approved cryptographic methods as defined in FIPS 140-2 (or its successor) and NIST 800-52 standards.
Provide an automated remote key-establishment method.
Ensure emergency re-keying of all devices can be remotely performed within 30 business days.
Provide a method for updating cryptographic primitives or algorithms.
Provide documentation detailing the patch management, vulnerability management, mitigation, and update processes.
Provide appropriate software and firmware updates to remediate newly discovered vulnerabilities or weaknesses within 30 days of discovery (critical/emergent within seven business days).

BUDGET

Estimate

$5,000,000 – $15,000,000

CONTRACT DURATION

60 months

TIMELINE

Published Date: March 16th, 2026

Response Date: March 23rd, 2026

Inactive Dates: March 28th, 2026

QUESTION DEADLINE

March 23rd, 2026

Issuing Agency

Department of Veterans Affairs

Organization overview and procurement intelligence available on paid plans.

See Issuer Research

DESCRIPTION

The requesting organization seeks a vendor to provide a professional service solution for network-based encryption key recovery storage. The solution must be capable of supporting large-scale S/MIME decryption to enable investigations, cybersecurity operations, litigation discovery, and other authorized use cases.

Requirements include integration with enterprise directory services to facilitate user lookup and authorization, and secure ingestion, cataloging, and controlled recovery of user encryption private keys. The process must ensure authorized personnel are provided with a strict, auditable, and controlled workflow for restoring encrypted content, maintaining rigorous access controls, chain-of-custody tracking, and adherence to security and privacy policies.

Additionally, the solution should generate immutable, exportable logs containing details such as user identity, certificate attributes, timestamps, and all recovery operations. This logging is essential for ongoing compliance and auditing purposes.

Source attribution

This Settle analysis is based on the issuing organization’s public RFP listing.