Protocol Free Encryption Device (PFED) for Sensitive But Unclassified (SBU) Networks Request for Information (RFI)

3. Instructions to Vendors

3.1.  Responses

Vendors shall respond to this RFI with a white paper in Microsoft Word format compatible with Office 365 no later than fifteen (15) days from the date this was posted or June 10, 2026. The responses should not exceed fifteen (15) pages for the entire submission. This page limit does not apply to administrative sections. The initial section of the white paper shall consist of administrative information and, at a minimum, include the following:

• Designated Point of Contact: Name, mailing address, overnight delivery address (if different), phone number, fax number, and email address.
• Business Size and Classification: Indicate your company’s business size and classification (e.g., large business, small business, small disadvantaged business, 8(a)-certified small disadvantaged business, HUBZone small business, woman-owned small business, very small business, veteran-owned small business, service-disabled veteran-owned small business) based on North American Industry Classification System (NAICS) code 334210 Telephone Apparatus Manufacturing.  

3.2 Requested Information

The responding vendor shall address the questions and topics of interest outlined in this paragraph of the RFI and is limited to fifteen (15) pages for the entire submission. This section shall provide evidence of vendor experience and briefly summarize the PFED’s capabilities. Interested parties are requested to respond to this RFI with a white paper addressing the following questions. Potential respondents shall answer the questions in sections 3.2.1 and 3.2.2. If a question is not applicable to the device(s), simply respond to the question stating, “Not Applicable”.

3.2.1 Company and Device(s) Overview

1. Provide an overview of your company and your experience in the field of network security and cryptography. 
2. Describe your primary device(s) that meet the description of a protocol-agnostic inline network encryptor. Include model names, target use cases, and key differentiators.
3. Provide example deployment diagrams for common use cases (e.g., data center interconnect, secure campus link). 
4. Please provide a general, non-binding overview of your pricing model for your device(s).
   1. Is licensing based on hardware, throughput, features, or a subscription model? 

3.2.2 Technical Information

1. What are the supported throughput rates for your devices (e.g., 1 Gbps, 10 Gbps, 40 Gbps, 100 Gbps, etc.)?
   1. Is this throughput guaranteed at full duplex?
   2. What industry standard was used to determine throughput?
2. What is the Size, Weight and Power (SWAP) of your device(s)?
3. What are the power, cooling, and physical rack unit requirements for the device(s)?
   1. Are redundant power supplies available?
4. Describe the management interface of the device (e.g., CLI, Web GUI, NETCONF/YANG).
   1. How is network management performed? 
5. What logging and auditing capabilities are available?
   1. What types of events are logged? 
6. How are software and firmware updates securely applied to the device? 
7. What is the typical latency added by the device at various throughput rates? Please provide specific metrics in microseconds (µs). 
8. What physical network interfaces are supported and how are they to be replaced?
9. Which Commercial National Security Algorithm (CNSA) Suite standards is your device compliant with?
10. Do your devices hold any government or industry security certifications or other compliance? Please list all relevant, current certifications or compliances (e.g., FIPS, Common Criteria EAL4+). 
    1. Please include any relevant IDs associated with the certifications or compliances.
11. What cryptographic algorithms and modes of operation are used for data encryption (e.g., AES-256 GCM)? 
12. What PQC protocols are implemented on the device?
13. Describe the key management architecture.
    1. How are cryptographic keys generated, distributed, stored, and rotated?
    2. Is an external Key Management Server required or supported? 
14. Are the cryptographic keys ephemeral, refreshing automatically for each session? What is the default key-life?

3.3 Responses

White paper submissions, prepared in Microsoft Word format compatible with Office 365, are due 15 calendar days following the release of this RFI. Responses shall be formatted in Times New Roman, 12-point font, and include a Title Page (Section 1) and a synopsis (Section 2). Section 2 is limited to a maximum of fifteen (15) pages and must be submitted via email to Contracting Officer, Sharon A. Peterson, [email protected] and Contract Specialist, Melody S. Thomas, [email protected].

Any proprietary information or trade secrets contained within the submission must be clearly marked on all relevant materials. The Government will handle all information designated as Proprietary in accordance with applicable regulations. Please note that all submissions become the property of the USG and will not be returned. All USG and contractor personnel reviewing RFI responses will be bound by signed non-disclosure agreements and will adhere to the responsible use and protection of proprietary information, as outlined in 41 USC 423. The USG assumes no liability for damages incurred due to the failure to properly identify proprietary information.

4.0 Questions

Questions regarding this announcement shall be submitted in writing via e-mail to Contracting Officer, Sharon A. Peterson, [email protected], and Contract Specialist, Melody S. Thomas, [email protected].  Verbal questions will NOT be accepted. Questions will be answered by posting responses to the SAM.gov website. Accordingly, questions shall NOT contain proprietary or classified information.