What should contractors do to respond to the FAA's RFI on transitioning the National Airspace System to post-quantum cryptography? 2026

According to GSA guidelines, contractors must provide a clear, phased migration roadmap that maps current cryptographic dependencies to candidate post-quantum algorithms, cost models, and test harnesses. This paragraph addresses immediate scope: contractors should inventory cryptographic endpoints across avionics, ground systems, communications, and back-office services, quantify affected keys and certificates, and estimate rework. Per NIST PQC standardization guidance, list which round-3/standardized algorithms you will adopt and provide fallback strategies. The FAA RFI (published in the Federal Register June 2025) requests end-to-end test plans and timelines; include a schedule with milestones at 6, 12, and 24 months. Per FAR contracting rules, identify subcontracting and teaming opportunities and indicate small-business status when applicable to expedite evaluation. Include an explicit supply-chain risk-management plan referencing NIST SP 800-series practices and attestations for hardware roots of trust and crypto modules.

Per FAR 19.502, small businesses can use teaming and subcontracting to compete for larger PQC modernization work; your RFI response should state intended set-aside strategies and identify certified partners (8(a), HUBZone, WOSB, SDVOSB). The SBA reports that 78% of small contractors anticipate pursuing PQC-related work by 2027, so emphasize how your small-business status accelerates cost-effective execution. Under OMB M-25-21, agencies will prioritize modern, secure technology transitions; therefore include cost-benefit analysis and compliance alignment to OMB guidance. Include FedRAMP considerations for cloud-hosted key-management and cryptographic services, and note if you plan to pursue FedRAMP authorization or reuse authorized solutions.

The SBA reports that 78% of potential PQC vendors expect to pivot existing cryptographic services toward PQC by 2027; use that industry momentum to present credible staffing and training plans. Under OMB M-25-21, agencies will expect documented risk assessments and budget alignment; attach a short A-123-style control matrix showing how PQC migration maps to existing A-123 controls. DoD's CMMC framework requires demonstrable cybersecurity maturity for controlled unclassified information; while FAA is civilian, reference CMMC practices for supplier assurance and incident response to strengthen your supply-chain claims. Cite NIST PQC milestones and indicate planned participation in algorithm validation and interoperability test events.

According to GSA guidelines, contractors must demonstrate testable interoperability of candidate PQC algorithms within existing NAS protocols and certify that critical-path comms (radionavigation, ADS-B feeds, control links) maintain latency and reliability metrics. Per FAR requirements, include a quality-control plan that documents contract deliverables, acceptance criteria, and integration test steps with FAA system owners. Under OMB M-25-21, agencies will expect vendors to quantify cost, schedule, and security tradeoffs; provide a line-item cost estimate for algorithm substitution, cryptographic library upgrades, HSM replacements, and certificate reissuance. Reference NIST PQC validation timelines and show how your demonstration will stage pilots for low-risk subsystems first (6–12 month pilots) and high-criticality systems in a 12–36 month window.

Per FAR 19.502, small businesses can accelerate selection by highlighting teaming arrangements with certified prime contractors; list named subcontractors, their NAICS codes, and socio-economic certifications (8(a), HUBZone, SDVOSB). The SBA reports that 78% of small contractors expect PQC demand growth—use that to justify recruiting and training costs and to show labor availability. DoD's CMMC framework requires documented cybersecurity processes; although CMMC is DoD-specific, adopt CMMC practices for incident response and supply-chain verification to increase FAA confidence. Include references to past performance showing you met cryptographic upgrades on schedule and budget, with dates, contract numbers, and dollar values where allowable.

Under OMB M-25-21, agencies will require clear governance and budget authority for procurement and lifecycle support of PQC solutions; present an explicit sustainment cost by year for 3–5 years. According to GSA guidelines, quantify replacement cycles for HSMs, TLS endpoints, and PKI certificates and show software lifecycle plans including patching and algorithm agility. Include FedRAMP considerations for cloud-hosted key management and list any current FedRAMP-authorized products you plan to reuse. Per FAR contracting principles, clarify whether your response is informational (RFI) only or anticipatory of a future solicitation; disclose any conflicts and intent to form joint ventures for prime bidding.