Procurement Independence Notice: Q-Day Audits is an independent governance publication. We do not bid on RFPs, perform accredited cryptographic audits, or certify vendor compliance. Have your legal and procurement teams review all exported clauses before issuing a tender.
Vendor-Neutral PQC Audit RFP Builder & Assessor Scoring Rubric
Generic penetration-testing Statements of Work miss offline PKI ceremonies, PKCS#11 v3.2 HSM firmware roadmaps, and machine-readable CycloneDX v1.6 deliverables. Select the exact cryptographic modules your enterprise requires and export a clean Markdown or plain-text RFP in seconds.
Interactive Vendor-Neutral PQC Audit RFP Builder
Configure your procurement parameters and toggle required Statement of Work modules below. Document generation runs entirely in your browser; nothing entered here is transmitted to any server.
1. Procurement Header & Scope Modules
2. Tailored RFP Document Preview
# REQUEST FOR PROPOSAL (RFP): ENTERPRISE POST-QUANTUM CRYPTOGRAPHIC (PQC) INVENTORY & AUDIT READINESS ASSESSMENT
- **Issuing Entity:** [ORGANISATION_LEGAL_NAME]
- **Proposal Submission Window:** 30 Calendar Days from issue date
- **Regulatory & Technical Baseline:** NIST IR 8547 + OWASP CycloneDX v1.6 + NSA CNSA 2.0
- **Template Source:** Generated client-side via Q-Day Audits (https://qdayaudits.com/rfp-template/)
- **Independence Notice:** Q-Day Audits (qdayaudits.com) provides this vendor-neutral procurement template for educational and internal governance use only and does not bid on RFPs or certify compliance.
---
## 1. Engagement Objective
[ORGANISATION_LEGAL_NAME] invites proposals from qualified, independent cryptographic security assessors to conduct a structured Post-Quantum Cryptography (PQC) inventory verification, architecture gap assessment, and prioritized migration roadmap aligned with **NIST IR 8547 + OWASP CycloneDX v1.6 + NSA CNSA 2.0**.
## 2. Mandatory Standards & Reference Specifications
All assessment methodologies, severity ratings, and machine-readable deliverables must reference current primary standards:
- **NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)** finalized post-quantum standards.
- **NIST IR 8547** classical asymmetric deprecation (2030) and disallowance (2035) schedule.
- **OWASP CycloneDX v1.6** Cryptographic Asset Inventory (CBOM) JSON schema (`cryptoProperties` objects for algorithms, certificates, and protocols).
## 3. In-Scope Assessment Workstreams (4 Selected)
### 3.1 [MOD-A] External Perimeter TLS 1.3, Edge Gateways & OpenSSH Bastions
- **Required Workstream:** Assessor shall enumerate all internet-facing TLS, QUIC, and SSH endpoints, validate TLS 1.3 hybrid post-quantum group negotiation (X25519MLKEM768), identify legacy TLS 1.2 or RSA key-transport listeners, and deliver remediation configurations.
- **Expected Evidence Artifact:** Active handshake verification for X25519MLKEM768 (0x11EC), middlebox fragmentation testing, and OpenSSH 9.9+ key-exchange configuration audit.
### 3.2 [MOD-B] Internal Service Mesh, East-West mTLS & Identity Token Signing
- **Required Workstream:** Assessor shall sample internal microservice mTLS policies, message-broker transport encryption, and enterprise identity provider (OIDC/SAML/JWKS) signing keys, documenting classical RSA/ECDSA dependencies and rotation lead times.
- **Expected Evidence Artifact:** Inspection of Kubernetes ingress/mesh proxies, internal API cipher suites, and OIDC/SAML/JWT asymmetric signing rotation schedules.
### 3.3 [MOD-C] PKCS#11 HSM Clusters, Cloud KMS & Offline Root CA Ceremony Review
- **Required Workstream:** Assessor shall review physical and cloud HSM inventories, verify vendor firmware support for NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), inspect root and issuing CA certificate validity horizons against 2030/2035 deprecation gates, and evaluate key-ceremony controls.
- **Expected Evidence Artifact:** FIPS 140-3 module audit, PKCS#11 v3.2 firmware verification for ML-KEM and ML-DSA, and offline root/issuing CA key-ceremony workpaper review.
### 3.4 [MOD-D] Source Repository Scanning & OWASP CycloneDX v1.6 CBOM Integration
- **Required Workstream:** Assessor shall validate or configure automated source-code and container scanning to emit valid OWASP CycloneDX v1.6 JSON Cryptographic Asset Inventories (CBOM) with populated cryptoProperties records (algorithms, certificates, protocols, and OIDs) free of proprietary vendor lock-in.
- **Expected Evidence Artifact:** Static AST cryptographic discovery across first-party repositories and delivery of validated CycloneDX v1.6 JSON inventories.
## 4. Mandatory Deliverables
1. **Validated CycloneDX v1.6 CBOM Archive (`*.cdx.json`):** Machine-readable cryptographic inventory mapped to concrete repositories, endpoints, certificates, and OIDs.
2. **Prioritized HNDL & Regulatory Gap Register:** Risk-ranked ledger cross-referencing data confidentiality retention horizons against classical RSA, ECDH, and ECDSA exposure.
3. **Executive Board Briefing & Multi-Year Transition Schedule:** Phased remediation plan separating immediate hybrid transport upgrades from multi-year HSM and root PKI ceremonies.
## 5. Assessor Independence & Procurement Conditions
1. Require mandatory disclosure of any OEM, resale, referral, or affiliate commission relationships with HSM, CA, or cryptographic scanner vendors.
2. Require unconditional handover of all raw OWASP CycloneDX v1.6 JSON inventories and audit workpapers with zero recurring software license obligation.
3. Require named CVs for the engagement principal and lead cryptographic architect, prohibiting undisclosed subcontracting.
## 6. Commercial Pricing Format
Bidders must provide a fixed-fee or capped time-and-expense schedule broken down by each numbered workstream in Section 3, stating daily rates by role, tooling assumptions, and sample redacted deliverables.
Procurement review note: Have internal legal counsel and procurement governance attach your standard Master Services Agreement (MSA), mutual NDA, and jurisdiction terms prior to distribution.
Procurement Committee Bidder Evaluation Rubric
Pair your exported RFP with this five-factor scoring matrix when shortlisting external cryptographic security consultancies.
| Evaluation Criterion | Weight | Qualified Bidder Evidence | Disqualifying Red Flag |
|---|---|---|---|
| Open CycloneDX v1.6 Data Handover | 25% | Commits contractually to delivering validated, schema-compliant CycloneDX v1.6 JSON files that your engineering team retains perpetually without SaaS lock-in. | Delivers only static PDF reports or locks inventory records inside a proprietary annual portal subscription. |
| PKCS#11 v3.2 HSM & Offline Root Ceremony Depth | 25% | Demonstrates hands-on FIPS 140-3 Level 3 HSM firmware audit experience, split-custody root CA ceremony review, and LMS/XMSS state-management verification. | Treats PKI and HSMs as out-of-scope questionnaires while running only commodity external SSL scans. |
| Hybrid TLS 1.3 & East-West Service Mesh Testing | 20% | Evaluates X25519MLKEM768 (0x11EC) ClientHello packet-size behavior across load balancers, DPI firewalls, Envoy/Istio meshes, and OpenSSH 9.9+ bastions. | Recommends disabling TLS 1.3 middlebox safeguards or deploying non-standardized post-quantum ciphers directly to production. |
| Regulatory Workpaper Traceability | 15% | Maps every finding directly to OMB M-23-02, NSA CNSA 2.0, NIST IR 8547 (2030/2035), EU DORA Art. 9, or ASD ISM clauses alongside data retention horizons. | Applies generic CVSS vulnerability scores without evaluating Harvest-Now-Decrypt-Later confidentiality lifetimes. |
| Commercial Independence & Fee Transparency | 15% | Discloses any software resale, OEM, or referral ties upfront and prices assessment workstreams independently of tool procurement. | Uses a discounted assessment solely to bundle multi-year proprietary appliance or certificate licenses. |
Reviewed by Evelyn Mercer, Principal Cryptographic Governance & GRC Editor
Reviews OWASP CycloneDX CBOM schemas, federal post-quantum procurement mandates, and PKI governance frameworks.
Last reviewed:
All regulatory mandate timelines, CycloneDX v1.6 schema references, audit scoping weights, and RFP clauses are reviewed every 3 months, or sooner whenever NIST, NSA, OMB, ENISA, or the Australian Signals Directorate issues updated guidance.
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- NIST SP 1800-38: Migration to Post-Quantum Cryptography (NCCoE Practice Guide) (NIST National Cybersecurity Center of Excellence, Discovery & Migration Playbook)
- CISA, NSA & NIST Joint Factsheet: Quantum-Readiness Migration to Post-Quantum Cryptography (US Cybersecurity and Infrastructure Security Agency (CISA), Vendor Procurement Questions)
- OASIS PKCS #11 Cryptographic Token Interface v3.2 Specification (OASIS Open Standards, ML-KEM & ML-DSA Mechanisms)
- NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes (LMS & XMSS) (National Institute of Standards and Technology, HSM State Assurance)
Save Work Email for Procurement & Audit Template Revisions
Enterprise CBOM & PQC Audit GovernanceReceive notifications when we add new RFP clauses for FIPS 140-3 post-quantum module validations, EU DORA technical standards, or third-party SaaS schedules.