Zero Trust Post Quantum Cryptography (PQC) Roadmap AOI 26-A006 under RCC CSO N6523626S0001

The advent of cryptographically relevant quantum computers (CRQCs) poses a direct, existential threat to the security and operational integrity of Department of Navy (DoN) and Marine Corps systems. In accordance with National Security Memorandum 10 (NSM-10) and OMB Memorandum M-23-02, the DoN must execute a rapid, phased, and strategically coordinated migration to Post-Quantum Cryptography (PQC). To manage risk, coordinate migration, and optimize financial investments, the DoN must first establish a complete, authoritative, and continuous baseline inventory of all cryptographic algorithms, protocols, modules, and
implementations currently deployed. Currently, cryptographic baselines rely on resourceintensive, manual processes. The DoN requires an automated solution to accelerate discovery and improve enterprise-wide visibility.

NIWC Atlantic seeks to prototype a rapidly deployable, integrated, and scalable commercial solution capable of automating the discovery, identification, and cataloging of cryptographic assets across all DoN and Marine Corps networks and systems. This includes enterprise IT (onpremise and cloud), mobile systems, operational technology (OT), and tactical/embedded weapon platforms. The ultimate objective is to automate the generation of a Cryptographic Bill of Materials (CBOM) to support central risk reporting, vulnerability assessments, and PQC migration prioritization.