Most agencies cannot inventory their cryptographic assets or machine identities. We can — vendor-neutral, no remediation, no agenda.
NSA requires documented algorithm inventories across classified and unclassified systems. We generate that baseline without disruption to operations.
State actors are collecting DoD encrypted traffic today. Quantum relevance arrives 2030–2035. Classification windows demand action now.
Unmanaged service accounts are the vector state actors exploit. We deliver the NHI inventory your Zero Trust architecture requires.
Federal auditors require service account inventories with credential rotation evidence. Most civilian agencies cannot produce this on demand. MIBOM closes that gap before the auditors arrive.
Our platform feeds directly into your CDM dashboards. No manual export, no translation layer. Real-time posture within your existing CDM investment.
Bundled discovery costs agencies 30–50% more. QFed delivers inventory only — you run your own competitive RFP, preserving FAR requirements and saving millions.
OMB M-23-02 mandates a complete cryptographic asset inventory. Most agencies have no automated way to produce it.
"When we scan cisa.gov — the agency writing the guidance — they're in the same position as everyone else."
Federal environments average 144 non-human identities per human user. 97% are over-privileged. Most have no owner. IG audits now require a complete machine account inventory.
"MFA protects human logins. Firewalls protect the perimeter. Neither inventories service accounts."
State actors are harvesting encrypted federal traffic now. When quantum computers arrive — 2030 to 2035 — everything collected today becomes readable.
"Clearance files. Treaty documents. Acquisition strategies. Data with decades-long confidentiality windows is already at risk."
Major vendors bundle discovery with remediation — by the time you have inventory, you've lost procurement leverage. QFed separates discovery from remediation. Always.
"We don't sell remediation. No preferred vendors. No incentive to steer you anywhere but toward competitive bids."
Vendor-neutral automated discovery of every cryptographic asset — algorithms, certificates, key lengths, libraries, dependencies. Generates a machine-readable CBOM aligned to OMB M-23-02, with native CISA CDM integration.
Complete inventory of every non-human identity — service accounts, API keys, OAuth tokens, certificates, bots, secrets, scripts. Generates the audit-ready identity report federal IGs require.
Define scope — network ranges, cloud accounts, on-prem, SaaS. No agents required. Activates within days of task order.
Discovery runs across your defined environment. No credentials transferred. No data leaves your perimeter. On-premise available for classified.
Every finding reviewed by our cryptographic science team. Risk-prioritized, written for both technical and executive audiences.
Complete inventory reports with executive briefing. Structured for your competitive procurement — any vehicle your agency prefers.
Quarterly rescans, certificate expiry alerts, NHI drift detection, compliance mapping updates.
We inventory everything. Then we stop. No remediation. No vendor referrals. No agenda. Independent by design.
No remediation services — ever
No preferred vendor relationships
Findings structured for competitive RFP
Data belongs to your agency — fully portable
| Mandate | What It Requires | How QFed Addresses It | Coverage |
|---|---|---|---|
| OMB M-23-02 | Automated cryptographic inventory of all federal systems | ACDI generates machine-readable CBOM covering all discovered cryptographic assets | ✓ Direct |
| CNSA 2.0 | Software/firmware deadline Dec 31, 2026; full compliance by 2033 | ACDI maps all RSA/ECDSA/ECDHE with CNSA 2.0 readiness scoring and migration priority queue | ✓ Direct |
| CISA CDM | Continuous Diagnostics & Mitigation real-time dashboard feeds | Native CDM integration — direct feed to agency dashboards, no manual export required | ✓ Native |
| EO 14028 / Zero Trust | Complete inventory of all identities including non-human accounts | MIBOM delivers NHI inventory Zero Trust architecture requires | ✓ Direct |
| FISMA / IG Audits | Documented inventory of privileged accounts with rotation evidence | MIBOM generates audit-ready identity reports with ownership and rotation status | ✓ Direct |
| NIST SP 800-208 | Algorithm compliance detection and deprecation timeline tracking | ACDI flags all deprecated algorithm usage, prioritized by NIST schedule | ✓ Direct |
| NSM-10 / PQC Strategy | PQC migration planning underway for all federal agencies | ACDI delivers the cryptographic inventory NSM-10 migration planning requires | ✓ Enabling |
No-cost executive or technical briefing. Live demo using publicly available federal infrastructure. No commitment.
Response: Same business day
Format: Video, on-site, or written brief
Cost: No charge
Process: Online request
Request Briefing →Scoped engagement delivering CBOM and/or MIBOM with executive briefing. No remediation bundled. Ever.
Output: Machine-readable BOM + executive brief
Vehicle: Direct procurement, P-Card eligible
Pricing: Quote via Typeform
Order Assessment →Continuous monitoring, quarterly rescans, certificate expiry alerts, NHI drift detection.
Frequency: Continuous + quarterly rescans
Alerts: Cert expiry · NHI drift · algo changes
Pricing: Annual — quote via Typeform
Discuss Subscription →Expose the hidden costs of 'free' cryptographic assessments. Why discovery-to-remediation bundling destroys competitive procurement and how vendor-neutral approaches save millions.
Target: Federal CISOs, Procurement Officers
Request Access →Critical timeline for federal cryptographic inventory requirements. Month-by-month compliance milestones, audit preparation checklists, and remediation sequencing strategies.
Target: Compliance Officers, Agency Leadership
Request Access →How DoD components and IC agencies can generate the cryptographic baseline CNSA 2.0 requires — classified, unclassified, JWCC cloud, and supply chain — without vendor lock-in.
Target: DoD CISOs, Program Managers, IC Leadership
Request Access →Request a no-cost agency briefing. We'll show you what's there. All of it. No agenda attached.
Request Briefing via Typeform →