CN-550000-BED34-W0010000.pdf

STATE OF FLORIDA DEPARTMENT OF TRANSPORTATION

TASK WORK ORDER FOR

MASTER UNIVERSITY AGREEMENT

375-040-80

PROCUREMENT

OGC – 07/14

Master Agreement #:

BED34

Cost Center # - Task Work Order #:

977 - 01

University:

University of West Florida

Task Work Order Description:

Connected Vehicle Security Metrics and Threat Intelligence

The start date of this task work order is:

Upon execution of the Task Work Order by the Department.

Issuance of a Notice to Proceed.

As specified in Exhibit A (Scope of Service).

In accordance with the above referenced contract, you are authorized to perform the tasks detailed in attached Exhibit A (Scope of Services). All services required under this Task Work Order will be completed by:

5/31/2024 or the end date of the Master Agreement, whichever occurs first.

For the required services, compensation shall be $ 267,871.35 as described in the attached Exhibit B (Method of Compensation).

Fund Type:

State Funds Federal Funds

Applicable Appendices: (If checked, Appendix must be attached to the TWO)

Appendix 1 Terms for Federal Aid Contracts Appendix 2 Terms for Information Technology Resources Appendix 3 Terms for Federal Transit Administration Other:

Note: Master University Agreement cannot be used for grant disbursement to subrecipients

Department Contact:

Name: Jennifer Clark Phone: (850) 414-4614

Office: Research Center Email: jennifer.clark@dot.state.fl.us

Departmental Approval:

J. Darryll Dockstader Manager, Research Center (Name) (Title) (Signature) (Date)

University Acceptance:

(Name) (Title) (Signature) (Date)

Legal Review:

Matthew C. Schwartz, Ph.D. Associate V.P. of Research Admin.

UWF Office of the General Counsel:

George Ellenberg, Ph.D.

Provost/Senior Vice President

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489AD

05/31/2022

DocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

6/1/2022 | 12:32 PM EDT

Exhibit A -- Scope of Service

Project Title: Connected Vehicle Security Metrics and Threat Intelligence

Principal Investigator: Guillermo A. Francia, III, Ph.D.

Center for Cybersecurity, University of West Florida 220 W Garden Street Suite 250 Pensacola, FL 32502 gfranciaiii@uwf.edu Phone: (850) 474-3321

DSR Administrative Contact: Elan Travis University of West Florida 11000 University Pkwy, Pensacola, FL32514 etravis@uwf.edu Phone: (850) 474-2825

Project Manager: Raj Ponnaluri, Ph.D., P.E., PTOE, PMP Connected Vehicles, Arterial Management, Managed Lanes Florida Department of Transportation (FDOT) Raj.Ponnaluri@dot.state.fl.us

April 29, 2022

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Background Statement

The emergence of connected and autonomous vehicles at an unprecedented pace ushered several local government-sponsored initiatives to start planning and building a transportation information network that utilizes intelligent sensors and sophisticated communication systems. Peripheral sensors that are used to assist the human operator in lane changing, obstacle avoidance, and parking are slowly being integrated in modern automotive vehicles. Although this newly found convenience is a boon to society, both socially and economically, it presents security challenges that are endemic to connected technologies. These challenges underscore the need to examine the state of connected vehicle security and design an effective threat intelligence portal.

Today’s automobiles have more than 150 electronic control units (ECUs), which are embedded devices that control and automate the vehicle operations and performance including, but not limited to, infotainment, engine monitoring, tire pressure measurement, location and guidance, comfort and safety, braking, and autonomous driving. Further, modern vehicles are equipped with wireless communication devices, some connected to the Internet, that enable access convenience and online services (Karahasanovic, 2016).

These devices, together with advanced communication technologies, enable the expansion of the attack surface of a modern automotive vehicle. The major components of the attack surface are depicted on Figure 1.

Figure 1. Attack Surface of a Modern Automotive Vehicle

Vehicle to Vehicle (V2V):

DSRC, C-V2X, Lidar, Sonar, Radar, WiFi, Bluetooth

Vehicle to Infrastructure (V2I):

Telematics Cellular, GPS, DSRC

Sensors Cameras

Vehicle to Device (V2D):

CAN Bus Infotainment USB Devices, OBD Devices, ECUs

Key Fob

Tire Pressure Monitoring System (TPMS)

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

A technical brief by Trend Micro, described the vulnerability found in modern vehicles’ networks. This vulnerability enables a stealthy denial-of-service attack that practically works for every automotive vendor and had been disclosed and prompted an Industrial

Control Systems-Computer Emergency Response Team (ICS-CERT) alert: ICS-ALERT-

17-209-01. Exploitable hardware design flaws in some capacitive micro-electromechanical system (MEMS) accelerometer sensors produced by prominent automobile parts manufacturers were reported in another ICS-CERT alert in early 2017:

ICS_ALERT-17-073-01A. Tools, techniques, and procedures in securing traditional

Information Technology (IT) systems cannot simply be applied to vehicle network systems due to their incongruent functionalities and sophistication. Recognizing this fact, a special set of security metrics and a threat intelligence gathering, and analysis system are needed to proactively secure these systems.

Project Objectives

The objectives of the proposed project are as follow:

1. Design and develop a comprehensive set of security metrics and visualization system for connected vehicles;

2. Implement a prototype Machine Learning (ML) system that will process sensor data for intelligent security analytics; and

3. Create a web-based threat intelligence portal for connected vehicles.

The goal of the project is to enhance and enable the continuous improvement of the cybersecurity posture of the transportation system in Florida through security metrics, intelligent analytics, and threat intelligence.

Project Team

The project team is composed of experienced researchers with proven track records of steering innovative projects to successful conclusions. The project will be led by Dr.

Guillermo Francia, III, Ph.D. as the Principal Investigator (PI). The qualifications, roles, and responsibilities of each team member are provided in the following:

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

• Dr. Guillermo Francia, III, a two-time recipient of a Fulbright award related to cyber security projects, has successfully managed research projects worth over $3M that were funded by the National Science Foundation, Department of Defense, Department of Energy, and Department of Homeland Security. He held

Distinguished Professor and Director of the Center for Information Security positions at Jacksonville State University prior to joining University of West Florida

(UWF) in 2018. He will assume the overall administration of the project, as well as the leadership role in research on vehicle security metrics, visualization, and

Machine Learning.

• Dr. Tirthankar Ghosh (co-PI) spent thirteen years at St. Cloud State University, MN, as the lead faculty and program director for Cybersecurity. Dr. Ghosh has received millions of dollars’ worth of grants from NSF, DOD, State of MN, and the private sector. Dr. Ghosh’s research areas include Intrusion and Anomaly Detection, Threat Intelligence, Adversary Behavior Modeling, and Cybersecurity Education.

He will lead the research activities on Vehicle Threat Intelligence and Threat

Hunting. He will also assist Dr. Francia in assessment, procurement, and reporting.

• Dr. Brian Eddy, an Associate Professor, holds a Ph.D. in Computer Science from the University of Alabama. His research examines software engineering, program comprehension, software maintenance and evolution, model-driven engineering and information retrieval. Dr. Eddy also studies modern software development techniques for cloud and service-based architectures. Dr. Eddy has a M.S. in

Computer Science from the University of Alabama and two B.S. degrees from

Armstrong Atlantic State University – one in Computer Science, the other in

Applied Mathematics. His research on latent Dirichlet allocation has been published in Empirical Software Engineering. He will lead the design and implementation of the Amazon Web Services (AWS) based Threat Modeling, Collection, and Intelligence Portal System. Dr. Eddy will collaborate with Dr. Ghosh in the development of the Threat Modeling Engine.

The PI and co-PIs will be supported by student research assistants who will undertake the application and system development activities. Further, an administrative assistant

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F will be hired and will be responsible for project scheduling, budget management, invoicing, and student hiring and supervision.

Project Kick-off Teleconference

The principal investigator will schedule a kick-off meeting to be held within the first 30 days of task work order execution. The kick-off meeting will consist of a webinar at least

30 minutes in length. The purpose of the meeting is to review the tasks, deliverables, deployment plan, timeline, and expected/anticipated project outcomes and their potential for implementation and benefits. The principal investigator shall prepare a presentation following the template provided at https://www.fdot.gov/research/project-mgt-resources.shtm.

The project manager, principal investigator, and research performance coordinator shall attend. Other parties may be invited if appropriate.

Supporting Tasks and Deliverables:

The following illustrates each of the project tasks and the associated deliverables for each task.

Task 1: Develop vehicle security metrics based on published literature and standards.

Document the research activities associated with the development.

A very well-known cliché states that “what cannot be measured cannot be improved.”

This is the motivation behind this task. We propose to develop vehicle security metrics based on attack surfaces on three abstract dimensions: method, data, and channel. We will investigate the cost-benefit ratio between efforts of gaining access and potential impacts of security failure among the three dimensions. This technique based on an earlier published work by the PI on baseline operational metrics for industrial control systems. Further, we will also leverage industry-recognized frameworks, standards, and guidelines as bases for the development of the metrics.

Among the prominent frameworks, standards, and guidelines are the following:

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F https://www.fdot.gov/research/project-mgt-resources.shtm

● The Common Vulnerability Scoring System (CVSS), which is an open framework for communicating the characteristics and severity of software vulnerabilities. The Forum of Incident Response and Security Teams

(FIRST) developed the metric framework based on the static intrinsic qualities of vulnerabilities, the evolution of the vulnerabilities, and the behavior of the vulnerabilities on the user environment.

● The U.S. Government Accountability Office (GAO) Report on Vehicle

Cybersecurity which contains, among others, the key security vulnerabilities in modern vehicles, the key practices and technologies to mitigate vehicle cybersecurity vulnerabilities, the challenges facing stakeholders, and the

Department of Transportation’s (DOT) efforts in addressing the issues in vehicle cybersecurity.

● The Society of Automotive Engineers (SAE) Cybersecurity Guidebook for

Cyber-Physical Vehicle Systems, which describes a cybersecurity process framework from which an organization can develop processes to design and build cybersecurity in vehicular systems.

● The National Highway Traffic Safety Administration (NHTSA) Automotive

Security Best Practices for Modern Vehicles, which presents the results and analysis of a review of best practices and observations in the field of cybersecurity involving electronic control systems across a variety of industry segments where the safety-of-life is concerned.

● The National Institute of Standards and Technology (NIST) Cybersecurity

Framework components for managing cybersecurity risks for connected vehicles.

Deliverable 1: Upon completion of Task 1, the research team will submit to the

Research Center at research.center@dot.state.fl.us a technical memorandum containing the details of the developed Vehicle Security Metrics and a record of the vehicle security research activities.

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F mailto:research.center@dot.state.fl.us

Task 2: Design and implement a web-enabled Vehicle Security Metrics Visualization

System (VSMVS). Visualization takes advantage of cognitive perception in effectively presenting information to users. It offers a powerful means of recognizing trends and patterns that are not easily recognized using non-visual methods. In essence, the cognitive reasoning process is augmented by perception to bring about a more rapid analytical reasoning process. This task focuses on the depiction of security metrics that were developed in Task 1 by utilizing visual perception. The implementation of this system will employ the tools and facilities that are available through subscriptions provided by

Amazon Web Services (AWS). The itemized AWS services are shown below. The development process will adhere to FDOT’s development standards (see https://dev.azure.com/fdot/Standards/) and Transportation Technology Manual (see https://www.fdot.gov/it/oitmanual.shtm).

Deliverable 2: Upon completion of Task 2, the research team will submit to the

Research Center at research.center@dot.state.fl.us a technical memorandum that contains a compilation of the following: the design specifications and requirements of the VSMVS, the implementation code and support documents of the web enabled VSMVS, and a white paper on vehicle security research and/or a peer-reviewed publication.

Task 3: This task is mainly focused on the testing and deployment of the web enabled

VSMVS. Access to the VSMVS through the AWS cloud services will be limited to FDOT personnel. Any additional access will be granted at the discretion of the FDOT project manager.

Deliverable 3: Upon completion of Task 3, the research team will submit to the containing the test plans, scenarios, and cases used for testing the VSMVS. The technical memorandum will also include a user manual for the VSMVS.

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F https://dev.azure.com/fdot/Standards/ https://www.fdot.gov/it/oitmanual.shtm

Task 4: Data ingestion, cleansing, normalization, and data mutation (malicious data injection) of the Connected Vehicle Roadside Unit (RSU). This task will utilize the dataset, in SAE J2735 message format, that were previously collected by RSUs in Gainesville, FL. The data will be preprocessed and normalized for Machine Learning. In addition, synthetic anomalous data will be randomly injected to simulate cyber threats and attacks.

The dataset, in SAE J2735 message format, include the following: BasicSafetyMessage

(BSM), PersonalSafetyMessage (PSM), SignalPhaseAndTiming (SPAT), SignalRequestMessage (SRM), SignalStatusMessage (SSM), and

TravelerInformationMessage (TIM).

Deliverable 4: Upon completion of Task 4, the research team will submit to the containing the dataset attributes, the details of preprocessing, normalization, and injection processes, and the data attributes and indicators of simulated cyber threats and attacks.

Task 5: Design, implement, and test a prototype Machine Learning system. This task complements Task 4 to realize a prototype Machine Learning (ML) system for vehicle security and performance monitoring. This task will utilize the AWS SageMaker Studio for

ML development and deployment.

Deliverable 5: Upon completion of Task 5, the research team will submit to the containing the design specification and requirements of the prototype ML system, the implementation of the prototype ML system, the performance indicators gathered during the application of the ML system on the modified RSU dataset, and the documents containing the test plans, scenarios, and cases used for testing.

Task 6: Design and implement a Vehicle Threat Modeling Engine (VTME). The VTME will use a variety of Open-Source Intelligence (OSINT) data sources for collating realistic

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F vehicle threat intelligence to support threat models. Each cyber threat model will be built based on the stages identified in the slightly modified Lockheed Martin Cyber Kill Chain.

Specific Tactics, Techniques and Procedures (TTPs), endemic to connected vehicle systems, will be initially populated from MITRE’s Adversarial Tactics, Techniques, and

Common Knowledge (ATT&CK) matrix. Specific Indicators of Compromise (IoCs) associated with TTPs can be obtained from sources such as Open Threat Exchange

(OTX) and VirusTotal. Specific known vulnerabilities and the affected platforms can be identified via the Common Vulnerabilities and Exposures (CVE) and Common

Weaknesses and Enumeration (CWE) databases. All of these are free and publicly available resources.

Deliverable 6: Upon completion of Task 6, the research team will submit to the containing a compilation of the design specification and requirements of the VTME, a record of the implementation details, and the test plans, scenarios, cases and results for the VTME.

Task 7: Design and implement an automated Vehicle Threat Collection System (VTCS).

This task focuses on the design and development of an automated system whose purpose is to collect threat intelligence feeds from various sources. Threat Intelligence data will come from publicly available Open-Source Intelligence (OSINT) sites. These include Open Threat Exchange (OTX) and VirusTotal, both of which offer Application

Programming Interfaces (APIs) for automated queries. These threat feeds include IoCs associated with the attacks. Common Vulnerabilities and Exposures (CVEs) are freely distributed as a download in a variety of formats to include Comma Separated Values

(CSVs) and Extensible Markup Language (XML). The CVE data identifies specific makes, models, and versions of vulnerable devices in connected vehicles. We will also leverage the community-developed list of Common Weaknesses Enumerations (CWEs) that is also freely available in automation friendly formats.

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Deliverable 7: Upon completion of Task 7, the research team will submit to the contains the following: the design specification and requirements of the VTCS, the record of the implementation details, and the test plans, scenarios, cases and results for the VTCS.

Task 8: Design, implement and deploy a Vehicle Threat Database System (VTDS). The threat intelligence data will need an efficient repository at the back-end for search query processing and access. Thus, this task will focus on the design and implementation of a cloud-enabled vehicle threat database management system through AWS.

Deliverable 8: Upon completion of Task 8, the research team will submit to the contains the following: the design specification (ER models and constraints) and requirements of the VTDS, a record of the implementation details, and the test plans, scenarios, cases and results for the VTDS.

Task 9: Design, develop and deploy a Vehicle Threat Intelligence Portal (VTIP). The VTIP will provide the front-end web-enabled Graphical User Interface (GUI). It will facilitate secure access to the functionalities of the connected vehicle threat information system.

The threat database, along with other external threat feeds and initial Indicators of

Compromise (IOC), will be fed to the VTIP, which will generate a list of final IoCs and package them in standard Structured Threat Information Expression (STIX) format. The portal will provide a threat sharing functionality and connectivity to a Malware Information

Sharing Platform (MISP) server. It will also provide a search functionality for searching

IoCs. The threats will be mapped to the MITRE ATT&CK Framework to provide better visibility and acceptance. The implementation of this portal will employ the tools and facilities that are available through subscriptions provided by Amazon Web Services

(AWS). The itemized AWS services are shown below. The development process will adhere to FDOT’s development standards (see https://dev.azure.com/fdot/Standards/) and Transportation Technology Manual (see https://www.fdot.gov/it/oitmanual.shtm).

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F mailto:research.center@dot.state.fl.us mailto:research.center@dot.state.fl.us https://dev.azure.com/fdot/Standards/ https://www.fdot.gov/it/oitmanual.shtm

Deliverable 9: Upon completion of Task 9, the research team will submit to the that contains the following: the design specification and requirements of the VTIP, the record of the implementation details, the test plans, scenarios, cases and results for the VTIP, and an analysis of the impact of each vehicle vulnerability on connected vehicle infrastructure and interconnection systems.

Task 10: System Integration, Testing and Deployment. This task will focus on the integration, testing and final deployment of all the systems that were designed and implemented in the previous tasks.

Deliverable 10: Upon completion of Task 10, the research team will submit to the contains the following: the details of system integration, testing, and deployment, the record of continuous improvement of the system, and a detailed user manual.

Task 11: Draft of Final Report and Closeout Teleconference

Deliverable 11a: Ninety (90) days prior to the end date of the task work order, the university will submit a draft final report in PDF and Word formats to research.center@dot.state.fl.us.

The draft final report will contain the following sections and subsections:

1. Major Accomplishments

a. Major activities

b. Key outcomes and achievements

c. Opportunities for training and sustainability

d. Dissemination activities

e. Future plans

2. Media, Products and/or Services Resulting from the Project

a. Publications

b. Software products

c. Services (if any)

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F mailto:research.center@dot.state.fl.us

3. Participants

a. List of participants in the project and roles

b. Other organizations (if any)

4. Project Evaluation/Assessment

a. Description of assessment/evaluation methods and instruments

b. Assessment/evaluation data

5. Changes/Problems

a. Description/justification of deviations from project goals and objectives, if any

The draft final and final reports must follow the Guidelines for University Presentation and Publication of Research and the FDOT Research Final Report Style Guide available at https://www.fdot.gov/research/project-mgt-resources.shtm.

The report must be well-written and edited for technical accuracy, grammar, clarity, organization, and format. The report must also comply with section 508 of the United

States Workforce Rehabilitation Act of 1973.

Deliverable 11b: Thirty (30) days prior to the end date of the task work order, the principal investigator will schedule a closeout teleconference. The principal investigator shall prepare a PowerPoint presentation following the template provided at https://www.fdot.gov/research/project-mgt-resources.shtm.

At a minimum, the principal investigator, project manager, and research performance coordinator shall attend. The purpose of the meeting is to review project performance, the deployment plan, and next steps.

Task 12: Final Report

Deliverable 12: Upon Department approval of the draft final report, the research team will submit the Final Report in PDF and Word formats electronically to the

Research Center at research.center@dot.state.fl.usThe Final Report is due by the end date of the task work order.

Use of Student(s) and other Research Assistants

Four students, preferably graduate students, will be hired as research assistants. The students will assist the Principal Investigator (PI) and the co-PIs in research, contribute

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F https://www.fdot.gov/research/project-mgt-resources.shtm to the design and development of the proposed systems, software engineer the implementation of the system, and work on testing and deployment of the systems.

One OPS staff will be hired primarily as a local project and budget manager.

Equipment

The project will not be acquiring any equipment. The Center for Cybersecurity at UWF will provide the necessary computing equipment that will access the cloud infrastructure and services provided by Amazon Web Services (AWS).

Expenses

Amazon Web Services (AWS) Estimates:

● Database Management System o Aurora, db.t3.large o Aurora, storage charge o Aurora DB backup o NOTE: Aurora snapshots are NOT backups. Recommend to just use built-in Aurora daily backups unless you absolutely need to take a snapshot of the DB. Even if you take a snapshot and delete it, you still get charged.

● Web Server and Visualization System o EC2 On-Demand, Linux, a1.xlarge (4 x vCPU, 8GB RAM) o EC2 On-Demand, Windows, t3.large (2 x vCPU, 8GB RAM) o AWS EBS Volume Snapshot: $0.10/GB/mo (assuming Linux instance acts as web server, so 8GB volume, keep last 5, 40GB total)

● Machine Learning System o SageMaker On-Demand Notebook, ml.t3.large o SageMaker storage: $0.14/GB/mo (assuming 50GB)

● Storage o S3 bucket: $0.021/GB (assuming it will reach 10TB)

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Travel

Travel expense will not be incurred in this project.

Financial Consequences

Payment shall be made only after receipt and approval of goods and services.

Deliverable(s) must be received and accepted in writing as specified in the task work order prior to payment.

If the Research Center and/or project manager determine that the performance of the university is unsatisfactory, the Research Center shall notify the university of the deficiency to be corrected, and correction shall be made within a timeframe to be specified by the Research Center. Within five days of notice from the Research Center, the university shall provide the Research Center with a corrective action plan describing how the university will address all issues of contract non-performance, unacceptable performance, failure to meet the minimum performance levels, deliverable deficiencies, or contract non-compliance. If the corrective action plan is unacceptable to the Research

Center, the university shall be assessed a non-performance retainage equivalent to 10% of the total invoice amount. The retainage shall be applied to the invoice for the current billing period. The retainage shall be withheld until the university resolves the deficiency.

If the deficiency is subsequently resolved, the university may bill the Department for the retained amount during the next billing period. If the university is unable to resolve the deficiency, the funds retained may be forfeited at the end of the task work order period.

Minimum Performance Measures

Performance metrics are defined in this scope of work, which describes the tasks, milestones, and/or deliverables the principal investigator shall accomplish and provide under this task work order. The Research Center will conduct periodic reviews to determine compliance with the tasks, milestones, and/or deliverables.

Publication Provision

If at any time during the task work order (TWO), the university desires to publish, in any form, any material developed under the TWO, the university must submit to the Project

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Manager and the Research Center at research.center@dot.state.fl.us a written abstract and notification of intent to publish the materials and receive the Project Manager’s concurrence to publish. Such approval to publish shall not be unreasonably withheld. If the Project Manager does not provide a written response within 30 days after receipt, the university may publish. The publication must include the following language:

“The opinions, findings and conclusions expressed in this publication are those of the author(s) and not necessarily those of the Florida Department of Transportation or the U.S. Department of Transportation.”

Project Milestones/Timeline

The project is anticipated to start on June 01, 2022 and be completed in 24 months. There will be overlapping tasks since the project personnel will be divided into groups working on concurrent activities. The draft of the Final Report will be submitted to FDOT for review and comment on or before the 22nd month. The Final Report will be submitted to FDOT on or before the 24th month. The project deliverable schedule and timeline are shown below. The deliverable for each task will be submitted to FDOT no later than the end of the month as indicated in the table of deliverable schedule.

Schedule of Deliverables

Tasks and Deliverables

Anticipated Date of

Deliverable Submittal

(month/year)

TO BE

COMPLETED BY

RESEARCH

CENTER

(performance monitoring)

Project Kickoff Teleconference June 2022

Deliverable 1: Technical Memorandum (Task 1) December 2022

Deliverable 2: Technical Memorandum (Task 2) January 2023

Deliverable 3: Technical Memorandum (Task 3) May 2023

Deliverable 4: Technical Memorandum (Task 4) November 2023

Deliverable 5: Technical Memorandum (Task 5) May 2023

Deliverable 6: Technical Memorandum (Task 6) November 2022

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Deliverable 7: Technical Memorandum (Task 7) June 2023

Deliverable 8: Technical Memorandum (Task 8) November 2023

Deliverable 9: Technical Memorandum (Task 9) January 2024

Deliverable 10: Technical Memorandum (Task 10) April 2024

Deliverable 11a: Draft of Final Report (Task 11) February 2024

Deliverable 11b: Closeout Teleconference (Task 11) February 2024

Deliverable 12: Final Report (Task 12) May 2024

Project Timeline (based on a start date of June 1, 2022)

Month 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 Task J J A S O N D J F M A M J J A S O N D J F M A M

Kick-off

20232022

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

Exhibit B – Method of Compensation

BED34 TWO 977-01

1.0 Purpose

This Exhibit defines the limits of compensation to be made to the University for the services set forth in Exhibit A and the method by which payment shall be made.

2.0 Compensation

For the satisfactory performance of services details in Exhibit A, the University shall be paid a

Maximum Amount of $267,871.35. The Maximum Amount consists of the following amounts:

Deliverable 1 (Lump Sum) $25,537.91

Deliverable 2 (Lump Sum) $36,891.63

Deliverable 3 (Lump Sum) $ 5,107.58

Deliverable 4 (Lump Sum) $ 7,661.37

Deliverable 5 (Lump Sum) $20,430.33

Deliverable 6 (Lump Sum) $36,891.62

Deliverable 7 (Lump Sum) $30,645.49

Deliverable 8 (Lump Sum) $30,645.49

Deliverable 9 (Lump Sum) $30,645.49

Deliverable 10 (Lump Sum) $30,645.49

Deliverable 11a (Lump Sum) $ 8,172.13

Deliverable 12 (Lump Sum) $ 4,596.82

3.0 Progress Payments

The University shall submit an invoice upon approval of each task deliverable in a format acceptable to the Research Center. Lump sum payments shall be made to the University for the satisfactory completion of each task and approval by the Department of each task deliverable.

Invoices shall be submitted to the Florida Department of Transportation, Research Center, 605

Suwannee Street, MS 30, Tallahassee, FL 32399-0450 or electronically to research.center@dot.state.fl.us The Research Center will allow itself ten (10) working days for approval from receipt of deliverable and invoice.

4.0 Tangible Personal Property

This task work order does not include the purchase of Tangible Personal Property as defined in

Chapter 273, F.S.

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

FLORIDA DEPARTMENT OF TRANSPORTATION

FUNDS APPROVAL

BED34

5/6/2022

CONTRACT INFORMATION

FUNDS APPROVAL INFORMATION

FUNDS APPROVED/REVIEWED FOR ROBIN M. NAITOVE, CPA, COMPTROLLER ON 5/6/2022

Action: Task Work Order

Reviewed or Approved: APPROVED

Organization Code: 55220000977

Expansion Option: A4

Object Code: 132600

Amount: $278,502.65

Financial Project: 4194971B201

Work Activity (FCT): 770

CFDA:

Fiscal Year: 2022

Budget Entity: 55150200

Category/Category Year: 088857/22

Amendment ID: W001

Sequence: 00

User Assigned ID: 977-01

Enc Line (6s)/Status: 0001/04

Total Amount: $278,502.65

Contract: BED34

Contract Type: BU - PLANNING & RESEARCH SERVICES (PLN/RSH)

Vendor Name: UNIVERSITY OF WEST FLORIDA

Vendor ID: F592976783005

Beginning Date of This Agreement: 04/25/2022

Ending Date of This Agreement: 04/24/2032

Contract Total/Budgetary Ceiling:

Method of Procurement: G - GOVERMENTAL AGENCY (287.057,F.S.)

Description: Planning and Research Services

Page1 of 1

To: Jennifer.Clark@dot.state.fl.us

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F

FLORIDA DEPARTMENT OF TRANSPORTATION

FUNDS APPROVAL

BED34

5/19/2022

CONTRACT INFORMATION

FUNDS APPROVAL INFORMATION

FUNDS APPROVED/REVIEWED FOR ROBIN M. NAITOVE, CPA, COMPTROLLER ON 5/19/2022

Action: Task Work Order

Reviewed or Approved: APPROVED

Organization Code: 55220000977

Expansion Option: A4

Object Code: 132600

Amount: ($10,631.30)

Financial Project: 4194971B201

Work Activity (FCT): 770

CFDA:

Fiscal Year: 2022

Budget Entity: 55150200

Category/Category Year: 088857/22

Amendment ID: W001

Sequence: 01

User Assigned ID: 977-01

Enc Line (6s)/Status: 0001/04

Total Amount: ($10,631.30)

Contract: BED34

Contract Type: BU - PLANNING & RESEARCH SERVICES (PLN/RSH)

Vendor Name: UNIVERSITY OF WEST FLORIDA

Vendor ID: F592976783005

Beginning Date of This Agreement: 04/25/2022

Ending Date of This Agreement: 04/24/2032

Contract Total/Budgetary Ceiling:

Method of Procurement: G - GOVERMENTAL AGENCY (287.057,F.S.)

Description: Planning and Research Services

Page1 of 1

To: Jennifer.Clark@dot.state.fl.us

DocuSign Envelope ID: E422466C-104E-4EBB-BE12-A6FD6A1489ADDocuSign Envelope ID: 699442D2-44E3-4FA2-9E6E-BAE7D520C04F