UDOT RFP- Connected Vehicle Security Certificate Management System (CV SCMS)

The Utah Department of Transportation (UDOT) is seeking proposals for a Connected Vehicle Security Certificate Management System (CV SCMS) through a Request for Proposal (RFP) released on July 7, 2025, with proposals due by August 7, 2025. The solicitation aims to establish multiple contracts for a comprehensive system that will manage digital security certificates for vehicle-to-everything (V2X) communication networks, covering 385 UDOT signalized intersections, 46 city intersections, 92 roadway locations, and 421 fleet vehicles, with plans to expand to approximately 600 additional roadside units and 215 additional on-board units by early 2026. The system must maintain all state data in U.S. data centers, provide a secure administrative interface, support multiple root Certificate Authorities, and ensure 99.9% monthly uptime. Vendors must demonstrate expertise in digital certificate management for connected vehicle environments, ability to integrate with existing communication protocols, and compatibility with current roadside and onboard hardware from manufacturers like Kapsch, Commsignia, Ficosa, and Cohda. The evaluation process will follow a multi-stage approach, including a responsiveness review, technical evaluation, virtual system demonstrations, and cost proposal assessment, with vendors scored on a 330-point system across categories such as system information, project requirements, additional features, system demonstration, and cost.

The procurement does not explicitly mention specific set-aside designations or restrictions on respondent types. The current V2X security certificates are provided by Integrity Security Services (ISS) through a Panasonic of North America contract that is expiring, and the new system will replace this existing infrastructure. UDOT has budgeted approximately $200,000 for the first year of system operation, including licensing, installation, integration, setup, and training, with anticipated annual costs of less than $100,000 in subsequent years for certificates, management, and system maintenance. The contract will have an initial term of 5 years with an option to extend for an additional 5 years, potentially totaling 10 years. The solicitation shows a strong preference for cloud-based solutions, specifically using UDOT's existing Google Cloud Platform (GCP) instance, with the requirement that all state data reside on Department of Technology Services (DTS)-managed accounts. Vendors must ensure compliance with cybersecurity standards including IEEE 1609.2.1, ISO/SAE 21434, and NIST SP 800-53, with the ultimate goal of enhancing transportation safety and mobility in alignment with UDOT's Zero Fatalities initiative.