This chapter is a compilation of tools and best practices related to the pre-solicitation phase of technology procurements. Its content was derived from a combination of the following:
This chapter is organized into three sections of narrative content to describe best practices for the pre-solicitation phase of technology procurements. These sections include:
Five tools to assist DOTs in the pre-solicitation phase of their technology procurement efforts are also included in the appendices. A brief explanation of how to use each tool is given in this report; however, because the tools contain various file types (Word, Excel, PDF), the individual tools are provided as separate files so that they can be directly used in their native file format. The list of tools includes:
The integration of the concept of operations (ConOps) tool, as used by MaineDOT, is essential to highlight. This tool has been identified by the research team as a pivotal element in the planning and execution of transportation projects. The ConOps is a strategic planning document that facilitates the transition from traditional, outdated systems to contemporary, integrated solutions. It provides a comprehensive blueprint, delineating the project’s purpose, essential requirements, and operational procedures. This high-level overview is instrumental in shaping the functionality of new systems. Crucially, the ConOps is integral to the development of RFPs, ensuring a streamlined and effective project implementation process. This is particularly valuable in scenarios involving accelerated timelines or other challenging conditions. Furthermore, the ConOps aids in identifying potential gaps and areas requiring future research, thereby maintaining alignment with the overarching research objectives and ensuring a coherent and forward-looking approach to project planning.
Refer to Appendix L for a template example of a ConOps document that is based on input from MaineDOT, MnDOT, and others.
Another aspect of an effective project intake process is to remind internal project teams to review state or agency guidelines on data, software, and other technology-related policies. Each state or agency may have different governing policies related to the early planning of new technologies, especially related to justifying the need for new technology, planning for how new technology will be integrated into the current technology environment, cybersecurity protocols, and more. Early review of existing guidelines will result in a more efficient and effective procurement process that minimizes potential surprises downstream.
Another point of pre-solicitation planning occurs when DOTs decide to use federal funds from the U.S. Department of Transportation through the Federal Highway Administration (FHWA), the Federal Transit Administration (FTA), or the Federal Railroad Administration (FRA). The FHWA, FTA, and FRA each provide federal funds based on the actual mode (or modes) of transportation (highways, transit, or rail) that the DOT operates and maintains.
Through the procurement process, DOTs may acquire various commercially available technology goods and services in compliance with the federal funds they receive to complete advanced technology projects. DOTs are permitted to use their own procurement procedures that reflect applicable state and local laws and regulations if those procedures conform to the procurement standards of the government-wide Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, under 2 Code of Federal Regulations (CFR) §§ 200.314 through 200.326 (National Archives n.d.-a).
Additionally, if federal funding is used for intelligent transportation system (ITS) projects provided by FHWA, the regulations under 23 CFR Part 940 must be followed for the procurement of ITS technologies (National Archives n.d.-b).
Another consideration is the Build America Buy America Act, which was enacted as part of the Infrastructure Investment and Jobs Act of 2021 (Office of Acquisition Management n.d.). There are also acknowledgments of prohibited platforms, which restrict foreign sources of technology (U.S. Department of Transportation 2024).
DOTs are responsible for adherence to maintaining their own procurement standards in the settlement and satisfaction of all contractual and administrative issues related to contracts entered in support of the federal funding awarded or allocated. This includes disputes, claims, protests of awards, source evaluation, or other matters of a contractual nature. Other responsibilities include:
There are also considerations for the size and type of procurements when using federal funds. For example, fair and reasonable procedures shall be used for all procurements not exceeding the simplified acquisition threshold of $250,000 (or lower if state or local laws have a lower threshold). Contracts secured under the simplified acquisition procedure must still document that the DOT took actions to ensure that it is receiving the best price for the services/goods purchased (e.g., document three separate price quotes and justify why one was chosen). Contracts exceeding $250,000 need to go through a formal competitive bidding process.
Furthermore, if a DOT is conducting a sole source procurement, it must follow the same policies and procedures it uses for procurements from its non-federal funds under 2 CFR § 200.317. Sole source procurements are conducted by noncompetitive proposals, wherein the solicitation of a proposal is from only one source.
Additional information related to procurement guidance when leveraging federal funds can be found at:
The SOW outlines the technology requirements that a DOT’s project team aims to procure from technology providers. The SOW might also include or be referred to by various terms, such as “specifications,” “minimum qualifications,” “functional requirements,” “business requirements,” and “security requirements.” However, irrespective of the terminology, the SOW serves as the backbone during the pre-solicitation phase, providing a clear directive for the DOT project team and potential technology providers. A draft SOW should be completed before conducting market research.
Establishing the SOW and the current state of affairs should precede the release of the RFP. Figure 3 depicts the general sequence of events that is preferred for most technology procurements. It is not uncommon for organizations to prematurely engage in discussions with technology providers or initiate requests for quotes prior to finalizing their SOW. A premature engagement
typically consists of user groups extending invitations to individual vendors to conduct demonstrations, presentations, meetings, and/or other direct engagements but without the formal support, guidance, and supervision of procurement and contracting staff. This misguided sequence of activities tends to result in confusion and inefficiencies.
Conversely, market research processes are to be conducted in coordination with appropriate procurement and contracting staff. This enables more formal and centralized tracking of the outreach and engagement of external vendors before the eventual solicitation. Further, there are established market research techniques such as a request for information, pilot-level RFPs, and others that can be facilitated with the involvement of procurement professionals. Finally, the involvement of procurement professionals can also ensure that market research activities are openly advertised to the entire marketplace (which avoids giving the false impression of favoritism if only certain known vendors were engaged).
Developing a comprehensive (or at least a draft-level) SOW prior to market research interactions facilitates a systematic approach, ensures all project needs are accurately identified, and fosters alignment among stakeholders. Furthermore, proper procurement protocol typically requires or strongly prefers that discussions with external technology providers about their products and services be conducted in a formal and organized process with the full knowledge, support, and guidance of the DOT’s procurement professionals. Figure 3 shows the major activities during the RFP (see Figure 1 for the overall phases).
The SOW is a pivotal document that equips technology providers with the necessary information to consider the project and develop a robust proposal. Inadequately prepared SOWs may lead to reduced competition, wide pricing ranges, and poor-quality proposals, as vendors may find the SOW unachievable or unfair (see Figure 4). Poor SOWs may also result in vendors submitting generic, marketing-heavy proposals and assigning less competent teams to the project. All these impacts can result in a greater probability of scope gaps, change orders, and dissatisfaction during the post-solicitation technology roll-out.
When crafting the SOW per optimal practices, the DOT’s project team specialists need to adopt the viewpoint of the technology providers submitting proposals for the project. To accomplish this, it is advisable to pose the following key inquiries:
The SOW should incorporate more than just a list of itemized requirements. It should also address the DOT’s overall objectives, use cases, project parameters (e.g., budget, schedule), and the current state of technology within the organization. Here are the key components:
The DOT project team can achieve this by articulating a clear problem they wish to resolve. What is the business motivation behind this effort? What is the necessity and objective of the new technology? This information is generally simpler to document than the granular specifics within a requirements list. In essence, outlining the overall purpose can prove more beneficial for technology providers than supplying minutely specific data around functional, technical, business, security, and data requirements.
In drafting the SOW, the most beneficial step a DOT’s project team can take is to outline your needs from a bird’s-eye view. What will the technology do for you? What results do you wish to achieve? For instance, the expected outcomes from a computerized maintenance management system could encompass:
Be aware that introducing additional categories or definitions of requirements is not advisable. Shy away from other classifications of requirements that are “nice-to-have” or “on roadmap.” Such categories may only be advisable in the largest, most complex projects that span the entire DOT enterprise and represent tens of millions in annual spending. Instead, for most technology projects, focus on the two categories of mandatory vs. desired, and simply discard the rest. This will lead to a more succinct, precise enumeration of itemized requirements that genuinely capture the core priorities of the DOT’s project team.
Identify any areas of the scope that are not well-defined or well-known. A best practice is to openly identify these items and ideally provide a reasonable benchmark or “guesstimate” for providers to use in their proposal.
Providing an assumed quantity or definition for unknown items is better than omitting these items, for two reasons:
Finally, it is important to show that the DOT has resourced a dedicated project team and will make subject matter experts available to support the project.
The “current state” serves as an instructional guide encompassing crucial aspects pertaining to the DOT’s existing environment that will be impacted by the project. This includes a definition of the legacy system(s), if any. This section should also cover the operational environment that currently exists and make use of the current technology or legacy system. The current state information will eventually be included in the RFP document alongside the SOW. As shown in Figure 5, the SOW and current state work together within the RFP. Their combined purpose is to “paint the picture” for prospective technology providers regarding the DOT’s future need vs. current environment concerning the new technology being solicited.
The current state often takes precedence over the SOW for technology providers. One reason is that technology providers already have a clear expectation of the future state because it is essentially the specifications of their existing technology (which they already understand in detail). They need to set up their technology to fit the client’s specific environment.
For a technology provider, the client’s existing environment is generally the largest unknown of the entire project and represents their greatest risk. Technology providers are therefore extremely interested in learning about the client’s current state, because it gives them more insight into the environment they would be integrating their technology into.
This current state is a primary consideration for pricing (especially as it relates to the technology implementation or roll-out). As illustrated in Figure 6, implementing technology is akin to navigating from “Point A” (current state) to “Point B” (the future state described in the SOW). The current state’s criticality surpasses that of the future state because it provides a clear starting point, offering foresight into potential roadblocks and challenges in the journey. It is crucial to note that technology providers usually possess a comprehensive understanding of the future state, as it essentially involves deploying their own system specifically tailored to the client’s environment.
In the analysis of technology RFPs from DOTs, the research team reviewed a series of three RFPs issued by a single DOT for deployment of connected vehicle signal phase and timing. The technologies included equipment systems with signal phase and timing encoders/processing
units, roadside unit antennas, power and communications cables, on-board units, specialized tools, and diagnostic software. These RFPs were issued over 4 years for different regions of that state. One noticeable change across the three RFPs was that the issuing DOT included increasingly greater detail on the existing configuration requirements.
Five additional reasons are provided to further explain why the current state is so critical to project success:
In summary, the inclusion of explicit, concise, and comprehensive information on the current state significantly increases the probability of selecting the most suitable system and technology provider team. Therefore, the current state should be thoroughly documented and considered an indispensable part of the technology implementation process.
Multiple justifications exist to which client teams may appeal to bypass the current state analysis. This section reveals the seven most frequently cited reasons and debunks their efficacy as valid grounds for omitting the current state.
In conclusion, the importance of current state documentation is indisputable. Each day spent on its documentation can potentially save multiple days during the implementation phase. The significant payback amplifies the question: Can clients afford to neglect current state documentation?
The documentation of the current state should ideally comprise five primary elements, each providing significant insights to the technology providers, as follows:
This section shares several tips to help project teams undertake the process of developing their current conditions and SOW. These are proven practices to overcome the top six greatest challenges in completing the pre-solicitation activities related to the SOW and current conditions.
Many practitioner groups can underestimate the significance of portraying their current state environment. Yet, this aspect is a critical determinant for technology providers when they craft precise pricing, schedules, and resource requirements for their services, including implementation, deployment, and associated data migration tasks. If the SOW lacks a clear description of the current state, the technology providers will effectively be navigating without a map in terms of where to start with technology deployment, which inevitably leads to additional contingencies
in their pricing. Also, the client will incur extra costs, as the technology providers must sit with them to glean the necessary current state information. Moreover, the current state heavily influences the deployment timeline. If the client compels technology providers to make assumptions in their proposals, it becomes highly probable that the project will face schedule setbacks and other change orders later.
When a client neglects to include their current state in the RFP, they will surely bear the cost eventually. The chosen technology provider will invariably wish to understand the client’s present operations to ensure their technology is deployed optimally. If the client procrastinates gathering their current state until after the contract has been signed, they compel the technology provider to aid in this effort while their time is being billed—a route that invariably proves costlier than if the client had done it independently. Moreover, remember that nobody comprehends the subtleties of the client organization as well as the client, so assigning this task to a technology provider will invariably result in less accurate outcomes.
Another compelling rationale to start with the current state is that it represents the most straightforward part of the entire scoping procedure. Frequently, project teams can become stuck or delayed when articulating their future state requirements, mainly because the future state can seem more nebulous and might involve novel technology aspects that the team is not yet acquainted with. Nonetheless, the project team is undoubtedly well-versed in the structure of the current state environment, which makes it an ideal starting point to ensure the scoping process does not hit a roadblock at the onset.
Perhaps the greatest dilemma when crafting the SOW is determining the necessary information to include and the level of detail required (see Figure 7). Overloading the SOW and current state with excessive information can pose a risk. Presenting an SOW that borders on information overload or that carries overly specific requirements can make it burdensome for technology providers to respond promptly (and may even drive them away from your business altogether). However, being too vague can lead technology providers to incorporate additional contingencies to account for the gaps in the SOW.
The consequences of each extreme in the balancing act are as follows:
Consequences of an overly prescriptive SOW and current conditions:
Consequences of an open-ended SOW and current conditions:
The principal objective of the SOW is to offer a clear and reasonable benchmark, allowing technology providers to generate precise pricing and proposals in response to the RFP. A well-defined SOW ensures the cost proposals are directly comparable, akin to parallel comparisons. Therefore, DOT project teams should strive to make this benchmark easy for technology providers to locate and comprehend (and the benchmark should be presented regarding the core cost drivers that technology providers will utilize in formulating their quotes).
Bear in mind that the objective is not to make the SOW unbearably detailed. DOT project teams are advised to adhere to the page restrictions described previously in the sections on the SOW and current state. The SOW simply needs to create a clear image and align with industry norms to facilitate fair competition (see Figure 8). Excessive focus on upfront details can cause proposers to overlook major objectives and bypass crucial background information (current state). Information that may sometimes seem apparent or extraneous is highly beneficial to bidders.
In summary, DOT project teams should seek a clear, concise, accurate, and complete set of SOW and current state documentation. The goal is to avoid the extremes of being overly prescriptive or too open-ended because both scenarios lead to the negative consequences described earlier.
Perhaps the greatest “political hot button” is whether to publish the project budget and schedule constraints openly. Project teams should be ready to navigate this question along with potential internal pushback against openly releasing this information to prospective technology providers.
The preferred practice from this study is to disclose the budget directly in the RFP. The precise budget should be released, not a rough estimate or a range but the true amount at the project team’s disposal. However, ensure the disclosure is done correctly and by adopting the right procurement procedures.
The thought of releasing the budget initially elicits reservations. However, consider the broader context. The primary concern is the potential exploitation of the disclosed budget by technology providers, who may inflate their prices to align with the budget. But how often does a project budget truly surpass the project scope? Put another way, how frequently does the project team have more money than they need? In most instances, organizations are in the reverse situation, where their budget is inadequate or “tight” for their project scope. This reality implies that the project team frequently asks technology providers for more than the project’s budget can afford.
To help project teams understand the impacts of releasing the budget, evaluate both scenarios: having a constrained budget or having more money than is needed. In each scenario, the pros and cons of releasing vs. concealing the budget are considered.
What are the pros and cons of concealing the budget?
What are the pros and cons of openly disclosing the budget?
In summation, there is little actual risk in disclosing the budget; the risk is mostly perceived. Therefore, the preferred approach is to share the project budget as a strategy to attract the best technology providers at the best prices.
The DOT’s project team should include the perspectives of end users and subject matter experts (SMEs) to ensure the new technology will be a proper fit to accomplish their objectives. However, this does not mean that the end users and SMEs need to be experts in how the technology works or the specific capabilities of a particular technology; rather, these stakeholders should focus on clearly articulating their needs, goals, and current state environment. The biggest needs in a DOT’s project team are usually described by answering the following questions:
In addition, it is typically beneficial for DOT project teams to collaborate with their organization’s IT group to comprehend any technical prerequisites or related policies (e.g., security, functional). These often encompass security considerations, data regulations, and other facets related to integrating new technology into the organization. While the DOT project team is not required to have deep expertise in these areas, they need to engage actively with their IT counterparts to gather this vital information. It is worth noting that the IT department frequently has pre-prepared documentation that can be incorporated into the project’s SOW.
All DOT project teams should conduct a thorough process of market research before putting an RFP on the street. Market research refers to the systematic identification of potential technology vendors and products that could fulfill project requirements. This section provides six guidelines to enhance the effectiveness of the market research process.
Evaluations are defined as assessments of competing technology providers or products. Such assessments should be kept separate from market research and wait until the formal RFP is launched and full proposals are received. Many project teams start to form preferences and evaluation-like judgments during the market research process, which goes against the principles of a fair, open, and competitive public procurement process.
Instead, project teams should focus on the primary objectives of market research, which are:
During market research, it is crucial not to be swayed by marketing materials and presentations from technology providers. Marketing material could result in an unjustifiable bias among the client’s project team, leading to skewed preferences for certain providers. Market research is not an evaluation process and parallel proposals have not yet been submitted; hence, it is inappropriate to make evaluative judgments at this stage and to review overly marketing-based materials.
While technology providers often request one-on-one meetings with clients ahead of the RFP process under the pretense of better understanding client needs, these meetings can potentially create biased evaluations by building premature relationships. Such meetings primarily serve as marketing opportunities for technology providers and can introduce unnecessary biases within the client teams and evaluators.
External vendors can provide valuable insight, but they should not be overly relied upon. It is essential to remember that vendors typically rank entire companies and product offerings rather than specific project teams and their capabilities. These vendors may carry their own biases and potentially favor certain technology providers based on previous associations. However, it can be beneficial for vendors to provide a comprehensive list of potential technology providers and systems that could meet the client’s minimum requirements, if this strategy is used effectively.
Traditional request for information (RFI) processes should only be employed if clear objectives have been defined. Many RFIs turn into disorganized collections of marketing content from technology providers with minimal tangible benefits. Before initiating an RFI process, the DOT should identify specific information that needs to be collected and make decisions based on the RFI responses. The DOT should also explicitly tell vendors not to submit marketing materials.
The market research phase presents an opportunity to advertise the upcoming project to the technology provider community, aiming to attract interest and stimulate competition during the RFP stage. This includes identifying points of contact for procurement, indicating an upcoming procurement process, and initiating non-disclosure agreement procedures if necessary to avoid future delays in the procurement process.
Identifying the right team is crucial, and understanding the organization’s level of technological maturity plays a pivotal role in shaping team formation and key decisions. The organization’s internal context ranges from simply upgrading existing operations to the adoption of entirely new technologies without any baseline.
As Figure 9 illustrates, there are three major considerations in the early planning stages of a new technology procurement:
Overall, this research report attempts to strike a balance between these considerations, understanding that each technology procurement can vary considerably depending on the specific scenario. The research has incorporated feedback from a variety of scenarios. The research aims to find a middle ground that aligns with the complexity and the specific needs of the project. This balance ensures outcomes are both practical and beneficial and avoids extremes that may not be feasible or universally beneficial. Achieving consensus on what constitutes acceptable
advancement in technology is essential. The organization must navigate within its capabilities to develop consistent, useful tools for most technology projects that DOTs will procure.
Conducting market research for a new technology solution prior to entering a formal procurement or solicitation event can be a critical step in ensuring the success of the solicitation process. Market research involves gathering comprehensive information about the available technologies, understanding the needs and preferences of the target users, and evaluating potential suppliers and their capabilities. By analyzing market trends, competitive offerings, and regulatory requirements, DOTs can identify the best-fit solutions and set realistic expectations for performance and cost. Additionally, engaging with industry experts and stakeholders helps identify potential risks and opportunities, ensuring that the procurement strategy is well-informed and aligned with organizational goals. Effective market research enhances decision-making and improves the likelihood of selecting a technology solution that delivers long-term value and meets the organization’s specific needs (by adjusting the subsequent solicitation process).
Another important function of market research is to find and engage potential DBEs. In cases of procuring advanced technology where the DOT may be less familiar with the marketplace as a whole, the need to perform dedicated outreach to advertise, connect, and communicate with DBEs becomes even more critical.
There are several methods of conducting market research. Among the most common are to review existing contract vehicles and approved vendor lists, reach out to peers, conduct internet searches, or query business directories. One formal mechanism that DOTs are familiar with is to initiate an RFI or similar procedure. This method is beneficial in the case of advanced technologies that may be new and therefore have less available information via the aforementioned market research sources. An RFI is a formal document used to gather information from potential technology providers about their products, services, and capabilities. The primary purpose of an RFI is to collect data that help the DOT understand what solutions are available in the market, assess their suitability for meeting the organization’s needs, and identify any potential constraints or opportunities.
An RFI typically includes several sections, such as:
RFIs are used early in the procurement process to help organizations refine their requirements, develop a better understanding of the market landscape, and shape the subsequent RFP or request for quotation processes. They are instrumental in making informed decisions and ensuring that the final procurement strategy is comprehensive and aligned with the organization’s goals.
One DOT that participated in the study shared information about their RFI process for a large, enterprise-wide software solution. In this scenario, the DOT conducted an RFI roughly 1.5 to
2 years before issuing the RFP. The RFI was publicly released and was found to be useful in identifying potential providers and gathering budget information (which helped justify the internal budget request), and it aided in defining requirements and evaluation criteria in a manner that was attractive to providers.
In addition to RFIs, most DOTs will also include outreach to other DOTs to understand whether the same technology solution has already been procured and possibly implemented by a peer. DOTs may also examine cooperative purchasing contracts for pre-existing technologies that have already been vetted. An example of this is discussed in Chapter 9 with the case study from Rhode Island.
All new technology procurements must be carefully reviewed from a security standpoint. This represents a significant difference from typical engineering, construction, and operations procurements, which typically do not involve new technologies that present cybersecurity threats.
There must be management support and commitment to establish a strong and responsible cybersecurity culture at the DOT. IT professionals account for roughly 3% to 4% of an engineering organization such as a DOT. Therefore, it can be difficult to establish the importance of IT-related topics, among which cybersecurity may be the most important. An effective strategy to build support and cultural awareness is to discuss new technology procurements in the context of risk to the agency. Another effective approach is to showcase how failure to follow a responsible cybersecurity protocol can slow down the implementation of a new technology, which ultimately expresses the cybersecurity risk in terms of traditional engineering project management, namely, risks to being on time, on budget, and delivering the levels of quality the project was intended to achieve.
From a cybersecurity standpoint, the worst-case scenario occurs if the DOT has already purchased a new technology and then comes to the cybersecurity team afterward to request support in implementation. Rather, the cybersecurity team should be engaged immediately as the project begins early planning.
Most DOTs have matured to the level of preparing an acceptable user policy (AUP) or similar governing protocol. In such policies, typically a prohibited behavior is the solicitation, implementation, or creation of any IT software or hardware solution without following IT-related governing procedures. In other words, if a project team or individual acts outside the policy requirements, there may be justification for personnel action against them. Some DOTs require every employee to sign their AUP (or similar document) every year as part of mandated cybersecurity training.
The nature of cybersecurity is such that DOTs have a wide variety of policies, procedures, and maturity levels. This can lead to instances where technology vendors attempt to play clients off one another; for example, project teams should be prepared for vendor claims such as, “We work with other states, and they don’t ask us to do this.” Such claims are not sufficient justification to omit, overlook, or gain exemption from cybersecurity considerations. The DOT’s cybersecurity experts should always be consulted for their professional assessment.
Another cybersecurity challenge is building the DOT’s security framework along with associated standard policies and procedures. The goal is not to have hundreds of pages of documentation on procedures, but actual living policies and procedures with accompanying administrative controls.
Within individual RFPs for new technologies, there are several cybersecurity documents and procedures that are commonplace:
MnDOT has a full IT project request process for formally establishing the need for a new technology. The initial request considers the business case for the new technology, which includes aspects such as whether the new technology is commercial-off-the-shelf (COTS), the overall business readiness (with emphasis on how the new technology will impact the existing technology environment, including integrations and data sources), current state environment (existing applications, applicable sunset deadlines, etc.), requirements related to policy or regulation, and initial budgeting (available funds, estimate of internal resources, and total cost of ownership).
All new IT project requests are entered into a centralized planning hub where they are prioritized for funding decisions.
There are also several roles that cybersecurity professionals fulfill during the procurement process itself:
Another important lesson is to recognize that modifications to existing technology are, in effect, the creation of new technology. This applies even if the modification is made under an existing contract. Such modifications should be treated with the same level of scrutiny and consideration as entirely new solutions. Additionally, it is essential to consider these modifications in the context of longer-term implementation and system maintenance. Options for enhancements and upgrades should be evaluated comprehensively to ensure they align with the organization’s evolving needs and security standards. Furthermore, any change made to an application necessitates an update or review of the DOT’s system security plan or equivalent. This is not just a procedural formality; it is a fundamental aspect of maintaining system integrity and security. These practices not only enhance the effectiveness and security of the technology but also streamline the procurement process, ensuring that modifications and new technologies are appropriately evaluated and integrated.
Another consideration is technologies that fall under the “set-it-and-forget-it” category. In other words, technologies that are procured once and may not be revisited for several years (examples include traffic signal devices, programmable logic controls, and supervisory control and data acquisition systems). DOTs should not wait until there is a major problem to revisit these
technologies. Rather, DOTs should plan for reviews at regular interviews. For example, the cybersecurity team may ask internal project teams or departments whether they have recently completed a summary cybersecurity questionnaire.
NCHRP Web-Only Document 355: Cybersecurity Issues and Protection Strategies for State Transportation Agency CEOs: Volume 2, Transportation Cyber Risk Guide is a resource on cybersecurity considerations. This guide touches upon several considerations that are relevant to the procurement of new technologies. Among these considerations are to build an agency-wide culture of awareness and vigilance regarding the importance of cybersecurity, provide staff training related to procurement processes (knowing that most staff are neither procurement professionals nor cybersecurity gurus), and recognize that the gap between agency workforce capabilities and the degree of cybersecurity vulnerability increases each time a new technology is implemented (Ramon et al. 2023).
Finally, one distinction is that cybersecurity is not the same topic as information privacy. Personal and protected information includes sensitive data such as social security numbers, driver’s license numbers, etc. However, this is not typically within the primary jurisdiction of the cybersecurity team and may even be managed by a separate agency altogether (e.g., the Department of Motor Vehicles may oversee the confidentiality of driver licenses). DOTs will typically have established privacy controls that account for instances where confidential information will be involved, even if that confidential information will be managed by another agency.
DBE considerations are an important component of the procurement process. When embarking on new procurements, agencies should ensure that DBEs have an equitable opportunity to compete for and participate in DOT-funded projects. This includes establishing DBE goals, encouraging the use of DBE sub-vendors, and providing support through outreach and technical assistance. The DOT’s adherence to DBE regulations promotes a level playing field and aims to foster a diverse and inclusive economic environment within the transportation industry. These considerations are integral to the DOT’s procurement strategy, aligning with broader federal objectives to advance equitable business practices and economic growth among disadvantaged communities.