Bridge Certificate Authority Request for Quote

(Note:  The period of quote submissions in now closed)

DirectTrust is working to develop a new product and service for the healthcare industry, a Bridge Certification Authority aimed at the unique needs of healthcare organizations, and that will be of significant benefit to our existing trust community as well as serve to promote interoperability of identity and trust across the broader healthcare industry and multiple trust communities therein.

DirectTrust is searching for a partner to operate the Bridge on behalf of DirectTrust. As part of this search we have developed a Request for Quote (RFQ) that is to be completed by any interested and qualified candidate.  The successful candidate will be asked to set up and operate on behalf of DirectTrust, a Bridge Certification Authority (BCA) for Healthcare, the purpose of which will be to provide interoperability of trust for the Certificate Authorities (CAs) servicing the healthcare industry in the United States, with the potential to grow globally. The successful candidate will also provide a path for DirectTrust member CAs to enable US Federal PKI compatibility. Therefore, a foundational requirement for the proposed BCA is to be able to cross-certify with the US Federal Bridge Certification Authority (FBCA).

The RFQ, was developed to inform and invite service providers and technology operators to submit a product or services offer, which must be compliant with the requirements described in the RFQ.

DirectTrust reserves its right to cancel the Request for Quote (RFQ) or redefine the quoting requirements at any time during the bidding process.

The release of this RFQ does not bind DirectTrust to subsequently enter into any contract of agreement with any party.

The Request for Quote may be downloaded using the link provided below.

DirectTrust looks forward to receiving responses to this RFQ.

Important RFQ Key Dates and Timeline

The RFQ process will follow the schedule described here below:

Date Description
2/10/2017 RFQ released
2/17/2017 Submission of clarification questions by bidders
3/10/2017 Revised Date Final reply to all clarification questions from DirectTrust
3/20/2017 Revised Date Submission of Bids by bidders
5/15/2017 Submit Business Plan to DT Board of Directors
5/22/2017 Initial short listing by DirectTrust
6/15/2017 Award of Contract

DirectTrust reserves the right to update the above dates as needed.

Questions regarding the RFQ should be sent using the form below or emailed direct to:

Ask BCA-RFQ related questions here

2 + 12 =

Frequently Asked Questions

Based on the following statement “The Offeror will first establish the DT Bridge CA, including the necessary documents and procedures for bridge operations and admission. The Offeror will then provide the additional documents needed for FBCA cross-certification” and when coupled with compliance table capability questions, it appears the offeror is expected to perform the actual work of U.S. FBCA cross-certification. Is it expected that the offeror will (1) provide the tools and artifacts needed for US FBCA cross-certification ONLY, (2) provide the tools and artifacts needed for US FBCA cross-certification AND perform the cross-certification work, or (3) propose what it considers is the best approach?

Answer:  It was originally envisioned the offeror would provide both the tools and artifacts needed, and perform the cross-certification work (i.e., question option #2). The offeror is welcome to propose alternatives as to what it considers the best approach.

The policy mapping of applicants to the HCBCA policy requirements, and the approval of HCBCA applicants would typically be the function of a Management Authority. Is the offeror expected to (1) act in the capacity of the Bridge Management Authority, (2) provide the tools necessary for a DirectTrust body to act as the Bridge Management Authority, or (3) propose what it considers the best approach?

Answer:  It was originally envisioned that a DirectTrust (DT) committee will operate as the Bridge Management Authority (BMA) for the purposes of setting policies and approving HCBCA applicants (i.e., question option #2). The offeror will compile the necessary technical documentation from the HCBCA applicant for presentation to the DT BMA. DT will collect additional non-technical documentation required by DT (e.g., signed DT policy documents). The offeror is welcome to propose alternatives as to what it considers the best approach.