Case Study:
Securing Connected Roadways

TrustThink has supported federal, state, and industry stakeholders in strengthening the cybersecurity foundations of connected roadway systems, focusing on trust, interoperability, and practical implementation.

As transportation infrastructure becomes increasingly connected, cybersecurity is no longer a back-office concern. Roadside Units (RSUs), traffic signal controllers, and V2X systems now operate as distributed, software-driven components within a larger trust ecosystem—exchanging data with vehicles, management centers, cloud services, and external partners in real time.

The Challenge:
Trust at the Edge

Connected roadway environments introduce unique cybersecurity challenges:

  • Devices are deployed in physically exposed locations
  • Systems rely on wireless communications and cryptographic trust
  • Multiple stakeholders—manufacturers, integrators, infrastructure owners, and operators—must align on security responsibilities
  • Standards evolve faster than deployment cycles

Without clear trust models and security expectations, agencies face increased risk, inconsistent implementations, and costly retrofits.

Our Work in Action

  • Defining Security Expectations for Roadside Units (RSUs)
  • Enabling Interoperable Cryptographic Trust in V2X Systems
  • Bridging Architecture, Standards, and Operations

Defining Security Expectations for Roadside Units (RSUs)

TrustThink supported the development of the ITS Security Control Set for Roadside Units, helping establish a clear, standards-based approach for securing RSUs across a wide range of deployment scenarios. 

This work translated high-level cybersecurity frameworks—such as the NIST Cybersecurity Framework and NIST SP 800-53—into practical, device-specific controls aligned with ARC-IT architectures and real-world RSU operating environments. The result was a control set that manufacturers, integrators, and infrastructure owners could actually use to design, procure, and assess secure roadside equipment. 

By grounding security requirements in how RSUs are deployed and managed, this effort helped reduce ambiguity and improve consistency across the ecosystem. 

Enabling Interoperable Cryptographic Trust in V2X Systems

TrustThink has played a key role in advancing cryptographic trust models for connected vehicle environments, including work related to IEEE 1609.2 and 1609.2.2 standards.

This included addressing how certificates, permissions, and trust relationships are managed across jurisdictions and operational boundaries, an essential challenge for large-scale V2X deployment. Our work focused on enabling flexible, policy-driven trust without sacrificing interoperability, supporting real-world deployment scenarios where multiple SCMS managers, agencies, and operators must coexist.

These efforts help ensure that safety-critical messages can be trusted, regardless of where a vehicle or roadside device originates.

Uncrewed System Cybersecurity Testing

Across these efforts, TrustThink consistently worked at the intersection of architecture, standards, and operational reality. Rather than treating cybersecurity as a checklist, we focused on how trust is established, enforced, and maintained across complex systems of systems.

This approach helped stakeholders understand not just what controls were required, but why they mattered, and how they fit into broader transportation system goals such as safety, reliability, and interoperability.

The Impact

Through this work, TrustThink has helped:

  • Improve consistency and clarity in ITS cybersecurity expectations
  • Reduce deployment risk for connected roadway infrastructure
  • Enable scalable, standards-aligned trust architectures
  • Support agencies and industry in preparing for future capabilities such as expanded V2X deployment and cryptographic modernization

Looking Ahead

Securing connected roadways is an ongoing challenge as transportation systems continue to evolve.
TrustThink remains focused on helping agencies and industry partners design trust into systems early,
so that innovation can move forward without compromising safety, resilience, or public confidence.