EV Charging Management System RFP Checklist

An EV charging management system RFP should do more than collect a long list of features. It should reveal whether a CPMS vendor can connect your actual chargers, support your operating and revenue model, protect your data, meet service expectations, and scale without creating costly lock-in.

This guide is written for charge point operators, charger manufacturers, fleets, utilities, property groups, parking operators, and regional charging platforms. If you are still defining the platform category, begin with TrendPower’s CPMS software guide for EV charging operators. If you are ready to procure, use the checklist below as the technical and commercial backbone of your RFP.

What Should an EV Charging Software RFP Achieve?

A useful RFP turns business goals into testable requirements. It gives vendors the same operating assumptions, asks them to distinguish standard functionality from configuration and custom development, and creates a defensible way to compare answers.

The objective is not to select the platform with the most checkmarks. The objective is to identify the solution with the best verified fit for your chargers, customers, countries, integrations, internal team, risk tolerance, and five-year growth plan.

What Information Should You Prepare Before Sending the RFP?

Vendors cannot provide a reliable scope, price, or timeline if the RFP only asks for “a scalable EV charging platform.” Include a concise project profile with enough detail to test fit.

• Business model and target usersPublic CPO, fleet, workplace, residential, destination, OEM, utility, roaming service, or a combination.
• Network baselineCurrent and forecast sites, chargers, connectors, monthly sessions, users, and geographic regions for years 1, 3, and 5.
• Hardware inventoryManufacturer, model, firmware, OCPP version, connectivity, power rating, and current backend for each representative charger type.
• Customer journeyApp, web, QR, RFID, contactless payment, Autocharge, Plug & Charge, guest access, reservation, and support expectations.
• Commercial modelTariffs, taxes, subscriptions, idle fees, promotions, roaming, invoicing, refunds, commissions, and settlement parties.
• Integration landscapePayment gateways, ERP, CRM, fleet systems, energy systems, data warehouse, maps, ticketing, identity, and roaming partners.
• Security and deployment constraintsCloud region, private cloud or on-premise needs, data residency, SSO, audit, privacy, and regulatory requirements.
• Procurement planBudget range, decision process, pilot scope, desired launch date, acceptance criteria, and contract term.

Complete EV Charging Management System RFP Checklist

1. Business Scope, Roles, and Scale

Start with operating reality. A platform designed for a single private depot may not support a multi-party public network with site hosts, agents, investors, fleets, and roaming partners.

• Describe supported business models and identify which are live in production.
• Explain the hierarchy for organizations, regions, sites, chargers, connectors, operators, site hosts, fleets, and end users.
• Show role-based access control, approval flows, delegated administration, and tenant isolation.
• State demonstrated production scale and the test method for chargers, concurrent sessions, API traffic, and reporting volume.
• Explain how new countries, currencies, tax rules, languages, time zones, and legal entities are added.

2. OCPP and Charger Interoperability

“OCPP supported” is not a sufficient answer. The Open Charge Alliance publishes multiple OCPP versions, and actual behavior depends on the charger model, firmware, security profile, message set, and vendor implementation. Ask for exact evidence.

• List supported OCPP editions and transports, including OCPP 1.6J, OCPP 2.0.1, and the roadmap for OCPP 2.1 where relevant.
• Provide a charger compatibility matrix by manufacturer, model, firmware, tested functions, known limitations, and test date.
• Provide OCPP certification details or other conformance evidence for the offered CSMS version. Verify certificates through the OCA, rather than relying only on a logo.
• Demonstrate onboarding, authorization, transactions, meter values, remote start/stop, reset, unlock, availability, reservations, charging profiles, diagnostics, and firmware workflows.
• Explain offline behavior, message queues, clock drift, duplicate events, reconnect reconciliation, and transaction recovery.
• Describe the process, ownership, cost, and lead time for integrating an untested charger or firmware revision.

For mixed-brand networks, request a pilot with representative hardware. TrendPower’s EV charging point management system page explains why compatibility should be validated against the real charger and required workflow, not the protocol name alone.

3. Monitoring, Remote Operations, and Uptime

• Show real-time status for stations, EVSEs, connectors, sessions, connectivity, power, meter values, and alarms.
• Explain configurable alarm rules, severity, suppression, correlation, escalation, and notification channels.
• Demonstrate remote diagnostics, logs, charging curves, fault codes, remote commands, and auditable operator actions.
• Define availability and utilization calculations, including the treatment of planned maintenance, blocked bays, and communication outages.
• Show ticket creation, assignment, SLA timers, technician workflows, service evidence, verification, and maintenance history.
• Provide dashboards and exports for first-time charge success, session failures, MTTR, alarm recurrence, and charger availability.

Buyers evaluating field-service workflows can review TrendPower’s intelligent operations management approach to monitoring, remote diagnosis, remediation, dispatch, and closed-loop work orders.

4. Driver Experience, Access, and Support

• Identify supported access methods: mobile app, mobile web, QR code, RFID, guest checkout, Autocharge, ISO 15118 Plug & Charge, or fleet credentials.
• Show station discovery, live availability, connector details, price display, navigation, reservations, session status, receipts, and charging history.
• Describe accessibility, supported languages, local formats, consent handling, account deletion, and customer data export.
• Explain app ownership, app-store accounts, release cadence, crash analytics, supported OS versions, and web fallback.
• Show customer-support tools for session lookup, remote assistance, refunds, disputes, notifications, and case history.

5. Tariffs, Billing, Payments, and Settlement

Pricing is market-specific, while payment security creates shared responsibilities. Ask the vendor to map data and money flows, not merely display a payment-provider logo.

• Show tariffs by energy, time, session, connection time, idle time, location, user group, membership, and time of use.
• Explain tax, rounding, currency, invoice numbering, refunds, credits, deposits, pre-authorization, failed payments, and chargebacks.
• List payment gateways and methods by target country, plus merchant-of-record, acquiring, payout, and reconciliation responsibilities.
• Define the payment-card data flow and each party’s PCI DSS scope. The PCI Security Standards Council is the authoritative source for current PCI DSS materials.
• Demonstrate site-host, agent, investor, or partner revenue sharing, statements, approvals, adjustments, and settlement records.
• Provide finance exports, reconciliation keys, audit trails, and handling for sessions that complete after a communication outage.

Use TrendPower’s EV charging payment solution overview to identify questions about localized payments, tariffs, transactions, and settlement.

6. Roaming and Ecosystem Interoperability

• List supported OCPI versions, roles, modules, connection models, roaming hubs, and live integrations.
• Show exchange of locations, EVSE status, tariffs, tokens, commands, sessions, CDRs, and credentials.
• Explain retry logic, version negotiation, duplicate handling, CDR correction, reconciliation, and partner-specific mapping.
• Clarify per-partner fees, hub fees, transaction fees, implementation costs, certification, and ongoing support.

The EVRoaming Foundation’s OCPI overview explains how OCPI connects eMobility service providers and charge point operators. Your RFP should ask which parts of the protocol are implemented and proven—not only whether “OCPI” appears on a feature sheet.

7. APIs, Data, and Enterprise Integrations

• Request versioned API documentation, sandbox access, authentication methods, rate limits, pagination, filters, idempotency, and error models.
• List available APIs and webhooks for chargers, sites, users, tariffs, sessions, transactions, alarms, tickets, and reports.
• Define webhook signing, retries, ordering, deduplication, replay, monitoring, and dead-letter handling.
• Explain data freshness, retention, aggregation, export formats, bulk extraction, and access to raw versus derived data.
• Describe integration ownership for ERP, CRM, SSO, fleet, energy, maps, data warehouse, and support systems.
• Require API security controls to be mapped to recognized guidance such as the OWASP API Security Project.

8. Energy and Smart-Charging Controls

• Describe static and dynamic load management at connector, charger, circuit, site, portfolio, and fleet levels.
• Explain power allocation rules, priorities, minimum power, fairness, departure targets, and manual override.
• Show how charger limits, meter data, building load, solar, storage, and utility signals are received and validated.
• Define behavior when meters, gateways, chargers, or the CPMS lose connectivity.
• Ask for supported OCPP smart-charging functions, control intervals, telemetry latency, and proof from a comparable deployment.

9. Security, Privacy, and Resilience

Security answers should be architecture-specific and contractually meaningful. “We use encryption” does not explain identity, key management, monitoring, vulnerability handling, or recovery.

• Request a current architecture and data-flow diagram showing trust boundaries, data stores, third parties, admin paths, and charger connections.
• Define encryption in transit and at rest, TLS versions, certificate lifecycle, secrets management, key ownership, and rotation.
• Show MFA, SSO, RBAC, least privilege, session controls, service accounts, privileged-access review, and immutable audit logs.
• Provide secure development, dependency management, code review, penetration testing, vulnerability disclosure, patching, and incident-response practices.
• State data-controller and processor roles, subprocessors, hosting locations, cross-border transfers, retention, deletion, and data-subject request support.
• Define backups, restore testing, redundancy, disaster recovery, RTO, RPO, status communications, and business continuity.
• Ask how the platform implements relevant OCPP security profiles and how charger certificates are issued, stored, rotated, and revoked.

For a common risk vocabulary, buyers can reference the NIST Cybersecurity Framework. The RFP should still specify the laws, standards, and controls that apply to the buyer’s own jurisdictions and contracts.

10. Deployment, Data Ownership, and Portability

• Compare public cloud, private cloud, and on-premise options, including responsibility for infrastructure, updates, monitoring, and security.
• Define production, test, staging, training, and disaster-recovery environments and whether they are included in price.
• State who owns charger, user, session, tariff, transaction, operational, analytical, and derived data.
• Require documented full exports in usable formats, including identifiers and relationships needed for migration.
• Clarify domains, certificates, app-store accounts, SMS/email accounts, payment accounts, source-code options, and custom-code ownership.
• Define exit assistance, export timing, transition access, charger endpoint changes, deletion certificates, and termination fees.

11. Implementation, Migration, and Acceptance

• Request a delivery plan with phases, dependencies, named owners, customer inputs, risks, and entry/exit criteria.
• Define charger onboarding, configuration, payment, app, integration, security, performance, failover, and user-acceptance tests.
• For migration, inventory backend URLs, credentials, certificates, SIM/APN dependencies, charger access, data exports, and incumbent-vendor obligations.
• Require a representative pilot, measurable pass/fail criteria, rollback plan, defect severity rules, and sign-off process.
• Detail data migration scope, mapping, reconciliation, historical access, cutover method, downtime, and post-cutover validation.
• Define administrator, operations, finance, support, and technical training plus handover documentation.

If your requirements extend beyond standard configuration, compare the boundary between product capability and project work using TrendPower’s custom EV charging software solution.

For a practical example of requirements shaped around a real operating model, review TrendPower’s U.S. home EV charging platform case study, which connects residential charging, controlled sharing, access, scheduling, payments, and owner settlement.

12. Support, SLA, Roadmap, and Commercial Terms

• Define support hours, languages, channels, severity levels, response targets, restoration targets, escalation, and service credits.
• Define platform uptime, measurement point, exclusions, maintenance windows, notification, and monthly reporting.
• Describe release cadence, notice periods, backward compatibility, regression testing, customer testing, and emergency changes.
• Separate committed features from roadmap items and state whether roadmap dates are contractual.
• Itemize setup, licensing, charger, connector, user, session, app, hosting, storage, API, roaming, payment, support, integration, and professional-service fees.
• Provide price tiers, minimums, overages, annual increases, foreign-exchange assumptions, taxes, renewal, termination, and exit costs.
• Provide comparable customer references and permission to discuss implementation quality, stability, support, and unexpected costs.

A Vendor Response Format That Makes Answers Comparable

Attach a response table to every requirement. Keep narrative proposals for context, but score only structured answers that identify availability, evidence, delivery effort, timing, assumptions, and cost.

TrendPower’s Recommended 100-Point CPMS RFP Scoring Model

Adjust the weights before proposals arrive. That prevents a persuasive demonstration from changing priorities after the fact. Use a 0–5 score for each category, multiply it by the assigned weight, and require evaluators to cite evidence.

Suggested scoring scale: 0 = no response; 1 = unsupported; 2 = partial or roadmap; 3 = meets the requirement with acceptable evidence; 4 = exceeds it with strong proof; 5 = proven fit with low delivery risk and clear contractual commitment.

What Should You Test in the Demo and Pilot?

A polished demo can hide manual steps, simulated data, and untested integrations. Give every shortlisted vendor the same scenarios and sample data.

1. Connect a representative charger. Complete authorization, remote start/stop, meter values, transaction closure, offline recovery, and a failed-session investigation.
2. Run the complete money flow. Configure a tariff, complete a payment, issue a receipt or invoice, process a refund, export finance data, and reconcile settlement.
3. Resolve an operational incident. Trigger an alert, inspect logs, perform a supported remote action, create a ticket, escalate it, and close it with an audit trail.
4. Exercise roles and data controls. Test operator, site-host, support, finance, and restricted-admin permissions. Export data and inspect audit records.
5. Prove an integration. Use the sandbox API or OCPI connection to exchange real test objects, handle errors, and validate retries and reconciliation.
6. Test failure and recovery. Simulate charger or network disconnection, duplicate messages, payment failure, and rollback from a release or migration step.

Seven CPMS Vendor Red Flags

1. “OCPP compatible” without a model-and-firmware test matrix.
2. Roadmap features shown as if they are available today.
3. No clear owner for payment compliance, reconciliation, or failed transactions.
4. API access promised without documentation, sandbox access, limits, or export tests.
5. Uptime claims without a definition, measurement method, exclusions, or remedy.
6. Low subscription pricing paired with unclear integration, storage, support, or exit fees.
7. No practical migration plan, rollback method, or contractual data-portability commitment.

How Do You Turn the Winning RFP into a Safer Contract?

Do not let the most important answers disappear after vendor selection. Attach the final response, architecture, compatibility matrix, implementation plan, pricing schedule, SLA, security obligations, data-processing terms, and acceptance tests to the agreement or statement of work.

Convert phrases such as “supports,” “can integrate,” and “high availability” into named deliverables and measurable outcomes. State what happens if a critical charger workflow fails the pilot, a custom integration misses acceptance, or the buyer needs a complete export at termination.

EV Charging Management System RFP FAQ

Authoritative Sources for Your RFP Team

• Open Charge Alliance — OCPP protocols
• Open Charge Alliance — specification downloads
• EVRoaming Foundation — OCPI overview
• PCI Security Standards Council — payment security standards
• OWASP — API Security Project
• NIST — Cybersecurity Framework

Reviewed for procurement relevance: September 20, 2026. Protocol, security, payment, privacy, and regulatory requirements change over time; verify the latest official materials and obtain legal or compliance advice for your target markets.