Introduction to the CURP Biométrica Project
The Mexican Secretariat of Government (Segob), through the National Population and Identity Registry (Renapo), has initiated a multi-annual public tender for contracting an “integral service of administration and operation of computing services.” This investment, capped at 520 million pesos, aims to bolster the technological infrastructure supporting the new biometric CURP (Clave Unica de Registro de Poblacion).
Background on CURP Biométrica
The rollout of this infrastructure coincides with the launch of CURP biométrica, whose regulatory framework was published in the Official Gazette of the Federation on July 16, 2025. As part of this initiative, the Mexico City pilot module offers voluntary and free CURP issuance with biometric data, including facial recognition, fingerprints, iris scans, and signatures.
Authorities are required to accept CURP biométrica starting October 16, 2025. The general-purpose platform for its processing must be ready by October 15, 2025. Registration of minors for educational purposes will be mandatory from November 14, 2025. This transition to digital identifiers necessitates computational capacity, storage, networking, and security from Renapo for mass person registration and online verification by various agencies.
Budget and Timeline
Segob has structured a multi-year budget with minimum and maximum amounts per year:
- 2025: Minimum: 20 million pesos, Maximum: 50 million pesos
- 2026: Minimum: 150 million pesos, Maximum: 210 million pesos
- 2027: Minimum: 150 million pesos, Maximum: 210 million pesos
- 2028: Minimum: 30 million pesos, Maximum: 50 million pesos
The total cap for this instrument is 520 million pesos, while the floor sums to 350 million pesos for the entire duration. The contract will be open for amounts, allowing Segob to request services according to its needs within these ranges and pay based on deliverables and service levels.
Technical Requirements
The technical annex mandates that the platform supports containerization technologies like Platform as a Service (PaaS) and operates as private cloud to support microservices-based applications.
Key requirements include high availability, load balancing, API exposure, role-based authentication, monitoring tools, and support for programming languages such as Java (Quarkus/Spring Boot), Node.js, PHP, and Python, along with databases like PostgreSQL, MongoDB, MySQL, SQL Server, among others.
The selected provider must migrate existing microservices-based applications to a container platform within two months post-award. The operational phase will run until February 29, 2028. Six months before contract termination, the provider must ensure an orderly transition of services to Segob or its designated entity.
Security Standards
The security section of the tender has stringent requirements. Segob insists on new, state-of-the-art infrastructure with no announced end-of-life date. Equipment must have redundant components, log retention for at least three months, and 24/7 manufacturer support throughout the contract duration.
Providers must present solutions that rank as leaders in the most recent Gartner security report, featuring AI capabilities for threat correlation and containment, along with specialized tools to protect containerized applications, CI/CD cycles, and sensitive data. Proactive monitoring, vulnerability analysis, and resilience against denial-of-service attacks are also mandatory.
The CURP biométrica project is one of the most contentious initiatives by President Sheinbaum’s administration in digital identity. With a budget of up to 520 million pesos and high technical and security requirements, Segob seeks infrastructure ensuring the safety of Mexican citizens’ data.
