addendum-1-rfp-dos-2026-06.pdf

DOS-RFP-2026-06

ADDENDUM 1

Questions and Answers

P-37 Version (State Contract)

The currently approved P-37 version is located here:

https://www.das.nh.gov/purchasing/docs/info/doj/P-37_Standard_Contract_Form.pdf

Due to the time constraints of this project, no changes to the P-37 will be entertained to avoid any additional delays in obtaining Executive Council approval.

Project Monitoring Locations:

The MDR monitoring locations will be at the networking core sites of Concord and Laconia.

The devices in these locations will be attached to spanning ports that will broadcast all network traffic in those locations. In addition to capturing traffic at these too primary sites, 5 critical remote sites (Blue Job, Kearsarge, Hyland Hill, Manns Hill and Mt Washington) will send localized traffic at those sites back to either Concord or Laconia via Netflow.

Additionally, there will be direct monitoring locations at Grafton County Sheriffs Office, Belknap County Sheriffs Office and Rockingham County Sheriffs office. These are smaller, Motorola-only networks that should monitor for suspicious changes to the volume or destination of traffic, particularly at the interconnect points with the DESC networks.

Monitoring devices will be places into DESC server racks.

Network Topology:

DESC operates a fully Layer 3 network topology that is routed between the two primary locations of Concord and Laconia, as well as to the NHICNet Core network, the DESCNet Microwave network and the Emergency Communications Center carrier network.

Layer-3 boundaries between the DESC network and the county networks are enforced through Motorola SAR Routers.

Full network diagrams will be provided to the winning vendor. High-level network diagrams have been attached to this response.

There is no Out of Band networking available on the microwave network or at the county networks, however there are out of band networks available at Concord and Laconia.

Network Inventory:

A full inventory will be shared only with the winning vendor. This estimate of the inventory should be used to approximate the scope of this project.

https://www.das.nh.gov/purchasing/docs/info/doj/P-37_Standard_Contract_Form.pdf

Between Concord and Laconia, there are approximately 50 virtual servers running on 6 VM hosts and 4 SANs. There are approximately 350 endpoints running in this environment.

Additionally, between the core network, NHICNet Core and DESCNet, there are approximately 8 network devices per remote site (400 total) plus 25 network devices each in Concord and Laconia for a total of approximately 450 network devices.

Additionally, there are four Cisco Firepower firewalls.

Network Pathways:

There are approximately 6 VRFs in the network topology. While not provided at this point, DESC will provide the winning vendor with a list of allowed and unallowed network pathways, along with any prohibited network traverses.

Network Bandwidth:

For all NHICNet Core connections, the maximum bandwidth is 200mb. For all DESCNet Microwave connections, the maximum bandwidth is 100mb. Connectivity between Concord and Laconia is 1 GB.

Bandwidth & Data Retention

Typical bandwidth for NHICNet Core sites is 50 mb. Typical bandwidth for DESCNet links is 20 mb. Typical bandwidth for Concord and Laconiais approximately 200MB excluding backup jobs.

Retention objectives for this data are thirty days.

Current Cybersecurity Infrastructure

Currently all endpoints are protected with Crowdstrike with plans to migrate a select number of devices to SentinelOne later this year. Additionally, all servers and workstations are regularly scanned with Tenable for security vulnerabilities. Finally, all server logs are currently aggregated into a Netmon appliance in Concord.

Currently there is no MDR operating anywhere in the DESC networking environment.

FedRAMP and StateRAMP Certification

FedRAMP or StateRAMP certification is preferred.

Data Integration Inquiries

• Identity & directory: There is only one domain (two on prem DCs) in scope for the project.

• Endpoint & server telemetry: operating systems are out of scope.

• Application/SaaS/cloud: business apps and cloud services are out of scope.

• Vulnerability data: Systems are scanned utilizing a Tenable scanner.

• Ticketing/ITSM & messaging: DESC IT utilizes an on-prem TrackIT ticking system.

Miscellaneous Questions:

- Are there Microsoft user licenses associated with assets within the radio network?

- Answer: No.

- Is the expectation of SOW Section 2, Phase 1 be the visibility of log ingestion and monitoring?

- Answer: At least monitoring.

- Is StateRAMP / FedRAMP required?

- Answer: No, but vendors who do not have State or FedRAMP certifications are required to complete a StateRAMP snapshot and to be StateRAMP Authorized within 24 months.

- What end point detection Solutions are Certified Motorola? Section 1.26.

- Answer: It is up to the vendor to determine this.

- What kind of visibility are you looking for, for configuration drift?

- Answer: Abnormal change in bandwidth.

- Do you expect to have monitoring visibility and granular reporting capabilities for each of the 18 mountaintops?

- Answer: No, DESC will identify 5 critical sites to NetFlow traffic from those locations to either Concord or Laconia for inspection.

- Who is your vendor for the MPLS network?

- Answer: ePlus.

- What is the bandwidth capacity of any interface that needs network threat detection (e.g. 1Gbps, 10 Gbps, etc.).

- Answer: 100-200 MB.

- Does the DESC have a hypervisor within the DESC infrastructure, and if so, is DESC willing to host a virtual network detection sensor?

- Answer: Yes. However, due to mission critical nature of this environment and the uncertainty about the number of resources that might be required, DESC does not desire to host a virtual sensor in this environment.

- What is the physical device configuration for the BTOP, DESCNet, and Guest VRF zones? Are any or all of those zones configured for separate physical router interfaces?

- Answer: Specific devices and configurations will be provided to the winning vendor only.

- Please provide Exhibit A, B, and C as referenced throughout Attachment 1.

- Answer: No such references exist but are built with the winning vendor award based on the RFP proposal.

- Will the supplier(s) of the Land Mobile Radio (LMR) network be permitted to bid?

- Answer: There are no restrictions on who can bid.

- Please provide network, system, and security architecture for the Motorola ASTRO

Land Mobile Radio (LMR) / Radio Network Infrastructure (RNI) environment.

- Answer: A full schema of that environment will be provided to the winning vendor.

- Are logs currently collected for monitoring and analysis?

- Answer: Some logs are currently collected in DESCs Netmon appliance.

- Is a Security Information and Event Management (SIEM) system currently in use in the Motorola ASTRO Land Mobile Radio (LMR) / Radio Network Infrastructure (RNI) environment?

- Answer: Yes, Motorola Unified Event Manager.

- Is a Security Information and Event Management (SIEM) system currently in use in the

NHICnet environment?

- Answer: No

- What is the ingestion rate or events per second (eps) that the current SIEM processes?

- Answer: Unknown.

- Is an Endpoint, Detection and Response (EDR) system currently in use in the Motorola ASTRO Land Mobile Radio (LMR) / Radio Network Infrastructure (RNI) environment?

- Answer: Yes

- Please list your current security tools, such as SIEM, EDR, XDR, firewall brands/models, IDS/IPS, vulnerability scanners, email security gateways, cloud security posture management (CSPM), etc.

- Answer: This information will be provided to the winning vendor.

- Is the Motorola ASTRO Land Mobile Radio (LMR) / Radio Network Infrastructure (RNI) environment isolated from the internet?

- Answer: Yes, and there are no plans to allow internet into this environment.

- Please provide network, system, and security architecture for the partner RNI environments, specifically those operated by Grafton County, Belknap County, and Rockingham County.

- Please confirm that the requirement is still valid that RNI partners should have access to an individualized monitoring console restricted to their networking environment.

- Answer: Confirmed.

- What are your desired log retention policies?

- Answer: At least 30 days.

- Is an Endpoint, Detection and Response (EDR) system currently in use in the NHICnet environment?

- Answer: On some devices, Crowdstrike.

- Are logs currently collected for monitoring and analysis?

- Is the NHICnet network isolated from the internet?

- Answer: Yes, and there are no plans to allow internet into this environment.

- Are remote access solutions included in the monitoring scope?

- Please provide brand/model and operating system of the Motorola Dispatch Consoles and other selected systems.

- Since this solution needs to monitor authentication and authorization/access services, what is the overarching directory service in use within the Motorola ASTRO Land Mobile Radio (LMR) / Radio Network Infrastructure (RNI) and the NHICnet environments?

- Answer: Cisco ISE.

- Do the partner RNI networks utilize their own directory service for authentication and authorization/access to their RNI networks? How are network traffic Authentication and Authorization managed currently within the partner RNI networks?

- Answer: No. Motorola Astro 25 radio systems are homogenous and authenticated by its domain controllers. As the System owner, any entity who joins our system is authenticated by these system DCs. Both radio cores, primary core in Concord and the backup core in Laconia, each have a primary and backup DC. DESC manages this system.

- What are the definitions of critical alerts and high-severity events?

- Answer: It is expected that the winning vendor provides those recommendations.

- There is no place on the pricing form for the optional years. How should the bidder provide that information? There is no place on the pricing form to provide the pricing requested for future partner expansion. How should the bidder provide that information?

- Answer: The vendor may provide a separate table or attachment.

- If the NHICNET Microwave Broadband Networking project is delayed or fails, what impact will it have on this RFP?

- Answer: The microwave project is currently nearing completion.

- Could the DESC please confirm whether this is a new initiative or an existing engagement?

- Answer: New.

- Could the DESC provide an estimated budget or a Not-to-Exceed (NTE) amount for this contract?

- Could the DESC please provide the anticipated project timeline, including key milestones and the overall expected duration of the engagement?

- Answer: The project must be fully implemented no later than March 31st, 2026.

- Could the DESC please clarify whether it intends to award this RFP to a single vendor or multiple vendors?

- Answer: One vendor.

- For Phase 1 (Motorola RNI monitoring), can you clarify the number of RNI components and Fortinet devices that require continuous monitoring?

- For Phase 2 (NHICnet backbone), can you provide the total number of Cisco Catalyst switches, Firepower firewalls, and ISE nodes to be monitored?

- Regarding Phase 3 (future partner expansion), do you have an estimate of the number of additional agencies or endpoints expected to be onboarded over the next 3–5 years?

- Are there specific SLAs or uptime requirements for each phase of monitoring (e.g., detection time, response time)?

- Answer: 99.999%

- For RNI and NHICnet, can you clarify whether all monitoring must be fully agentless, or are there exceptions where endpoint agents can be installed (e.g., future optional EDR integration)?

- Answer: Agentless only. EDR is out of scope.

- Will DESC provide existing flow/log access (e.g., NetFlow, VPN logs, Fortinet logs, Cisco pxGrid) for MDR integration, or is the MDR provider expected to deploy telemetry collection themselves?

- Answer: DESC IT will provide log access with direction from the vendor.

- Are there restrictions on packet capture or deep inspection due to the operational sensitivity of the RNI network?

- Answer: The RNI traffic is encrypted, so deep packet inspection is not expected.

- For RNI partner counties (Grafton, Belknap, Rockingham), will the MDR provider have direct access to their networks, or will access be mediated through DESC?

- Answer: Direct access.

- Can you clarify the roles of DESC, Motorola ASTRO, and ePlus in incident response? For example, who is responsible for initial triage, mitigation, and remediation?

- Answer: DESC IT and DESC Radio are first tier response for all issues.

- Are there pre-existing incident response playbooks or escalation procedures we need to align with, or will the MDR provider develop these?

- Answer: Vendor developed.

- Are there required SLA response times for alerts and incidents across different network segments?

- Answer: Appendix B, SLA section as well as B1.32 – 34.

- Regarding EDR for Motorola dispatch consoles, are there specific endpoints or consoles already identified for Phase 3, or is this exploratory?

- Answer: Exploratory.

- For pxGrid / identity-aware detection, are there specific identity providers or sessions

DESC wants correlated (e.g., VPN, network posture, role)?

- Answer: Network posture, specifically Wi-Fi and Ethernet.

- To clarify, for Phase 1 and Phase 2, are you seeking only Managed Detection and Response (MDR) services, including monitoring, alerting, and incident response, without the requirement for the vendor to supply any new software or tools? We understand that the existing infrastructure (Fortinet, Cisco, pxGrid, etc.) will remain in place and our service would integrate with it.

- Answer: The vendor is expected to provide everything required for their solution to monitor the environment as described.

- What is the desired level of remediations (Level 0 – Monitoring and escalation only), Level 1 – Monitoring and ad Adhock Remediation (Few hours), or Level 2 – Complete MSSP monitoring and remediation.

- Answer: Monitoring and escalation only.

- Can DESC provide an estimate of the daily or monthly data volume to be ingested for

MDR monitoring from the RNI and NHICnet environments (in GB or TB)? This would include logs, flow data, VPN sessions, and telemetry. Understanding the expected data volume will help size the monitoring, storage, and reporting requirements.

- Answer: Unknown.

- To confirm our understanding, for the initial phases of this MDR engagement (Phase 1 and 2), DESC is requesting monitoring of existing network and RNI infrastructure only, without the deployment of any EDR agents or endpoint protection tools. EDR integration is considered an optional capability for future phases. Is this correct?

- Answer: Correct.

- Can DESC provide a budget range or target cost for the MDR engagement?

Understanding the expected budget will help ensure our proposed solution aligns with the State’s needs and priorities.

- Can DESC clarify whether the MDR monitoring, and incident response activities are expected to be performed entirely remotely from the vendor’s SOC, or if there is any requirement for on-site presence at DESC facilities or partner sites?

- Answer: Remote monitoring with the ability for DESC and its partners to have access to a dashboard to see the current status of the network.

- Is the MDR expected to monitor the detections from the Motorola devices?

- Answer: It is not required.

- Would NHDOS be willing to extend the due date by up to two business weeks?

- Would NHDOS be willing to accept the use of a cooperative contract in lieu of the current terms and conditions?

- Would NHDOS be willing to accept partial bids?

- Answer: All bids will be evaluated and scored based on all requirements in the RFP.

- Is the State of NH looking for a service provider with staff associated to the maintenance, monitoring and/or incident management of the solution?

- Answer: Monitoring.

- Is the State of NH just looking to procure the hardware or software required to deliver the services required in the RFP?

- Answer: The vendor should propose whatever is needed to meet the requirements of the

RFP.

- Does the monitoring and/or security services include the security of the Radio Frequency communications?