addendum5-attachment1-table-b-2.1-mssp-system-requirements.xlsx
XLSX spreadsheet 36 KB Posted
- Solicitation number
- RFP DOT Managed Security Service Provider (MSSP) #2025-067
- Issued by
- New Hampshire
About this file
This file is a system requirements specification table (Table B-2.1) for a Managed Security Service Provider (MSSP) solicitation by the New Hampshire Department of Transportation (NHDOT) in support of its Traffic and Signals Management Operations (TSMO) Bureau and Transportation Management Center (TMC). The MSSP vendor will provide 24/7/365 continuous monitoring of NHDOT's network infrastructure, endpoints, applications, and critical Intelligent Transportation Systems (ITS), including traffic management systems and SCADA/ICS components where applicable. The solution must deliver Security Information and Event Management (SIEM) capabilities with centralized dashboards, real-time threat correlation and analysis, intrusion detection and prevention systems (IDS/IPS), vulnerability scanning and management, incident response services, access control and identity management monitoring, data loss prevention, and security awareness training support. Additional requirements include field operations support with technician deployment capabilities, comprehensive documentation and deliverables spanning concept of operations, system requirements specifications, incident response plans, testing reports, and configuration management plans. The specification requires compliance with the NIST Cybersecurity Framework, New Hampshire state cybersecurity policies, federal ITS regulations (23 CFR Part 940), and relevant ITS industry standards such as NTCIP security considerations.
The requirements table categorizes 128 distinct functional and non-functional requirements across 15 major domains, designating each requirement with a criticality level of Mandatory (M), Essential (E), or Optional (O). Critical performance requirements include generating alerts for critical security incidents within five minutes of detection, maintaining 99.99% system uptime, retaining security logs for a minimum of 365 days with the most recent 90 days immediately searchable, and responding to Emergency Response on-demand field service requests immediately and Critical Level 1 requests within four hours. Field technicians must possess relevant networking certifications (CCNA, CompTIA Network+, or CompTIA A+), demonstrate electronics and electrical knowledge, maintain OSHA 10-Hour Construction Safety certification, complete work zone traffic control training, and adhere to MUTCD and NHDOT-specific safety guidelines. The deliverables pricing worksheet lists 33 specific activities, deliverables, and milestones spanning planning and project management, installation, testing, system deployment, and ongoing operations phases, though specific cost details and contract term information are not provided in this requirements specification document.
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table B-2.1
| SYSTEM REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req# | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| Security Monitoring & Event Management | |||||
| B1.1 | The Proposed Solution shall provide 24/7/365 continuous monitoring of NHDOT's network infrastructure, endpoints, applications, and critical transportation systems (e.g., traffic management systems, SCADA/ICS if applicable). | M | |||
| B1.2 | The Proposed Solution shall collect, aggregate, and normalize security logs and events from diverse NHDOT IT and ITS sources. | M | |||
| B1.3 | The Proposed Solution shall perform real-time correlation and analysis of security events to detect anomalies, indicators of compromise (IOCs), and potential threats. | O | |||
| B1.4 | The Proposed Solution shall provide a centralized Security Information and Event Management (SIEM) platform for comprehensive visibility. | M | |||
| B1.5 | The Proposed Solution shall support customizable dashboards and alerts for different NHDOT stakeholder roles, including IT security, network operations, and ITS operations personnel. | M | |||
| B1.6 | The Proposed Solution shall monitor and alert on unusual or unauthorized activity related to ITS field device access, configuration changes, or firmware updates, particularly during maintenance windows. | M | |||
| B1.7 | The Proposed Solution shall include the ability to generate and manage alerts based on defined thresholds and anomalies within the network. | M | |||
| B1.8 | The Proposed Solution shall include the capability to alert the MSSP's field services technicians upon identification of critical network events. | M | |||
| B1.9 | The Proposed Solution shall communicate with NHDOT's Transportation Management Center (TMC) via verbal (script) and electronic for notification of identified issues and recording of log entries. | M | |||
| Threat Detection & Prevention | |||||
| B2.1 | The Proposed Solution shall detect and prevent known and emerging threats including: malware, ransomware, phishing attempts, and other malicious attacks. | M | |||
| B2.2 | The Proposed Solution shall provide Intrusion Detection Proposed Solution (IDS) and Intrusion Prevention Proposed Solution (IPS) capabilities for network traffic analysis, including monitoring of ITS-specific communication protocols (e.g., NTCIP, DSRC, proprietary protocols). | M | |||
| B2.3 | The Proposed Solution shall perform network segmentation monitoring to ensure proper isolation of critical Proposed Solutions, including ITS operational networks. | E | |||
| B2.4 | The Proposed Solution shall leverage up-to-date threat intelligence feeds relevant to government, critical infrastructure, and transportation sectors. | M | |||
| B2.5 | ITS-Specific Threat Detection: The Proposed Solution shall detect and alert on unauthorized access attempts to ITS field devices, attempts at signal manipulation, unauthorized firmware updates, and other attacks targeting ITS operational integrity. | M | |||
| B2.6 | Malicious Code Detection (Field Devices): The Proposed Solution shall detect and alert on the presence of malicious code on ITS field devices or associated maintenance tools, if capabilities allow. | M | |||
| Vulnerability Management | |||||
| B3.1 | The Proposed Solution shall conduct regular vulnerability scanning of NHDOT's network devices, servers, applications, and endpoints. | M | |||
| B3.2 | The Proposed Solution shall provide prioritized reporting of identified vulnerabilities based on severity and potential impact to NHDOT operations. | M | |||
| B3.3 | The Proposed Solution shall provide recommendations and support for vulnerability remediation and patch management. | M | |||
| B3.4 | ITS Device and Application Vulnerability Management: The Proposed Solution shall specifically identify and report vulnerabilities in ITS roadside equipment, controllers, and central ITS applications, including outdated firmware, insecure configurations, and known software flaws. | M | |||
| B3.5 | Field Maintenance Tool Vulnerability Assessment: The Proposed Solution shall provide guidance or capabilities for assessing vulnerabilities in tools and laptops used by field maintenance personnel when interacting with ITS equipment. | M | |||
| Incident Response & Management | |||||
| B4.1 | The Proposed Solution shall provide a defined incident response plan and procedures, tailored to NHDOT's environment and critical transportation systems, with specific playbooks for ITS-related incidents (e.g., traffic signal outages due to cyberattack, unauthorized access to camera feeds). | M | |||
| B4.2 | The Proposed Solution shall provide 24/7/365 incident triage, analysis, and escalation capabilities, ensuring rapid response to incidents impacting transportation operations. | M | |||
| B4.3 | The Proposed Solution shall support forensic analysis capabilities for security incidents, including those involving ITS devices and data. | M | |||
| B4.4 | The Proposed Solution shall provide post-incident reporting and lessons learned analysis, incorporating insights from ITS-specific incidents. | M | |||
| B4.5 | Field Incident Coordination: The Proposed Solution shall coordinate incident response activities with NHDOT's field maintenance teams for incidents originating from or impacting ITS roadside equipment. | M | |||
| Access Control & Identity Management | |||||
| B5.1 | The Proposed Solution shall monitor and report on unauthorized access attempts to NHDOT Proposed Solutions and data, including remote access to ITS devices and central control Proposed Solutions. | M | |||
| B5.2 | The Proposed Solution shall provide capabilities for privileged access management (PAM) monitoring for both IT and ITS administrative accounts. | M | |||
| B5.3 | Field Personnel Access Monitoring: The Proposed Solution shall monitor and alert on suspicious or unauthorized access attempts by field maintenance personnel to ITS devices, both physical and logical. | ||||
| M | |||||
| Data Protection & Privacy | |||||
| B6.1 | The Proposed Solution shall monitor and report on unauthorized access or exfiltration of NHDOT's sensitive data, including personally identifiable information (PII) and critical ITS operational data (e.g., traffic flow data, sensor readings). | M | |||
| B6.2 | The Proposed Solution shall support data loss prevention (DLP) capabilities. | M | |||
| B6.3 | ITS Operational Data Integrity: The Proposed Solution shall monitor and alert on suspicious modifications or corruption of ITS operational data that could impact transportation Proposed Solution functionality. | M | |||
| Security Awareness & Training | |||||
| B7.1 | The Proposed Solution shall provide recommendations and support for NHDOT's security awareness training programs for all personnel, including specialized training for ITS operators and field technicians on cybersecurity best practices for operational technology and secure field maintenance procedures. | M | |||
| B7.2 | The Proposed Solution security awareness training programs shall include specialized training for ITS operators and field technicians on cybersecurity best practices for operational technology and secure field maintenance procedures. | M | |||
| Performance Requirements | |||||
| B8.1 | Alerting Latency: The Proposed Solution shall generate alerts for critical security incidents within five [5] minutes of detection | M | |||
| B8.2 | Incident Response Time: The Proposed Solution shall initiate response to critical security incidents upon TMC approval. | M | |||
| B8.3 | System Uptime: The Proposed Solution's central monitoring system and detection infrastructure shall maintain an uptime of at least 99.99% (excluding planned maintenance). | M | |||
| B8.4 | Data Retention: The Proposed Solution shall retain security logs and event data for a minimum of 365 days for forensic and compliance purposes. (Per state requirements) | M | |||
| B8.4.1 | The most recent 90 days of security logs and event data shall be available immediately to and searchable by NHDOT and NH DoIT peronnel. | M | |||
| B8.4.2 | Other than security logs and event data related to an active breach investigation or regulatory response, security logs and event data from 91 days old to 180 days old shall be available within 24 hours upon request. | E | |||
| B8.4.3 | Other than security logs and event data related to an active breach investigation or regulatory response, security logs and event data older than 180 days may be archived and made available within five working days upon request. | E | |||
| B8.4.4 | Security logs and event data related to an active breach investigation or regularory response shall be available immediately to and searchable by NHDOT and NH DoIT personnel for a period not less than 120 days or until the investigation or regulatory response is complete, whichever time period is longer. | M | |||
| B8.5 | Scalability: The Proposed Solution shall be scalable to accommodate NHDOT's future growth in network size, number of endpoints, and data volume, including expansion of ITS infrastructure. | M | |||
| B8.6 | The MSSP solution shall not introduce detectable latency to critical ITS operational communications | E | |||
| B8.7 | The Proposed Solution shall provide monthly reports on network uptime, incident response times, and resolution metrics. | M | |||
| Security Requirements | |||||
| B9.1 | Secure Operations: The Proposed Solution shall operate its Security Operations Center (SOC) and all related infrastructure with robust physical and logical security controls. | M | |||
| B9.2 | Data Segregation: The Proposed Solution shall ensure strict logical and, where necessary, physical segregation of NHDOT's data from other clients' data. | M | |||
| B9.3 | Personnel Security: All Proposed Solution personnel with access to NHDOT systems or data shall undergo national background checks and appropriate security clearances. | M | |||
| B9.4 | Secure Communications: All communications between NHDOT's environment and the MSSP's systems shall be encrypted using industry-standard protocols. | M | |||
| B9.5 | Least Privilege: The Proposed Solution shall operate with the principle of least privilege when accessing NHDOT's systems. | E | |||
| B9.6 | ITS Device Hardening & Configuration: The Proposed Solution shall provide recommendations and support for implementing secure configuration baselines for NHDOT's ITS field devices and central systems, including disabling unnecessary services and ports. | M | |||
| B9.7 | Supply Chain Security: The Proposed Solution shall demonstrate a process for assessing the security posture of third-party ITS equipment and software vendors. | E | |||
| B9.8 | Field Maintenance Security Policies: The Proposed Solution shall provide recommendations for NHDOT's field maintenance security policies, including secure remote access, use of authorized tools, and handling of sensitive device configurations. | M | |||
| B9.9 | Secure Remote Access for Maintenance: The Proposed Solution shall support and monitor secure remote access methods (e.g., VPN, jump boxes) used by NHDOT field maintenance personnel to access ITS equipment. | M | |||
| B9.10 | Integrity of Field-Deployed Software/Firmware: The Proposed Solution shall provide capabilities to verify the integrity of software and firmware deployed to ITS field devices during maintenance activities. | E | |||
| B9.11 | Incident Response Integration: The Proposed Solution's systems and processes shall be integration-ready with NHDOT's current incident response plan, including the ability to act immediately in cyber events under predefined conditions. This requirement will be implemented in a phased approach, initially requiring pre-approval for incident response with gradually greater degrees of automony as conditions warrant. | E | |||
| Compliance Requirements | |||||
| B10.1 | NIST Cybersecurity Framework: The MSSP solution shall align with the core functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover). | M | |||
| B10.2 | NH State Cybersecurity Policies: The Proposed Solution shall demonstrate understanding and adherence to applicable New Hampshire state cybersecurity policies and incident reporting requirements (e.g., RSA 420-P:6, Statewide Information Security Manual). | M | |||
| B10.3 | Federal Regulations for ITS: The Proposed Solution shall understand and, where applicable, support NHDOT's compliance with federal regulations pertinent to ITS projects (e.g., 23 CFR Part 940). | M | |||
| B10.4 | Data Privacy: The Proposed Solution shall handle NHDOT's data in accordance with relevant privacy regulations (e.g., NH RSA 359-C:20 for breach notification). | M | |||
| B10.5 | ITS Industry Standards: The Proposed Solution shall demonstrate familiarity with and ability to support NHDOT's adherence to relevant ITS industry standards related to cybersecurity (e.g., NTCIP security considerations). | M | |||
| Operational Requirements | |||||
| B11.1 | Service Level Agreements (SLAs): The Proposed Solution shall propose and adhere to comprehensive SLAs covering availability, incident response times, reporting frequency, and other critical performance metrics, with specific consideration for the impact on ITS operations. | M | |||
| B11.1.1 | Integration with NHDOT Systems: The MSSP's systems should be capable of integrating with or providing data to NHDOT's Compass system for tracking response times. | O | |||
| B11.2 | The Proposed Solution shall establish clear communication channels and protocols with NHDOT IT and ITS operational personnel, including field maintenance teams. | M | |||
| B11.3 | The Proposed Solution shall provide regular (e.g., weekly, monthly, quarterly) security reports detailing threats, vulnerabilities, incidents, and overall security posture, including a dedicated section for ITS-specific security findings. | M | |||
| B11.4 | The Proposed Solution shall provide immediate notification for critical security incidents, especially those impacting transportation system availability or safety. | M | |||
| B11.5 | Change Management: The Proposed Solution shall follow a defined change management process for any modifications to the security solution or its configurations within NHDOT's environment, coordinating closely with NHDOT's ITS change control procedures, particularly those related to field maintenance activities. | M | |||
| B11.6 | Knowledge Transfer: The Proposed Solution shall provide documentation and, as needed, training to NHDOT staff (including ITS operators and field technicians) to ensure understanding of the Proposed Solution and its integration with ITS, emphasizing secure field best management and maintenance practices. | E | |||
| B11.7 | Onboarding & Transition: The Proposed Solution shall provide a detailed plan for the seamless onboarding and transition of NHDOT's security operations to the Proposed Solution, minimizing disruption to transportation services. | M | |||
| B11.8 | Field Maintenance Coordination: The Proposed Solution shall establish clear coordination procedures with NHDOT's field maintenance teams to ensure security considerations are integrated into routine and emergency maintenance activities. | M | |||
| Integration Requirements | |||||
| B12.1 | ITS System Integration: The MSSP solution shall be capable of integrating with and monitoring NHDOT's specific ITS components and systems (e.g., traffic signal controllers, dynamic message signs, CCTV systems, vehicle detection systems, central traffic management software, and data analytics platforms). This includes the ability to ingest logs and telemetry from these diverse ITS devices and applications. | E | |||
| B12.2 | Data Source Compatibility: The MSSP solution shall be compatible with NHDOT's existing data sources for security logging, including logs from ITS devices, controllers, sensors, and proprietary ITS applications, in addition to standard IT sources (e.g., firewalls, servers, network devices). | E | |||
| B12.3 | API/Interface Availability: The MSSP solution shall provide APIs or other standard interfaces to allow for potential future integration with NHDOT's internal tools or dashboards, and potentially with ITS architectural components for data exchange, as mutually agreed upon. | O | |||
| B12.4 | Field Maintenance System Integration: The MSSP solution shall be capable of integrating with NHDOT's field maintenance management systems or ticketing systems to correlate security events with maintenance activities, if such systems exist and are accessible. | O | |||
| B12.5 | If the Vendor's Proposed Solution includes equipment to be installed on premises, the MSSP Vendor shall configure all on-premises monitoring systems in accordance with the State Cyber Security Group's deployment requirements. | M | |||
| B12.6 | The Proposed Solution shall provide a work order system to track response times, troubleshooting activities, and repairs that can be integrated with NHDOT's Work Order Fleet Inventory (WOFI) system. | O | |||
| B12.7 | The Proposed Solution's work order system shall be functionally compatible with the WOFI system and/or Footprints. | O | |||
| B12.8 | The Proposed Solution shall grant NHDOT and NHDoIT full access to the Vendor’s work order system. | M | |||
| Documentation & Deliverables Requirements | |||||
| B13.1 | Concept of Operations (ConOps): The Proposed Solution shall submit a detailed ConOps outlining the operational aspects of the Proposed Solution service within NHDOT's context, emphasizing its role in securing transportation systems. | M | |||
| B13.2 | System Requirements Specification (SRS): The Proposed Solution shall submit a document detailing all functional and non-functional requirements of the Proposed Solution, with traceability to NHDOT's needs and ITS operational objectives. | M | |||
| B13.3 | Incident Response Plan (IRP): The Proposed Solution shall submit a tailored IRP for NHDOT, including roles, responsibilities, and procedures for various incident types, with specific sections addressing ITS operational impacts and recovery. | M | |||
| B13.4 | Test Plans & Reports: The Proposed Solution shall submit documentation of all verification and validation activities, including test plans, procedures, and expected results, with specific V&V activities for ITS components. | M | |||
| B13.5 | Configuration Management Plan: The Proposed Solution shall submit a plan outlining how changes to the Proposed Solution solution and its configurations will be managed, including changes impacting ITS field devices. | M | |||
| B13.6 | Regular Security Reports: As specified in Requirement B11.3, with clear reporting on ITS-specific security posture. | M | |||
| B13.7 | Post-Incident Reports: The Proposed Solution shall submit detailed reports for all significant security incidents, including root cause analysis, corrective actions, and lessons learned, with a focus on transportation system impacts. | M | |||
| B13.8 | Training Materials: The Proposed Solution shall submit documentation and materials for any training provided to NHDOT staff. | E | |||
| B13.9 | Field Maintenance Security Guidelines: The Proposed Solution shall submit documentation providing specific security guidelines and best practices for NHDOT's field maintenance personnel when interacting with ITS equipment. | E | |||
| Project Management Requirements | |||||
| B14.1 | Systems Engineering Approach: The Proposed Solution shall demonstrate a clear understanding and application of the FHWA's systems engineering requirements under 23 CFR 940, the systems engineering 'V'-diagram and its associated processes throughout the project lifecycle, ensuring a structured approach to securing ITS. | M | |||
| B14.2 | Project Management: The Proposed Solution shall employ sound project management methodologies, including a dedicated Project Manager, clear communication plans, and regular progress reporting, with specific consideration for ITS project phases. | M | |||
| B14.3 | Risk Management: The Proposed Solution shall implement a continuous risk management process to identify, assess, and mitigate security risks specific to NHDOT's environment, with a strong emphasis on risks to transportation system availability, integrity, and safety. | M | |||
| B14.4 | Quality Assurance: The Proposed Solution shall have a robust quality assurance process to ensure the high quality and effectiveness of all services and deliverables, particularly for ITS security. | M | |||
| B14.5 | Continuous Improvement: The Proposed Solution shall demonstrate a commitment to continuous improvement, regularly reviewing performance and adapting services to evolving threats and NHDOT's needs, especially in the rapidly changing ITS security landscape. | E | |||
| Field Operations Requirements | |||||
| B15.1 | The Proposed Solution's field operations shall be supported by, or leverage, the following system capabilities: | - | |||
| B15.1.1 | Diagnostic Tools and Equipment: Field technicians shall be equipped with a comprehensive "Field Services Kit" containing consumable equipment and diagnostic tools. This includes, but is not limited to: power supplies, patch cords, USB cables, CAT 6 cable, fuses, light kit (for fiber), and multimeters. | M | |||
| B15.1.2 | Inventory Management (NHDOT Inventory): The field technicians will have access to network hardware and equipment from a NHDOT-maintained inventory for replacements. The Vendor shall obey and integrate with NHDOT processes for requesting and tracking parts from this inventory. | M | |||
| B15.1.3 | Location Tracking & Communication: Field technicians shall contact the NHDOT TMC to notify upon arrival and upon departure at field sites (requiring Compass log entries). | M | |||
| B15.2 | The Vendor's field services personnel responsible for the management and maintenance of the ITS networking and communications infrastructure are required to possess and maintain the following minimum qualifications and demonstrated expertise: | ||||
| B15.2.1 | Networking Certifications: It is highly desirable that field maintenance personnel possess professional certifications demonstrating foundational networking knowledge. | E | |||
| B15.2.2 | Cisco Certified Network Associate (CCNA): Demonstrates proficiency in installing, configuring, operating, and troubleshooting medium-sized routed and switched networks using Cisco technologies. | E | |||
| B15.2.3 | CompTIA Network+: Validates the ability to design, configure, manage, and troubleshoot wired and wireless networks, with a vendor-neutral approach. | E | |||
| B15.2.4 | CompTIA A+: Demonstrates foundational knowledge in IT infrastructure, including hardware, software, networking, and security. | E | |||
| B15.2.5 | Another certification that demonstrates comparable depth of knowledge and practical skills in network infrastructure management may be submitted for consideration as an approved equivalent. | E | |||
| B15.2.6 | Electronics and Electrical Knowledge: Field technicians must possess a strong understanding of fundamental electronics and electrical principles relevant to ITS equipment. | M | |||
| B15.2.7 | Field technicians shall demonstrate an understanding of power requirements (AC and DC systems). | M | |||
| B15.2.8 | Field technicians shall demonstrate the ability to safely and effectively use multimeters and other electrical diagnostic tools. | M | |||
| B15.2.9 | Field technicians shall demonstrate knowledge of wiring, cabling standards, and basic electrical troubleshooting in an outdoor, industrial, or ITS environment. | M | |||
| B15.2.10 | Field technicians shall demonstrate familiarity with low-voltage electrical systems typical for communications equipment. | M | |||
| B15.2.11 | Field technicians should have experience with legacy systems commonly found in ITS infrastructure, specifically including, but not limited to analog cameras and serial communications | E | |||
| B15.3 | The Vendor's field services personnel shall strictly adhere to all applicable safety regulations and best practices when performing work on or near roadways and ITS infrastructure. | M | |||
| B15.4 | Compliance with Standards: The Proposed Solution Vendor shall ensure full compliance with all relevant federal, state, and local work zone safety standards, including, but not limited to, the Manual on Uniform Traffic Control Devices (MUTCD) and NHDOT-specific safety guidelines. | M | |||
| B15.5 | Personnel Training: All field personnel engaged in roadside or work zone activities shall possess safety training and certifications satisfactory to NHDOT. | M | |||
| B15.5.1 | Field technicians shall have completed an OSHA 10-Hour Construction Safety course and carry their certification card at all times while in the field. | E | |||
| B15.5.2 | The Vendor shall have someone in responsible charge who has completed Work Zone Traffic Control training (e.g., ATSSA Flagger Certification, Traffic Control Technician). | E | |||
| B15.5.3 | The Vendor shall incorporate any other specific safety training mandated by NHDOT for contractors working within its right-of-way at present and anything that should be required for the life of the contract. | M | |||
| B15.6 | Traffic Control Plans: For any work that could have an impact on the free-flow of traffic, the Vendor shall coordinate the establishment of a temporary traffic control work zone. | M | |||
| B15.6.1 | The Proposed Solution Vendor may be required to recommend a site-specific traffic control plan in accordance with MUTCD and NHDOT standards. These plans will be reviewed and approved by NHDOT prior to implementation. | E | |||
| B15.6.2 | The NHDOT may elect to provide temporary traffic control using NHDOT maintenance personnel. | E | |||
| B15.7 | Personal Protective Equipment (PPE): Field personnel shall consistently use appropriate Personal Protective Equipment (PPE) as required by the nature of the work and applicable safety regulations, including high-visibility apparel (e.g., ANSI Class 2 or 3 vests), hard hats, safety footwear, and eye protection | M | |||
| B15.8 | Incident Reporting and Communication: The Vendor shall have established procedures for immediate reporting of all safety incidents, accidents, or near-misses to NHDOT and relevant authorities. Communication protocols must ensure safety messages are relayed effectively between field teams and NHDOT personnel. | M | |||
| B15.9 | Equipment Safety: All vehicles and equipment used by the Vendor in work zones must be properly maintained, equipped with required safety features (e.g., warning lights, reflective markings), and operated by qualified personnel | M | |||
| B15.10 | On-Demand Field Response Services (ODFRS): The Vendor shall be responsive to on-demand field services requests from the State. | M | |||
| B15.10.1 | ODFRS are intended to be field services specifically requested by the State to supplement existing state maintenance forces. | M | |||
| B15.10.2 | The Vendor shall respond to Emergency Response ODFRS immediately upon notification. | M | |||
| B15.10.3 | The Vendor shall respond to Critical Level 1 Response ODFRS within 4 hours. Critical Level 1 is intended for responses requested Monday-Friday between 7AM and 3PM, excluding holidays. | M | |||
| B15.10.4 | The Vendor shall respond to Critical Level 2 Response ODFRS within 15 hours. Critical Level 2 is intended for responses requested outside of the hours listed for Critical Level 1. | M | |||
| B15.10.5 | The Vendor shall respond to Priority Response ODFRS within two business days. Priority Response is intended for response to occur during regular business hours. | M |
&D &P of &N &F
Activity Deliverable Milestone
| ACTIVITY / DELIVERABLES / MILESTONES PRICING WORKSHEET | ||||
| ACTIVITY, DELIVERABLE, OR MILESTONE | DELIVERABLE TYPE | PROJECTED DELIVERY DATE | MILESTONE PAYMENT | |
| PLANNING AND PROJECT MANAGEMENT | ||||
| 1 | Conduct Project Kickoff Meeting | Non-Software | ||
| 2 | Work Plan | Written | ||
| 3 | Project Status Reports | Written | ||
| 4 | Infrastructure Plan, including Desktop and Network Configuration Requirements | Written | ||
| 5 | Security Plan | Written | ||
| 6 | Communications and Change Management Plan | Written | ||
| 7 | Software Configuration Plan | Written | ||
| 8 | Systems Interface Plan and Design/Capability | Written | ||
| 9 | Testing Plan | Written | ||
| 10 | Data Conversion Plan and Design | Written | ||
| 11 | Deployment Plan | Written | ||
| 12 | Comprehensive Training Plan and Curriculum | Written | ||
| 13 | End User Support Plan | Written | ||
| 14 | Business Continuity Plan | Written | ||
| 15 | Documentation of Operational Procedures | Written | ||
| INSTALLATION | ||||
| 16 | Provide Software Licenses (if needed) | Written | ||
| 17 | Provide Fully Tested Data Conversion Software | Software | ||
| 18 | Provide Software Installed, Configured, and Operational to Satisfy State Requirements | Software | ||
| TESTING | ||||
| 19 | Conduct Integration Testing | Non-Software | ||
| 20 | Conduct User Acceptance Testing | Non-Software | ||
| 21 | Perform Production Tests | Non-Software | ||
| 22 | Test In-Bound and Out-Bound Interfaces | Software | ||
| 23 | Conduct System Performance (Load/Stress) Testing | Non-Software | ||
| 24 | Certification of 3rd Party Pen Testing and Application Vulnerability Scanning. | Non-Software | ||
| SYSTEM DEPLOYMENT | ||||
| 25 | Converted Data Loaded into Production Environment | Software | ||
| 26 | Provide Tools for Backup and Recovery of all Applications and Data | Software | ||
| 27 | Conduct Training | Non-Software | ||
| 28 | Cutover to New Software | Non-Software | ||
| 29 | Provide Documentation | Written | ||
| 30 | Execute Security Plan | Non-Software | ||
| OPERATIONS | ||||
| 31 | Ongoing Hosting Support | Non-Software | ||
| 32 | Ongoing Support & Maintenance | Software | ||
| 33 | Conduct Project Exit Meeting | Non-Software | ||
| TOTAL COST |
File details come from the government source that posted it. Updated .