addendum5-attachment4---rfp-doit-2025-067-table-b-2.2-and-table-b-2.3.xlsx
XLSX spreadsheet 29 KB Posted
- Solicitation number
- RFP DOT Managed Security Service Provider (MSSP) #2025-067
- Issued by
- New Hampshire
About this file
This is an addendum document containing technical requirements and service level agreements for the New Hampshire Department of Transportation's RFP DoIT 2025-067 for managed security services and field support to the TSMO Bureau and TMC operations. The addendum specifies that vendors must comply with prohibited technologies restrictions by verifying against the State of New Hampshire's Prohibited Technologies List and the FCC Covered List, with vendor responsibility to check parent companies via SAM.gov. Security compliance requires adherence to NIST Special Publication 800-171 Revision 2 baseline controls and NIST SP 800-53 Revision 5 moderate-level controls. Vendors must achieve StateRAMP Authorization within 12 to 24 months depending on their current status, or alternatively provide FedRAMP Authorization or HITRUST certification. Solutions must be hosted on pre-approved platforms including AWS US East/West, AWS GovCloud, Azure Commercial or Government Cloud, Google Services, or Oracle Government Cloud. Web content and mobile applications must comply with WCAG 2.1 Level AA standards, and vendors must submit completed VPAT 2.5 assessments.
The service level agreement requirements mandate 24/7 system hosting availability except during scheduled maintenance, with technical support available via phone or email between 6:30 a.m. and 5:00 p.m. Monday through Friday Eastern Time. Critical security patches must be applied within 48 hours of availability, high-vulnerability patches within 15 calendar days, and all other patches within 60 calendar days. The vendor must provide quarterly reporting on system uptime, change requests, vulnerabilities, and incidents. Service credits apply when vendors fail to meet uptime requirements using the formula of the total contract item price divided by 365 multiplied by the number of days the contract item was not provided. Liquidated damages of $260 per calendar day apply for failure to complete assigned milestones, not exceeding 25 percent of monthly invoice payments. Vendors may be liable for direct damages caused by security failures up to two times the fees paid during the preceding 12 months, except in cases of gross negligence, willful misconduct, fraud, or data protection violations. Two business days' advance notification to the State Project Manager is required for all system changes and updates.
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table B-2.2
| TECHNICAL REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| PROHIBITED TECHNOLOGIES | |||||
| PT1 | No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf |
and
| No equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlist | M | ||
| PT2 | It is the Vendor’s responsibility to check for the parent company for any equipment, products or services. Visit SAM.gov to search for prohibited companies. | M | |
| SECURITY COMPLIANCE REQUIREMENTS | |||
| T1.1 | Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline |
| SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/171/r3/final | M | |
| T1.2 | Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus |
| SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final | E | ||
| STATERAMP AUTHORIZATION | |||
| T2.1 | StateRAMP Ready/Authorized Certification https://stateramp.org/ | E | |
| T2.2 | If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract. | M | |
| T2.3 | If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.4 | If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract | M | |
| T2.5 | If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal. | M | |
| T2.6 | If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.7 | Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. | M | |
| OTHER CERTIFICATION IN LIEU OF STATERAMP | |||
| T3.1 | FedRAMP Authorized https://www.fedramp.gov/ How to Become FedRAMP Authorized FedRAMP.gov | O | |
| T3.2 | HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance Information Risk Management and Compliance https://hitrustalliance.net/ | O | |
| HOSTED PLATFORM | |||
| T4.1 | The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any SaaS or other Software Product. If your platform is included in the list below identify the platform in the Vendor Comments. |
• AWS US East/West
• AWS GOVCLOUD
• AZURE Commercial Cloud
• AZURE Government (Includes Dynamics 365)
• GOOGLE Services (Cloud Platform Products and Underlying Infrastructure)
• ORACLE Government Cloud – Common Controls
| • ORACLE Federal Managed Cloud Services | M | ||
| INDIVIDUAL AGENCY COMPLIANCE REQUIREMENTS (NOT APPLICABLE) | |||
| - | - | - | |
| INFORMATION TECHNOLOGY ACCESSIBILITYCCESIABILITY COMPLIANCE | |||
| T6.1 | Web content and mobile applications must comply with WCAG 2.1, (https://www.w3.org/TR/WCAG21/) Level AA. | M | |
| T6.2 | Hardware that transmits information or has a user interface, such as display screens, variable message signs, and kiosks, must comply with ICT Accessibility Standards and Guidelines (https://www.access-board.gov/ict/), Chapter 4: Hardware. | M | |
| T6.3 | Vendor shall complete the VPAT 2.5 WCAG (November 2023) (https://www.itic.org/dotAsset/9893d84b-efc7-460a-97ed-851477def5c4.docx) and submit with their proposal in Section III: Responses to Requirements and Deliverables ITI Accessibility Policy (https://www.itic.org/policy/accessibility/vpat) | M |
Table B-2.3
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| SLA-1 | The Vendor’s System support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof. | M | |||
| SLA-2 | The Vendor shall maintain the system monitoring in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-3 | The Vendor shall repair or replace the hardware or software, or any portion thereof, so that the System operates in accordance with the Specifications, terms, and requirements of the Contract. | E | |||
| SLA-4 | All hardware and software components of the Vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within 48 hours of availability and validation of the patch. Critical patches are defined as mitigation for vulnerabilities under active exploitation. Patches for high vulnerabilities not under active exploitation shall be applied within fifteen (15) calendar days from vulnerability publication date. All other patches shall be applied within sixty (60) calendar days from vulnerability publication date. (RA-5) | M | |||
| SLA-5 | The State shall have unlimited access, via phone or email, to the Vendor technical support staff between the hours of 6:30am to 5:00pm- Monday through Friday ET. | M | |||
| SLA-6 | The critical networking and communication equipment issues and incidents for the several service levels are defined in Supplemental Appendix B-2.3.1 Incident Response. | M | |||
| SLA-7 | As part of the maintenance agreement, the Vendor shall commit to the timeline for critical networking and communication equipment issues and incidents for the several service levels in accordance with Supplemental Appendix B-2.3.1 Incident Response. | M | |||
| SLA-8 | The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance. | M | |||
| SLA-9 | A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied. | M | |||
| SLA-10 | If the Vendor is unable to meet the uptime requirement of SLA-8 or the time-based requirements under SLA-2, SLA-4, SLA-5, and SLA-7, the Vendor shall credit the State’s account in an amount based upon the following formula: | M |
(Total Contract Item Price/365) x Number of Days Contract Item Not Provided.
| The State must request this credit in writing. | ||
| SLA-11 | The Vendor shall use a change management policy for notification and tracking of change requests as well as critical outages. | M |
| SLA-12 | A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no work around to the problem. | M |
| SLA-13 | The Vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: | M |
| · Service up-time | ||
| · All change requests implemented, including operating system patches | ||
| · All Vulnerabilities reported including corrective action plan | ||
| · All Incidents reported including actual issue and resolution | ||
| · Number of incidents reported by level with initial response time, service time, and resolution time. | ||
| SLA-14 | The Vendor will give two-business days prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes. | M |
| SLA-15 | The Vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost. | M |
| SLA-16 | For all maintenance Services calls, the Vendor shall ensure the following information will be collected and maintained: | M |
| 1. Nature of the Incident Response. | ||
| 2. Current Status of the Incident Response. | ||
| 3. Recommended Action plans, dates, and times. | ||
| 4. Expected and actual completion time. | ||
| 5. Incident resolution information. | ||
| 6. Resolved by. | ||
| 7. Identifying number i.e., work order number. | ||
| 8. Issue identified by. | ||
| 9. Development of After Action report. | ||
| SLA-17 | The Vendor must work with the State to identify and troubleshoot system failures, incidents and vulnerabilities by collecting the following information: | M |
| 1. Diagnosis of the root cause of the failure, incident, or vulnerability. | ||
| 2. Identification of repeat calls or repeat problems. | ||
| 3. Action item to minimize future repeats. |
SLA-18 The State may assign specific assignments, tasks, and milestones throughout the life of the Project. When assignments are established with documented tasks and milestones, the Vendor shall be required to complete the assignments and tasks within the agreed upon milestones. Tasks may include on-demand field services as described in Appendix E, Section 1.6. Failure to complete assignments and tasks within the agreed upon time is subject to supplemental liquidated damages in accordance with NHDOT Standard Specifications Section 108. For assignments and tasks associated with this project, supplemental liquidated damages shall be at the rate of $260.00 per calendar day, which amount the Vendor shall credit the State’s account.
| The State must request this credit in writing for each failure to complete assignments and tasks or to meet agreed upon milestones. Liquidated damages shall not exceed 25% of the monthly invoice payment for services during any calendar month. | M | ||
| SLA-19 | If the State determines that the Vendor is at fault for failure to meet SLA-2 or SLA-12 based on identified vulnerabilities and/or due to intrusions and exploits that result in damage (system damage, equipment damage and/or financial damage) to the State or the State’s network, the Vendor shall be liable to correct/repair the damage and address the vulnerability, intrusion, or exploit at no additional cost to the State. Where the State suffers financial damages, the State shall be entitled to recover its direct damages from such failure, subject to an aggregate liability not to exceed two times the fees paid during the preceding 12 months. | M |
| The liability limitation shall not apply to gross negligence, willful misconduct, fraud, confidentiality breaches, or violations of applicable data protection laws and statutes. | ||
| SLA-20 | The State may assign specific tasks as part of this Project. For example: | M |
| 1. The Vendor shall work with the State to support the TSMO Bureau’s transition from a Layer 2 to a Layer 3 network. (nearly completed) | ||
| 2. The Vendor shall support the integration of new traffic signal systems into the TSMO Bureau’s network. | ||
| 3. The Vendor shall support the Department’s integration of connected vehicle infrastructure (V2I/V2X). | ||
| 4. The Vendor shall support expanding the Department's use of Cisco ISE, Catalyst Center and Cyber Vision on the ITS network. | ||
| Failure to complete tasks at the agreed upon milestones throughout the life of the Project is subject to supplemental liquidated damages as described in SLA-18. | ||
| SLA-21 | Failure to perform/submit/complete any other requirements of the Contract, including but not limited to System Requirements of Table B-2.1 and Deliverables from Table B-3, will be subject to supplemental liquidated damages as described in SLA-18. | M |
File details come from the government source that posted it. Updated .