addendum5-attachment5---appendix-b-2.3.1-incident-response-revised.pdf
PDF 339 KB Posted
- Solicitation number
- RFP DOT Managed Security Service Provider (MSSP) #2025-067
- Issued by
- New Hampshire
About this file
This is Addendum 5, Attachment 5 to the RFP DoIT 2025-067 Managed Security Service Provider (MSSP) document issued by the New Hampshire Department of Transportation, establishing the incident response requirements and procedures for cybersecurity events affecting NHDOT's Intelligent Transportation Systems (ITS) infrastructure and field systems. The addendum defines a structured incident response process that the selected MSSP vendor must follow in coordination with NHDOT's Transportation Management Center (TMC) and NHDoIT, with response requirements differentiated by incident severity level and aligned with service level agreements SLA-6 and SLA-7. The MSSP vendor is required to demonstrate how its incident response processes, resources, and capabilities will align with NHDOT's established Incident Response Workflow, and may propose enhancements that improve timeliness, coordination, and effectiveness while remaining consistent with operational needs.
The document classifies all cybersecurity events into three categories: Critical Incidents (events actively causing or with potential to cause immediate disruption of statewide ITS operations, compromise of safety-critical systems, loss of operational awareness during transportation incidents, or loss of sensitive data); High Priority Alerts (security events with significant but not catastrophic impact, such as targeted malware, unauthorized VPN access attempts, or intrusion into non-critical ITS systems); and Routine Issues (lower-severity incidents including misconfigurations, failed patches, minor anomalies, or isolated false positives). The vendor's proposed solution must differentiate between triage, mitigation, troubleshooting/escalation, and repair/restore phases, with specific time-based performance metrics required: Time to Triage (TTT) to acknowledge alerts and initiate incident handling; Time to Initial Mitigation (TIM) to contain incidents and prevent damage or unauthorized access; Time to Troubleshoot/Escalate to resolve incidents; and Time to Resolve (TTR) to complete repairs and restoration of networks and devices, with resolution timelines to be defined in the vendor's approved Incident Management and Response Plan (IMRP).
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
STATE OF NEW HAMPSHIRE
DEPARTMENT OF TRANSPORTATION
RFP DoIT 2025-067 – Managed Security Service Provider (MSSP)
APPENDIX B SUPPLEMENTAL
Appendix B-2.3.1
INCIDENT RESPONSE
1. Summary
The purpose of this Appendix is to establish the MSSP’s structured approach to handling cybersecurity incidents affec�ng the NHDOT ITS network and field systems. It defines incident categories, response expecta�ons, communica�on protocols, and resolu�on standards in alignment with NHDOT’s opera�onal priori�es and SLA-6 and SLA-7. The MSSP Vendor will coordinate closely with NH DoIT and TSMO Bureau staff to ensure rapid isola�on, inves�ga�on, and recovery of services while maintaining clear documenta�on and preserving forensic evidence.
2. Incident Response Process
To ensure a clear and consistent approach to cybersecurity events affec�ng NHDOT’s Intelligent
Transporta�on Systems (ITS) infrastructure, the State has developed an Incident Response Workflow.
This diagram illustrates the communica�on flow, response levels, and escala�on procedures that the selected Vendor will be expected to follow in coordina�on with the NHDOT Transporta�on
Management Center (TMC) and NHDoIT.
The workflow establishes response �me requirements based on incident severity, ranging from a single device outage to a statewide disrup�on, and includes procedures for remote troubleshoo�ng, site response, repor�ng, and escala�on. The Incident Response Workflow diagram serves as a reference model and baseline expecta�on for vendor response and escala�on protocols.
Vendors are expected to demonstrate in their proposals how their incident response processes, resources, and capabili�es will align with this workflow. Where appropriate, vendors may also propose enhancements or addi�onal steps that improve �meliness, coordina�on, and effec�veness while remaining consistent with NHDOT’s opera�onal needs.
3. Types of Incidents
All cybersecurity events affec�ng the NHDOT ITS environment are classified in the following three categories:
3.1. Cri.cal Incident: Any event ac�vely causing or with poten�al to cause immediate disrup�on of statewide ITS opera�ons (i.e., ransomware), compromise of safety-cri�cal systems (i.e., failure of equipment during part-�me shoulder use opera�ons), immediate loss of opera�onal awareness during a transporta�on incident (i.e., communica�ons failure for ITS equipment monitoring a highway crash or police incident) or loss of sensi�ve data.
3.2. High Priority alert: Security events with significant but not catastrophic impact, such as targeted malware detected on a field network segment, unauthorized VPN access a8empt, or intrusion into non-cri�cal ITS systems.
3.3. Rou.ne issues: Lower-severity incidents including (but not limited to) misconfigura�ons, failed patches, minor anomalies flagged by monitoring systems, or isolated false posi�ves. Any incident that has not been assigned a Cri�cal or High Priority status by either the MSSP Vendor or by NHDOT personnel will be considered a Rou�ne issue.
4. Response .me to Incidents
The MSSP's Proposed Solu�on must differen�ate between triage, mi�ga�on, troubleshoo�ng/escala�on, and repair/restore phases.
4.1. Time to Triage (TTT): Time to acknowledge an alert and ini�ate incident handling. This includes a determina�on if the alert is a true or false posi�ve or if addi�onal inves�ga�on is needed. Time to Triage (TTT) shall be defined as the �me lag between the �me when the alert is created and the �me when an ini�al mi�ga�on is proposed for ac�on.
4.2. Time to Ini.al Mi.ga.on (TIM): The Time to Ini�al Mi�ga�on (TIM) is intended to contain the incident to prevent damage, spread, unauthorized access, or data loss. The ini�al mi�ga�on implements the recommended ac�on(s) from triage (Cri�cal and High Priority) or troubleshoo�ng (Rou�ne). Time to Ini�al Mi�ga�on (TIM) shall be defined as the �me lag between granted authority (e.g., no�ce to proceed from NHDOT to implement the mi�ga�on) to confirma�on that the recommended mi�ga�on ac�on(s) has been taken.
4.3. Time to Troubleshoot/Escalate: Once an incident has been contained through the ini�al mi�ga�on, the Time to Troubleshoot (Cri�cal and High Priority) shall be defined as the �me lag between confirma�on of the ini�al mi�ga�on to the recommenda�on of ac�on(s) to resolve the incident. Time to Escalate (Rou�ne) shall be defined as the �me lag between confirma�on of the ini�al mi�ga�on to a determina�on that addi�onal ac�on(s) is needed to ini�ate a resolu�on, plus the �me required to take the proposed ac�on for effec�ve resolu�on.
4.4. Time to Resolve (TTR): The Time to Resolve (TTR) shall be defined as the �me it takes to resolve the incident through repairs or restora�on of the network and devices. Resolu�on
�melines shall be defined by the Vendor’s approved Incident Management and Response Plan
(IMRP).
The Proposed Solu�on shall have systems in place to track and ensure an alert and incident response
�me in accordance with the table below:
Incident Type Time to Triage (TTT) Time to Ini.al
Mi.ga.on (TIM)
Time to
Troubleshoot/Escalate
Cri.cal Incident <30 minutes <15 minutes <60 minutes
High Priority Alert <60 minutes <60 minutes <60 minutes
Rou.ne Issues N/A <24 hours <5 business days
Time to Resolve (TTR) shall be based on the Vendor’s approved IMRP.
The alert and incident response clock begins when the alert is created (either by MSSP monitoring or
NHDOT TMC). The TTT and TIM are not cumula�ve; the �me lag between ini�al mi�ga�on proposal and authority granted for that ac�on is not the Vendor’s responsibility, therefore, a new clock begins for TIM when authority is granted for the ini�al mi�ga�on ac�on(s) resul�ng from triage or rou�ne troubleshoo�ng.
The Time to Resolve begins when an alert is acknowledged as an incident (i.e., a true posi�ve) and ends when the incident has been resolved as defined by all of the following condi�ons:
• The threat has been eradicated or is no longer ac�ve.
• Any compromised accounts, creden�als, systems, and access paths have been addressed.
• Systems have been restored to the pre-incident opera�onal state and validated by NHDOT.
• Any required follow-up ac�ons have been completed or assigned.
File details come from the government source that posted it. Updated .