addendum5-inquiryresponses.pdf

STATE OF NEW HAMPSHIRE

DEPARTMENT OF TRANSPORTATION

RFP DoIT 2025-067 – Managed Security Service Provider (MSSP)

ADDENDUM #5

A number of inquiries were received from poten�al vendors by the September 22, 2026 deadline and are answered and addressed in this Addendum. In addi�on, the state held one-on-one mee�ngs with the vendors, which resulted in addi�onal modifica�ons to the RFP as detailed below.

Modifica�ons to the RFP (includes new MSSP_RFP_Addendum5 that supersedes all previous versions of the RFP):

1. Cover Sheet: Updated to show the dates that Addendums #2-#5 were published. Updated to reflect the revised Proposal Due Date of November 17, 2026 at 3:00 PM ET. Added nota�on that edits to the RFP are in Bold Type throughout MSSP_RFP_Addendum5.

2. Sec�on 1.1.1 Introduc�on: Added a reference quan�ty of 190 ethernet switches on the current network.

3. Sec�on 1.1.2 Scope of Work (SOW) Overview:

a. Modified the fourth paragraph to indicate that the State will provide a list of current assets to the selected Vendor. Includes clarifica�on of the Vendor’s responsibility to verify the list of current assets and work with the State to resolve any conflicts.

b. Modified the eighth paragraph to indicate that the list of relevant creden�als is not intended to require a Vendor to possess staff with all given creden�als, subject to the requirements in Appendix D, Sec�on 3.

4. Sec�on 1.2 Schedule of Events: Revised Schedule of Events in accordance with Addendum #4.

5. Sec�on 2.5 Vendor Inquiries: A new paragraph has been added, detailing the Extended Vendor

Inquiry Period.

6. Sec�on 3.1.2 Transmi@al Form Le@er: Revised the proposal due date to November 17, 2026

(Addendum #4 included the Word document of the transmi@al le@er).

7. Sec�on 3.1.11 Price Proposal: Revised to indicate that Tables E-1.1 through E-1.8 shall be included in the Price Proposal.

8. Appendix B, Sec�on 1 Statement of Work:

a. Modified the third paragraph to indicate that the State will provide a list of current assets to the selected Vendor.

b. Modified the seventh paragraph to indicate that the list of relevant creden�als is not intended to require a Vendor to possess staff with all given creden�als, subject to the requirements in Appendix D, Sec�on 3.

9. Table B-2.1:

a. New requirements have been added to Sec�on B8 Performance Requirements detailing

NHDOT and NH DoIT access to logs and event data.

b. New requirements have been added to Sec�on B15 Field Opera�ons Requirements to specify the on-demand field response service (ODFRS) �mes. These requirements relate directly to pricing in Appendix E, Table E-1.6.

10. Appendix B, Sec�on 2.3 Service Level Agreement (SLA):

a. SLA-4 includes a defini�on of a cri�cal patch and adjusts the �ming for applica�on of patches.

b. SLA-18 includes a clarifica�on regarding pricing for on-demand field response services.

c. SLA-18 includes a clarifica�on that supplemental liquidated damages will be capped at

25% of the monthly invoice value.

d. SLA-19 modifies the Vendor’s financial responsibility for failure to meet SLA-2 or SLA-12, requiring reimbursement to the State for up to two �mes the fees paid during the preceding 12 months, subject to excep�ons for negligence, misconduct, fraud, or viola�ons of law.

11. Appendix B-2.3.1: Appendix B-2.3.1 has been substan�vely changed to redefine the protocol and

�melines for the various stages of incident response.

a. Several examples of a Cri�cal Incident have been included for guidance.

b. Response and Service �mes have been replaced with Time to Triage (TTT), Time to Ini�al

Mi�ga�on (TIM) Time to Troubleshoot/Escalate and Time to Resolve (TTR).

c. The table of alert and incident response tracking has been updated to �melines that are more aligned with industry standards.

d. Some defini�ons for a resolved incident are now included.

e. For clarifica�on, the incident response service levels are subject to SLA-7 and SLA-10.

12. Appendix C, Table C: Topics: The reference to an a@achment for Topic 4 has been removed.

13. Appendix D, Sec�on 3: Field Services Supervisor – Corrected the cer�fica�on to CompTIA

Network+.

14. Appendix E, Table E-1.1: Minor discrepancies between the Deliverables table and the Pricing tables have been corrected.

15. Appendix E, Sec�on 1.6 and Table E-1.6: Changes were made to clarify that these are for on-demand field services (ODFRS) only and are therefore independent of the incident response requirements indicated in Appendix B-2.3.1 (as revised). For clarifica�on, the ODFRS performance standards described in Table B-2.1 Sec�on 15 and Appendix E, Sec�on 1.6 are subject to SLA-18. A new A@achment 6 with the pricing worksheets has been provided.

16. Appendix I: Reference to A@achment 8 has been modified; previous A@achment 8 was incorporated into A@achment 7.

17. Revised A@achment 1 - Table B-2.1

18. Revised A@achment 4 - Table B-2.2 and Table B-2.3

19. Revised A@achment 5 – Appendix B-2.3.1

20. Revised A@achment 6 – Table E Pricing Worksheets

The following ques�ons have been received (some ques�ons have been paraphrased for convenience and clarity):

1. What is required for penetra�on tes�ng?

Response: There are four references to the Vendor's penetration testing:

• Requirement T2.7 anticipates penetration testing of the Contractor's environment as part of

StateRAMP compliance.

• Appendix C, Topic 6, question 4 asks for the Vendor's approach to Security Testing, specifically whether the Vendor uses internal or external resources for simulated penetration testing.

• Appendix C, Topic 10 requires the Vendor to fill out the Testing chart to identify Vendor vs. State roles in various testing scenarios, including simulated attack penetration testing.

• Appendix C, Topic 10, question 12 asks the Vendor to outline the methodology for Security and

Penetration Testing to comply with NIST SP800-115.

2. How many ethernet switches are deployed in the field today?

Response: At the �me of the RFP, the State maintains approximately 190 field switches.

3. Requirement B12.5 obliges the Vendor to configure all on-premises monitoring systems in accordance with the State Cyber Security Group's deployment requirements. Would the State please share those requirements during the inquiry period, or characterize them, so that on-premises design and cost can be proposed accurately?

Response: The current on-premises monitoring systems include CyberVision, ICE, and Catalyst Center.

Additionally, the New Hampshire Department of Information Technology (NH DoIT) maintains a list of policies and procedures regarding cybersecurity at the following link:

https://www.doit.nh.gov/cybersecurity/nh-cybersecurity-policy-library. The Vendor will be responsible for any requirements relevant to this project found in these policies and procedures.

Relative to the requirements for on-premises monitoring systems, the Vendor is directed to Information

Assets - Access Control Policy in accordance with NIST SP 800-53 Rev. 5 Controls.

4. Requirement B8.2 provides that the Vendor shall ini�ate response to cri�cal incidents "upon TMC approval," and B9.11 describes phased autonomy beginning with pre-approval. Is TMC approval authority available 24/7/365? If not, what are the staffed hours, who holds authority outside them, and what is the State's target �me to grant approval?

Response: The Transportation Management Center (TMC) is a 24/7/365 operation. The TMC will have the authority to provide approval to critical incident mitigations that are included in the Incident Management and Response Plan. Where custom mitigations or responses are needed, the next level of authority will be the Bureau of TSMO leadership that generally are on duty from 7:00AM-4:00PM, Monday-Friday, except state holidays.

5. For the phased approach to response autonomy in B9.11, what condi�ons or milestones would the State expect to see before gran�ng greater automa�on, and over what an�cipated

�meframe?

Response: The State does not have defined milestones for increasing levels of autonomy. It is anticipated that as the Vendor successfully navigates incident response and as the relationship between the State and

Vendor matures, the Vendor will be granted increasing levels of autonomy as determined by the State.

Vendor may anticipate at least three months trial period prior to adding in automation.

6. Field technicians will draw replacement hardware from a NHDOT-maintained inventory. Would the State describe the inventory loca�ons, current stock levels for common failure items, the request and tracking process, and typical availability? We also wish to confirm that the Vendor is not responsible for stocking spares, and to understand how State stock availability interacts with the Vendor's response and resolu�on commitments.

Response: The selected Vendor will be provided the field equipment inventory location(s) and typical stock levels as well as the procedures for access to the inventory. The Vendor shall not be responsible for maintaining the inventory of spare materials but may be required to replace hardware that is borrowed from

State inventory to temporarily fix a failure caused by the Vendor's actions.

7. Is there an established budget, appropria�on or not-to-exceed range for this contract?

Alterna�vely, can the State share prior-year expenditure on comparable services?

Response: The State is not prepared to share the estimated budget for this effort. There has not been a prior similar contract with comparable services at NHDOT.

8. SLA-19 provides that where the State determines the Vendor is at fault, the Vendor shall correct the damage at no addi�onal cost and addi�onally credit the State 120% of the financial cost or damage created. No limita�on of liability is stated. Would the State consider a mutually agreed aggregate cap on this obliga�on, for example a mul�ple of annual contract value, consistent with the limita�ons customary in the P-37 General Provisions? Would the State also clarify how

"at fault" is determined and whether the Vendor has a right to contest that determina�on?

Response: If the State determines that the Vendor is at fault for failure to meet SLA-2 or SLA-12 based on iden�fied vulnerabili�es and /or due to intrusions and exploita�ons that result in direct damage(s)

(system damage, equipment damage, financial damage) to the State or the State's network, the State shall be en�tled to recover its direct damages from such failure, subject to an aggregate liability not to exceed two �mes the fees paid during the preceding 12 months. The liability limita�on shall not apply to gross negligence, willful misconduct, fraud, confiden�ality breaches, or viola�ons of applicable data protec�on laws and statutes. Determina�ons for "at fault" status will be dictated by the Contract language; specifically, under Contract General Provisions (P-37).

9. Requirement B8.3 requires 99.99% up�me of the central monitoring system excluding planned maintenance, and Topic 18 requires a 99.99% guarantee measured monthly, while SLA-8 requires availability 24x7 except during scheduled maintenance. Would the State confirm the measurement period, what cons�tutes planned or scheduled maintenance for the calcula�on, and the method by which up�me is calculated and evidenced?

Response: The selected MSSP Vendor shall be responsible for providing and guaranteeing the availability of the system 24x7, with an allowance for not more than 260 seconds (4.3 minutes) per month of unan�cipated down�me. Planned and scheduled maintenance periods shall be maintenance down�me that has been pre-arranged with the State a minimum of 72 hours prior to the outage and shall indicate the start and guaranteed end �me of the outage. These planned and scheduled maintenance periods should occur during NHDOT's typical maintenance window of Monday through Friday between 10:00

AM and 2:00 PM, excluding State holidays. The Vendor shall provide repor�ng on down�me (planned and unplanned), with independent verifica�on by the State.

10. Table C excludes only Topic 1 aBachments from the 98-page maximum, and the per-topic limits sum to exactly 98 pages. Topic 10 requires a sample User Acceptance Test Plan as an appendix and Topic 12 requires environment diagrams as an aBachment, while Topics 4 and 12 state the limit "includes the ABachment." Would the State confirm whether required appendices and aBachments for Topics 2 through 22 count toward the per-topic limits and the 98-page total?

Response: The intent of the page limit for Appendix C responses excludes the sample User Acceptance Test

Plan (to be provided as an appendix to the proposal) but includes the attachment referenced in Topic 12. A correction has been made to Table C to remove the reference to the Attachment with Topic 4. Any other attachments or appendices required by the Topic questions will not count against the 98-page limit for

Appendix C responses.

11. Sec�on 4, paragraph 2.6 states the State will only consider pricing provided in Tables E-1.1 through E-1.8, while Sec�on 3, paragraph 1.11 lists Tables E-1.1 and E-1.3 through E-1.7 for

Sec�on VIII. Would the State confirm whether Table E-1.2 is to be submiBed, and whether it is included in the scored Total Proposal Price?

Response: Table E-1.2 shall be submitted as part of the proposal. The price from Table E-1.2 is entered into

Table E-1.8 and is calculated into the Total Proposal Price. RFP Section 3.1.11 has been revised to include

Table E-1.2 in the list.

12. Would the State confirm whether StateRAMP/GovRAMP authoriza�on status is evaluated at the level of the overall managed security service, or separately for each underlying product comprising the proposed solu�on? Where a solu�on combines authorized and non-authorized components, how will the 53 points be assessed, and how does the State interpret "within periodicity"?

Response: The State will evaluate FedRAMP/StateRAMP (GovRAMP) authorization status based on the proposed solution components, not solely at the Vendor entity level. The full 53 points are available only where the Vendor's Proposed Solution (Hosting and Product(s)) is fully FedRAMP or StateRAMP authorized and within periodicity. Accordingly, where a proposed solution combines authorized and non-authorized components, the State's interpretation is that the proposal would receive 18 points. The State defines

"within periodicity" to mean the applicable FedRAMP/StateRAMP/GovRAMP authorization is current, active and maintained within the program's required renewal/assessment cycle.

13. Supplemental liquidated damages of $260.00 per calendar day are applied under SLA-18 and extended by SLA-20 and SLA-21 to every assigned task, every Table B-3 Deliverable and every

Table B-2.1 System Requirement. Would the State clarify whether the $260.00 applies per contract, per assignment, or concurrently per item, and whether an aggregate cap applies?

Would the State also confirm whether damages are suspended where the delay is caused by a

State dependency, such as pending TMC approval or unavailable inventory?

Response: With respect to delays caused by a State dependency, such as delays in State approvals, responses, or inventory availability, the State’s expectation is that supplemental liquidated damages would apply only where the delay is attributable to the Vendor’s failure to perform within the performance requirement or standard. Where a related delay by the State is the substantive cause of the Vendor's failure to perform, such delays generally would not be subject to supplemental liquidated damages. The State will agree to cap supplemental liquidated damages: supplemental liquidated damages for failure to perform in accordance with the service level agreement (SLA) requirements shall not exceed 25% of the monthly invoice payment for services during any calendar month.

14. Both Axis Cameras and Gridsmart Cameras exist in the environment, can quan��es for each type of camera be provided?

Response: At the time of RFP publication, NHDOT maintains 232 Axis cameras of varying models, 86

GridSmart cameras, and 190 ethernet switches.

15. Would NHDOT be able to provide a list of contact informa�on associated with their exis�ng incident response plan for the vendor to properly contact key resources during various security incidents (Cri�cal, High, Medium and Low)?

Response: This list and contact information will be provided to the selected Vendor.

16. What cadence and format of coordina�on mee�ngs does the State expect — weekly, monthly, quarterly — and are these on site in Concord, remote, or a mix?

Response: The State does not require a specific meeting cadence, however, meeting frequency should be related to the level of effort for the project phase. During project startup, the Vendor should anticipate weekly project meetings. Once the Proposed Solution has been implemented and is in active operations, the project meetings frequency can be extended to monthly.

Meetings are generally expected to be virtual, with in-person meetings held as needed for specific purposes such as incident after action and field coordination.

17. Are there small business, DBE, veteran-owned or New Hampshire resident business par�cipa�on goals, preferences or repor�ng obliga�ons applicable to this procurement?

Response: While the State supports small businesses and operates a Disadvantaged Business Enterprise

(DBE) program under 49 CFR Part 26, there is not a project-specific participation goal in this RFP.

18. Within the 150 points allocated to the Proposed Solu�on, is there a published sub-weigh�ng across Topics 1 through 6 and 9 through 11, or across the requirement categories in Table B-2.1?

Response: There is no published sub-weighting of the 150 Proposed Solution points across Topics 1–6 and

9–11 or across the requirement categories in Table B-2.1. These materials are used to evaluate the

Proposed Solution as a whole.

19. For the five required jurisdic�on references, will the State contact all five, and should references be no�fied in advance? Is there a preferred window during which the State expects to make reference calls?

Response: The State has the authority to, but not an obligation to, contact any or all of the five references.

The RFP requires Vendors to provide five jurisdiction references but provides only that the State may conduct reference checks as part of the evaluation. Vendors are strongly encouraged to notify references in advance and confirm that contact information is current and accurate. The RFP does not specify a preferred window for reference calls. Any calls would generally be expected during the evaluation period following proposal submission and prior to final vendor selection.

20. Where a Vendor claims confiden�ality for por�ons of its proposal, would the State confirm whether the separate fully redacted copy is required in both physical and electronic form, and whether it is in addi�on to the copy counts specified in Sec�on 2, paragraph 2?

Response: If a Vendor claims confidentiality for any portion of its proposal, the RFP requires the Vendor to provide a separate fully redacted copy of the complete document, together with a letter identifying the specific redactions and rationale (Section 5.5.1, paragraphs 1-3). The RFP does not separately break out redacted-copy quantities by medium; however, because both physical and electronic submissions are required and the electronic proposal must have the same layout and formatting as the physical proposal, Vendors should include the redacted copy with both the physical and electronic submissions. This redacted copy requirement is separate from, and in addition to, the proposal copy counts stated in Section 2.

21. Which specific NHDOT and NH DoIT cybersecurity policies, standards and the Statewide

Informa�on Security Manual provisions will the MSSP be contractually bound to? Can these be made available before proposal submission, or at minimum listed by �tle and version?

Response: The State adheres to NIST 800-53 Moderate and there will be a (strong) preference for vendors enrolled in GovRAMP (formerly StateRAMP). Vendors shall be responsible for all of the NH DoIT policies and standards. The Statewide Information Security Manual (SISM) has been superseded by a series of IT policies that are available here: https://www.doit.nh.gov/cybersecurity/nh-cybersecurity-policy-library

22. Smart Work Zones and construc�on technologies are named in the scope. How many SWZ deployments are typically ac�ve at once, are they NHDOT-owned or contractor-supplied, and are contractor-supplied units in scope for monitoring while deployed?

Response: The number of Smart Work Zones (SWZ) deployed at any given time is variable; however, the total number of systems deployed concurrently averages five systems. NHDOT includes SWZs in construction contracts, requiring contractor-supplied equipment and systems. The Vendor will be responsible for monitoring the SWZ network traffic while deployed.

23. Table C-2.2 requires the Vendor to es�mate State staff resource hours by role. Would the State indicate the roles and approximate availability NHDOT and NH DoIT an�cipate commiKng, par�cularly TMC operators and field maintenance personnel? Who will serve as State Project

Manager, and what �me commitment is expected of them?

Response: The State is not prescribing specific State staff roles, named individuals, or committed availability for Table C-2.2. Vendors should use Table C-2.2 to estimate the level of effort anticipated for

State resources to support the Vendor's implementation approach, including any key assumptions. At this time, the State Project Manager is the individual named as the RFP POC in Section 2.5 but is subject to change at the State's sole discretion after Contract Award and Notice to Proceed.

24. Does NHDOT operate an exis�ng ITS change control board? If so, what is its mee�ng frequency, its composi�on, and the process and lead �me for an emergency change outside the normal cycle?

Response: NHDOT has established an MSSP Oversight Committee to review all aspects of the MSSP contract. It is anticipated that the Oversight Committee will be responsible for reviewing changes throughout the life of the project. Meetings are held on an ad hoc basis when issues require attention and decisions. The NHDOT Project Manager will determine what constitutes an emergency and organize a meeting for the Oversight Committee as needed.

25. What invoicing frequency and payment terms does the State an�cipate, and is payment milestone-based against the Table E-1.1 deliverables, monthly in arrears against opera�ons, or a combina�on?

Response: The State an�cipates monthly invoices for work completed through the invoicing period. For deliverables and milestones, the Vendor should invoice based on a percent complete basis in the invoice period.

26. Should the Years 1 through 5 pricing assume annual escala�on, or does the State expect firm-fixed pricing across the full ini�al term?

Response: The pricing structure for Tables E-1.4, E-1.5 and E-1.6 are set up to allow the Vendor to dictate the price for each year of the initial five-year term of the contract. The Vendor should provide their pricing for each year of the contract accordingly. Table E-1.7 is set up to allow the Vendor to either provide a one-time price for the given option or a year-by-year price for each year of the initial five-year term of the contract, depending on the nature of the optional requirement being priced.

27. The contract may be extended twice for up to two years each. Does the State wish extension-term pricing to be proposed now? If so, where should it be presented, given the pricing worksheets run only to Year 5?

Response: The proposed pricing for this Proposal shall be based only on the initial Contract Term of five years. If the State desires to execute the Extended Contract Term for an additional two-year term, the State will request a price proposal from the Vendor approximately six months prior to the completion of the initial

Contract Term. If the State desires to extend the contract a second time, the State will request another price proposal approximately six months prior to the completion of the first Extended Contract Term.

28. Requirement B8.1 requires alerts for cri�cal security incidents within five minutes of detec�on.

Would the State confirm that the clock starts at detec�on by the monitoring plaMorm rather than at the �me of the origina�ng event, and how the State expects detec�on �me to be evidenced?

Response: In accordance with the revised Appendix B.2.3.1, the Time to Triage is intended to begin from the security alert by the monitoring system or by personnel actively monitoring the environment, not from the time the originating event first occurred. Vendors will be required to describe how alert generation and time stamps will be documented in their Proposed Solution.

29. The SLA-10 credit formula uses "Total Contract Item Price." Would the State clarify how the contract item is iden�fied for a failure that affects a single service element rather than the whole contract?

Response: When the State determines that a failure affects only an individual service element, the credit calcula�on will be based on the applicable contract item pricing rather than the Total Contract Value.

30. For a managed security service delivered substan�ally through third-party product consoles, would the State confirm whether a VPAT 2.5 is required for each product console the State would access, or a single VPAT covering the Vendor-provided portal and repor�ng interface?

Response: The VPAT 2.5 submission should cover all State-accessible user interfaces included in the proposed solution. If State users will access multiple third-party product consoles, the Vendor should provide VPAT coverage for each such console, unless a single VPAT clearly covers all of them.

31. Will oral presenta�ons include a live product demonstra�on? If so, would the State indicate which capabili�es it expects to see demonstrated, so that an appropriate environment can be prepared?

Response: The State an�cipates that oral presenta�ons will include a comprehensive overview and demonstra�on of the Vendor's Proposed Solu�on, including the technologies, tools, and capabili�es that will be u�lized to sa�sfy the requirements outlined in the RFP.

32. Is the annual volume shown in Table E-1.6 (2× Level 1, 12× Level 2, 12× Level 3, 26× Level 4) a commiBed minimum the vendor will be paid for regardless of actual incident volume, or strictly a per-call rate applied to actual dispatches with no guaranteed minimum or ceiling?

Response: The quantities of service levels included in Table E-1.6 represent an annual budget for all on-demand field services anticipated. While the actual mix of on-demand field services may be different, the intent is that the sum of all the anticipated services is representative of the level of effort expected.

33. Please provide the current authorita�ve inventory of all in-scope NHDOT ITS network and communica�ons infrastructure, including device type, vendor/model, loca�on, lifecycle status, support status, owner, management interface, and whether each asset is office-based, field-deployed, or cloud-hosted.

Response: See revised Section 1.2 Scope of Work Overview, paragraph 4. NHDOT does not intend to provide the inventory list as detailed as requested as records may not be available. NHDOT will share the list of current assets to the selected Vendor but for an order of magnitude, the State maintains 426 switches, routers, and wireless radios at the time of this RFP. The MSSP Vendor will be required to verify the list of assets and work with NHDOT to resolve any conflicts between the State's provided list and the Vendor's initial inventory. Additionally, the selected Vendor will be required to maintain a current inventory of network devices, including connectivity mapping and baseline traffic flow analysis, in coordination with NHDOT and

NH DoIT.

34. Please iden�fy which assets are explicitly out of scope because they are ITS field devices themselves versus in-scope because they are network or communica�ons infrastructure connec�ng those devices to the State system.

Response: The MSSP Vendor is not responsible for operating and maintaining the ITS field equipment whose primary purpose is to collect or disseminate data and information, such as the CCTV cameras, DMS signs, and radar units. The MSSP scope is limited to the network and communications infrastructure that connects those field devices to the State system, typically beginning at the switch, router, or modem equipment.

35. Please provide the current network topology for the TSMO/TMC environment, including core, distribu�on, field edge, VPN, fiber, wireless, cellular, and internet paths used by ITS services.

Response: A detailed current network topology is not being released with this RFP. Vendors should base their proposals on the architecture and scope information provided in the RFP and describe their approach to discovery, validation, and transition planning during implementation.

36. Please describe the current opera�ng boundary between NHDOT, NH DoIT, TSMO, TMC opera�ons, and any third-party providers for monitoring, field response, network engineering, change approval, and incident response.

Response: NHDOT is the entity with overall responsibility for the State of New Hampshire transportation system, including the ITS equipment. The Bureau of TSMO is the NHDOT organization primarily responsible for operating and maintaining the State's ITS equipment and network. The TMC is a 24/7/365 operations center responsible for general oversight of the State's transportation system and uses the ITS field equipment as a tool for that oversight role. NH DoIT is the entity with overall responsibility for the State of

New Hampshire information technology infrastructure, including for NHDOT. Firewalls separate the NH

DoIT State Network from the NHDOT ITS Network infrastructure and devices. NH DoIT has assigned several staff members to be permanently embedded with NHDOT at the Bureau of TSMO with specific assignment to be responsible for portions of the TMC network operations. The MSSP Vendor will coordinate closely with

NHDOT's Bureau of TSMO and its embedded NH DoIT staff members. The MSSP Vendor will provide network monitoring, cybersecurity support, incident response, vulnerability assessment, and field support for network/communications infrastructure, while NHDOT / NH DoIT retain operational authority, approvals, and responsibility for broader State systems and ITS device operations.

37. Please provide the number, type, and geographic distribu�on of the more than 350 ITS devices referenced in the RFP, grouped by CCTV, DMS, radar, weather sta�ons, traffic signal controllers, and communica�ons equipment.

Response: The maintenance and operation of the equipment noted in the question are not the responsibility of the Vendor.

38. Please iden�fy all environments the bidder must monitor or support, including produc�on, test, development, training, disaster recovery, field lab, and any segmented OT/ITS zones.

Response: The MSSP Vendor is only responsible for the Production and Development environments of the network. This includes the ITS Network L3 Ring connecting the Bureau of TSMO to the Bureau of Turnpikes and the NHDOT headquarters at 7 Hazen Drive. As part of the Vendor's proposal response, they may recommend any additional environments that should be included for effective monitoring and continuity of operations.

39. Please provide the current segmenta�on model and any planned changes associated with the transi�on from Layer 2 to Layer 3 networking.

Response: Since the original draft of the RFP, NH DoIT has completed the transition to Layer 3 routing.

Further assistance with establishing routed networks is no longer required.

40. Please iden�fy all current management planes, jump hosts, VPN gateways, privileged access workflows, and remote access methods used to access ITS network equipment and field communica�ons infrastructure.

Response: Detailed information on management planes, privileged access workflows, jump hosts, VPN gateways, and remote access methods will not be issued at this time. Access methods and required privileges will be coordinated with the selected Vendor based on the approved implementation and security approach.

41. Please iden�fy all available log sources, telemetry sources, event types, APIs, syslog feeds, NetFlow/IPFIX sources, packet capture points, EDR sources, vulnerability data sources, and opera�onal monitoring feeds available to the MSSP.

Response: NHDOT intends to leverage existing tools including existing firewalls, WhatsUp Gold, Cisco ISE, Catalyst Center, and Cyber Vision Netflow Data. All other information on available logs, syslog feeds, telemetry, event types, current APIs, NetFlow/IPFIX sources, packet capture points, EDR sources, and vulnerability data requested will not be issued at this time. This information will be coordinated with the selected Vendor based on the Vendor's approved Work Plan, Security Plan, and approach.

42. Please define the minimum required log inges�on scope for day-one monitoring versus later phases, including mandatory sources, preferred sources, and sources not currently available.

Response: The minimum Day One ingestion scope will not be issued at this time. Vendors should propose the log and telemetry sources necessary to satisfy the monitoring, detection, incident response, reporting, and compliance requirements of the RFP, with an approach for phased expansion as needed.

43. Please iden�fy the expected daily event volume, average and peak EPS, network flow volume, reten�on volume, and growth assump�ons for all in-scope sources.

Response: NHDOT cannot provide an expected daily event volume at this �me as the State does not have a baseline or measurement tools to es�mate. These topics will be discussed with the Selected Vendor.

44. Please specify whether the State expects the bidder to deploy a new SIEM, integrate with an exis�ng SIEM, operate an exis�ng plaMorm, or provide a hybrid approach.

Response: The State is open to a Proposed Solution that leverages existing State tools, supplemented by additional Vendor-provided capabilities, provided the proposal satisfies the RFP requirements. Vendors should clearly describe their proposed architecture and any dependencies on existing tools. The State does not have an SIEM for ITS.

45. Please clarify required dashboard personas and views for IT security, network opera�ons, ITS opera�ons, TMC personnel, NH DoIT leadership, NHDOT leadership, and field services.

Response: Vendors should propose dashboarding, reporting, and user views appropriate for operational, technical, and executive management audiences.

46. Please iden�fy exis�ng aler�ng thresholds, severity taxonomy, escala�on rou�ng, and business impact rules used by the TMC and NH DoIT.

Response: See revised Appendix B.2.3.1. The State will not provide a separate detailed taxonomy beyond the incident categories and response expectations in the RFP and Appendix B-2.3.1. Vendors should align their proposed severity model, escalation routing, and alerting approach with the Critical, High Priority, and

Routine categories as described in the RFP and Appendices.

47. Please clarify whether NHDOT requires access to raw logs, normalized events, dashboards, reports, case records, or all of these under the bidder solu�on.

Response: The State expects appropriate access to monitoring outputs, reporting, incident records, and related information needed to provide oversight of the network and to administer the contract while supporting on-going operations. Vendors should describe what data views, dashboards, reports, and case information will be available to the State within the requirements and parameters of the RFP.

48. Please define the required log reten�on model for the base 365-day requirement, including hot, warm, cold, searchable, and exportable reten�on expecta�ons.

Response: See modifications to B8 requirements for new log retention guidance.

49. Please specify whether op�onal 48-month addi�onal event log reten�on should be priced as searchable reten�on, archive-only reten�on, or exportable evidence reten�on.

Response: The optional 48-month additional event log retention shall be considered storage under new

Requirement B8.4.3.

50. Please clarify the required evidence format for audit-ready repor�ng, including whether reports must preserve source logs, �mestamps, chain-of-custody metadata, and change history.

Response: Vendors should propose audit-ready reporting and evidence handling consistent with the RFP, including sufficient documentation to support incident response, vulnerability reporting, corrective actions, and compliance/audit needs. The State anticipates that this may include source logs, metadata with timestamps, and change history.

51. Please iden�fy the required threat detec�on use cases for transporta�on, cri�cal infrastructure, government, ITS-specific protocols, VPN access, firmware changes, signal manipula�on, field access, and physical/logical access correla�on.

Response: The threat detection use cases include but may not be limited to account threats from brute force attacks, unusual login behavior, malware and ransomware, defense evasion, port scanning, unusual command-and-control traffic, DDoS indicators, vulnerability exploitation, mass file access, and logging gaps.

52. Please provide known ITS communica�on protocols, proprietary protocols, management protocols, and expected network behaviors that must be understood before tuning IDS/IPS detec�ons.

Response: The most common ITS communication protocol is NTCIP. Other protocols that must be understood include SNMP, UDP/IP, TCP/IP and HTTP/HTTPS. As the NHDOT ITS programs grow, there will be additional protocols that may be required, including SAE J2735 and C-V2X for connected vehicle systems.

53. Please clarify whether the bidder is expected to provide preven�ve blocking capabili�es, detec�on-only monitoring, or both for ITS network traffic.

Response: The Proposed Solution shall support both effective detection and, where appropriate, preventive and containment actions. These detection, prevention, and containment actions shall be described in the

Incident Management and Response Plan. Additionally, containment actions will be subject to the phased autonomy approach described in the RFP.

54. Please iden�fy any current threat intelligence subscrip�ons, government informa�on-sharing channels, ISAC sources, or State-provided intelligence feeds the bidder must consume or correlate.

Response: NHDOT currently uses Catalyst Center for Cisco firmware that provides vulnerability information.

55. Please define what cons�tutes unauthorized field device access, unauthorized firmware update, or unauthorized configura�on change for aler�ng purposes, including approved maintenance windows and excep�on workflows.

Response: Unauthorized access, updates, or configuration changes that require alerts shall be anything not pre-approved by the Bureau of TSMO. Pre-approval may include an approved maintenance vendor calling the TMC immediately before field equipment access. It is anticipated that the Vendor will learn the NHDOT standard operating procedures and "tune" their alerts accordingly.

56. Please provide the current vulnerability scanning scope, excluded network ranges, scanning windows, creden�al availability, asset cri�cality model, and safe-scan constraints for ITS/OT systems.

Response: Scanning scope is all ITS networks managed and maintained by the Bureau of TSMO. Further definition and refinement may occur during system implementation.

57. Please clarify whether vulnerability remedia�on support means advisory recommenda�ons only, implementa�on support, patch orchestra�on, change execu�on, or field dispatch.

Response: Vulnerability remediation support will depend on the nature of the vulnerability and the expected remediation. Support will typically include recommendations but may also lead to implementation support in the field and firmware updates and patches. The anticipated support shall be described in the Incident

Management and Response Plan. Additionally, the level of support will be subject to the phased autonomy approach described in the RFP.

58. Please iden�fy the current firmware, opera�ng system, and configura�on baseline status for ITS network devices and field maintenance tools.

Response: The State will not provide a detailed current baseline status for the existing network. The selected Vendor will be expected to support inventory, assessment, and recommendations for secure configurations and hardening.

59. Please clarify how cri�cal, high, and other vulnerabili�es are defined for the SLA-4 patch

�melines and whether scoring is CVSS, vendor severity, KEV, opera�onal cri�cality, or State-defined priority.

Response: See updated language for SLA-4. Critical is defined by vulnerabilities under active exploitation.

High is defined as vulnerabilities not under active exploitation.

60. Please describe the State approval process required before patches, compensa�ng controls, configura�on changes, or firmware updates can be implemented in produc�on or field environments.

Response: The Vendor shall contact the TMC with a recommended action. The State will review each recommendation prior to authorizing actions.

61. Please provide the full incident response workflow diagram referenced in Appendix B-2.3.1, including escala�on paths, decision authori�es, response team roles, and severity criteria.

Response: The State will not provide a more detailed workflow diagram at this time. The selected Vendor will be responsible for developing an Incident Management and Response Plan that details the escalation paths, decision points, and severity criteria based on the guidance in the RFP.

62. Please define who has authority to approve containment, isola�on, remedia�on, recovery ac�on, field dispatch, or emergency change execu�on during a cybersecurity incident.

Response: Levels of authority will be determined during the design discussions with the Selected Vendor.

63. Please clarify whether the bidder must preserve forensic evidence for every incident category or only for Cri�cal and High Priority incidents.

Response: The Vendor is expected to preserve forensic evidence for every Critical and High Priority incident.

Additionally, patterns of Routine incidents may require preservation for evaluation.

64. Please define required evidence handling protocols, chain-of-custody expecta�ons, reten�on period, storage loca�on, and transfer procedure for forensic ar�facts.

Response: Vendors should summarize their standard evidence handling, retention, and transfer procedures in the Proposal. The selected Vendor will be required to detail their procedures in the Data Storage and

Archive Plan.

65. Please clarify how incident response clocks begin, stop, pause, and restart when ac�on is awai�ng NHDOT approval, TMC authoriza�on, field access, parts availability, or third-party provider support.

Response: See revised Appendix B.2.3.1. The timing of triage, mitigation, and troubleshooting has been redefined in the revised Appendix.

66. Please define the required format and �ming of post-incident reports, aSer-ac�on reports, root cause analysis, correc�ve ac�on plans, and lessons learned deliverables.

Response: These topics will be included in pre-implementation design discussions between the selected

Vendor, the Bureau of TSMO and NH DoIT.

67. Please clarify whether incident response must include opera�onal recovery of communica�ons infrastructure, cybersecurity containment only, field network troubleshoo�ng, or all three.

Response: Incident response shall include cybersecurity containment and field network troubleshooting.

Incident response may also include operational recovery depending on the situation.

68. Please iden�fy any regulatory, law enforcement, public communica�ons, or interagency no�fica�on obliga�ons the bidder must support during security incidents.

Response: The Vendor is only responsible to provide notifications to the State. All regulatory, law enforcement, public communications or other interagency communications will be the responsibility of the

State.

69. Please provide technical documenta�on, available APIs, access requirements, and integra�on expecta�ons for New England Compass, Catalyst Center, Cyber Vision, WhatsUp Gold, Cisco ISE, WOFI, and Footprints.

Response: Technical documentation and access requirements for current NHDOT tools and interfaces will be coordinated with the selected Vendor during implementation.

70. Please iden�fy the required interface formats for data export, audit export, forensic export, and execu�ve repor�ng, including CSV, JSON, API, PDF, or na�ve plaMorm access.

Response: Data formats will be included in pre-implementation design discussions between the selected

Vendor, the Bureau of TSMO and NH DoIT. The Vendor will be responsible for documenting the interface formats in the Data Storage and Archive Plan.

71. Please confirm the required StateRAMP/GovRAMP authoriza�on path for the proposed solu�on based on the bidder’s current status, including Security Snapshot, Ready, Ac�ve, In Process, Pending, or Authorized.

Response: The State adheres to NIST 800-53 Moderate and there will be a (strong) preference for vendors enrolled in GovRAMP (formerly StateRAMP). See requirements in Table B-2.2.3.

72. Please clarify whether StateRAMP/GovRAMP requirements apply to the en�re bidder plaMorm, hos�ng environment only, SOC tooling, �cke�ng/work order systems, or any subcontractor-hosted components.

Response: The Vendor's proposal will be scored based on the level of StateRAMP authorization for the

Vendor's Proposed Solution, all inclusive.

73. Please confirm whether FedRAMP authoriza�on can receive full, par�al, or no scoring credit if

StateRAMP/GovRAMP authoriza�on is incomplete.

Response: Partial points may be allocated for FedRAMP authorization with incomplete StateRAMP

(GovRAMP) authorization at NH DoIT's discretion.

74. Please iden�fy whether the State requires review rights over 3PAO audits, risk assessments, vulnerability assessments, and penetra�on tests before award, aSer award, or upon request throughout the contract.

Response: Under Table B-2.2.3, Requirement T2.7, the State reserves the right to request and review 3PAO audits, risk assessments, vulnerability assessments, and penetration tests of the contractor environment upon request at any time after award.

75. Please confirm whether all data storage, processing, and transmission must remain inside the con�nental United States, including telemetry, �cke�ng data, logs, backups, support sessions, and subcontractor systems.

Response: Yes, the Appendix B, Section 4 requires all storage, processing, and transmission of State data to occur solely on information technology systems within the Continental United States.

76. Please clarify background check requirements for bidder employees and subcontractors, including �ming, disqualifying criteria, renewal frequency, and whether State review is required before access.

Response: Background checks are addressed in Appendix B, Section 5. The Vendor shall conduct criminal background checks and shall not use staff, including subcontractors, who have been convicted of crimes of dishonesty or certain felony/misdemeanor offenses as described in the RFP. The State may conduct reference and background screening of the Vendor's Project Manager, Key Staff and any other personnel who will be granted access to sensitive State data. The State's reference checks and background screening may be done at any time during the Contract.

77. Please iden�fy whether PCI/merchant card provisions in Appendix G are applicable to this MSSP scope or included only as a standard template ar�fact.

Response: Appendix G is not applicable to this project. Maintaining the integrity of the RFP requires keeping

Appendix G in the document.

78. Please confirm whether the bidder must submit both physical and electronic proposals, and whether the physical proposal remains controlling if there is any discrepancy with the electronic proposal.

Response: Yes, RFP Sec�on 2 requires both physical proposals and electronic proposals for a complete proposal submission. In the event of a discrepancy, Sec�on 2.3b states that the physical proposal labeled

ORIGINAL shall govern.

79. Please confirm whether price proposal content must be sealed separately from the technical proposal in both physical and electronic submissions, and whether any pricing references in narra�ve sec�ons would cause rejec�on.

Response: See RFP Section 2. The price proposal content shall be sealed separately from the technical proposal in the physical submission. To maintain separation for the electronic submission, the Vendor may submit the technical proposal and price proposal as separate emails, separate files within the same email

(clearly labeled), or separate files uploaded to the State's file transfer site.

Pricing references in narrative sections are prohibited. Pricing references are permitted only in Table B-2.1 for the ‘Custom' Vendor Delivery Method. Failure to follow the instructions of the RFP may be cause for a

Proposal to be rejected, at the State's discretion.

80. Please clarify whether confiden�al one-on-one mee�ngs are s�ll available for vendors and what topics may be addressed confiden�ally versus through public wriBen responses.

Response: At the time of this Addendum, the One-on-One meetings have been completed.

81. Please clarify whether monitoring, opera�ons, maintenance, and support pricing must be fixed by year for all five years or may include usage bands �ed to log volume, device count, or service

�ers.

Response: Vendors shall provide Firm Fixed Price pricing in the Appendix E tables for the years and items requested. If a proposed pricing structure relies on assumptions, those assumptions should be clearly stated in the Price Proposal submission. One and only one price may be provided for each line within the

Vendor's…