attachment-1-rfp-doit-2026-13.pdf

STATE OF NEW HAMPSHIRE

DEPARTMENT OF SAFETY, DIVISION OF MOTOR VEHICLES

DoIT RFP 2026-013 – DOS AUTOMATED DRIVER LICENSE TESTING SOFTWARE

ATTACHMENT 1: BUSINESS AND TECHNICAL REQUIREMENTS

1. Business and Technical Requirements

Please leverage the instructions below to complete the Fuel Toll System Business and Technical Requirements outlined below and submit with your Proposal in Section III: Responses to System Requirements and Deliverables.

Criticality Column: (M) Indicates a requirement that is "Mandatory". The State considers it to be of such great importance that it must be met in order for the proposal to be accepted. If the proposer believes that there is something about their proposal that either obviates the need for this requirement or makes it of less importance this must be explained within the comments. The State retains the right to accept a proposal if the need of the requirement is reduced or eliminated by another feature of the proposal.

(P) Indicates a requirement which is "Preferred". This requirement is considered by the State to be of great usefulness, but the lack of this feature is not considered serious enough to disqualify the proposal.

Vendor Response Column: Place a “Yes” if the current release of the software can fully support ALL the functionality described in the row, without special customization. A “Yes” can only be used if the delivery method is Standard (see delivery method instructions below).

Otherwise, enter an "No"; A "No" can only be used with delivery method Future, Custom, or Not Available/Not Proposing (see delivery method instructions below).

Delivery Method Column:

Complete the delivery method using a Standard, Future, Custom, or Not Available/Not Proposing (as defined below) that indicates how the requirement will be delivered.

Standard - Feature/Function is included in the proposed system and available in the current software release.

Future - Feature/Function will be available in a future release. (Provide anticipated delivery date, version, and service release in the comment area.)

Custom - Feature/Function can be provided with custom modifications. (Respondent must provide estimated hours and average billing rate or flat cost for the software modification in the comment area. These cost estimates should add up to the total cost for software modifications found in the cost summary table in Appendix E of the RFP).

Not Available/Not Proposing - Feature/Function has not been proposed by the Vendor. (Provide brief description of why this functionality was not proposed.)

Comments Column: For all Delivery Method responses vendors must provide a brief explanation of how the requirement will be met. Free form text can be entered into this column.

Remainder of this page intentionally left blank

2. Business and Technical Requirements Worksheet

State Business Requirements Vendor

Req # Requirement Description Criticality Vendor

Response Delivery Method

Comments

Example 1.1

Example requirement text M Yes Standard This is a standard feature in our platform. Please see Attachment 2 of our response.

ADLT

B1.1

The solution must provide appropriate knowledge examinations for the following:

Commercial Driver, including all necessary endorsement tests, Motorcycle, including motorcycle permit, Operator, School Bus Certificate and Driver Education Instructor. M

B1.2

The Solution must include the FMCSA approved AAMVA provided commercial licensing testing suite in its entirety and must be updated with any changes, to include adding, removing or clarifying questions as mandated by AAMVA and FMCSA in a timely fashion. All CDL tests must use test bank questions as defined for CDL, 2022 model 17 specs or latest version from AAMVA. M

B1.3

The solution must include the Motorcycle Safety Foundation (MSF) testing suite in its entirety and must be updated with any changes to include adding, removing and clarifying questions as mandated by MSF in a timely manner to include all motorcycle test types. M

B1.4

The solution must include vendor provided testing suite including comprehensive question banks related to operator examinations for use in New Hampshire knowledge test question banks. M

B1.5

The solution must provide knowledge examinations based on the specified criteria as dictated by the DMV, for example:

Commercial Driver License as specified by FMCSA/AAMVA Standards

Motorcycle/Motorcycle Permit as specified by MSF standards

Operator

School Bus Certificate

Driver Education Instructor M

B1.6

The solution must allow the Administrator to modify the test banks by selecting questions from vendor and state provided testing questions. M

B1.7

The solution shall stop the test as soon as the applicant has satisfied either the pass or fail criteria for the test to ensure timely testing for all qualified applicants. (i.e. number of correct answers to pass or number of incorrect answers to fail) M

B1.8 The solution must provide the ability to set time limits on each knowledge examination type. M

B1.9

The solution must provide the ability to change, modify, delete or add additional questions to the state specific question banks, to include voice over capabilities. M

B1.10

The solution shall use high quality graphics or digital photographs to depict actual roadway conditions, signage, etc. and shall appear simultaneously on-screen with the associated test question. M

B1.11 The solution must have the ability to attach video clips to the questions. M

B1.12 The solution must provide all knowledge examinations in American sign language, to include the display of each question and answers to the applicants in sign language. M

B1.13

The solution must have audible capabilities on all testing workstations to include reading each question and answer to the applicants. Solution must use a secure listening device to ensure privacy, as well as provide volume adjustment by the applicant. M

B1.14 The solution shall provide an integrated audio recording tool that will enable DMV staff to record questions and answers for distribution across all workstations. M

B1.15

The solution must provide the ability for DMV staff to monitor testing progress remotely, regardless of the location the test is being administered. (Role based permission) M

B1.16

The solution must have the capability to print paper copies of the test, answer sheet and answer key (for the examiner) that shall include the associated image or graphic for each question. The printouts must be on 8 1/2" x 11" paper. M

B1.17

The solution must have the ability to provide uninterrupted progress for tests during any outages in connectivity once the connection has been reestablished. M

B1.18

The solution must provide the ability to randomize exams, and the test questions assigned to the exams. M

B1.19

The solution must generate all tests using algorithms/methods that will ensure that unique tests are administered to each applicant and further that each test shall cover all areas of knowledge as required by the DMV and FMCSA as applicable. The algorithms/methods used to generate the tests shall also ensure that the degree of difficulty will remain uniform across the spectrum of examinations generated. M

B1.20 The solution must provide the ability to flag certain test questions within the test bank to appear in every test. M

B1.21 The solution must provide the capability for multiple examination types to be assigned to an applicant at one time for applicants qualified to take more than a single test. M

B1.22 The solution must provide the capability to authenticate the applicant prior to administering the appropriate knowledge examination. M

B1.23 The solution must provide full audit tracking capabilities for all user actions taken. M

B1.24

The solution must provide direct access for DMV users based on roles assigned in the active directory from VISION. The following roles must be passed through the solution from VISION:

Clerks, managers, administrators, examiners and view only. M

B1.25

The solution must have the capability to add, modify, delete or block road skills assessment schedules and assessment lengths for each assessment location regardless of the type of assessment being conducted. M

B1.26 The solution must have the capability for the customer service representative to be able to schedule road skills assessments for operators, motorcycles or commercial driver exams. M

B1.27 The solution must provide the capability for customers to be able to schedule their road skills assessments online for operator, motorcycle or commercial driver exams. M

B1.28 The solution must provide the capability to run standard reports and perform custom queries to generate ad hoc reports. M

B1.29

The solution must track and report testing statistics for both knowledge examinations and road skills assessment by DMV location, staff, examiner and geographic area. Reports must include but are not limited to the following: number of exams taken by test type, number of pass/fail per examination, by applicant, location, test type and examiner, pass/fail by question to determine level of difficulty. M

B1.30

The solution must track and report accurate statistical information for knowledge examinations and road skills assessment criteria, to include but not limited to, questions and grading given by examiner. M

B1.31

The solution scheduling system must have the ability to pass scheduled appointments for knowledge and skills tests to VISION for use in a daily report. Information must include but are not limited to the following: customer identifier, test(s) scheduled, date of test, time of test. M

B1.32 The solution must be capable of bidirectional communication with the NH DMV system of record, VISION (Vehicle Information System In an Online Network). M

B1.33

The solution must be capable of migrating the current question test banks as specified by NH

DMV. M

Road Skills Assessments via mobile devices

B2.1 The solution must be cloud based accessible via a variety of browsers such as FireFox, Chrome, Edge, Safari, and with a range of mobile devices such as smartphones and tablets. M

B2.2 The solution must be capable of administering road skills assessments and test results for operator, motorcycle, and all classes of commercial driver licenses. M

B2.3 The solution should include GPS capability that can track and report examiners test routes to ensure road test reliability and validity. P

B2.4

The solution must provide the ability to receive customer data from VISION system for road skills assessment assignment including Customer Identifier, First, Last Name, DOB, Customer Photo, and License status. M

B2.5

The solution must provide the ability to establish predetermined times for pre-trip skills and road tests, established by the state. M

B2.6

The solution must allow examiners to score individual test items on the skills test while in progress and automatically display the total score at the end of the test. This functionality must be available in offline mode or while connected to the network. M

B2.7

The solution must use sign-on credentials and active directory using role-based entitlements in VISION for the following roles: Administrators, Examiners and View only. M

B2.8 The solution should be capable of loading predetermined test-driving routes by location. P

B2.9

The solution should be capable of changing or modifying the road skills assessment route to another predetermined route based on traffic, road construction, and other unforeseen conditions. P

B2.10

The solution should utilize GPS tracking to record and log the coordinates of the driven skills assessment. Solution must allow Examiners and Administrators to review and verify the appropriate route. P

B2.11

The solution should store the GPS tracking information including the test route as part of the record. P

B2.12

The solution should be capable of keeping track if the GPS signal is lost during the test and storing that information as part of the record. P

B2.13

The solution may provide an option for administrators to remotely monitor road tests in progress through GPS functionality. P

B2.14

The solution must be able to transmit test results of the road skills assessment in real time once the assessment is complete. M

B2.15

The solution must be able to transmit GPS route information for the road skills assessment in real time once the assessment is complete. P

B2.16

The solution should provide reporting that shows when GPS tracking was overridden to ensure validity of road testing. P

B2.17

The solution must have the capability to store road skills assessment results in the event wireless and/or cellular connectivity is not available so they may be downloaded later. M

B2.18

In the event wireless and/or cellular connectivity is not available, at a minimum the following information is what must be stored: overall score, pass/fail indication, applicant identifier from VISION, applicant first name, applicant last name, applicant date of birth, applicant photo, date and time of test, examiner’s name, and any photos taken. M

B2.19 The solution must provide full audit tracking information for each user’s actions taken. M

B2.20 The solution must include the States standard data encryption (McAfee Endpoint). M

FMCSA COMPLIANCE MANDATES

B3.1 The solution must provide the ability to track scores and share information with other jurisdictions via CSTIMS in accordance with FMCSA mandates. M

B3.2 The solution must ensure test question randomization for all knowledge examinations. M

B3.3 The solution must ensure AAMVA compliant test forms. M

B3.4 The solution must allow for randomization of pre-trip test forms. M

B3.5

Vendor must ensure that test questions and question banks are updated with any changes, to include adding, removing and clarifying questions as mandated by AAMVA and FMCSA in a timely fashion. M

Application Requirements

General Specifications

A1.1

Ability to access data using open standards access protocol (please specify supported versions in the comments field). M

A1.2

Data is available in commonly used format over which no entity has exclusive control, with the exception of National or International standards. Data is not subject to any copyright, patent, trademark or other trade secret regulation. M

A1.3

Web-based compatible and in conformance with the following W3C standards: HTML5, CSS

2.1, XML 1.1, M

Application Security

A2.1

Verify the identity or authenticate all of the system client applications before allowing use of the system to prevent access to inappropriate or confidential data or services. M

A2.2

Verify the identity and authenticate all of the system’s human users before allowing them to use its capabilities to prevent access to inappropriate or confidential data or services. M

A2.3 Enforce unique usernames. M

A2.4

Enforce complex passwords for Administrator Accounts in accordance with DoIT’s Statewide User Account and Password Policy. M

A2.5

Enforce the use of complex passwords for general users using capital letters, numbers and special characters in accordance with DoIT’s Statewide User Account and Password Policy. M

A2.6 Encrypt passwords in transmission and at rest within the database. M

A2.7

Establish the ability to expire passwords after a definite period of time in accordance with DoIT’s Statewide User Account and Password Policy. M

A2.8 Provide the ability to limit the number of people that can grant or change authorizations. M

A2.9 Establish the ability to enforce session timeouts during periods of inactivity. M

A2.10 The application shall not store authentication credentials or sensitive data in its code. M

A2.11

Log all attempted accesses that fail identification, authentication and authorization requirements. M

A2.12

The application shall log all activities to a central server to prevent parties to application transactions from denying that they have taken place. M

A2.13 All logs must be kept for six (6) months. M

A2.14

The application must allow a human user to explicitly terminate a session. No remnants of the prior session should then remain. M

A2.15 Do not use Software and System Services for anything other than what they are designed for. M

A2.16 The application Data shall be protected from unauthorized use when at rest. M

A2.17

The application shall keep any sensitive Data or communications private from unauthorized individuals and programs. M

A2.18

Subsequent application enhancements or upgrades shall not remove or degrade security requirements. M

A2.19 Utilize change management documentation and procedures. M

A2.20

Web Services: The service provider shall use Web Services exclusively to interface with the State’s data in near real time when possible. M

State Technical Requirements

Prohibited Technologies

PT1.1

No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf

M https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf and no equipment or services on the FCC Covered List found here:

https://www.fcc.gov/supplychain/coveredlist

Security Compliance Requirements

T1.1

Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline (SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations CSRC (nist.gov))

M

T1.2

Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations

- Baseline Plus (SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov))

P

T1.3

Continuous Monitoring - For any resulting award(s) and subsequent contract(s), the awarded Vendor(s) will grant access to continuous monitoring and reporting through the life of the contract. The State reserves the right to request and review all Third- Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the Vendor's environment.

M

T1.4

If not StateRAMP certified, vendor agrees to adhere to the DoIT Vulnerability Remediation Standards and shall provide Vulnerability Tests weekly or allow the installation of the DoIT host-based vulnerability scanner (Tenable Nessus Agent).

The Vendor agrees those vulnerability scans will be delivered and reviewed by the NHCIC, DESC IT, and DOS IT weekly. Vendor shall also deliver a vulnerability scan after any major system updates. If there are deficiencies listed, they shall be remediated leveraging the schedule below.

M The following vulnerability remediation timeframe applies for Internet accessible systems:

1. Critical: Immediately upon availability of patch.

2. High vulnerabilities: 15 calendar days from vulnerability publication date.

3. Medium vulnerabilities: 30 calendar days from vulnerability publication date.

https://www.fcc.gov/supplychain/coveredlist

4. Low vulnerabilities: 90 calendar days from vulnerability publication date.

If a vulnerability cannot be remediated within the specified timeframe, a mitigation and remediation plan must be submitted along with an Exception to Baseline Controls as outlined in Policy NHS0235, Security and Privacy Plan Policy, Exceptions to Baseline Controls.

StateRAMP Authorization

T2.1 StateRAMP Ready/Authorized Certification (Home - StateRAMP) P

T2.2 If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract.

M

T2.3 If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.

M

T2.4 If StateRAMP in Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.

M

T2.5 If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal.

M

T2.6

If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.

M

T2.7

Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment.

The contractor shall respond to all flaws discovered, by providing a mutually agreed upon timeframe to resolve the issue(s) and/or implement a compensating control.

M

Other Certifications in lieu of StateRAMP

T3.1 FedRAMP Authorized How to Become FedRAMP Authorized | FedRAMP.gov P

T3.2 HITRUST (HITRUST is common for Health Care related products and services.)

HITRUST Alliance | Information Risk Management and Compliance

P

Hosted Platform

T4.1

The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any SaaS or other Software Product. If your platform is included in the list below, identify the platform in the Vendor Comments. AWS US East/West, AWS GOVCLOUD, AZURE Commercial Cloud, AZURE Government (includes Dynamics 365), GOOGLE Services (Cloud Platform Products and Underlying Infrastructure), ORACLE Government Cloud - Common Controls, and ORACLE Federal Managed Cloud Services.

P

Individual Agency Compliance Requirements

T5.1 NH State Law, RSA 260:14 Driver Privacy Act M

Information Technology Accessibility Compliance

T6.1 Web content and mobile applications must comply with WCAG 2.1, Level AA M

T6.2 Hardware that transmits information or has a user interface, such as display screens, variable message signs, and kiosks, must comply with ICT Accessibility Standards and Guidelines, Chapter 4: Hardware.

M

T6.3 Vendor shall complete the VPAT 2.5 WCAG (November 2023) and submit with their proposal in Section III: Responses to Requirements and Deliverables (https://www.itic.org/policy/accessibility/vpat)

M

Service Level Agreement

SLA-1

The Vendor's System support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof.

M

SLA-2

The Vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing, upgrades and fixes as required.

M

SLA-3

The vendor shall repair or replace the hardware or software, or any portion thereof, so that the System operates in accordance with the Specifications, terms, and requirements of the Contract.

SLA-4

All hardware and software components of the Vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within sixty (60) days of release by their respective manufacturers. (RA-5)

M

SLA-5

The State shall have unlimited access, via phone or Email, to the Vendor technical support staff between the hours of 8:30am to 5:00pm- Monday through Friday EST.

M

SLA-6

The Vendor shall conform to the specific deficiency class as described below or as agreed to by the parties:

· Class A Deficiency - Software - Critical, does not allow System to operate, no work around, demands immediate action; Written Documentation - missing significant portions of information or unintelligible to State; Non-Software - Services were inadequate and require re-performance of the Service.

· Class B Deficiency - Software - important, does not stop operation and/or there is a workaround, and user can perform tasks; Written Documentation -portions of information are missing but not enough to make the document unintelligible; Non-Software - Services were deficient, require reworking, but do not require re-performance of the Service.

· Class C Deficiency - Software - minimal, cosmetic in nature, minimal effect on System, low priority and/or user can use System; Written Documentation -minimal changes required and of minor editing nature; Non-Software - Services require only minor reworking and do not require re-performance of the Service.

SLA-7

As part of the maintenance agreement, ongoing support issues shall be responded to according to the following:

· Class A Deficiencies - The Vendor shall have available to the State on-call telephone assistance, with issue tracking available to the State, eight (8) hours per day and five (5) days a week with an email / telephone response within two (2) hours of request; or the Vendor shall provide support onsite or with remote diagnostic services within four (4) business hours of a request;

· Class B & C Deficiency - The State shall notify the Vendor of such Deficiencies during regular business hours and the Vendor shall respond back within four (4) hours of notification of planned corrective action; The Vendor shall repair or replace Software and provide maintenance of the Software in accordance with the Specifications, Terms, and Requirements of the Contract.

SLA-8

The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance.

M

SLA-9

A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied.

M

SLA-10

If the Vendor is unable to meet the uptime requirement, the Vendor shall credit State’s account in an amount based upon the following formula: (Total Contract Item Price/365) x Number of Days Contract Item Not Provided. The State must request this credit in writing.

M

SLA-11

The Vendor shall use a change management policy for notification and tracking of change requests as well as critical outages.

M

SLA-12

A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no workaround to the problem.

M

SLA-13

The Vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: Server uptime; All change requests implemented, including operating system patches; All critical outages reported including actual issue and resolution; Number of deficiencies reported by class with initial response time as well as time to close.

M

SLA-14

The Vendor will give two business days' prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes.

M

SLA-15

The Vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost.

M

SLA-16

For all maintenance Service calls, the Vendor shall ensure the following information will be collected and maintained: P

1) nature of the Deficiency.

2) current status of the Deficiency.

3) action plans, dates, and times.

4) expected and actual completion time.

5)Deficiency resolution information.

6) Resolved by.

7)Identifying number i.e. work order number; 8) Issue identified by.

SLA-17

The Vendor must work with the State to identify and troubleshoot potentially large-scale System failures or Deficiencies by collecting the following information:

P

1) mean time between reported Deficiencies with the Software.

2) diagnosis of the root cause of the problem; and

3) identification of repeat calls or repeat software problems.

Remainder of this page intentionally left blank