attachment_14_RFP DOIT 2025-036 Table B-2.2 and Table B-2.3.xlsx
XLSX spreadsheet 16 KB Posted
- Attached to
- Traffic Data Management System (TDMS)
- Solicitation number
- RFP DOIT 2025-036
- Issued by
- Rockingham County, New Hampshire
About this file
The document is a technical requirements and service level agreement (SLA) table for the New Hampshire Department of Transportation's (NHDOT) Traffic Data Management System (TDMS) RFP DOIT 2025-036. The RFP seeks a comprehensive web-based software system to manage traffic data from 8,500 monitoring stations, supporting 300 authorized users across nine regional planning commissions. The system must meet Federal Highway Administration requirements, integrate with ESRI products, and process various traffic data types including vehicle records, volume, classification, speed, and weigh-in-motion data. The contract has an initial 5-year term from October 27, 2025, through November 1, 2030, with potential for two optional 2-year extensions. A mandatory vendor conference is scheduled for January 16, 2025, at 11:00 AM ET in Concord, NH, with proposals due by May 15, 2025, at 3:00 PM ET.
The technical requirements mandate that the vendor's solution must be FedRAMP or StateRAMP authorized, with specific compliance requirements including NIST Special Publication 800-171 and 800-53 controls. The system must support data archiving for 20 years, with capacity to store 1.5 billion continuous count vehicle records and 300 million short count records annually. Vendors must demonstrate successful implementation in at least two U.S. jurisdictions since January 2022. The evaluation will use a 1000-point scale, with 600 points for technical factors and 400 points for pricing. The system must be compatible with traffic monitoring equipment from multiple vendors and serve stakeholders including the Department of Safety, Traffic Planning, Homeland Security, Highway Design, Bridge Design, Research and Materials, Transportation Systems Management and Operations, and Environmental Services.
View the file
Other files
Show all 47
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table B-2.2
| TECHNICAL REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| PROHIBITED TECHNOLOGIES | |||||
| No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf |
and
| No equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlist | M | |
| SECURITY COMPLIANCE REQUIREMENTS | ||
| T1.1 | Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline |
| SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final | M | |
| T1.2 | Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus |
| SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final | E | ||
| STATERAMP AUTHORIZATION | |||
| T2.1 | StateRAMP Ready/Authorized Certification https://stateramp.org/ | E | |
| T2.2 | If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract. | M | |
| T2.3 | If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.4 | If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.5 | If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal. | M | |
| T2.6 | If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the Vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.7 | Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. | M | |
| OTHER CERTIFICATION IN LIEU OF STATERAMP | |||
| T3.1 | FedRAMP Authorized https://www.fedramp.gov/ How to Become FedRAMP Authorized | FedRAMP.gov | E | |
| T3.2 | HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance | Information Risk Management and Compliance https://hitrustalliance.net/ | E | |
| HOSTED PLATFORM | |||
| T4.1 | The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any |
SaaS or other Software Product. If your platform is included in the list below identify the platform in the Vendor Comments.
• AWS US East/West
• AWS GOVCLOUD
• AZURE Commercial Cloud
• AZURE Government (Includes Dynamics 365)
• GOOGLE Services (Cloud Platform Products and Underlying Infrastructure)
• ORACLE Government Cloud – Common Controls
| • ORACLE Federal Managed Cloud Services | E | ||
| INDIVIDUAL AGENCY COMPLIANCE REQUIREMENTS (EXAMPLES LISTED BELOW) | |||
| T5.1 | FTI Pub 1075 | M | |
| T5.2 | HIPAA | M | |
| T5.3 | FERPA | M | |
| T5.4 | CIJS | M |
Table B-2.3
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| SLA-1 | The Vendor’s System support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof. | M | |||
| SLA-2 | The Vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-3 | The Vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-4 | All hardware and software components of the Vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within sixty (60) days of release by their respective manufacturers. (RA-5) | M | |||
| SLA-5 | The State shall have unlimited access, via phone or Email, to the Vendor technical support staff between the hours of 8:30am to 5:00pm- Monday through Friday ET. | M | |||
| SLA-6 | The Vendor shall conform to the specific deficiency class as described below or as agreed to by the parties: |
o Class A Deficiency - Software - Critical, does not allow System to operate, no work around, demands immediate action; Written Documentation - missing significant portions of information or unintelligible to State; Non Software - Services were inadequate and require re-performance of the Service.
o Class B Deficiency - Software - important, does not stop operation and/or there is a work around and user can perform tasks; Written Documentation - portions of information are missing but not enough to make the document unintelligible; Non Software - Services were deficient, require reworking, but do not require re-performance of the Service.
| o Class C Deficiency - Software - minimal, cosmetic in nature, minimal effect on System, low priority and/or user can use System; Written Documentation - minimal changes required and of minor editing nature; Non Software - Services require only minor reworking and do not require re-performance of the Service. | M | |
| SLA-7 | As part of the maintenance agreement, ongoing support issues shall be responded to according to the following: |
a. Class A Deficiency- The Vendor shall have available to the State on-call telephone assistance, with issue tracking available to the State, eight (8) hours per day and five (5) days a week with an email / telephone response within two (2) hours of request; or the Vendor shall provide support on-site or with remote diagnostic Services, within four (4) business hours of a request;
| b. Class B & C Deficiency–The State shall notify the Vendor of such Deficiencies during regular business hours and the Vendor shall respond back within four (4) hours of notification of planned corrective action; The Vendor shall repair or replace Software, and provide maintenance of the Software in accordance with the Specifications, Terms and Requirements of the Contract. | M | ||
| SLA-8 | The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance. | M | |
| SLA-9 | A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied. | M | |
| SLA-10 | If The Vendor is unable to meet the uptime requirement, The Vendor shall credit State’s account in an amount based upon the following formula: (Total Contract Item Price/365) x Number of Days Contract Item Not Provided. The State must request this credit in writing. | M | |
| SLA-11 | The Vendor shall use a change management policy for notification and tracking of change requests as well as critical outages. | M | |
| SLA-12 | A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no work around to the problem. | M | |
| SLA-13 | The Vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: Server up-time; All change requests implemented, including operating system patches; All critical outages reported including actual issue and resolution; Number of deficiencies reported by class with initial response time as well as time to close. | M | |
| SLA-14 | The Vendor will give two-business days prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes. | M | |
| SLA-15 | The Vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost. | M | |
| SLA-16 | For all maintenance services calls, The Vendor shall ensure the following information will be collected and maintained: 1) nature of the Deficiency; 2) current status of the Deficiency; 3) action plans, dates, and times; 4) expected and actual completion time; 5) Deficiency resolution information, 6) Resolved by, 7) Identifying number i.e. work order number, 8) Issue identified by; | P | |
| SLA-17 | The Vendor must work with the State to identify and troubleshoot potentially large-scale System failures or Deficiencies by collecting the following information: 1) mean time between reported Deficiencies with the Software; 2) diagnosis of the root cause of the problem; and 3) identification of repeat calls or repeat Software problems. | P | |
| SLA-18 | The System shall be 100% available on the 24th and 25th day of each month to allow NHDOT to meet their federal requirement to submit HPMS data to FHWA. | M | |
| SLA-19 | Adequate performance is defined as software availability to all registered users at a minimum of 99.99% of the time on a monthly basis, exclusive of a regularly scheduled maintenance window. | M | |
| SLA-20 | Adequate performance for the Public facing access is defined as software availability a minimum of 99.9% of the time on a monthly basis, exclusive of a scheduled maintenance window. Down time of the internet service provider (ISP) shall not be excluded from the availability requirement. | M |
File details come from the government source that posted it. Updated .