attachment-14-rfp-doit-2025-036-table-b-2.2-and-table-b-2.3.xlsx
XLSX spreadsheet 16 KB Posted
- Attached to
- Traffic Data Management System (TDMS)
- Solicitation number
- RFP DOIT 2025-036
- Issued by
- Rockingham County, New Hampshire
About this file
This file contains two technical requirements tables (B-2.2 and B-2.3) for the New Hampshire Department of Transportation's Traffic Data Management System (TDMS) procurement under RFP DOIT 2025-036. Table B-2.2 specifies security and compliance requirements that vendors must meet, including prohibition of equipment and services listed on the State of New Hampshire's Prohibited Technologies List and the FCC Covered List. Vendors must comply with NIST Special Publication 800-171 R2 baseline controls for protecting controlled unclassified information and NIST SP 800-53 Revision 5 moderate-level security controls. StateRAMP authorization is mandatory, with vendors required to achieve StateRAMP Authorized status within 12 to 24 months depending on their current status, or alternatively demonstrate FedRAMP Authorization or HITRUST certification. Vendors must identify pre-approved hosting platforms including AWS (US East/West and GOVCLOUD), Azure (Commercial and Government), Google Services, and Oracle Government Cloud. Agency-specific compliance requirements including FTI Pub 1075, HIPAA, FERPA, and CIJS must also be met.
Table B-2.3 establishes comprehensive Service Level Agreement (SLA) requirements for system support, maintenance, and performance. The vendor must provide system support and maintenance from the contract effective date through the end of the term with all hardware and software fully supported by manufacturers, applying critical patches within 60 days of release. Technical support availability is required between 8:30 AM and 5:00 PM Monday through Friday ET via phone or email, with response times of two hours for Class A deficiencies (critical) and four hours for Class B and C deficiencies (important and minimal). The hosting server must maintain 24/7 availability except during scheduled maintenance windows, with software availability targets of 99.99% monthly for registered users and 99.9% for public-facing access, excluding scheduled downtime. The system must achieve 100% availability on the 24th and 25th of each month to support NHDOT's federal HPMS data submission requirements. Vendors must implement change management policies, maintain detailed maintenance records with quarterly reporting on uptime and deficiencies, and provide advance notification and training for all updates and upgrades.
View the file
Other files
Show all 47
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table B-2.2
| TECHNICAL REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| PROHIBITED TECHNOLOGIES | |||||
| No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf |
and
| No equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlist | M | |
| SECURITY COMPLIANCE REQUIREMENTS | ||
| T1.1 | Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline |
| SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final | M | |
| T1.2 | Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus |
| SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final | E | ||
| STATERAMP AUTHORIZATION | |||
| T2.1 | StateRAMP Ready/Authorized Certification https://stateramp.org/ | E | |
| T2.2 | If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract. | M | |
| T2.3 | If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.4 | If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.5 | If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal. | M | |
| T2.6 | If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the Vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.7 | Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. | M | |
| OTHER CERTIFICATION IN LIEU OF STATERAMP | |||
| T3.1 | FedRAMP Authorized https://www.fedramp.gov/ How to Become FedRAMP Authorized | FedRAMP.gov | E | |
| T3.2 | HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance | Information Risk Management and Compliance https://hitrustalliance.net/ | E | |
| HOSTED PLATFORM | |||
| T4.1 | The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any |
SaaS or other Software Product. If your platform is included in the list below identify the platform in the Vendor Comments.
• AWS US East/West
• AWS GOVCLOUD
• AZURE Commercial Cloud
• AZURE Government (Includes Dynamics 365)
• GOOGLE Services (Cloud Platform Products and Underlying Infrastructure)
• ORACLE Government Cloud – Common Controls
| • ORACLE Federal Managed Cloud Services | E | ||
| INDIVIDUAL AGENCY COMPLIANCE REQUIREMENTS (EXAMPLES LISTED BELOW) | |||
| T5.1 | FTI Pub 1075 | M | |
| T5.2 | HIPAA | M | |
| T5.3 | FERPA | M | |
| T5.4 | CIJS | M |
Table B-2.3
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| SLA-1 | The Vendor’s System support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof. | M | |||
| SLA-2 | The Vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-3 | The Vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-4 | All hardware and software components of the Vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within sixty (60) days of release by their respective manufacturers. (RA-5) | M | |||
| SLA-5 | The State shall have unlimited access, via phone or Email, to the Vendor technical support staff between the hours of 8:30am to 5:00pm- Monday through Friday ET. | M | |||
| SLA-6 | The Vendor shall conform to the specific deficiency class as described below or as agreed to by the parties: |
o Class A Deficiency - Software - Critical, does not allow System to operate, no work around, demands immediate action; Written Documentation - missing significant portions of information or unintelligible to State; Non Software - Services were inadequate and require re-performance of the Service.
o Class B Deficiency - Software - important, does not stop operation and/or there is a work around and user can perform tasks; Written Documentation - portions of information are missing but not enough to make the document unintelligible; Non Software - Services were deficient, require reworking, but do not require re-performance of the Service.
| o Class C Deficiency - Software - minimal, cosmetic in nature, minimal effect on System, low priority and/or user can use System; Written Documentation - minimal changes required and of minor editing nature; Non Software - Services require only minor reworking and do not require re-performance of the Service. | M | |
| SLA-7 | As part of the maintenance agreement, ongoing support issues shall be responded to according to the following: |
a. Class A Deficiency- The Vendor shall have available to the State on-call telephone assistance, with issue tracking available to the State, eight (8) hours per day and five (5) days a week with an email / telephone response within two (2) hours of request; or the Vendor shall provide support on-site or with remote diagnostic Services, within four (4) business hours of a request;
| b. Class B & C Deficiency–The State shall notify the Vendor of such Deficiencies during regular business hours and the Vendor shall respond back within four (4) hours of notification of planned corrective action; The Vendor shall repair or replace Software, and provide maintenance of the Software in accordance with the Specifications, Terms and Requirements of the Contract. | M | ||
| SLA-8 | The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance. | M | |
| SLA-9 | A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied. | M | |
| SLA-10 | If The Vendor is unable to meet the uptime requirement, The Vendor shall credit State’s account in an amount based upon the following formula: (Total Contract Item Price/365) x Number of Days Contract Item Not Provided. The State must request this credit in writing. | M | |
| SLA-11 | The Vendor shall use a change management policy for notification and tracking of change requests as well as critical outages. | M | |
| SLA-12 | A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no work around to the problem. | M | |
| SLA-13 | The Vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: Server up-time; All change requests implemented, including operating system patches; All critical outages reported including actual issue and resolution; Number of deficiencies reported by class with initial response time as well as time to close. | M | |
| SLA-14 | The Vendor will give two-business days prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes. | M | |
| SLA-15 | The Vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost. | M | |
| SLA-16 | For all maintenance services calls, The Vendor shall ensure the following information will be collected and maintained: 1) nature of the Deficiency; 2) current status of the Deficiency; 3) action plans, dates, and times; 4) expected and actual completion time; 5) Deficiency resolution information, 6) Resolved by, 7) Identifying number i.e. work order number, 8) Issue identified by; | P | |
| SLA-17 | The Vendor must work with the State to identify and troubleshoot potentially large-scale System failures or Deficiencies by collecting the following information: 1) mean time between reported Deficiencies with the Software; 2) diagnosis of the root cause of the problem; and 3) identification of repeat calls or repeat Software problems. | P | |
| SLA-18 | The System shall be 100% available on the 24th and 25th day of each month to allow NHDOT to meet their federal requirement to submit HPMS data to FHWA. | M | |
| SLA-19 | Adequate performance is defined as software availability to all registered users at a minimum of 99.99% of the time on a monthly basis, exclusive of a regularly scheduled maintenance window. | M | |
| SLA-20 | Adequate performance for the Public facing access is defined as software availability a minimum of 99.9% of the time on a monthly basis, exclusive of a scheduled maintenance window. Down time of the internet service provider (ISP) shall not be excluded from the availability requirement. | M |
File details come from the government source that posted it. Updated .