attachment_2_RFP DOS 2026-02.xlsx

XLSX spreadsheet 41 KB Posted

Attached to
Crash Data Analysis System State and local contract opportunity
Solicitation number
RFP DOS 2026-02
Issued by
Merrimack County, New Hampshire

About this file

This document is a detailed Request for Proposal (RFP) from the New Hampshire Department of Safety (NH DOS/DOT) for a comprehensive traffic crash data management, analysis, and reporting software system. The RFP seeks a cloud-based, Commercial-Off-the-Shelf (COTS) Software-as-a-Service (SaaS) solution that will provide advanced data analysis capabilities for traffic crash data. The system must compile metrics from multiple data sources, produce predictive analyses, generate visualizations, recommend safety countermeasures, and support network screening and hazard location identification. The contract term is not explicitly stated, but the vendor must provide ongoing system maintenance, updates, and 99.9% uptime, with the system expected to be substantially complete and operational at the time of contract award.

The proposed system requires sophisticated data integration capabilities, including connectivity to diverse data sources and ingestion of multiple data feeds such as CCTV snapshots, environmental sensor data, and traffic incidents. The vendor must demonstrate deep traffic engineering expertise, familiarity with local and federal traffic safety knowledge, and the ability to handle data refinement and geolocation. While specific pricing is not detailed in the document, the RFP indicates the system should offer unlimited users and data, with on-call 24/7 software maintenance. The system must also comply with various security requirements, including NIST Special Publication controls, StateRAMP authorization, and accessibility standards like WCAG 2.1 Level AA. The vendor will be expected to provide continuous monitoring, vulnerability testing, and periodic reporting on system performance and maintenance activities.

View the file

Other files for this state and local contract opportunity

Other files attached to Crash Data Analysis System, newest first.
File Type Posted
Addendum_2_RFP DOS 2026-02.pdf PDF
Addendum_3_RFP DOS 2026-02.pdf PDF
Addendum_7_RFP DOS 2026-02.pdf PDF
attachment_3_RFP DOS 2026-02.xlsx XLSX spreadsheet
Addendum_6_RFP DOS 2026-02.pdf PDF
attachment_5_RFP DOS 2026-02.xlsx XLSX spreadsheet
Addendum_1_RFP DOS 2026-02.pdf PDF
Addendum_4_RFP DOS 2026-02.pdf PDF
Addendum_5_RFP DOS 2026-02.pdf PDF
RFP DOS 2026-02_respondents.pdf PDF
attachment_4_RFP DOS 2026-02.xlsx XLSX spreadsheet
attachment_1_RFP DOS 2026-02.pdf PDF
RFP DOS 2026-02.pdf PDF
attachment-2-rfp-dos-2026-02.xlsx XLSX spreadsheet
attachment-4-rfp-dos-2026-02.xlsx XLSX spreadsheet
rfp-dos-2026-02.pdf PDF
awarded.pdf PDF
addendum-2-rfp-dos-2026-02.pdf PDF
attachment-5-rfp-dos-2026-02.xlsx XLSX spreadsheet
rfp-dos-2026-02-respondents.pdf PDF
addendum-3-rfp-dos-2026-02.pdf PDF
rfp-dos-2026-02-scoring.pdf PDF
addendum-7-rfp-dos-2026-02.pdf PDF
attachment-1-rfp-dos-2026-02.xlsx XLSX spreadsheet
addendum-5-rfp-dos-2026-02.pdf PDF
attachment-3-rfp-dos-2026-02.xlsx XLSX spreadsheet
addendum-6-rfp-dos-2026-02.pdf PDF
addendum-1-rfp-dos-2026-02.pdf PDF
addendum-4-rfp-dos-2026-02.pdf PDF
Show all 29

On GovTribe

Work with this file on GovTribe

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Instructions

Vendor Instructions for Business Requirements (BR) and Technical Requirements (TR)
Vendor Response Column: Place a “Yes” if the current release of the software can fully support ALL the functionality described in the row, without special customization. A “Yes” can only be used if the delivery method is Standard (see delivery method instructions below). Otherwise, enter an "No"; A "No" can only be used with delivery method Future, Custom, or Not Available/Not Proposing (see delivery method instructions below).

Criticality Column:

(M) Indicates a requirement that is "Mandatory". The State considers it to be of such great importance that it must be met in order for the proposal to be accepted. If the proposer believes that there is something about their proposal that either obviates the need for this requirement or makes it of less importance this must be explained within the comments. The State retains the right to accept a proposal if the need of the requirement is reduced or eliminated by another feature of the proposal.

(P) Indicates a requirement which is "Preferred". This requirement is considered by the State to be of great usefulness but the lack of this feature is not considered serious enough to disqualify the proposal.

(O) Indicates a requirement which is "Optional". This requirement is considered by the State to be one which useful or potentially useful but not a central feature of the Project.

Delivery Method Column:

Complete the delivery method using a Standard, Future, Custom, or Not Available/Not Proposing (as defined below) that indicates how the requirement will be delivered.

Standard - Feature/Function is included in the proposed system and available in the current software release.

Future - Feature/Function will be available in a future release. (Provide anticipated delivery date, version, and service release in the comment area.)

Custom - Feature/Function can be provided with custom modifications. (Respondent must provide estimated hours and average billing rate or flat cost for the software modification in the comment area. These cost estimates should add up to the total cost for software modifications found in the cost summary table in Section X of the RFP).

Not Available/Not Proposing - Feature/Function has not been proposed by the Vendor. (Provide brief description of why this functionality was not proposed.)

Comments Column:

For all Delivery Method responses vendors must provide a brief explanation of how the requirement will be met. Free form text can be entered into this column.

Vendor Instructions for Activity, Deliverable, and Milestone
Vendor shall complete the Activity Deliverable, and Milestone Table identifying estimated delivery date and price.
Terms and Definitions
Please refer to Appendix H in the associated Request for Proposal (RFP) for a list of terms and definitions that are mentioned in either the RFP or the Requirements spreadsheet.

Requirements

BUSINESS REQUIREMENTS
State RequirementsVendor
Req #Requirement DescriptionCriticalityVendor ResponseDelivery MethodComments
Data Analysis Capabilities
B1.1The system shall compile metrics from disparate data sources to produce a comprehensive list of crash metrics.M
B1.2The system shall provide predictive methods for roadway network screening and hazard location identification.M
B1.3The system shall provide the ability to produce annual reports containing statistical analysis of crash metrics and patterns for agency partners as needed based on varying user requirements.M
B1.4The system shall accept and analyze multiple contributing factors (e.g., weather, driver behavior) for each crash, enabling a comprehensive understanding of crash causation.M
B1.5The system shall analyze crash data and generate visualizations (charts, diagrams) that clearly show key crash metrics, enabling users to easily understand and interpret the data.M
B1.6The system shall recommend safety countermeasures by referencing best-practice resources, including the AASHTO Highway Safety Manual, FHWA’s CMF Clearinghouse, and NHTSA’s Countermeasures That Work guide.M
B1.7The system shall use crash report data and official State of New Hampshire cost factors to calculate the economic impact of crashes.M
B1.8The system shall use collected data to develop Safety Performance Functions (SPFs), enabling crash predictions across the roadway network.M
B1.9The system shall rank corridors, sections, and intersections by crash potential using various data points (speed, citation data, traffic volume, etc.), comparing each location’s risk level to others in the network.M
B1.10The system shall, at a minimum, comply with the safety performance methods described in Highway Safety Manual Part B.M
B1.11The system shall compile crash data from multiple sources and produce a prioritized list of locations for safety improvements, based on crash types and severity.M
B1.12The system shall allow yearly safety analysis to accurately reflect roadway conditions and crash locations as they existed during each analysis year.M
B1.13The system shall store roadway configurations, geometries, and attributes separately for each calendar year. Each annual roadway snapshot must reflect the roadway conditions precisely as they existed during that specific year.M
B1.14The system shall provide functionality to analyze crash data for each year independently.M
B1.15The system shall clearly and permanently link crash records to the year in which they occurred.M
B1.16The system shall automatically detect changes to roadway alignment or configuration between annual snapshots, notifying users when signficant roadway changes are detected that could impact crash location accuracy.M
B1.17The system shall enable clear and intuitive comparison of crash analyses across different years.M
B1.18The system shall produce reports that indicate whether crash locations have been analyzed based on original-year conditions or relocated positions.M
B1.19The system shall track all changes, including crash relocations and roadway snapshot modifications, through a comprehensive audit trail.M
B1.20The system shall provide detailed documentation to explain decisions made during crash relocation processes.M
B1.21The system shall retain twenty years of data, which is the NH requirement for fatality crashes.M
B1.22The system shall provide the capability to automatically relocate crash locations annually to align with the most current roadway conditions.P
B1.23The system shall clearly document and retain both the original and relocated crash positions for transparency, should crash locations be relocated.P
B1.24The system shall be able to redact Personal Identifying Information (PII) to users outside of the NHDMV both in fields containing PII but also from the gist, crash summary, or diagram.P
Data Queries
B2.1Structured Query Language (SQL) capabilities - Pre-built SQL toolboxes - GUI windows with pull-down menus of data tables with pre-defined attributes, in conjunction with user-selected values, which accomplish specific types of queries. In general, the user shall have the option to:

• SELECT field(s) or attribute(s), in conjunction with aggregate functions of attribute(s)

• FROM any given data table(s) - crash tables and non-crash tables

• WHERE specified attribute(s) have a specified value or range of values selected by the user

• ORDERED BY specified attribute(s) in ascending or descending order

• GROUPED BY specified attribute(s)

• Having the result of the aggregate function satisfy some criteria Examples of Pre-built toolboxes:

• "Summarize crashes" grouped by the attribute "crash type" for the entire roadway network, excluding crashes at intersections; "Summarize crashes" could mean summing total number of crashes over x-number of years, calculating average crash frequency (#crashes per 100-million vehicle miles of travel) for roadway segments over x-number of years, or calculating average crash rate (#crashes per 10-million entering vehicle) for roadway intersections over x-number of years

• Above example but only for crashes located at intersections

• Above example but only for a paticular route system designation (e.g. U.S. Highway) or only for roadways with a specified number of lanes

• Select the top x% of y-mile long sections of roadway (excluding intersections) in the entire network with the highest Annual Crash Rate

• Find crash clusters or hot-spots within a user-specified segment length along a roadway(s), capable of specifying either a floating window that slides along a route at a given increment or specifying a fixed window

• Find crashes within a specified radius around a designated feature type such as rail at-grade crossings for the entire roadway network or subsets of the network Manual SQL Command-Line option - user-supplied SQL statements:

• Automated crash hazard reporting - utilizing predictive analysis, autonomously generate and send email notifications to specified recipients identifying locations where a high probability of vehicle crashes is likely to occur within a specified window of timeM
B2.2Graphical User Interface selection - with GIS integration capabilities, the user shall have:

• the ability to graphically select roadway locations/areas for analysis via graphical circular-radius selection tool or "polygon" selection tool

• the ability to retrieve crash data for x year, add x year, etc.; 3, 5, 10 years worth of data denoting the start and end time - cumulative non-fatal crashes for 2021-2022, etc.; and then be able to average that block of data but also compare and contrast. The dashboard would be able to compare, for example, 2022 serious injury crashes to the average SBI for the previous 3 years, 5 years, 10 years, etc.M
B2.3The system shall summarize crashes based on identified intersections and segments as identified by MIRE.M
B2.4The system shall summarize crashes based on identified intersections and segments as identified by sliding window analysis, an algorithm that analyzes crashes along a fixed length that can be moved along a roadway segment.P
Integrations
B3.1The system shall allow for diverse data source connectivity to easily connect to a wide range of data sources, such as RDBMS (Oracle/Microsoft SQL Server), API's (JSON/XML), FLAT files (csv, txt, Excel), and Esri services.M
B3.2The system shall have the ability to ingest data from structured (RDBMS system, csv, Excel) and semi-structured (JSON, XML) data sources.M
B3.3The system shall have error handling capabilities that alert users of failed jobs and provide users the ability to fix and re-run failed jobs.M
B3.4The system shall have monitoring and logging capabilities, including comprehensive logging of daily job runs, identifying bottlenecks, and tracking performance.M
B3.5In addition to internally-sourced state agency data, the following data feeds shall be ingested to enhance the crash reporting and analysis through the New England 511 Network:

• CCTV Snapshots and Camera Status

• DMS Messages

• Environment Sensor Data (Road temperature, precipitation, etc.)

• Incidents (hard braking, road construction, etc.)

• Lane Closures

• Network Information (Travel Times and Roadways)

• Travel Conditions

• Travel Times

• Traffic Incidents

• UNH GranitViewM
Unique Data Onboarding and Refinement Expertise
B4.1The vendor shall be intimately familiar with NH DOS/DOT traffic data management expectations.M
B4.2The NH DOS/DOT shall provide complete crash records for the past 10 years, which will need to be fully incorporated into the new software system.M
B4.3The system shall assess each crash's location and modify as necessary to most accurately locate each crash geographically through the use of batch location algorithms.M
B4.4The system shall allow partner agencies to flag crash locations that may require manual relocation.M
B4.5The scope of data refinement shall include automated crash type review and verification of crash information, including the number of occupants and vehicles involved and severity, by checking for consistency and accuracy.M
B4.6The system shall differentiate between any refined data fields and the original data from the provided crash data information.M
B4.7All refinement shall occur on a base GIS network that is frequently updated (quarterly and upon request) to mirror the real world and is fully accessible by NH DOS/DOT.M
B4.8The system shall provide 3D rendering of the roadway areas.P
B4.9The vendor shall show past crash safety data management system experience working closely with agencies to efficiently document crash safety concerns and solutions.M
B4.10The refinement shall produce high-quality, internally consistent, and well-documented datasets with appropriately detailed output to support necessary analysis and reporting.M
B4.11The vendor shall have already successfully deployed this approach elsewhere.M
Comprehensive Local and Federal Traffic Safety Knowledge
B5.1The vendor shall demonstrate experience developing innovations that improve on the efficiency and quality of crash analysis efforts.M
B5.2The vendor shall have a highway safety engineer on staff that posesses a professional engineering (PE) license in transportation that has overseen systems for GIS-based asset management and analysis or a road safety professional with equivalent experience.P
B5.3The traffic crash data management, analysis, and reporting system software shall draw on the vendor's distinctive familiarity with NH DOS/DOT traffic safety landscape, and direct involvement in building out safety infrastructure invesment best practices for government transportation agencies.P
B5.4Familiarity with HSM procedures, techniques, and approaches as well as Safety Performance Functions (SPF's), Calibration Factors (CF's), and Crash Modification Factors (CMF's) is requisite.M
B5.5The system shall feature use of the HSM Predictive Method to predict crash outcomes for network screening as well as detailed location studies.P
B5.6The system shall allow for modification to NH DOS/DOT-specific SPF's, CF's, and CMF's.M
B5.7The system shall already conform to NH DOS/DOT-specific accuracy requirements and data definitions such as the different attributes for crash types.M
B5.8The system shall offer Artificial Intelligence (AI) algorithms that provide NH DOS/DOT analysts and planners with instant recommendations for remedial actions that consider the severity of each location's crash patterns and context, as well as NH DOS/DOT-specific safety priorities and preferred safety countermeasures.M
B5.9The system shall provide instant, detailed cost estimates and comprehensive planning guidance to facilitate the NH DOS/DOT safety infrastructure capital programming.P
B5.10The system shall produce necessary safety reporting (e.g., a Vulnerable Road User (VRU) Assessment) in an automated fashion based on the crash incidences and patterns within the data.M
High-Level, Automated, Holistic Functionality with Visualization
B6.1The system shall be a comprehensive suite of traffic crash data management, analysis, and reporting safety planning tools that help NH DOS/DOT meet short- and long-term traffic safety goals.M
B6.2The system interface shall enable easy crash data and context toggling to navigate up to millions of crash records and infrastructure, such as schools, places of worship, licensed liquor establishments, parks, transit stations, and more.M
B6.3The visualizations shall allow government planners to explore their jurisdiction from city- or state-wide perspectives down to individual intersections.M
B6.4Maps and reports shall be easily exported for presentations and to respond to stakeholder requests. Reporting shall be available by varying jurisdictional areas as defined by the NH DOS/DOT.M
B6.5There shall be query and report functions that generate instant, detailed reports meeting federal guidelines, and which can be immediately shared with engineering and planning departments or the federal government.M
B6.6A one-click view of any crash shall provide an individual-level view of the particular crash, along with up-to-date crash attributes such as, vehicle information and persons impacted, with the appropriate redacted information per the Driver Privacy Act.M
B6.7Network screening tools shall include the ability to identify and prioritize corridors and other study areas based on a variety of safety metrics, including absolute and rate-adjusted measures, as well as historical and predictive measures.M
B6.8The interactive mapping tools shall show historical crash patterns including across timelines, helping NH DOS/DOT build a holistic understanding of safety performance progress over time.M
B6.9The dashboards shall include holistic benchmarking across geographies and time, to allow real-time assessment of the NH DOS/DOT crash safety performance.M
B6.10The system shall guide users through identifying high-priority areas for safety improvements using preferred safety and enforcement countermeasures, create construction programming details, and provide budget estimates.M
B6.11The system shall feature an emphasis on community census data, providing multiple tools that will help users understand demographic patterns and how safety performance intersects with various populations.M
B6.12Visualizations and mapping within the tool shall be high quality and meet effective practices for cutting-edge data visualization.M
B6.13The system design shall utilize simple and intuitive visual cues while avoiding distracting elements.M
B6.14Visualizations shall make use of the latest web-based technologies and high-end graphics to compellingly display crash data, overlay additional data, and provide a user-friendly visual aesthetic.M
B6.15The system shall provide an unparalleled means of comprehending complex data, making it an indispensable tool for data-driven decision making. This shall be accomplished by providing a dynamic combination of interactive maps, graphs, and visually captivating charts.M
Data Integrity Maintenance
B7.1The vendor shall demonstrate understanding of the importance of maintaining data integrity to ensure NH DOS/DOT has access to up-to-date and reliable data, including NHTSA’s performance attributes of timeliness, accuracy, completeness, uniformity, integration, and accessibility for the six state traffic records data systems: crash, driver, vehicle, roadway, citation and adjudication, and injury surveillance.M
B7.2Automated data exchanges via API and/or SFTP shall be used to manage the flow of data.M
B7.3All data modifications shall be tracked and notated, with data mapping provided by the vendor. This is because small changes to crash data, due to various factors such as new information, can impact the whole dataset and hamper NH DOS/DOT's ability to prioritize asset upgrades and create accurate budget forecasts.M
B7.4The system shall seamlessly integrate with NH DOS/DOT exisitng crash data collection databases and ensure up-to-date crash data across all software.M
B7.5The vendor shall show data management capability and the system should automate the maintenance of crash data, allowing full exportability as needed by NH DOS/DOT.M
B7.6The vendor shall work with the NH DOS/DOT to update all relevant data sets to keep pace with newer versions such as the MMUCC reporting format and relevant NH DOS/DOT reporting forms.M
B7.7The vendor shall structure the system to conform with NH RSA 260:14 Records and Certification with the NH DOS/DOT as the sole custodian of all driver/vehicle and e-Ticket-related data with rights to grant, modify, or revoke user privileges of the system.M
B7.8The system shall verify that all required form fields have been completed by local law enforcement agencies, and have the ability to produce validation reports based on parameters provided by the State upon request.P
Competitive Differentiation
B8.1The vendor shall demonstrate a combination of deep traffic engineering expertise, and NH DOS/DOT-specific knowledge leading to development of specialized, proprietary custom software that is commerically-proven, with demonstrated data refinement, geolocation, and analytical effectiveness.M
B8.2The system shall not require an extensive learning curve period, shall offer high data quality and reliability, and shall come with extensive system functionality including one-click querying, reporting, cost estimation, priority corridor/area identification, construction plans, and more.M
Software-as-a-Service (SaaS) Capability
B9.1The vendor shall offer a cloud-based, Commercial-Off-the-Shelf (COTS) solution.M
B9.2As a Software-as-a-Service (SaaS) product, the all-inclusive system shall include updates, including new and improved features, at no additional cost for the term of the contract.M
B9.3The system shall offer 99.9% uptime, and unlimited users and data, such as the number of crash points or elements.M
B9.4The vendor shall offer on-call 24/7 software maintenance for the life of the contract, ensuring system compatibility, data security, and software updates that incorporate the latest federal, state, and local ADA standards, data, and cybersecurity requirements.M
B9.5The vendor shall host in-person training during the product launch and additional training as necessary for new features and system upgrades (including documentation and notification of new releases), and on-call customer service support for questions and troubleshooting.M
B9.6The system shall continue to evolve and add innovations as developed by the provider.M
B9.7NH DOS/DOT retains rights in the data hosted by the chosen solution and shall have the ability to extract the data on-demand.M
B9.8The vendor shall provide training for NH DOS/DOT and agency partners.M
B9.10The system shall provide a module for agency partners to flag erroneous data.M
Schedule
B10.1The system shall be substantially complete and operational at the time of contract award.M
B10.2The vendor and NH DOS/DOT shall agree upon a reasonable time for NH DOS/DOT-specific customizations to the software setup, and a reasonable schedule for data refinement and data geolocation.M
B10.3The customizations and data intake period shall not exceed three (3) months, except in the case of delays and/or modifications by NH DOS/DOT.M
B10.4All crash data records provided shall be input into the system and available to NH DOS/DOT.M
B10.5The vendor shall, as proof of COTS viability of the solution, populate a pilot dataset of at least one hundred (100) crash points within the first three (3) weeks after award and receipt of the initial crash data, and shall provide NH DOS/DOT with access credentials to the system to verify its functionality on the pilot dataset.M
Crash Cost Analysis
B11.1Each intersection and segment shall have summary pages documenting the related crashes and automatically recommend safey countermeasures optimized by their benefit-to-cost ratio with overall costs summarized as well as individualized collision diagrams. This shall be automated and be available for all segments and intersections across the jurisdiction.M
B11.2The system shall offer immediate cost estimates using NH DOS/DOT's specific budget line items to help streamline the budgeting process and identify priorities for safety investment.M
B11.3The system shall generate a cost-benefit analysis of recommended countermeasures, using crash data to estimate potential safety benefits and associated costs.M
Public-Facing Dashboard
B11.1The system shall allow for public-facing dashboards that provide statistical summary-level data as defined by the State.M
B11.2The system shall handle a variety of dashboards, with local law enforcement agencies seeing data that may vary from data the State deems viewable to the public.M
B11.3The system shall be built in a way that the State can choose to toggle on/off the public-facing dashboard.M
B11.4The data figures, charts, maps, and tables shall provide operational and performance measurement within the tool modules, and also allow the user to convey a story within dashboards that are internal or public-facing.P
B11.5The system shall offer an exceptional user experience within a sophisticated and advanced data analysis platform as well as a public-facing portal to the system's crash data dashboard, which allows the public to view crash statistics and search available crash data metrics as defined by the NH DOS/DOT.M
B11.6The system shall provide role-based permissioning for various State agencies and the public view. The role-based requirements shall be configurable on-demand.M
TECHNICAL REQUIREMENTS
State RequirementsVendor
Req #Requirement DescriptionCriticalityVendor ResponseDelivery MethodComments
Prohibited Technologies
PT1No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf and no equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlistM
Security Compliance Requirements
T1.1Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline (SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations CSRC (nist.gov))M
T1.2Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus (SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov))P
T1.3Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status, and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. We also require a penetration test prior to go-live.M
T1.4Vendor agrees to ahere to the DoIT Vulnerability Remediation Standards and shall provide Vulnerability Tests weekly or allow the installation of the DOIT host-based vulnerability scanner (Tenable Nessus Agent). The vendor agrees those vulnerability scans will be delivered and reviewed by the NHCIC, DESC IT, and DOS IT weekly. Vendor shall also deliver a vulnerability scan after any major system updates. If there are deficiencies listed, they shall be remediated leveraging the below schedule.

The following vulnerability remediation timeframe applies for Internet-accessible systems:

1. Critical: Immediately upon availability of patch.

2. High vulnerabilities: 15 calendar days from vulnerability publication date.

3. Medium vulnerabilities: 30 calendar days from vulnerability publication date.

4. Low vulnerabilities: 90 calendar days from vulnerability publication date.

If a vulnerability cannot be remediated within the specified timeframe, a mitigation and remediation plan must be submitted along with an Exception to Baseline Controls as outlined in Policy NHS0235, Security and Privacy Plan Policy, Exceptions to Baseline Controls.M
StateRAMP Authorization
T2.1StateRAMP Ready/Authorized Certification (Home - StateRAMP)P
T2.2If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract.M
T2.3If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.M
T2.4If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.M
T2.5If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal.M
T2.6If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract.M
T2.7Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered, by providing a mutually agreed upon timeframe to resolve the issue(s) and/or implement a compensating control.M
Other Certifications in lieu of StateRAMP
T3.1FedRAMP Authorized How to Become FedRAMP Authorized | FedRAMP.govP
T3.2HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance | Information Risk Management and ComplianceP
Hosted Platform
T4.1The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any SaaS or other Software Product. If your platform is included in the list below, identify the platform in the Vendor Comments. AWS US East/West, AWS GOVCLOUD, AZURE Commercial Cloud, AZURE Government (includes Dynamics 365), GOOGLE Services (Cloud Platform Products and Underlying Infrastructure), ORACLE Government Cloud - Common Controls, and ORACLE Federal Managed Cloud Services.P
Individual Agency Compliance Requirements (examples listed below)
T5.1FTI Pub 1075M
T5.2HIPAAM
T5.3FERPAM
T5.4CJISM
Information Technology Accessibility Compliance
T6.1Web content and mobile applications must comply with WCAG 2.1, Level AAM
T6.2Hardware that transmits information or has a user interface, such as display screens, variable message signs, and kiosks, must comply with ICT Accessibility Standards and Guidelines, Chapter 4: Hardware.M
T6.3The vendor shall complete the VPAT 2.5 WCAG (November 2023) and submit with their proposal in Section III: Responses to Requirements and Deliverables (https://www.itic.org/policy/accessibility/vpat)M
SERVICE LEVEL AGREEMENT (SLA)
State RequirementsVendor
Req #Requirement DescriptionCriticalityVendor ResponseDelivery MethodComments
SLA-1The vendor's system support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof.M
SLA-2The vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing software enhancement upgrades and fixes as required at no cost to the State.M
SLA-3The vendor shall repair or replace the hardware or software, or any portion thereof, so that the System operates in accordance with the Specifications, terms, and requirements of the Contract.M
SLA-4All hardware and software components of the vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within sixty (60) days of release by their respective manufacturers. (RA-5)M
SLA-5The State shall have unlimited access, via phone or Email, to the vendor technical support staff between the hours of 8:30am to 5:00pm- Monday through Friday EST.M
SLA-6The vendor shall conform to the specific deficiency class as described below or as agreed to by the parties:

o Class A Deficiency - Software - Critical, does not allow System to operate, no work around, demands immediate action; Written Documentation - missing significant portions of information or unitelligible to State; Non-Software - Services were inadequate and require re-performance of the Service.

o Class B Deficiency - Software - important, does not stop operation and/or there is a workaround and user can perform tasks; Written Documentation - portions of information are missing but not enough to make the document unitelligible; Non-Software - Services were deficient, require reworking, but do not require re-performance of the Service.

o Class C Deficiency - Software - minimal, cosmetic in nature, minimal effect on System, low priority and/or user can use System; Written Documentation - minimal changes required and of minor editing nature; Non-Software - Services require only minor reworking and do not require re-performance of the Service.M
SLA-7As part of the maintenance agreement, ongoing support issues shall be responded to according to the following:

a. Class A Deficiencies - The vendor shall have available to the State on-call telephone assistance, with issue tracking available to the State, eight (8) hours per day and five (5) days a week with an email / telephone response within two (2) hours of request; or the vendor shall provide support onsite or with remote diagnostic services within four (4) business hours of a request;

b. Class B & C Deficiency - The State shall notify the vendor of such Deficiencies during regular business hours and the vendor shall respond back within four (4) hours of notification of planned corrective action; The vendor shall repair or replace Software, and provide maintenance of the Software in accordance with the Specifications, Terms, and Requirements of the Contract.M
SLA-8The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance.M
SLA-9A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied.M
SLA-10If the vendor is unable to meet the uptime requirement, the vendor shall credit State’s account in an amount based upon the following formula: (Total Contract Item Price/365) x Number of Days Contract Item Not Provided. The State must request this credit in writing.M
SLA-11The vendor shall use a change management policy for notification and tracking of change requests as well as critical outages.M
SLA-12A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no workaround to the problem.M
SLA-13The vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: Server uptime; All change requests implemented, including operating system patches; All critical outages reported including actual issue and resolution; Number of deficiencies reported by class with initial response time as well as time to close.M
SLA-14The vendor will give two business days' prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes.M
SLA-15The vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost.M
SLA-16For all maintenance Service calls, the vendor shall ensure the following information will be collected and maintained: 1) nature of the Deficiency; 2) current status of the Deficiency; 3) action plans, dates, and times; 4) expected and actual completion time; 5)Deficiency resolution information; 6) Resolved by; 7)Identifying number i.e. work order number; 8) Issue identified by.P
SLA-17The vendor must work with the State to identify and troubleshoot potentially large-scale System failures or Deficiencies by collecting the following information: 1) mean time between reported Deficiencies with the Software; 2) diagnosis of the root cause of the problem; and 3) identification of repeat calls or repeat software problems.P

File details come from the government source that posted it. Updated .