attachment_4_RFP DOS 2026-02.xlsx
XLSX spreadsheet 41 KB Posted
- Attached to
- Crash Data Analysis System State and local contract opportunity
- Solicitation number
- RFP DOS 2026-02
- Issued by
- Merrimack County, New Hampshire
About this file
This document is a Request for Proposal (RFP) from the New Hampshire Department of Safety (NH DOS/DOT) seeking a comprehensive Crash Data Analysis System for statewide implementation. The RFP outlines requirements for a cloud-based, Commercial-Off-the-Shelf (COTS) Software-as-a-Service (SaaS) solution that will provide advanced traffic crash data management, analysis, and reporting capabilities. The system must integrate multiple data sources, perform predictive analyses, generate visualizations, and recommend safety countermeasures. A mandatory virtual vendor conference is scheduled for 6/23/2025, with proposal submissions due by 8/4/2025 at 4:00 PM ET. The contract will require the selected vendor to populate an initial pilot dataset within three weeks of award and provide a system with 99.9% uptime, unlimited users, and comprehensive data management capabilities.
The procurement will be evaluated using a 110-point scoring system, with 65 points for the technical proposal, 35 points for pricing, and up to 10 bonus points for FedRAMP/StateRAMP authorization. While no specific budget is disclosed, the system requires rigorous security compliance, including NIST Special Publication controls, StateRAMP authorization, and WCAG 2.1 Level AA accessibility standards. All services and data centers must be located within the Continental United States, and vendors must conduct criminal background checks on staff. The contract will be a firm fixed-price type, requiring detailed pricing worksheets covering implementation, ongoing operations, hardware, software licenses, maintenance, and hosting. The system must integrate with existing traffic safety data infrastructure and demonstrate deep traffic engineering expertise to support the state's safety planning and infrastructure investment goals.
View the file
Other files for this state and local contract opportunity
Show all 29
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Vendor Instructions for Business Requirements (BR) and Technical Requirements (TR) |
| Vendor Response Column: Place a “Yes” if the current release of the software can fully support ALL the functionality described in the row, without special customization. A “Yes” can only be used if the delivery method is Standard (see delivery method instructions below). Otherwise, enter an "No"; A "No" can only be used with delivery method Future, Custom, or Not Available/Not Proposing (see delivery method instructions below). |
Criticality Column:
(M) Indicates a requirement that is "Mandatory". The State considers it to be of such great importance that it must be met in order for the proposal to be accepted. If the proposer believes that there is something about their proposal that either obviates the need for this requirement or makes it of less importance this must be explained within the comments. The State retains the right to accept a proposal if the need of the requirement is reduced or eliminated by another feature of the proposal.
(P) Indicates a requirement which is "Preferred". This requirement is considered by the State to be of great usefulness but the lack of this feature is not considered serious enough to disqualify the proposal.
(O) Indicates a requirement which is "Optional". This requirement is considered by the State to be one which useful or potentially useful but not a central feature of the Project.
Delivery Method Column:
Complete the delivery method using a Standard, Future, Custom, or Not Available/Not Proposing (as defined below) that indicates how the requirement will be delivered.
Standard - Feature/Function is included in the proposed system and available in the current software release.
Future - Feature/Function will be available in a future release. (Provide anticipated delivery date, version, and service release in the comment area.)
Custom - Feature/Function can be provided with custom modifications. (Respondent must provide estimated hours and average billing rate or flat cost for the software modification in the comment area. These cost estimates should add up to the total cost for software modifications found in the cost summary table in Section X of the RFP).
Not Available/Not Proposing - Feature/Function has not been proposed by the Vendor. (Provide brief description of why this functionality was not proposed.)
Comments Column:
For all Delivery Method responses vendors must provide a brief explanation of how the requirement will be met. Free form text can be entered into this column.
| Vendor Instructions for Activity, Deliverable, and Milestone |
| Vendor shall complete the Activity Deliverable, and Milestone Table identifying estimated delivery date and price. |
| Terms and Definitions |
| Please refer to Appendix H in the associated Request for Proposal (RFP) for a list of terms and definitions that are mentioned in either the RFP or the Requirements spreadsheet. |
Requirements
| BUSINESS REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| Data Analysis Capabilities | |||||
| B1.1 | The system shall compile metrics from disparate data sources to produce a comprehensive list of crash metrics. | M | |||
| B1.2 | The system shall provide predictive methods for roadway network screening and hazard location identification. | M | |||
| B1.3 | The system shall provide the ability to produce annual reports containing statistical analysis of crash metrics and patterns for agency partners as needed based on varying user requirements. | M | |||
| B1.4 | The system shall accept and analyze multiple contributing factors (e.g., weather, driver behavior) for each crash, enabling a comprehensive understanding of crash causation. | M | |||
| B1.5 | The system shall analyze crash data and generate visualizations (charts, diagrams) that clearly show key crash metrics, enabling users to easily understand and interpret the data. | M | |||
| B1.6 | The system shall recommend safety countermeasures by referencing best-practice resources, including the AASHTO Highway Safety Manual, FHWA’s CMF Clearinghouse, and NHTSA’s Countermeasures That Work guide. | M | |||
| B1.7 | The system shall use crash report data and official State of New Hampshire cost factors to calculate the economic impact of crashes. | M | |||
| B1.8 | The system shall use collected data to develop Safety Performance Functions (SPFs), enabling crash predictions across the roadway network. | M | |||
| B1.9 | The system shall rank corridors, sections, and intersections by crash potential using various data points (speed, citation data, traffic volume, etc.), comparing each location’s risk level to others in the network. | M | |||
| B1.10 | The system shall, at a minimum, comply with the safety performance methods described in Highway Safety Manual Part B. | M | |||
| B1.11 | The system shall compile crash data from multiple sources and produce a prioritized list of locations for safety improvements, based on crash types and severity. | M | |||
| B1.12 | The system shall allow yearly safety analysis to accurately reflect roadway conditions and crash locations as they existed during each analysis year. | M | |||
| B1.13 | The system shall store roadway configurations, geometries, and attributes separately for each calendar year. Each annual roadway snapshot must reflect the roadway conditions precisely as they existed during that specific year. | M | |||
| B1.14 | The system shall provide functionality to analyze crash data for each year independently. | M | |||
| B1.15 | The system shall clearly and permanently link crash records to the year in which they occurred. | M | |||
| B1.16 | The system shall automatically detect changes to roadway alignment or configuration between annual snapshots, notifying users when signficant roadway changes are detected that could impact crash location accuracy. | M | |||
| B1.17 | The system shall enable clear and intuitive comparison of crash analyses across different years. | M | |||
| B1.18 | The system shall produce reports that indicate whether crash locations have been analyzed based on original-year conditions or relocated positions. | M | |||
| B1.19 | The system shall track all changes, including crash relocations and roadway snapshot modifications, through a comprehensive audit trail. | M | |||
| B1.20 | The system shall provide detailed documentation to explain decisions made during crash relocation processes. | M | |||
| B1.21 | The system shall retain twenty years of data, which is the NH requirement for fatality crashes. | M | |||
| B1.22 | The system shall provide the capability to automatically relocate crash locations annually to align with the most current roadway conditions. | P | |||
| B1.23 | The system shall clearly document and retain both the original and relocated crash positions for transparency, should crash locations be relocated. | P | |||
| B1.24 | The system shall be able to redact Personal Identifying Information (PII) to users outside of the NHDMV both in fields containing PII but also from the gist, crash summary, or diagram. | P | |||
| Data Queries | |||||
| B2.1 | Structured Query Language (SQL) capabilities - Pre-built SQL toolboxes - GUI windows with pull-down menus of data tables with pre-defined attributes, in conjunction with user-selected values, which accomplish specific types of queries. In general, the user shall have the option to: |
• SELECT field(s) or attribute(s), in conjunction with aggregate functions of attribute(s)
• FROM any given data table(s) - crash tables and non-crash tables
• WHERE specified attribute(s) have a specified value or range of values selected by the user
• ORDERED BY specified attribute(s) in ascending or descending order
• GROUPED BY specified attribute(s)
• Having the result of the aggregate function satisfy some criteria Examples of Pre-built toolboxes:
• "Summarize crashes" grouped by the attribute "crash type" for the entire roadway network, excluding crashes at intersections; "Summarize crashes" could mean summing total number of crashes over x-number of years, calculating average crash frequency (#crashes per 100-million vehicle miles of travel) for roadway segments over x-number of years, or calculating average crash rate (#crashes per 10-million entering vehicle) for roadway intersections over x-number of years
• Above example but only for crashes located at intersections
• Above example but only for a particular route system designation (e.g. U.S. Highway) or only for roadways with a specified number of lanes
• Select the top x% of y-mile long sections of roadway (excluding intersections) in the entire network with the highest Annual Crash Rate
• Find crash clusters or hot-spots within a user-specified segment length along a roadway(s), capable of specifying either a floating window that slides along a route at a given increment or specifying a fixed window
• Find crashes within a specified radius around a designated feature type such as rail at-grade crossings for the entire roadway network or subsets of the network Manual SQL Command-Line option - user-supplied SQL statements:
| • Automated crash hazard reporting - utilizing predictive analysis, autonomously generate and send email notifications to specified recipients identifying locations where a high probability of vehicle crashes is likely to occur within a specified window of time | M | |
| B2.2 | Graphical User Interface selection - with GIS integration capabilities, the user shall have: |
• the ability to graphically select roadway locations/areas for analysis via graphical circular-radius selection tool or "polygon" selection tool
| • the ability to retrieve crash data for x year, add x year, etc.; 3, 5, 10 years' worth of data denoting the start and end time - cumulative non-fatal crashes for 2021-2022, etc.; and then be able to average that block of data but also compare and contrast. The dashboard would be able to compare, for example, 2022 serious injury crashes to the average SBI for the previous 3 years, 5 years, 10 years, etc. | M | ||
| B2.3 | The system shall summarize crashes based on identified intersections and segments as identified by MIRE. | M | |
| B2.4 | The system shall summarize crashes based on identified intersections and segments as identified by sliding window analysis, an algorithm that analyzes crashes along a fixed length that can be moved along a roadway segment. | P | |
| Integrations | |||
| B3.1 | The system shall allow for diverse data source connectivity to easily connect to a wide range of data sources, such as RDBMS (Oracle/Microsoft SQL Server), API's (JSON/XML), FLAT files (csv, txt, Excel), and Esri services. | M | |
| B3.2 | The system shall have the ability to ingest data from structured (RDBMS system, csv, Excel) and semi-structured (JSON, XML) data sources. | M | |
| B3.3 | The system shall have error handling capabilities that alert users of failed jobs and provide users the ability to fix and re-run failed jobs. | M | |
| B3.4 | The system shall have monitoring and logging capabilities, including comprehensive logging of daily job runs, identifying bottlenecks, and tracking performance. | M | |
| B3.5 | In addition to internally-sourced state agency data, the following data feeds shall be ingested to enhance the crash reporting and analysis through the New England 511 Network: |
• CCTV Snapshots and Camera Status
• DMS Messages
• Environment Sensor Data (road temperature, precipitation, etc.)
• Incidents (hard braking, road construction, etc.)
• Lane Closures
• Network Information (Travel Times and Roadways)
• Travel Conditions
• Travel Times
• Traffic Incidents
| • UNH GranitView | M | |||||
| Unique Data Onboarding and Refinement Expertise | ||||||
| B4.1 | The vendor shall be intimately familiar with NH DOS/DOT traffic data management expectations. | M | ||||
| B4.2 | The NH DOS/DOT shall provide complete crash records for the past 10 years, which will need to be fully incorporated into the new software system. | M | ||||
| B4.3 | The system shall assess each crash's location and modify as necessary to most accurately locate each crash geographically through the use of batch location algorithms. | M | ||||
| B4.4 | The system shall allow partner agencies to flag crash locations that may require manual relocation. | M | ||||
| B4.5 | The scope of data refinement shall include automated crash type review and verification of crash information, including the number of occupants and vehicles involved and severity, by checking for consistency and accuracy. | M | ||||
| B4.6 | The system shall differentiate between any refined data fields and the original data from the provided crash data information. | M | ||||
| B4.7 | All refinement shall occur on a base GIS network that is frequently updated (quarterly and upon request) to mirror the real world and is fully accessible by NH DOS/DOT. | M | ||||
| B4.8 | The system shall provide 3D rendering of the roadway areas. | P | ||||
| B4.9 | The vendor shall show past crash safety data management system experience working closely with agencies to efficiently document crash safety concerns and solutions. | M | ||||
| B4.10 | The refinement shall produce high-quality, internally consistent, and well-documented datasets with appropriately detailed output to support necessary analysis and reporting. | M | ||||
| B4.11 | The vendor shall have already successfully deployed this approach elsewhere. | M | ||||
| Comprehensive Local and Federal Traffic Safety Knowledge | ||||||
| B5.1 | The vendor shall demonstrate experience developing innovations that improve on the efficiency and quality of crash analysis efforts. | M | ||||
| B5.2 | The vendor shall have a highway safety engineer on staff that possesses a Professional Engineering (PE) license in transportation that has overseen systems for GIS-based asset management and analysis or a road safety professional with equivalent experience. | P | ||||
| B5.3 | The traffic crash data management, analysis, and reporting system software shall draw on the vendor's distinctive familiarity with NH DOS/DOT traffic safety landscape, and direct involvement in building out safety infrastructure invesment best practices for government transportation agencies. | P | ||||
| B5.4 | Familiarity with HSM procedures, techniques, and approaches as well as Safety Performance Functions (SPF's), Calibration Factors (CF's), and Crash Modification Factors (CMF's) is requisite. | M | ||||
| B5.5 | The system shall feature use of the HSM Predictive Method to predict crash outcomes for network screening as well as detailed location studies. | P | ||||
| B5.6 | The system shall allow for modification to NH DOS/DOT-specific SPF's, CF's, and CMF's. | M | ||||
| B5.7 | The system shall already conform to NH DOS/DOT-specific accuracy requirements and data definitions such as the different attributes for crash types. | M | ||||
| B5.8 | The system shall offer Artificial Intelligence (AI) algorithms that provide NH DOS/DOT analysts and planners with instant recommendations for remedial actions that consider the severity of each location's crash patterns and context, as well as NH DOS/DOT-specific safety priorities and preferred safety countermeasures. | M | ||||
| B5.9 | The system shall provide instant, detailed cost estimates and comprehensive planning guidance to facilitate the NH DOS/DOT safety infrastructure capital programming. | P | ||||
| B5.10 | The system shall produce necessary safety reporting (e.g., a Vulnerable Road User (VRU) Assessment) in an automated fashion based on the crash incidences and patterns within the data. | M | ||||
| High-Level, Automated, Holistic Functionality with Visualization | ||||||
| B6.1 | The system shall be a comprehensive suite of traffic crash data management, analysis, and reporting safety planning tools that help NH DOS/DOT meet short- and long-term traffic safety goals. | M | ||||
| B6.2 | The system interface shall enable easy crash data and context toggling to navigate up to millions of crash records and infrastructure, such as schools, places of worship, licensed liquor establishments, parks, transit stations, and more. | M | ||||
| B6.3 | The visualizations shall allow government planners to explore their jurisdiction from city- or state-wide perspectives down to individual intersections. | M | ||||
| B6.4 | Maps and reports shall be easily exported for presentations and to respond to stakeholder requests. Reporting shall be available by varying jurisdictional areas as defined by the NH DOS/DOT. | M | ||||
| B6.5 | There shall be query and report functions that generate instant, detailed reports meeting federal guidelines, and which can be immediately shared with engineering and planning departments or the federal government. | M | ||||
| B6.6 | A one-click view of any crash shall provide an individual-level view of the particular crash, along with up-to-date crash attributes. | M | ||||
| B6.7 | Network screening tools shall include the ability to identify and prioritize corridors and other study areas based on a variety of safety metrics, including absolute and rate-adjusted measures, as well as historical and predictive measures. | M | ||||
| B6.8 | The interactive mapping tools shall show historical crash patterns including across timelines, helping NH DOS/DOT build a holistic understanding of safety performance progress over time. | M | ||||
| B6.9 | The dashboards shall include holistic benchmarking across geographies and time, to allow real-time assessment of the NH DOS/DOT crash safety performance. | M | ||||
| B6.10 | The system shall guide users through identifying high-priority areas for safety improvements using preferred safety and enforcement countermeasures, create construction programming details, and provide budget estimates. | M | ||||
| B6.11 | The system shall feature an emphasis on community census data, providing multiple tools that will help users understand demographic patterns and how safety performance intersects with various populations. | M | ||||
| B6.12 | Visualizations and mapping within the tool shall be high quality and meet effective practices for cutting-edge data visualization. | M | ||||
| B6.13 | The system design shall utilize simple and intuitive visual cues while avoiding distracting elements. | M | ||||
| B6.14 | Visualizations shall make use of the latest web-based technologies and high-end graphics to compellingly display crash data, overlay additional data, and provide a user-friendly visual aesthetic. | M | ||||
| B6.15 | The system shall provide an unparalleled means of comprehending complex data, making it an indispensable tool for data-driven decision making. This shall be accomplished by providing a dynamic combination of interactive maps, graphs, and visually captivating charts. | M | ||||
| Data Integrity Maintenance | ||||||
| B7.1 | The vendor shall demonstrate understanding of the importance of maintaining data integrity to ensure NH DOS/DOT has access to up-to-date and reliable data, including NHTSA’s performance attributes of timeliness, accuracy, completeness, uniformity, integration, and accessibility for the six state traffic records data systems: crash, driver, vehicle, roadway, citation and adjudication, and injury surveillance. | M | ||||
| B7.2 | Automated data exchanges via API and/or SFTP shall be used to manage the flow of data. | M | ||||
| B7.3 | All data modifications shall be tracked and notated, with data mapping provided by the vendor. This is because small changes to crash data, due to various factors such as new information, can impact the whole dataset and hamper NH DOS/DOT's ability to prioritize asset upgrades and create accurate budget forecasts. | M | ||||
| B7.4 | The system shall seamlessly integrate with NH DOS/DOT exisitng crash data collection databases and ensure up-to-date crash data across all software. | M | ||||
| B7.5 | The vendor shall show data management capability and the system should automate the maintenance of crash data, allowing full exportability as needed by NH DOS/DOT. | M | ||||
| B7.6 | The vendor shall work with the NH DOS/DOT to update all relevant datasets to keep pace with newer versions such as the MMUCC reporting format and relevant NH DOS/DOT reporting forms. | M | ||||
| B7.7 | The vendor shall structure the system to conform with NH RSA 260:14 Records and Certification with the NH DOS/DOT as the sole custodian of all driver/vehicle and e-Ticket-related data with rights to grant, modify, or revoke user privileges of the system. | M | ||||
| B7.8 | The system shall verify that all required form fields have been completed by local law enforcement agencies, and have the ability to produce validation reports upon request based on parameters provided by the State. | P | ||||
| Competitive Differentiation | ||||||
| B8.1 | The vendor shall demonstrate a combination of deep traffic engineering expertise, and NH DOS/DOT-specific knowledge leading to development of specialized, proprietary custom software that is commerically proven, with demonstrated data refinement, geolocation, and analytical effectiveness. | M | ||||
| B8.2 | The system shall not require an extensive learning curve period, shall offer high data quality and reliability, and shall come with extensive system functionality including one-click querying, reporting, cost estimation, priority corridor/area identification, construction plans, and more. | M | ||||
| Software-as-a-Service (SaaS) Capability | ||||||
| B9.1 | The vendor shall offer a cloud-based, Commercial-Off-the-Shelf (COTS) solution. | M | ||||
| B9.2 | As a Software-as-a-Service (SaaS) product, the all-inclusive system shall include updates, including new and improved features, at no additional cost for the term of the contract. | M | ||||
| B9.3 | The system shall offer 99.9% uptime, and unlimited users and data, such as the number of crash points or elements. | M | ||||
| B9.4 | The vendor shall offer on-call 24/7 software maintenance for the life of the contract, ensuring system compatibility, data security, and software updates that incorporate the latest federal, state, and local ADA standards, data, and cybersecurity requirements. | M | ||||
| B9.5 | The vendor shall host in-person training during the product launch and additional training as necessary for new features and system upgrades (including documentation and notification of new releases), and on-call customer service support for questions and troubleshooting. | M | ||||
| B9.6 | The system shall continue to evolve and add innovations as developed by the provider. | M | ||||
| B9.7 | NH DOS/DOT retains rights in the data hosted by the chosen solution and shall have the ability to extract the data on-demand. | M | ||||
| B9.8 | The system shall provide a module for agency partners to flag erroneous data. | M | ||||
| Schedule | ||||||
| B10.1 | The system shall be substantially complete and operational at the time of contract award. | M | ||||
| B10.2 | The vendor and NH DOS/DOT shall agree upon a reasonable time for NH DOS/DOT-specific customizations to the software setup, and a reasonable schedule for data refinement and data geolocation. | M | ||||
| B10.3 | The customizations and data intake period shall not exceed three (3) months, except in the case of delays and/or modifications by NH DOS/DOT. | M | ||||
| B10.4 | All crash data records provided shall be input into the system and available to NH DOS/DOT. | M | ||||
| B10.5 | The vendor shall, as proof of COTS viability of the solution, populate a pilot dataset of at least one hundred (100) crash points within the first three (3) weeks after award and receipt of the initial crash data, and shall provide NH DOS/DOT with access credentials to the system to verify its functionality on the pilot dataset. | M | ||||
| Crash Cost Analysis | ||||||
| B11.1 | Each intersection and segment shall have summary pages documenting the related crashes and automatically recommend safey countermeasures optimized by their benefit-to-cost ratio with overall costs summarized as well as individualized collision diagrams. This shall be automated and be available for all segments and intersections across the jurisdiction. | M | ||||
| B11.2 | The system shall offer immediate cost estimates using NH DOS/DOT's specific budget line items to help streamline the budgeting process and identify priorities for safety investment. | M | ||||
| B11.3 | The system shall generate a cost-benefit analysis of recommended countermeasures, using crash data to estimate potential safety benefits and associated costs. | M | ||||
| Public-Facing Dashboard | ||||||
| B12.1 | The system shall allow for public-facing dashboards that provide statistical summary-level data as defined by the State. | M | ||||
| B12.2 | The system shall handle a variety of dashboards, with local law enforcement agencies seeing data that may vary from data the State deems viewable to the public. | M | ||||
| B12.3 | The system shall be built in a way that the State can choose to toggle on/off the public-facing dashboard. | M | ||||
| B12.4 | The data figures, charts, maps, and tables shall provide operational and performance measurement within the tool modules, and also allow the user to convey a story within dashboards that are internal or public-facing. | P | ||||
| B12.5 | The system shall offer an exceptional user experience within a sophisticated and advanced data analysis platform as well as a public-facing portal to the system's crash data dashboard, which allows the public to view crash statistics and search available crash data metrics as defined by the NH DOS/DOT. | M | ||||
| B12.6 | The system shall provide role-based permissioning for various State agencies and the public view. The role-based requirements shall be configurable on-demand. | M | ||||
| TECHNICAL REQUIREMENTS | ||||||
| State Requirements | Vendor | |||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments | |
| Prohibited Technologies | ||||||
| PT1 | No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf and no equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlist | M | ||||
| Security Compliance Requirements | ||||||
| T1.1 | Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline (SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations CSRC (nist.gov)) | M | ||||
| T1.2 | Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus (SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov)) | P | ||||
| T1.3 | Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded vendor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status, and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the vendor's environment. The vendor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. We also require a penetration test prior to go-live. | M | ||||
| T1.4 | Vendor agrees to adhere to the DoIT Vulnerability Remediation Standards and shall provide Vulnerability Tests weekly or allow the installation of the DOIT host-based vulnerability scanner (Tenable Nessus Agent). The vendor agrees those vulnerability scans will be delivered and reviewed by the NHCIC, DESC IT, and DOS IT weekly. Vendor shall also deliver a vulnerability scan after any major system updates. If there are deficiencies listed, they shall be remediated leveraging the below schedule. |
The following vulnerability remediation timeframe applies for Internet-accessible systems:
1. Critical: Immediately upon availability of patch.
2. High vulnerabilities: 15 calendar days from vulnerability publication date.
3. Medium vulnerabilities: 30 calendar days from vulnerability publication date.
4. Low vulnerabilities: 90 calendar days from vulnerability publication date.
| If a vulnerability cannot be remediated within the specified timeframe, a mitigation and remediation plan must be submitted along with an Exception to Baseline Controls as outlined in Policy NHS0235, Security and Privacy Plan Policy, Exceptions to Baseline Controls. | M | |||||
| StateRAMP Authorization | ||||||
| T2.1 | StateRAMP Ready/Authorized Certification (Home - StateRAMP) | P | ||||
| T2.2 | If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract. | M | ||||
| T2.3 | If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | ||||
| T2.4 | If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | ||||
| T2.5 | If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal. | M | ||||
| T2.6 | If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | ||||
| Other Certifications in lieu of StateRAMP | ||||||
| T3.1 | FedRAMP Authorized How to Become FedRAMP Authorized | FedRAMP.gov, | P | ||||
| T3.2 | HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance | Information Risk Management and Compliance | P | ||||
| Hosted Platform | ||||||
| T4.1 | The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any SaaS or other Software Product. If your platform is included in the list below, identify the platform in the Vendor Comments. AWS US East/West, AWS GOVCLOUD, AZURE Commercial Cloud, AZURE Government (includes Dynamics 365), GOOGLE Services (Cloud Platform Products and Underlying Infrastructure), ORACLE Government Cloud - Common Controls, and ORACLE Federal Managed Cloud Services. | P | ||||
| Individual Agency Compliance Requirements (examples listed below) | ||||||
| T5.1 | FTI Pub 1075 | M | ||||
| T5.2 | HIPAA | M | ||||
| T5.3 | FERPA | M | ||||
| T5.4 | CJIS | M | ||||
| Information Technology Accessibility Compliance | ||||||
| T6.1 | Web content and mobile applications must comply with WCAG 2.1, Level AA. | M | ||||
| T6.2 | Hardware that transmits information or has a user interface, such as display screens, variable message signs, and kiosks, must comply with ICT Accessibility Standards and Guidelines, Chapter 4: Hardware. | M | ||||
| T6.3 | The vendor shall complete the VPAT 2.5 WCAG (November 2023) and submit with their proposal in Section III: Responses to Requirements and Deliverables (https://www.itic.org/policy/accessibility/vpat). | M | ||||
| SERVICE LEVEL AGREEMENT (SLA) | ||||||
| State Requirements | Vendor | |||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments | |
| SLA-1 | The vendor's system support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof. | M | ||||
| SLA-2 | The vendor shall maintain the hardware and software in accordance with the specifications, terms, and requirements of the Contract, including providing software enhancement upgrades and fixes as required at no cost to the State. | M | ||||
| SLA-3 | The vendor shall repair or replace the hardware or software, or any portion thereof, so that the System operates in accordance with the Specifications, terms, and requirements of the Contract. | M | ||||
| SLA-4 | All hardware and software components of the vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied within sixty (60) days of release by their respective manufacturers. (RA-5) | M | ||||
| SLA-5 | The State shall have unlimited access, via phone or Email, to the vendor technical support staff between the hours of 8:30am to 5:00pm- Monday through Friday EST. | M | ||||
| SLA-6 | The vendor shall conform to the specific deficiency class as described below or as agreed to by the parties: |
o Class A Deficiency - Software - Critical, does not allow System to operate, no work around, demands immediate action; Written Documentation - missing significant portions of information or unitelligible to State; Non-Software - Services were inadequate and require re-performance of the Service.
o Class B Deficiency - Software - important, does not stop operation and/or there is a workaround and user can perform tasks; Written Documentation - portions of information are missing but not enough to make the document unitelligible; Non-Software - Services were deficient, require reworking, but do not require re-performance of the Service.
| o Class C Deficiency - Software - minimal, cosmetic in nature, minimal effect on System, low priority and/or user can use System; Written Documentation - minimal changes required and of minor editing nature; Non-Software - Services require only minor reworking and do not require re-performance of the Service. | M | |
| SLA-7 | As part of the maintenance agreement, ongoing support issues shall be responded to according to the following: |
a. Class A Deficiencies - The vendor shall have available to the State on-call telephone assistance, with issue tracking available to the State, eight (8) hours per day and five (5) days a week with an email / telephone response within two (2) hours of request; or the vendor shall provide support onsite or with remote diagnostic services within four (4) business hours of a request;
| b. Class B & C Deficiency - The State shall notify the vendor of such Deficiencies during regular business hours and the vendor shall respond back within four (4) hours of notification of planned corrective action; The vendor shall repair or replace Software, and provide maintenance of the Software in accordance with the Specifications, Terms, and Requirements of the Contract. | M | ||
| SLA-8 | The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance. | M | |
| SLA-9 | A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied. | M | |
| SLA-10 | If the vendor is unable to meet the uptime requirement, the vendor shall credit State’s account in an amount based upon the following formula: (Total Contract Item Price/365) x Number of Days Contract Item Not Provided. The State must request this credit in writing. | M | |
| SLA-11 | The vendor shall use a change management policy for notification and tracking of change requests as well as critical outages. | M | |
| SLA-12 | A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no workaround to the problem. | M | |
| SLA-13 | The vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: Server uptime; All change requests implemented, including operating system patches; All critical outages reported including actual issue and resolution; Number of deficiencies reported by class with initial response time as well as time to close. | M | |
| SLA-14 | The vendor will give two business days' prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes. | M | |
| SLA-15 | The vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost. | M | |
| SLA-16 | For all maintenance Service calls, the vendor shall ensure the following information will be collected and maintained: 1) nature of the Deficiency; 2) current status of the Deficiency; 3) action plans, dates, and times; 4) expected and actual completion time; 5)Deficiency resolution information; 6) Resolved by; 7)Identifying number i.e. work order number; 8) Issue identified by. | P | |
| SLA-17 | The vendor must work with the State to identify and troubleshoot potentially large-scale System failures or Deficiencies by collecting the following information: 1) mean time between reported Deficiencies with the Software; 2) diagnosis of the root cause of the problem; and 3) identification of repeat calls or repeat software problems. | P |
File details come from the government source that posted it. Updated .