dot-attachment4---rfp-doit-2025-067-table-b-2.2-and-table-b-2.3.xlsx
XLSX spreadsheet 30 KB Posted
- Solicitation number
- RFP DOT Managed Security Service Provider (MSSP) #2025-067
- Issued by
- New Hampshire
About this file
This file contains technical requirements tables for a Request for Proposal (RFP) issued by the New Hampshire Department of Transportation (NHDOT) to procure managed security services and field service support for the TSMO Bureau and TMC operations. The vendor selected will supplement NHDoIT's cybersecurity team by providing specialized cybersecurity services and field network support to ensure compliance with state and federal security requirements while protecting critical ITS infrastructure. The RFP requires vendors to meet mandatory prohibited technologies restrictions, NIST SP 800-171 Revision 2 security compliance baselines, and either StateRAMP authorization or equivalent certifications such as FedRAMP or HITRUST. Vendors must host solutions on pre-approved FedRAMP or StateRAMP-authorized platforms including AWS, Azure, Google Services, or Oracle Government Cloud. Web content and mobile applications must comply with WCAG 2.1 Level AA accessibility standards, and vendors must submit a completed VPAT 2.5 WCAG assessment with their proposals.
The service level agreement requirements establish that vendor support and maintenance commence upon contract effective date and extend through the full contract term with any extensions. The vendor must provide 24/7 system hosting availability except during scheduled maintenance windows, maintain unlimited phone and email technical support access during business hours (6:30 a.m. to 5:00 p.m. Monday through Friday ET), and apply critical patches immediately upon availability with high-vulnerability patches applied within 15 calendar days and all other patches within 60 calendar days. Quarterly reporting on service uptime, change requests, vulnerabilities, and incident metrics is required. Service credit formulas apply when uptime or time-based requirements are not met, calculated as (Total Contract Item Price/365) multiplied by the number of days the contract item was not provided. Liquidated damages of $260.00 per calendar day apply for failure to meet assigned milestones, and vendors may be liable for 120% of financial damages caused by security failures due to vendor fault. Two business days' notice must be provided to the State Project Manager prior to all system changes or updates.
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table B-2.2
| TECHNICAL REQUIREMENTS | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| PROHIBITED TECHNOLOGIES | |||||
| PT1 | No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf |
and
| No equipment or services on the FCC Covered List found here: https://www.fcc.gov/supplychain/coveredlist | M | ||
| PT2 | It is the Vendor’s responsibility to check for the parent company for any equipment, products or services. Visit SAM.gov to search for prohibited companies. | M | |
| SECURITY COMPLIANCE REQUIREMENTS | |||
| T1.1 | Comply with controls required by NIST Special Publication 800-171 R2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations to achieve the Baseline |
| SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/171/r3/final | M | |
| T1.2 | Comply With Moderate level controls as defined by NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations - BaseLine Plus |
| SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC (nist.gov) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final | E | ||
| STATERAMP AUTHORIZATION | |||
| T2.1 | StateRAMP Ready/Authorized Certification https://stateramp.org/ | E | |
| T2.2 | If StateRAMP Ready, you agree to attain StateRAMP Authorized within 12 months of the effective date of a resulting contract. | M | |
| T2.3 | If StateRAMP Active, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.4 | If StateRAMP In Process, you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract | M | |
| T2.5 | If StateRAMP Pending (Under review with StateRAMP PMO awaiting a determination for a verified status), you agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract or prior to contract renewal. | M | |
| T2.6 | If Not StateRAMP Progressing, Not StateRAMP Ready, or Not StateRAMP Authorized the vendor shall initiate and provide a StateRAMP Security Snapshot with their response. You agree to attain StateRAMP Authorized within 24 months of the effective date of a resulting contract. | M | |
| T2.7 | Continuous Monitoring – For any resulting award(s) and subsequent contract(s), the awarded contractor(s) will grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract. The State reserves the right to request and review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment. The contractor shall respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control. | M | |
| OTHER CERTIFICATION IN LIEU OF STATERAMP | |||
| T3.1 | FedRAMP Authorized https://www.fedramp.gov/ How to Become FedRAMP Authorized FedRAMP.gov | O | |
| T3.2 | HITRUST (HITRUST is common for Health Care related products and services.) HITRUST Alliance Information Risk Management and Compliance https://hitrustalliance.net/ | O | |
| HOSTED PLATFORM | |||
| T4.1 | The following Hosting Platforms are FedRAMP/StateRAMP Authorized and are pre-approved to host any SaaS or other Software Product. If your platform is included in the list below identify the platform in the Vendor Comments. |
• AWS US East/West
• AWS GOVCLOUD
• AZURE Commercial Cloud
• AZURE Government (Includes Dynamics 365)
• GOOGLE Services (Cloud Platform Products and Underlying Infrastructure)
• ORACLE Government Cloud – Common Controls
| • ORACLE Federal Managed Cloud Services | M | ||
| INDIVIDUAL AGENCY COMPLIANCE REQUIREMENTS (NOT APPLICABLE) | |||
| - | - | - | |
| INFORMATION TECHNOLOGY ACCESSIBILITYCCESIABILITY COMPLIANCE | |||
| T6.1 | Web content and mobile applications must comply with WCAG 2.1, (https://www.w3.org/TR/WCAG21/) Level AA. | M | |
| T6.2 | Hardware that transmits information or has a user interface, such as display screens, variable message signs, and kiosks, must comply with ICT Accessibility Standards and Guidelines (https://www.access-board.gov/ict/), Chapter 4: Hardware. | M | |
| T6.3 | Vendor shall complete the VPAT 2.5 WCAG (November 2023) (https://www.itic.org/dotAsset/9893d84b-efc7-460a-97ed-851477def5c4.docx) and submit with their proposal in Section III: Responses to Requirements and Deliverables ITI Accessibility Policy (https://www.itic.org/policy/accessibility/vpat) | M |
Table B-2.3
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| SERVICE LEVEL AGREEMENT (SLA) | |||||
| SLA-1 | The Vendor’s System support and maintenance shall commence upon the Effective Date and extend through the end of the Contract term, and any extensions thereof. | M | |||
| SLA-2 | The Vendor shall maintain the system monitoring in accordance with the specifications, terms, and requirements of the Contract, including providing upgrades and fixes as required. | M | |||
| SLA-3 | The Vendor shall repair or replace the hardware or software, or any portion thereof, so that the System operates in accordance with the Specifications, terms, and requirements of the Contract. | E | |||
| SLA-4 | All hardware and software components of the Vendor hosting infrastructure shall be fully supported by their respective manufacturers at all times. All critical patches for operating systems, databases, web services, etc., shall be applied immediately upon availability of the patch. Patches for high vulnerabilities shall be applied within fifteen (15) calendar days from vulnerability publication date. All other patches shall be applied within sixty (60) calendar days from vulnerability publication date. (RA-5) | M | |||
| SLA-5 | The State shall have unlimited access, via phone or email, to the Vendor technical support staff between the hours of 6:30am to 5:00pm- Monday through Friday ET. | M | |||
| SLA-6 | The critical networking and communication equipment issues and incidents for the several service levels are defined in Supplemental Appendix B-2.3.1 Incident Response. | M | |||
| SLA-7 | As part of the maintenance agreement, the Vendor shall commit to the timeline for critical networking and communication equipment issues and incidents for the several service levels in accordance with Supplemental Appendix B-2.3.1 Incident Response. | M | |||
| SLA-8 | The hosting server for the State shall be available twenty-four (24) hours a day, 7 days a week except for during scheduled maintenance. | M | |||
| SLA-9 | A regularly scheduled maintenance window shall be identified (such as weekly, monthly, or quarterly) at which time all relevant server patches and application upgrades shall be applied. | M | |||
| SLA-10 | If the Vendor is unable to meet the uptime requirement of SLA-8 or the time-based requirements under SLA-2, SLA-4, SLA-5, and SLA-7, the Vendor shall credit the State’s account in an amount based upon the following formula: | M |
(Total Contract Item Price/365) x Number of Days Contract Item Not Provided.
| The State must request this credit in writing. | ||
| SLA-11 | The Vendor shall use a change management policy for notification and tracking of change requests as well as critical outages. | M |
| SLA-12 | A critical outage will be designated when a business function cannot be met by a nonperforming application and there is no work around to the problem. | M |
| SLA-13 | The Vendor shall maintain a record of the activities related to repair or maintenance activities performed for the State and shall report quarterly on the following: | M |
| · Service up-time | ||
| · All change requests implemented, including operating system patches | ||
| · All Vulnerabilities reporting including corrective action plan | ||
| · All Incidents reported including actual issue and resolution | ||
| · Number of incidents reported by level with initial response time, service time, and resolution time. | ||
| SLA-14 | The Vendor will give two-business days prior notification to the State Project Manager of all changes/updates and provide the State with training due to the upgrades and changes. | M |
| SLA-15 | The Vendor shall make available to the State the latest program updates, general maintenance releases, selected functionality releases, patches, and Documentation that are generally offered to its customers, at no additional cost. | M |
| SLA-16 | For all maintenance Services calls, the Vendor shall ensure the following information will be collected and maintained: | M |
| 1. Nature of the Incident Response. | ||
| 2. Current Status of the Incident Response. | ||
| 3. Recommended Action plans, dates, and times. | ||
| 4. Expected and actual completion time. | ||
| 5. Incident resolution information. | ||
| 6. Resolved by. | ||
| 7. Identifying number i.e., work order number. | ||
| 8. Issue identified by. | ||
| 9. Development of After Action report. | ||
| SLA-17 | The Vendor must work with the State to identify and troubleshoot system failures, incidents and vulnerabilities by collecting the following information: | M |
| 1. Diagnosis of the root cause of the failure, incident, or vulnerability. | ||
| 2. Identification of repeat calls or repeat problems. | ||
| 3. Action item to minimize future repeats. |
SLA-18 The State may assign specific assignments, tasks, and milestones throughout the life of the Project. When assignments are established with documented tasks and milestones, the Vendor shall be required to complete the assignments and tasks within the agreed upon milestones. Failure to complete assignments and tasks within the agreed upon time is subject to supplemental liquidated damages in accordance with NHDOT Standard Specifications Section 108. For assignments and tasks associated with this project, supplemental liquidated damages shall be at the rate of $260.00 per calendar day, which amount the Vendor shall credit the State’s account. M
| The State must request this credit in writing for each failure to complete assignments and tasks or to meet agreed upon milestones. | ||
| SLA-19 | If the State determines that the Vendor is at fault for failure to meet SLA-2 or SLA-12 based on identified vulnerabilities and/or due to intrusions and exploits that result in damage (system damage, equipment damage and/or financial damage) to the State’s network, the Vendor shall be liable for the following: | M |
| 1. Correct/repair the damage and address the vulnerability, intrusion, or exploit at no additional cost to the State; AND |
| 2. The Vendor shall credit the State’s account in an amount equal to 120% of the financial cost or damage created by the failure. |
| The State must request this credit in writing. | ||
| SLA-20 | The State may assign specific tasks as part of this Project. For example: | M |
| 1. The Vendor shall work with the State to support the TSMO Bureau’s transition from a Layer 2 to a Layer 3 network. | ||
| 2. The Vendor shall support the integration of new traffic signal systems into the TSMO Bureau’s network. | ||
| 3. The Vendor shall support the Department’s integration of connected vehicle infrastructure (V2I/V2X). |
| Failure to complete tasks at the agreed upon milestones throughout the life of the Project is subject to supplemental liquidated damages as described in SLA-18. | ||
| SLA-21 | Failure to perform/submit/complete any other requirements of the Contract, including but not limited to System Requirements of Table B-2.1 and Deliverables from Table B-3, will be subject to supplemental liquidated damages as described in SLA-18. | M |
File details come from the government source that posted it. Updated .