dot-attachment5---appendix-b-2.3.1-incident-response.pdf
PDF 377 KB Posted
- Solicitation number
- RFP DOT Managed Security Service Provider (MSSP) #2025-067
- Issued by
- New Hampshire
About this file
This is an Incident Response appendix document supporting the New Hampshire Department of Transportation's (NHDOT) Request for Proposal for managed security services and field service support. The document outlines the incident response procedures and protocols that the selected Managed Security Service Provider (MSSP) vendor must implement and follow to support NHDOT's Traffic Systems Management Office (TSMO) Bureau and Traffic Management Center (TMC) operations. The appendix establishes the framework for how the MSSP vendor will detect, respond to, and manage cybersecurity incidents affecting NHDOT's critical Intelligent Transportation Systems (ITS) infrastructure and devices, ensuring alignment with state and federal security requirements and maintaining operational resilience.
The incident response procedures detailed in this appendix specify the vendor's responsibilities for incident classification, escalation protocols, notification timelines, documentation requirements, and coordination with NHDOT and state authorities during security events. The vendor must maintain incident logs, conduct post-incident analysis, and implement corrective actions to prevent future occurrences. These requirements ensure that the MSSP vendor's incident response capabilities are integrated with NHDOT's existing cybersecurity framework and meet federal standards for protecting critical infrastructure, while supporting the current NHDoIT team's oversight of the TSMO Bureau's security posture.
View the file
Other files
Show all 23
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
STATE OF NEW HAMPSHIRE
DEPARTMENT OF TRANSPORTATION
RFP DoIT 2025-067 – Managed Security Service Provider (MSSP)
APPENDIX B SUPPLEMENTAL
Appendix B-2.3.1
INCIDENT RESPONSE
1. Summary
The purpose of this Appendix is to establish the MSSP’s structured approach to handling cybersecurity incidents affec�ng the NHDOT ITS network and field systems. It defines incident categories, response expecta�ons, communica�on protocols, and resolu�on standards in alignment with NHDOT’s opera�onal priori�es and SLA-6. The MSSP will coordinate closely with NH DoIT and
TSMO Bureau staff to ensure immediate isola�on, inves�ga�on, and recovery of services while maintaining clear documenta�on and preserving forensic evidence.
2. Incident Response Process
To ensure a clear and consistent approach to cybersecurity events affec�ng NHDOT’s Intelligent
Transporta�on Systems (ITS) infrastructure, the State has developed an Incident Response Workflow.
This diagram illustrates the communica�on flow, response levels, and escala�on procedures that the selected Vendor will be expected to follow in coordina�on with the NHDOT Transporta�on
Management Center (TMC) and NHDoIT.
The workflow establishes response �me requirements based on incident severity, ranging from a single device outage to a statewide disrup�on, and includes procedures for remote troubleshoo�ng, site response, repor�ng, and escala�on. The Incident Response Workflow diagram serves as a reference model and baseline expecta�on for vendor response and escala�on protocols.
Vendors are expected to demonstrate in their proposals how their incident response processes, resources, and capabili�es will align with this workflow. Where appropriate, vendors may also propose enhancements or addi�onal steps that improve �meliness, coordina�on, and effec�veness while remaining consistent with NHDOT’s opera�onal needs.
3. Types of Incidents
All cybersecurity events affec�ng the NHDOT ITS environment are classified in the following three categories:
3.1. Cri.cal Incident: Any event causing or with poten�al to cause immediate disrup�on of statewide ITS opera�ons, compromise of safety-cri�cal systems, immediate loss of opera�onal awareness during a transporta�on incident (i.e., communica�ons failure for ITS equipment monitoring a highway crash or police incident) or loss of sensi�ve data.
3.2. High Priority alert: Security events with significant but not catastrophic impact, such as targeted malware detected on a field network segment, unauthorized VPN access a7empt, or intrusion into non-cri�cal ITS systems.
3.3. Rou.ne issues: Lower-severity incidents including (but not limited to) misconfigura�ons, failed patches, minor anomalies flagged by monitoring systems, or isolated false posi�ves.
4. Response .me to Incidents
The MSSP's system must differen�ate between troubleshoo�ng and repair phases, with the repair clock star�ng once NHDOT provides approval for the proposed solu�on.
4.1. Ini.al Response .me: Time to acknowledge and ini�ate incident handling.
4.2. Service Response .me: Time to provide recommended ac�on(s) and troubleshoo�ng of the incident.
4.3. Resolu.on .me: Time it takes to resolve the incident.
The Proposed Solu�on shall have systems in place to track and ensure a troubleshoo�ng response
�me in accordance with the table below:
Incident Type Ini.al Response
Time
Service Response
Time Resolu.on Time
Cri.cal Incident <10 minutes <15 minutes <4 hours
High Priority Alert <30 minutes <1 hour <1 business day
Rou.ne Issues <8 business hours <15 business hours <3 business days
The response clock begins when the issue is flagged (either by MSSP monitoring or NHDOT TMC).
The response �mes (Ini�al and Service) are not cumula�ve; the total �me from incident iden�fica�on to the development of an ac�on plan is equal to the Service Response Time. The response clock stops when the MSSP Vendor proposes a solu�on to NHDOT.
The resolu�on �me begins when the MSSP Vendor receives authoriza�on for the recommended ac�on and ends when the incident has been resolved.
File details come from the government source that posted it. Updated .