Question # Created Date User Created Question Subject Question Answer

1 7/24/2026 David Edelstein/Dragontech LLC Correct Due Date The bid opening date on Commbuys is listed on 8/26, but the RFP states 8/19 as the proposal due date. Can you please confirm which one is accurate? Bid opening date is now 8/26 per Addendum 1

2 7/24/2026 David Edelstein/Dragontech LLC NDA The RFP (Section 3.5) states that we need to sign an NDA, which should be available on Commbuys, but I don't see a link to the NDA on the Commbuys listing. Can you please provide the NDA if necessary?

Non-Disclosure Agreement document has been added to attachments

3 7/29/2026 Heather Low/The Apex Technology Group, Inc. Equipment Manufacturers Can you provide a complete list of equipment manufacturers we can expect to be in-scope for this assessment? Cisco and Fortinet

4 7/29/2026 Heather Low/The Apex Technology Group, Inc. Remote Access Will remote access to infrastructure be provided, or will all discovery and assessment activities require staff to be on-site work? Yes

5 7/29/2026 Heather Low/The Apex Technology Group, Inc. Clarification of Section 4.3 Section 4.3 suggests remediation implementation, hardware replacement, and configuration changes while in production are to be included unless otherwise specified but cannot adequately scope these prior to the assessment being completed. Can you clarify the question, and if the cost of hardware/licensing and labor shall also be included, or will it remain as written?

MBTA will purchase needed equipment. Assistance in creating a BOM would be needed.

6 7/29/2026 Heather Low/The Apex Technology Group, Inc. Hardware Purchases Will hardware purchase also be put out to bid or will the winning bidder of the assessment provide any necessary hardware as part of this bid. Hardware is not part of this bid.

7 7/29/2026 Heather Low/The Apex Technology Group, Inc. Existing Issues Are there existing constraints, challenges, or network infrastructure issues the MBTA is hoping to address as part of this assessment directly? Reduce routing protocals and automate circuit failover capabilities.

8 7/29/2026 AJ St.Lawrence/PRESIDIO NETWORKED SOLUTIONS LLC Countersigned NDA Will MBTA execute a countersigned NDA prior to submission? We require signed NDA in order to release financials This should have been part of the RFP

9 7/30/2026 Patricia Lawton/RL Controls, LLC SOW Section 3.2, Deliverable 4.3 For SoW sections 3.2 and deliverable 4.3, is MBTA's intent that the supplier performs a Threat, Risk, and Vulnerability Analysis (TRVA), or a similar structured paper report, or is the assessment to be informed by penetration testing (PT) or similar tool inspection?

PT is covered under MBTA Security. Paper report.

10 7/30/2026 Patricia Lawton/RL Controls, LLC Contract Award If a supplier wins the contract, would that supplier be allowed to bid any subsequent network upgrades? Yes

11 7/30/2026 Jennifer Golden/NWN Corporation Section 4.3 Scope Contradiction Section 4.3 states: "The following are included unless otherwise specified: Network remediation implementation, Hardware replacement, Configuration changes while in production." This appears to conflict with the assessment-oriented framing of Sections 1-3. Please confirm whether these three items are included in or excluded from the base scope of this engagement. If included, please provide the expected volume/parameters (e.g., number of devices subject to configuration change, hardware categories subject to replacement) so proposers can price accurately.

Base scope is a network assessment. After the assessment a project plan to correct bottlenecks, routing issues, and reduce number of protocals would be phased in over a period of time. MBTA would execute recommended changes with providers guidance\assistance.

12 7/30/2026 Jennifer Golden/NWN Corporation Device Count Validation Can the MBTA confirm the approximate count of Layer 3 routing devices in scope (routers, L3 switches, and the 60 firewalls), and whether all 550+ switches are in scope for discovery/documentation or only those participating in Layer 3 routing?

All are in scope

13 7/30/2026 Jennifer Golden/NWN Corporation Site Access Expectations Of the 12 campuses, 46 branch locations, and 150 specialized stations, how many require physical site visits versus remote assessment? Are there locations where remote access (console, management network) is unavailable and on-site presence is mandatory?

Yes there is remote access. I do not think all 150 stations would need site visits.

14 7/30/2026 Jennifer Golden/NWN Corporation Connectivity and Failover Testing Will failover/redundancy testing (Section 3.3) be permitted on production infrastructure, and if so, only during defined maintenance windows? Are after-hours/weekend windows required, and how many test windows should proposers assume?

Only during defined off hours maintenance windows. 10pm-5am

15 7/30/2026 Jennifer Golden/NWN Corporation OT/Transit - Critical Exclusions Are any network segments explicitly out of scope - e.g., train control/signaling (OT), SCADA, fare collection (AFC), radio/PTC, or safety-critical systems? Is the PCI/DSS cardholder-data environment fully in scope for security assessment?

This assessment is focused on our ACE core network. SCADA is scheduled to move over to ACE at some point in near future. There is a small PCI component for network failover of the AFC system from one datacenter to another.

16 7/30/2026 Jennifer Golden/NWN Corporation Wi-Fi Scope Depth Section 1 references Wi-Fi coverage across bus bays, light rail facilities, and transit centers, and Section 3.1 references wireless topology documentation. Is wireless limited to topology documentation, or does the MBTA expect RF/WLAN performance and security assessment as well?

Yes RF/WLAN performance and recommendations for improvements would be required.

17 7/30/2026 Jennifer Golden/NWN Corporation Expected Period of Performance What is the MBTA's target start date and expected duration for the assessment? Is there a downstream deadline (e.g., capital planning cycle, audit response, or compliance milestone) that the deliverables must feed?

November 2026 start and the entire project with expected changes and project plan would extend into 2027. Capital funds are secured.

18 7/30/2026 Jennifer Golden/NWN Corporation Integrator of Record Is there a systems integrator, value-added reseller, or managed services provider currently under contract to operate or maintain the network environment described in this RFP (including the Fortinet SD-WAN deployment and the SolarWinds/Cisco management tooling)? If so, is that firm eligible to propose on this assessment?

All support is MBTA Network Team.

19 7/30/2026 Jennifer Golden/NWN Corporation Prior Assessments Has the MBTA conducted a prior network, routing, or security architecture assessment of this environment (internally or via a third party)? If so, will the resulting documentation be made available to the awarded vendor?

No

20 7/30/2026 Jennifer Golden/NWN Corporation Fortinet SD-WAN Deployment Status Is the Fortinet SD-WAN deployment complete, in progress, or in planning? Approximately how many sites are live on SD-WAN today, and what is the target end-state? In-Progress. Some configuration but not enterprise wide.

21 7/30/2026 Jennifer Golden/NWN Corporation Monitoring Tool Disposition For the management/monitoring tools assessment (SolarWinds, Cisco Catalyst Center, ISE, EPNM, Nexus Dashboard): is the MBTA seeking consolidation/rationalization recommendations, or validation of current-state deployment and configuration?

SolarWinds, Cisco DNA are primary tools. EPM (NCS monitoring)

22 7/30/2026 Jennifer Golden/NWN Corporation Access Method Will the awarded vendor receive read-only credentials to network devices and management platforms, or will data collection be performed by MBTA staff with vendor-provided collection scripts/tools? Are automated discovery tools permitted on the production network?

Read only creds or shoulder surfing with MBTA staff.

23 7/30/2026 Jennifer Golden/NWN Corporation Personnel Vetting Question What background check, badging, or security vetting requirements apply to vendor personnel - particularly for data center access and access to PCI/DSS-scoped and security-sensitive network documentation? Are CORI checks or TSA/DHS-related requirements applicable?

MBTA would not do a CORI check on the vendor. It is up to the vendors to vet out their respective staff.

24 7/30/2026 Jennifer Golden/NWN Corporation Data Handling What are the MBTA's requirements for handling, storing, and transmitting network topology data, configurations, and vulnerability findings (e.g., encryption standards, U.S.-based storage, destruction on contract close)? Will a specific NDA or security addendum apply?

FTP, Email, Sharepoint.

25 7/30/2026 Jennifer Golden/NWN Corporation Compliance Framework Alignment Should the assessment methodology and Risk & Remediation Matrix align to specific frameworks like NIST SP 800-53 Rev 5, CISA/TSA Security Directive 1582-21-01 vulnerability assessment requirements, PCI/DSS v4.x, or the Commonwealth's IS.010 Information Security Risk Management Standard? Will findings be mapped to a framework of the MBTA's choosing?

There is a fail over component of AFC that fails between 10PP and 45HS today. NIST framework would be followed.

26 7/30/2026 Jennifer Golden/NWN Corporation On-Site Work Rules Are there union, escort, or safety-certification requirements (e.g., ROW safety training) for vendor personnel working at stations, bus facilities, or light rail sites? No, all vendors would be accompanied by MBTA personnel and most sites are not directly on the row.

27 7/30/2026 Jennifer Golden/NWN Corporation Evaluation Criteria and Weighting Can the MBTA share the evaluation criteria and their relative weighting (technical approach, past performance, key personnel, price, DBE participation)? See pgs 23-25 of RFP, Supplier Diversity 25%, all other 15%

28 7/30/2026 Jennifer Golden/NWN Corporation Key Personnel Requirements Are there minimum certification requirements for proposed personnel (e.g., CCIE/CCNP, NSE/Fortinet certifications, CISSP, SolarWinds SCP)? CCIE and higher level architect certs would be expected from vendor personell

29 7/30/2026 Jennifer Golden/NWN Corporation Deliverable Format Does the MBTA require deliverables in specific formats/tools (e.g., Visio for topology diagrams, specific risk-matrix template), and who are the intended audiences for the executive summary (CIO/CISO, Board, capital planning)?

Visio, Excel, PDFs, Project planning tools

30 7/30/2026 Jennifer Golden/NWN Corporation Follow-On Work Will the awarded assessment vendor be eligible (or ineligible) to compete for subsequent remediation/implementation work arising from the assessment's recommendations?

Yes if put out to bid

31 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work For the Fortinet SD-WAN deployment strategy review and the DMZ environment review, would the MBTA like these delivered as design and strategy recommendations, or as a configuration-level technical assessment of the current deployment?

All three

32 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work Section 4 lists network remediation implementation, hardware replacement, and configuration changes while in production. Could the MBTA confirm whether these activities are intended to be part of this engagement, so bidders can scope accordingly?

This would be phase 3 of the plan. MBTA personell witll execute with Vendor assistance during changes\replacements.

33 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work Of the devices in the environment (3 data centers, 550+ switches, 60 firewalls, 12 campuses, 46 branches, 150 stations), approximately how many participate in Layer 3 routing and are in scope for the routing protocol assessment?

All

34 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work Which of the listed routing protocols (OSPF, EIGRP, IS-IS, BGP, MPLS, L2VPN/L3VPN, VXLAN) are currently deployed in production? All

35 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work Is the MPLS and L2VPN/L3VPN service delivered over MBTA-owned infrastructure, over the referenced Carrier Ethernet and SONET transport, or a combination? Combination

36 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Scope of Work For the management and monitoring tools review (SolarWinds, Cisco Catalyst Center, Cisco ISE, Cisco EPNM, Cisco Nexus Dashboard), would the MBTA like an evaluation of current use of each platform, recommendations on future-state tooling, or both?

SolarWinds, Cisco DNA are primary tools. EPM (NCS monitoring)

37 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access Will the selected Contractor have read-only access to device configurations, routing tables, and the monitoring platforms, or will the assessment be based primarily on interviews, provided documentation, and configuration exports?

Yes

38 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access Are current network topology diagrams, IP addressing schemes, and VLAN documentation available to share, or should bidders plan to develop these as part of discovery?

Yes

39 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access For the connectivity and failover testing, would the MBTA prefer testing remain passive and non-disruptive, or is there appetite for controlled active testing (for example synthetic traffic or scheduled failover tests) within approved windows?

Controlled active testing. 1am-5am

40 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access How much of the assessment does the MBTA expect to be performed remotely versus on-site, and which facilities would typically require a physical visit? 3 datacenters maybe a couple of main sites

41 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access For on-site work near transit infrastructure that triggers the ROW safety training in Section 8.1.18.2, what is the typical scheduling and lead time for that training? No ROW training needed. MBTA personell will accompany

42 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Environment and Access Are there maintenance windows, change-freeze periods, or operational blackout dates that discovery and testing should be planned around? Thanksgiving and Christmas. Discovery activities will not be impacted.

43 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Compliance and Security The environment includes PCI/DSS zones. Would the MBTA like the assessment to specifically address routing and segmentation as they relate to PCI scope boundaries?

PCI AFC failover would be included.

44 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Compliance and Security Regarding the Confidential Information referenced in Section 3.5, what does that package contain, and can it be made available (following the NDA) before the August 5 question deadline so it can inform scoping?

Yes

45 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Commercial and Pricing Is there a budget or budget range the MBTA would like bidders to design their level of effort against? CIP funding in place

46 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Evaluation and Logistics What overall engagement duration does the MBTA anticipate from the estimated November 2, 2026 start to final deliverable acceptance? 3 phases; assessment, recommendations\project plan, execute plan.

Expected over a 1 year period depending on outage windows.

47 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Evaluation and Logistics For the three required references, would references for comparable large-scale enterprise network and security assessments be acceptable, or does the MBTA prefer references specific to transit or routing assessments?

Large scale along with Transit would be a bonus

48 7/31/2026 Jessica Giglio/Tec-Refresh, Inc. Evaluation and Logistics For the virtual presentations the week of September 14, how much notice will shortlisted bidders receive, and what presentation format and duration should they plan for? 1 week notice, virtual format, 40 mins with 20 mins for questions

49 7/31/2026 Hayden Boule/Ockers Technologies Scope Clarification Section 4.3 of the Scope of Work ends with the statement: "The following are included unless otherwise specified: Network remediation implementation, Hardware replacement, Configuration changes while in production." Please clarify whether any implementation, configuration changes, or hardware work is within the scope of this assessment contract, or whether the engagement is strictly limited to discovery, analysis, recommendations, diagrams, and a risk/remediation matrix.

MBTA personnel will purchase and install all hardware. BOM assistance may be need from Vendor along with Config assistance.

50 7/31/2026 Hayden Boule/Ockers Technologies Assessment Scope Is the assessment limited strictly to Layer 3 routing (as emphasized in the Purpose and Objectives), or does it include Layer 2 aspects, wireless (Wi-Fi across bus bays, light rail, and transit centers), firewall policy review beyond routing participation, or broader security posture (e.g., Cisco ISE, PCI/DSS controls)?

End to end all layers.

51 7/31/2026 Hayden Boule/Ockers Technologies Fortinet SD-WAN Should the Fortinet SD-WAN deployment strategy review be limited to current-state assessment and recommendations, or does it include design validation or migration considerations?

All

52 7/31/2026 Hayden Boule/Ockers Technologies Transport Infrastructure Are SONET, Carrier Ethernet, and the MBTA fiber plant to be assessed only from a Layer 3 overlay perspective, or is transport-layer performance, redundancy, or capacity also in scope?

SONET is being phased out

53 7/31/2026 Hayden Boule/Ockers Technologies Layer 3 Device Inventory Can MBTA provide (post-NDA) a current inventory or high-level counts of Layer 3 devices (routers, L3 switches, firewalls participating in routing), broken down by platform/vendor and role (core, distribution, access, DMZ, SD-WAN)?

Yes, primary Cisco and Fortinet shop

54 7/31/2026 Hayden Boule/Ockers Technologies Vendor Breakdown What percentage of the environment is Cisco versus Fortinet or other vendors? Are there any known end-of-life or unsupported devices that should be prioritized? 90% Cisco, 10% Fortinet

55 7/31/2026 Hayden Boule/Ockers Technologies Routing Protocols Which routing protocols (OSPF, EIGRP, IS-IS, BGP, MPLS, L2VPN/L3VPN, VXLAN) are currently active and primary versus residual/legacy? All are active

56 7/31/2026 Hayden Boule/Ockers Technologies Site Scope Are the three data centers, 12 campuses, 46 branch locations, and approximately 150 stations all in active production use, and are there any sites or segments that are planned for decommissioning, major upgrade, or exclusion?

SONET is being phased out

57 7/31/2026 Hayden Boule/Ockers Technologies NDA Deliverables After execution of the NDA, what specific confidential materials will be provided (existing topology diagrams, IP addressing plans, VLAN schemes, full or sample device configurations, routing tables, monitoring tool exports from SolarWinds, Catalyst Center, Cisco ISE, Cisco EPNM, Nexus Dashboard, etc.)?

All can be provided

58 7/31/2026 Hayden Boule/Ockers Technologies Network Access What level of network access will be granted (read-only SNMP, SSH, API, management tool access, flow/telemetry data)? Will this be available remotely from the start of the engagement?

Read only creds or shoulder surfing with MBTA staff. SSH.

59 7/31/2026 Hayden Boule/Ockers Technologies On-Site Access Will physical/on-site access to data centers, campuses, or stations be required or available? If so, what is the expected process, lead time, escort requirements, and any restrictions (background checks, hours, safety training)?

Yes immediate

60 7/31/2026 Hayden Boule/Ockers Technologies Existing Documentation Are there existing "as-built" documentation or recent assessments that can be leveraged, or should the discovery phase assume starting from near-zero documentation? Yes\partial

61 7/31/2026 Hayden Boule/Ockers Technologies Testing Constraints What constraints exist on active testing (path verification, latency/packet-loss measurements, failover/redundancy tests) in the production environment? Are there maintenance windows, peak-hour restrictions, or a preference for passive analysis only?

1am-5am primary testing hours depending on impact\interruption

62 7/31/2026 Hayden Boule/Ockers Technologies Failover Testing For failover and high-availability testing, is controlled disruption of non-critical links acceptable, or must all testing be non-disruptive? Planned disruptive testing

63 7/31/2026 Hayden Boule/Ockers Technologies Internet Connectivity Testing For the Internet connectivity assessment, from which vantage points (data centers, campuses, stations) and to what destinations should testing be performed? All

64 7/31/2026 Hayden Boule/Ockers Technologies Required Tools & Standards Are there preferred tools, methods, or MBTA standards that must be used (or avoided) for discovery, performance measurement, or diagramming? Would not use SolarWinds network scan due to triggered vulnerability alerts.

65 7/31/2026 Hayden Boule/Ockers Technologies Project Schedule Is there a preferred or maximum duration for the overall assessment, or any hard intermediate milestones (e.g., core/data-center assessment first, followed by campuses/stations)?

ASAP but total implmentation of changes\recommendation expect a year.

66 7/31/2026 Hayden Boule/Ockers Technologies Topology Diagram Requirements For the logical Layer 3 topology diagrams, what level of detail is expected (device-by-device versus site/aggregated, inclusion of wireless controllers or SD-WAN edges, preferred format such as Microsoft Visio, Lucidchart, or other)?

Visio is preffered and as detailed as possible for topology

67 7/31/2026 Hayden Boule/Ockers Technologies Risk Matrix Expectations Should the Risk and Remediation Matrix and recommendations include rough order-of-magnitude cost or effort estimates, or remain purely technical? Technical

68 7/31/2026 Hayden Boule/Ockers Technologies Concurrent Projects Are there any concurrent network projects, migrations, or known issues that the assessment team should coordinate around or prioritize? 45HS core network refresh, 10PP core refresh, General EOL refresh

69 7/31/2026 Hayden Boule/Ockers Technologies Personnel Requirements What are the background-check, badging, or security-clearance requirements for contractor personnel who will access systems or sites? Read only access will be provided. MBTA personnel to escort vendor to sites.

70 7/31/2026 Hayden Boule/Ockers Technologies Remote vs. On-Site Work Is remote work the expected primary model, or is a significant on-site presence anticipated? If on-site work is expected, at which locations? Most can be remote with a few sites visits

71 7/31/2026 Hayden Boule/Ockers Technologies Technical Point of Contact Will MBTA provide a single technical point of contact or network engineering liaison for the duration of the engagement, and will structured interviews with stakeholders (IT, Transit Operations, Security, PCI teams, etc.) be facilitated?

There will be MBTA point contacts from the Network Team. Ops and other teams would be notified during changes and off hours testing

72 7/31/2026 Hayden Boule/Ockers Technologies Price Response Format Can MBTA confirm whether the Price Response should treat the six "Specify Task" rows as mapping to the major Scope of Work activities (Network Discovery, Routing Protocol Assessment, Connectivity Testing, Performance Assessment, Report & Diagrams, Risk Matrix), or is a different task breakdown preferred?

Network Discovery, Protocol Assessment, Connectivity, Performance, Diagrams, and Risk Matrix is wanted

73 7/31/2026 Hayden Boule/Ockers Technologies Travel & Expenses Are travel, lodging, and other reimbursable expenses expected to be included in the not-to-exceed price, or will they be handled separately? Travel should be included in the bid

74 7/31/2026 Hayden Boule/Ockers Technologies Budget Expectations Has funding for this project been fully allocated, and if so, is MBTA able to share whether there is an anticipated budget range or not-to-exceed amount for this engagement?

CIP funding in place, this information is not being shared.

75 7/31/2026 Bob Spencer/Zones, Inc State contract Is this procurement being released under any state contract (e.g. ITS75, ITS86, etc)? No

76 7/31/2026 Bob Spencer/Zones, Inc Firewall Scope Clarification Does the assessment include detailed firewall policy/rule review and optimization, or are firewalls only being evaluated as part of the routing and network architecture assessment?

Yes any changes would require policy review

77 7/31/2026 Bob Spencer/Zones, Inc Routing Issues Can MBTA provide additional details regarding the primary routing, failover, performance, resiliency, or stability issues they are seeking to address through this assessment?

Failover for AFC from 10PP and 45HS is not automated. Fail over from ACE to a backup IPSEC tunnel also is not automated and needs manual intervention. Stability and automation of failover is an area that is included in the assessment or should be.

78 7/31/2026 Bob Spencer/Zones, Inc Operational Technology (OT) Network Scope Does the assessment scope include Operational Technology (OT) networks supporting transit operations, or is the assessment limited to the enterprise IT network? If OT is included, please identify the expected assessment boundaries.

All

79 7/31/2026 Bob Spencer/Zones, Inc Network Infrastructure Inventory Can MBTA provide a high-level inventory of network infrastructure included in scope, including manufacturers and major platform families (e.g., Cisco, Juniper, Nokia, Fortinet, etc.) for routers, switches, firewalls, wireless infrastructure, and WAN technologies

Yes

80 7/31/2026 Bob Spencer/Zones, Inc Assessment Access Method How will the selected vendor be provided access to the environment during the assessment? Will access be provided through direct device access, customer-led sessions, exported configurations, documentation repositories, or another method?

All

81 7/31/2026 Bob Spencer/Zones, Inc Routing Technologies Can the MBTA please provide additional details regarding the primary routing protocols currently deployed across the environment (e.g., OSPF, BGP, EIGRP, IS-IS, or other protocols)?

All are active

82 7/31/2026 Bob Spencer/Zones, Inc Network diagram(s) Can MBTA provide high level current network diagrams/documentation please? Yes once uder a NDA

83 7/31/2026 Bob Spencer/Zones, Inc Routing technologies Rephrased for above question so please ignore that one. Can MBTA provide any current-state network documentation, including high-level network diagrams, routing architecture diagrams, topology diagrams, and infrastructure inventories? Additionally, please identify the primary routing protocols currently deployed within the environment (e.g., OSPF, BGP, EIGRP, IS-IS, or other protocols).

Yes

84 8/4/2026 Peter Flynn/New Era Technology NE General & Program-Level Clarifications 1. Can MBTA provide a current high-level network diagram encompassing the three data centers, 12 campuses, and distributed branch/station environments described in the RFP?

Yes

85 8/4/2026 Peter Flynn/New Era Technology NE General & Program-Level Clarifications 2. Are there known network performance issues, incidents, or business drivers that initiated this assessment? Yes automated fail over issues, routing protocols.

86 8/4/2026 Peter Flynn/New Era Technology NE General & Program-Level Clarifications 3. What key success criteria, KPIs, or measurable outcomes will define a successful engagement? KPIs, Recommendation and Implementations

87 8/4/2026 Peter Flynn/New Era Technology NE General & Program-Level Clarifications 4. Are there preferred technology standards or vendor platforms that recommendations should align with? Cisco and Fortinet

88 8/4/2026 Peter Flynn/New Era Technology NE 2. General & Program-Level Clarifications Can we get access to MBTA CMDB Management tools to assist with this assessment? No

89 8/4/2026 Peter Flynn/New Era Technology NE Network Discovery & Inventory 5. Will MBTA provide existing asset inventories for the network infrastructure consisting of approximately 550 switches and 60 firewalls? Yes

90 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 6. Are standardized IP addressing schemes, VLAN structures, and naming conventions currently documented? Yes

91 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 7. What level of access will be granted to network devices (CLI/API) and monitoring platforms during the assessment? CLI read only

92 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 8. Will access be provided to existing management and monitoring tools such as SolarWinds, Cisco Catalyst Center, Cisco ISE, Cisco EPNM, and Cisco Nexus Dashboard?

Yes or shoulder surf

93 8/4/2026 Peter Flynn/New Era Technology NE Network Discovery & Inventory 9. Are there any third-party managed environments or restricted network segments that should be excluded from discovery activities? No but segments out of scope are firewalled

94 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 10. Which routing protocols listed in scope (e.g., OSPF, BGP, EIGRP, IS-IS, MPLS, VXLAN) are actively in use versus legacy or partially deployed? All

95 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 11. Are there documented routing design standards, policies, or governance frameworks currently in place? Yes partial

96 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 12. Is there a defined target-state architecture (e.g., SD-WAN, VXLAN overlays, segmentation strategy) that should guide recommendations? On-going

97 8/4/2026 Peter Flynn/New Era Technology NE Routing Architecture & Protocols 13. How is routing segmentation currently enforced across corporate, transit, and PCI/DSS environments? PCI, IT, OT

98 8/4/2026 Peter Flynn/New Era Technology NE Connectivity & WAN Environment 14. Can MBTA provide details regarding WAN connectivity, including service providers, circuit types, and SLA expectations? Yes, Crown Castl, Verizon, Comcast, Lumen, 99 8/4/2026 Peter Flynn/New Era Technology NE Performance & Capacity Assessment 17. What tools are currently used for monitoring bandwidth utilization, CPU, and memory across routing infrastructure? SolarWinds and Cisco DNA

100 8/4/2026 Peter Flynn/New Era Technology NE Performance & Capacity Assessment 18. Are there defined performance thresholds, alerting standards, or capacity planning processes in place? No, we want to establish

101 8/4/2026 Peter Flynn/New Era Technology NE Performance & Capacity Assessment 19. Have there been recent performance-related incidents or capacity constraints that should be prioritized during assessment? No

102 8/4/2026 Peter Flynn/New Era Technology NE Security & Compliance 20. Are existing security assessments, vulnerability scans, or audit reports available for review? Yes

103 8/4/2026 Peter Flynn/New Era Technology NE Security & Compliance 21. What compliance requirements must be maintained (e.g., PCI/DSS as referenced in the RFP)? PCI

104 8/4/2026 Peter Flynn/New Era Technology NE Security & Compliance 22. How is segmentation enforced across sensitive environments (e.g., firewalls, VRFs, policy-based controls)? Firewalls, VRFs, and policy based

105 8/4/2026 Peter Flynn/New Era Technology NE Security & Compliance 23. Are there known security gaps, misconfigurations, or audit findings that should be prioritized? No

106 8/4/2026 Peter Flynn/New Era Technology NE Monitoring & Tooling 24. Which monitoring platforms are considered authoritative sources for network health and performance? SolarWinds, Cisco DNA are primary tools. EPM (NCS monitoring)

107 8/4/2026 Peter Flynn/New Era Technology NE Monitoring & Tooling 25. Are there known gaps in visibility, alerting, or reporting capabilities within the current toolset? No not aware

108 8/4/2026 Peter Flynn/New Era Technology NE Monitoring & Tooling Is MBTA open to recommendations involving tool consolidation or modernization? Yes but it would need to be part of project plan and show real value

109 8/4/2026 Peter Flynn/New Era Technology NE Deliverables & Reporting Expectations 27. What level of detail is expected for network topology diagrams (logical vs. physical representation)? Both detailed

110 8/4/2026 Peter Flynn/New Era Technology NE Deliverables & Reporting Expectations 28. Are there preferred formats or standards for the risk and remediation matrix deliverable? Vision, Excel, pdfs, etc..

111 8/4/2026 Peter Flynn/New Era Technology NE Deliverables & Reporting Expectations 29. Who are the primary stakeholders responsible for the review and acceptance of deliverables? Network Team

112 8/4/2026 Peter Flynn/New Era Technology NE Deliverables & Reporting Expectations Is an executive-level presentation or readout session expected as part of the engagement? Yes a high lever presentation for CIO and Senior Director(s)

113 8/4/2026 Peter Flynn/New Era Technology NE Scope Boundaries & Optional Services 31. The RFP indicates exclusions such as remediation implementation, hardware replacement, and production configuration changes. MBTA personnel will purchase and install all hardware. BOM assistance may be need from Vendor along with Config assistance.

114 8/4/2026 Peter Flynn/New Era Technology NE Scope Boundaries & Optional Services Should the proposal include optional pricing for these remediation implementation, hardware replacement, and production configuration changes services? MBTA personnel will purchase and install all hardware. BOM assistance may be need from Vendor along with Config assistance.

115 8/4/2026 Peter Flynn/New Era Technology NE Scope Boundaries & Optional Services 32. Are there change control procedures or maintenance window restrictions that may impact assessment activities? Not assement but implementation

116 8/4/2026 Peter Flynn/New Era Technology NE Scope Boundaries & Optional Services Will production environment reviews require approvals, supervision, or escorted access? Yes

117 8/4/2026 Peter Flynn/New Era Technology NE Timeline & Engagement Logistics What is the anticipated project timeline, including start date and key milestones? 1 year total

118 8/4/2026 Peter Flynn/New Era Technology NE Timeline & Engagement Logistics Are on-site engagements required, or can assessment activities be conducted remotely? Most can be remote with a few sites visits

119 8/4/2026 Peter Flynn/New Era Technology NE Timeline & Engagement Logistics Will MBTA assign subject matter experts (SMEs) for routing, security, and WAN domains? Yes

120 8/4/2026 Peter Flynn/New Era Technology NE Strategic Direction & Future-State Considerations

37. Is MBTA currently evaluating or planning initiatives such as SD-WAN expansion, cloud networking integration, or Zero Trust architecture? SD-WAN expansion, cloud networking integration

121 8/4/2026 Peter Flynn/New Era Technology NE Strategic Direction & Future-State Considerations

38. Should recommendations include high-level budgetary estimates (ROM) for modernization initiatives? If it is for budget purposes yes

122 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Total number of sites currently connected via fiber? All

123 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory High-level network topology (ring, hub-and-spoke, mesh, etc Hub-and-spoke across a\b fiber rings

124 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Identification of primary and backup paths between locations? Yes

125 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Fiber type (Single-mode / Multi-mode)? Both between sites single, in site multi

126 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Strand count per run? Varies

127 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Cable type (e.g., OS1, OS2, OM3, OM4, etc.)? All of them

128 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Installation type (aerial, underground, conduit, direct burial Fiber network is aerial, underground, conduit

129 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Patch panel and termination details per site Newer sites we have that information most older sites we do not.

130 8/4/2026 Peter Flynn/New Era Technology NE Cabling & Inventory Connector types (LC, SC, etc.) LC

131 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, General Scope Is cloud-based routing and connectivity included in the scope of this assessment, or only terrestrial/on-prem network devices? Yes cloud based is included

132 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, General Scope To conduct the network assessment, will the selected vendor be given read-only access to all network devices at all locations, and access to MBTA network management and monitoring tools?

Read only access will be provided. MBTA personnel to escort vendor to sites.

133 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 2: Objectives Is a detailed firewall policy review, or the requirement for an external or internal penetration testing, included in the "Identify security vulnerabilities and misconfigurations? Yes

134 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 2: Objectives If a detailed firewall policy review is in scope, approximately how many firewall rules are included in the MBTA rulebase? This is part of the Network Discovery

135 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 3.1: Document Network Topology

Since wireless topology is indicated as within scope, is the expectation of the MBTA that the selected vendor will conduct an onsite wireless survey for purposes of Access Point placement and coverage mapping?

No

136 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 3.1: Identify All Layer 3 Devices

Will the selected vendor be provided access to the management subnet to assess and collect NDP, LLDP, CDP, SNMP? Yes read only

137 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 3.3: Connectivity Testing Are failover tests expected to be performed and supported by MBTA during the project, or is the failover assessment outlined in section 3.3 purely a configuration assessment?

Yes failover tests expected

138 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 4.3: Deliverables, Risk & Remediation Matrix

Will you please elaborate on the "Network remediation implementation" item. Does this inclusion mean that the MBTA is expecting agreed-upon remediation recommendations should be implemented/executed as part of this project, or is this item simply the detailed documentation of remediation recommendations?

Yes it would be executed in last phase over a period of time when outages windows are available

139 8/5/2026 Jeff Flanagan/Markley Boston, LLC Appendix A, Section 4.3: Deliverables, Risk & Remediation Matrix

Overall RFP scope indicates discovery and documentation, and does NOT indicate operational adjustments. Please elaborate on the "Configuration changes while in production" line item.

No config changes while in produciton. All changes executed during assigned outage windows.

140 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.1 - Network Discovery * Firewalls participating in routing:

Will you please clarify which firewalls are participating in routing and are included in the assessment? All firewalls would be included. Routing mainly pertains to Datacenters.

141 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC * DMZ Environment: Please expand on the DMZ assessment requirements. What specific information or configurations are expected to be captured and evaluated? There is a limited DMZ presence

142 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC * SD-WAN Deployment: Please clarify the scope of the SD-WAN assessment. Is the SD-WAN environment managed by FortiManager? Yes it managed by FortiManager

143 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Layer 3 Devices The RFP references routers, but the environment description only identifies switches and firewalls. Please provide the number of routers in scope. and if dedicated routers are not present, are any switches functioning as Layer 3 or edge routers?

All Layer 3 devices are in scope.

144 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Management and Monitoring Tools Assessment Please expand on the scope of this task. Specifically, does the assessment include: - Evaluation of platform software and firmware versions? - Review of high availability (HA) configuration and operational status? - Assessment of the overall health of the platform, including alarms, alerts, and system events? - Evaluation of how management and monitoring tools are being utilized, including recommendations for optimization or tool rationalization?

We're open to consider recommendations.

145 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3. Connectivity Testing Will connectivity testing be performed at all locations or only a representative sample? Only at selected or critical locations.

146 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3 - Connectivity Testing Will you please provide the total number of locations included in the testing scope? All MBTA locations are in scope. No limited to the currently listed number of sites (467).

147 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3 - Connectivity Testing Will testing be conducted during normal business hours or during a maintenance window? Please provide the anticipated testing schedule and timeframes. No producting affecting service will be done during business hours.

148 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3 - Connectivity Testing For failover and redundancy testing, will you please identify the platforms and devices included (e.g., firewalls, routers, switches, SD-WAN appliances, Internet circuits)? No producting affecting service will be done during business hours.

149 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3 - Connectivity Testing For the Internet connectivity assessment, how many Internet egress points are included in the scope? All of them

150 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC Section 3.3 - Connectivity Testing For path verification, will the selected bidder be permitted to deploy hardware or software tools to collect additional path and performance data? Yes, after NDA and if the devices are non-intrusive.

151 8/5/2026 Dan Buckley/PRESIDIO NETWORKED SOLUTIONS LLC General Assessment Question Will the selected bidder be permitted to install temporary hardware or software appliances within the MBTA network to support discovery, auditing, and data collection activities?

Yes, after NDA and if the devices are non-intrusive.

152 8/5/2026 David Edelstein/Dragontech LLC Project Drivers and Business Objectives What are the primary business drivers for conducting this assessment at this time? Are there known pain points, performance issues, end-of-life hardware, or other factors motivating the project?

Yes automated fail over issues, routing protocols, 153 8/5/2026 David Edelstein/Dragontech LLC Scope Clarification - Assessment vs.

Implementation

The Scope of Work appears to describe an assessment-only engagement; however, the final bullets (SOW 4.3) indicate activities such as network remediation implementation, hardware replacement, and production configuration changes. Please clarify whether any implementation services are within the scope of this procurement.

Yes, implementation services, guidance and recommendations are within the scope of this procurement.

154 8/5/2026 David Edelstein/Dragontech LLC Existing Network Architecture Can the MBTA provide an overview of the existing network architecture, including: 1. High-level overview of the current network architecture 2. Inventory of the existing network infrastructure 3. Existing network management, monitoring, and automation tools 4. Currently deployed networking and security vendors

Yes

155 8/5/2026 David Edelstein/Dragontech LLC Existing Documentation Will existing network documentation, diagrams, IP addressing documentation, and topology information be made available to the selected contractor? If so, is that documentation complete, accurate, and up-to-date?

Yes after NDA

156 8/5/2026 David Edelstein/Dragontech LLC Existing Discovery and Mapping Tools Are any automated network discovery or mapping tools currently deployed (e.g., NetBrain, Auvik, or similar)? No

157 8/5/2026 David Edelstein/Dragontech LLC Management Tool Assessment Scope Section 3.1 references SolarWinds, Cisco Catalyst Center, Cisco ISE, Cisco EPNM, and Cisco Nexus Dashboard. Are these products currently deployed and to be assessed, or are they being considered as potential future management platforms?

They are deployed and in used. Assessment or improvement recomendations are welcome.

158 8/5/2026 David Edelstein/Dragontech LLC Onsite vs. Remote Work Expectations Is there a requirement that any portion of the assessment work be performed on-site? Yes

159 8/5/2026 David Edelstein/Dragontech LLC Remote Access Can vendors assume that the MBTA will provide secure remote access to all systems, devices, and management platforms necessary to perform the assessment? Yes after NDA

160 8/5/2026 David Edelstein/Dragontech LLC MBTA Personnel Support During Discovery Should bidders assume that MBTA personnel will be available to assist with low-level discovery activities, such as providing device configurations, exporting information from management platforms, and gathering existing documentation? Or should bidders assume they are responsible for performing all discovery activities using their own labor?

Yes MBTA personnel will assist

161 8/5/2026 David Edelstein/Dragontech LLC Network Scanning Authorization Will active network scanning and discovery tools be permitted as part of the assessment? If so, are there any restrictions regarding tools, maintenance windows, or production environments?

Yes after NDA

162 8/5/2026 David Edelstein/Dragontech LLC Connectivity Testing Expectations The Scope of Work includes end-to-end Layer 3 connectivity testing, path verification, WAN validation, failover testing, and Internet connectivity assessment. Given the size of the environment, there could be a very large number of possible source/destination paths to validate. Can the MBTA clarify whether it expects comprehensive testing of all connectivity paths or representative testing of critical routes and services? If representative testing is expected, will the MBTA identify the critical traffic flows to be validated?

Yes after NDA

163 8/5/2026 David Edelstein/Dragontech LLC Latency and Packet Loss Testing Scope Can the MBTA clarify its expectations for the latency and packet loss testing? Is the intent to measure existing network performance (e.g., baseline latency and packet loss across representative paths), or is the selected contractor expected to perform impairment testing by introducing latency, packet loss, or other network degradations to evaluate application and routing behavior under adverse conditions?

The MBTA expects latency and packet loss testing and reports on the existing environment.

164 8/5/2026 David Edelstein/Dragontech LLC Performance Assessment Data Sources For the performance assessment activities, are there existing monitoring platforms that provide historical utilization, CPU, memory, interface, and performance data that the selected contractor can leverage?

Yes after NDA

165 8/5/2026 David Edelstein/Dragontech LLC Existing End-of-Life Infrastructure Can the MBTA identify any networking or security hardware that is currently end-of-life or approaching end-of-support? Yes there is an ongoing project

166 8/5/2026 David Edelstein/Dragontech LLC Pricing Form - Team Size The Pricing Response form includes four proposed team members. Is this intended as a specifically required maximum team size, or may bidders add or remove columns to propose a different team size if appropriate?

Yes

167 8/5/2026 David Edelstein/Dragontech LLC Pricing Form - Additional Rows The Pricing Response form includes six rows for proposed tasks. May bidders add additional rows to the Pricing Response form if additional tasks are necessary to accurately reflect the proposed approach?

Yes

168 8/5/2026 David Edelstein/Dragontech LLC Firewall Rule Base Size The Scope of Work references approximately 60 firewalls. Approximately how many firewall rules, NAT policies, and VPN peer configurations exist across the environment?

Part of the Network Discovery Process

169 8/5/2026 David Edelstein/Dragontech LLC Proposed Resource Identification Must bidders identify every individual who may participate in the project, including junior engineers and supporting personnel, or is it sufficient to identify only key personnel and project leadership?

Please identify all individuals participating in the project.

170 8/5/2026 David Edelstein/Dragontech LLC Project Schedule Expectations Does the MBTA have a preferred project start date, assessment duration, or desired completion timeline beyond the estimated contract award and service start dates? To be determined after the bid is awarded.

171 8/5/2026 David Edelstein/Dragontech LLC Power of Attorney Requirement If the proposal is signed by a corporate officer who has authority to bind the company, is a separate Power of Attorney still required? Are there specific requirements for this document?

The Bidder shall submit a duly executed and notarized Power of Attorney in its own form, signed by a legally authorized officer, authorizing the Authorized Signatories to sign the Bid Response and bind the Bidder to the terms of the Response.

172 8/5/2026 David Edelstein/Dragontech LLC Proof of Insurance Requirement Section 3.19…