RFP DOS 2026-06.pdf

Template V7.0 – 02/2025

STATE OF NEW HAMPSHIRE

Department of Safey Division of Emergency Services and Communications

DOS-RFP-2026-06 NHICNet Managed Security Protection

RFP ISSUED 9/9/2025

VENDOR CONFERENCE 9/24/2025 9:00 AM ET

LOCATION 110 Smokey Bear Blvd Concord, NH STATE AGENCY POINT OF CONTACT NAME: Robert M. Lussier, Assistant Director

EMAIL: Robert.M.Lussier@desc.nh.gov

TEL: 603-271-6911

CONTRACT TYPE Firm Fixed Price

PROPOSAL DUE DATE 10/22/2025 2:00 PM ET

mailto:Robert.M.Lussier@desc.nh.gov

STATE OF NEW HAMPSHIRE

Department of Safey Division of Emergency Services and Communications

RFP-DOS-2026-06 - NHICNet Managed Security Protection

TABLE OF CONTENTS

Table of Contents

SECTION 1: OVERVIEW AND SCHEDULE OF EVENTS

SECTION 2: PROPOSAL SUBMISSION, DEADLINE, AND LOCATION INSTRUCTIONS

SECTION 3: PROPOSAL ORGANIZATION, CONTENT, AND REQUIRED ITEMS

SECTION 4: EVALUATION OF PROPOSALS

SECTION 5: TERMS AND CONDITIONS RELATED TO THE RFP PROCESS

SECTION 6: CONTRACT TERMS AND AWARD

APPENDIX A: VENDOR CONFERENCE REQUIREMENTS

APPENDIX B: BUSINESS/TECHNICAL REQUIREMENTS AND DELIVERABLES

APPENDIX C: TOPICS FOR MANDATORY RESPONSES

APPENDIX D: STANDARDS FOR DESCRIBING VENDOR QUALIFICATIONS

APPENDIX E: PRICING

APPENDIX F: DOIT INFRASTRUCTURE AND SECURITY

APPENDIX G: MERCHANT CARD SERVICES

APPENDIX H: TERMS AND DEFINITIONS

APPENDIX I: P-37 STATE OF NEW HAMPSHIRE GENERAL PROVISIONS AND EXHIBITS

Remainder of this page intentionally left blank

Division of Emergency Services and Communications DOS-RFP-2026-06 - NHICNet Managed Security Protection

SECTION 1: OVERVIEW AND SCHEDULE OF EVENTS

1. Executive Summary

Introduction

The State of New Hampshire, through the Division of Emergency Services and Communications (DESC), is issuing this Request for Proposal (RFP) to provide a Managed Security Protection Solution across the entire LMR and Microwave public safety communications network.

Additionally, DESC seeks assistance in the design and implementation of the solution into the newly designed network, NHICnet.

NHICnet serves as the vital wireless communications backbone for state, county, regional, and local public safety agencies 24/7/365 across New Hampshire. Given the interconnected nature of these networks, a unified and robust cybersecurity monitoring solution is paramount to ensure the integrity, availability, and confidentiality of critical public safety communications and data.

This upgrade will enhance network reliability and security, ensuring continued support for emergency services across New Hampshire.

The vendor solution must deliver a comprehensive, multi-layered cybersecurity service that supports passive telemetry collection from Cisco Catalyst switches, FirePower Firewalls and Identity Services Engine. Key capabilities include threat detection, behavioral analytics, configuration drift monitoring, and coordinated incident response involving DESC IT. The provider must offer U.S.-based SOC operations with defined SLAs, align with NIST and CJIS frameworks, and enable DESC to detect, analyze, and respond to threats affecting mission-critical systems such as LMR and segmented public safety networks. Optional features such as endpoint detection for Motorola dispatch consoles, Cisco ISE configuration change detection, and full visibility across VRF-based segmentation is preferred.

No equipment or services on the State of New Hampshire's Prohibited Technologies List found here: Prohibited Technologies List and

No equipment or services on the FCC Covered List found here: FCC Section 2 List of Equipment and Services

The DESC is responsible for the operation and maintenance of this statewide public safety microwave and Land Mobile Radio (LMR) communication system, which enables seamless communication for State Police, county sheriffs, and local first responders.

Project Overview/Justification: – The DESC seeks proposals from qualified vendors to provide comprehensive Managed Detection and Response (MDR) services. The primary objective is to enhance the cybersecurity posture of the critical New Hampshire Interoperable Communications Network (NHICnet) as well as the Motorola ASTRO Radio Network Infrastructure (RNI) and its interconnected partner networks by proactively identifying, analyzing, and responding to cyber threats and suspicious activity.

https://www.doit.nh.gov/sites/g/files/ehbemt506/files/inline-documents/sonh/prohibited-technologies.pdf https://www.fcc.gov/supplychain/coveredlist https://www.fcc.gov/supplychain/coveredlist

Division of Emergency Services and Communications

2. Schedule of Events

The following table provides a Schedule of Events for this RFP through contract finalization and approval. The Agency reserves the right to amend this Schedule at its sole discretion and at any time through a published Addendum.

EVENT DATE & TIME (ET)

RFP Released to Vendors / Inquiry Period Begins (on or about)

September 9, 2025

Notification to the State of the Number of Representatives Attending the Vendor Conference (Mandatory)

September 19, 2025

Vendor Conference

September 24, 2025 9:00 AM Division of Emergency Services and Communications, 110 Smokey Bear Blvd, Concord, NH 03305

Vendor Inquiry Period Ends (Final Inquiries due)

October 7, 2025

Final State Responses to Vendor Inquiries October 10, 2025 Final Date and Time for Proposal Submission October 22, 2025 2:00pm ET Invitations for Oral Presentations October 27, 2025 Vendor Presentations/Discussion Sessions/Interviews (Mandatory or Optional)

October 30, 2025

Estimated Date of Vendor Selection November 4, 2025 Anticipated Governor and Council Approval January 14, 2026

SECTION 2: PROPOSAL SUBMISSION, DEADLINE, AND LOCATION INSTRUCTIONS

1. Proposal Submission

Physical Proposals and Electronic Proposals submitted in response to this RFP must be received no later than the time and date specified in the Schedule of Events, herein.

The Price Proposal must be labeled clearly and submitted separately from the Technical Proposal.

Late submissions will not be accepted. Delivery of the Proposals shall be the Vendor’s responsibility. The time of receipt shall be considered when a Proposal has been officially documented by the Agency, in accordance with its established policies, as having been received at the location or via email as designated below. The Agency accepts no responsibility for damaged, mislabeled, or undeliverable mailed or emailed Proposals.

2. Physical Proposals

Physical Proposals must be addressed to:

Physical Proposals must be addressed to:

STATE OF NEW HAMPSHIRE

Division of Emergency Services and Communications Robert M. Lussier 110 Smokey Bear Blvd Concord, NH 03305

Proposals must be clearly marked as follows:

STATE OF NEW HAMPSHIRE

RESPONSE TO RFP: RFP-DOS-2026-06- NHICNET Managed Security Protection Physical Submissions shall include:

Package 1- Technical Proposal without pricing:

a. One (1) original and five (5) clearly identified copies of the Technical Proposal, including all required attachments.

b. One electronic version of the proposal.

c. One (1) electronic proprietary redacted submission due to RSA 91-A “Right to Know

Law” requests.

d. One (1) copy of the Proposal Transmittal Form Letter (described in Section 3.1.2:

Transmittal Form Letter, herein) shall be signed by an official authorized to legally bind the Vendor and shall be marked “ORIGINAL.”

Package 2 – Price Proposal:

a. A separate Price Proposal must be labeled clearly and sealed separately from the

Technical Proposal.

One (1) original and two (2) copies of the Price Proposal, including Pricing Worksheets (as described in Appendix E), must be bound separately.

3. Electronic Proposals

Electronic-only Proposals are not allowed.

4. Number of Proposals

Vendors are permitted to submit up to One (1) Proposal each with a unique solution in response to this RFP.

The original and all copies shall be bound separately, delivered in sealed containers, and permanently marked as indicated above. A Vendor’s disclosure or distribution of its Proposal other than to the State will be grounds for disqualification.

5. Vendor Inquiries

All inquiries concerning this RFP, including but not limited to, requests for clarifications, questions, and any changes to the RFP, shall be submitted via email to the following RFP Point of Contact:

Robert Lussier, Assistant Director Email: Robert.M.Lussier@desc.nh.gov

Inquiries must be received by the RFP Point of Contact no later than the conclusion of the Vendor Inquiry Period identified in the Schedule of Events. Inquiries received later than the conclusion of the Vendor Inquiry Period shall not be considered properly submitted and may not be considered.

The State assumes no liability for assuring accurate/complete email transmission/receipt and is not required to acknowledge receipt.

The Agency intends to issue official responses to properly submitted inquiries on or before the date specified in the Schedule of Events section, herein. The Agency may consolidate and/or paraphrase questions for sufficiency and clarity. Oral statements, representations, clarifications, or modifications concerning the RFP shall not be binding upon the Agency. Official responses by the Agency will be made only in writing by the process described above.

The Agency will require the selected Vendor to execute a Contract using the P-37 State of New Hampshire General Provisions and any attached exhibits. To the extent that a Vendor believes that exceptions to the standard form contract will be necessary for the Vendor to enter into the Agreement, the Vendor must submit those exceptions during the Vendor Inquiry Period.

6. Restriction of Contact with Agency Employees

From the date of release of this RFP until an award is made and announced regarding the selection of a Vendor, all communication with personnel employed by or under contract with the Agency regarding this RFP is prohibited unless first approved by the RFP Points of Contact listed herein.

Agency employees have been directed not to hold conferences and/or discussions concerning this RFP with any potential Contractor during the selection process, unless otherwise authorized by the RFP Point of Contact. Vendors may be disqualified for violating this restriction on communications.

mailto:Robert.M.Lussier@desc.nh.gov

7. Validity of Proposal

Proposals must be valid for one hundred and eighty (180) days following the deadline for submission of Proposals in the Schedule of Events, or until the Effective Date of any resulting Contract, whichever is later.

SECTION 3: PROPOSAL ORGANIZATION, CONTENT, AND REQUIRED ITEMS

1. Proposal Organization

Proposals should adhere to the following outline:

Cover Page

Transmittal Form Letter

Table of Contents

Section I: Executive Summary

Section II: Glossary of Terms and Abbreviations

Section III: Responses to Requirements and Deliverables

Section IV: Narrative Responses

Section V: Corporate Qualifications

Section VI: Qualifications of Key Vendor staff

Section VII: Vendor Attachments

Section VIII: Price Proposal (sealed separately)

1.1. Cover Page

The first page of the Vendor’s Proposal should be a cover page containing the following text:

STATE OF NEW HAMPSHIRE

Division of Emergency Services and Communications

RESPONSE TO RFP: DOS-RFP-2026-06 - NHICNet Managed Security Protection

The cover page should also include the Vendor’s name, contact person, contact telephone number, address, city, state, zip code, fax number, and email address.

1.2. Transmittal Form Letter

The Vendor must submit a signed Transmittal Form Letter with their response using the Transmittal Form Letter template provided on the following page. Any electronic alteration to the content of this Transmittal Form Letter template is prohibited. Any such changes shall result in a Proposal being rejected.

State of New Hampshire Proposal Transmittal Form Letter Company Name:

Address:

To: Robert M. Lussier 603-271-6911 Robert.M.Lussier@desc.nh.gov RE: Proposal Invitation Name: NHICNET Managed Security Protection Proposal Number: RFP-DOS-2026-06 Proposal Due Date and Time: 10/22/2025 2:00 PM ET

To Whom It May Concern:

Company Name: hereby submits an offer to provide to the State of New Hampshire the Services indicated in DOS-RFP-2026-06 - NHICNet Managed Security Protection at the price(s) quoted in Vendor Response Section VIII: Price Proposal, in complete accordance with all conditions of this RFP and all Specifications set forth in the RFP and in the P-37 State of New Hampshire General Provisions and Exhibits, identified in Appendix I.

We attest to the fact that:

1. The company has reviewed and agreed to be bound by the RFP.

2. The company has not altered any of the language or other provisions contained in the RFP document.

3. The Proposal is effective for a period of 180 days from the RFP Closing Date or until the Effective Date of any resulting Contract, whichever is later.

4. The prices quoted in the Proposal were established without collusion with other vendors.

5. The Vendor has read and fully understands this RFP.

Further, in accordance with RSA 21-I:11-c, the undersigned Vendor certifies that neither the Vendor nor any of its subsidiaries, affiliates or principal officers (principal officers refers to individuals with management responsibility for the entity or association):

a) Has, within the past 2 years, been convicted of, or pleaded guilty to, a violation of RSA 356:2, RSA 356:4, or any state or federal law or county or municipal ordinance prohibiting specified bidding practices, or involving antitrust violations, which has not been annulled.

b) Has been prohibited, either permanently or temporarily, from participating in any public works project pursuant to RSA 638:20.

c) Has previously provided false, deceptive, or fraudulent information on a vendor code number application form, or any other document submitted to the state of New Hampshire, which information was not corrected as of the time of the filing a bid, proposal, or quotation.

d) Is currently debarred from performing work on any project of the federal government or the government of any state.

e) Has, within the past 2 years, failed to cure a default on any contract with the federal government or the government of any state.

f) Is presently subject to any order of the department of labor, the department of employment security, or any other state department, agency, board, or commission, finding that the applicant is not in compliance with the requirements of the laws or rules that the department, agency, board, or commission is charged with implementing.

g) Is presently subject to any sanction or penalty finally issued by the department of labor, the department of employment security, or any other state department, agency, board, or commission, which sanction or penalty has not been fully discharged or fulfilled.

h) Is currently serving a sentence or is subject to a continuing or unfulfilled penalty for any crime or violation noted in this section.

i) Has failed or neglected to advise the division of any conviction, plea of guilty, or finding relative to any crime or violation noted in this section, or of any debarment, within 30 days of such conviction, plea, finding, or debarment: or

j) Has been placed on the debarred parties list described in RSA 21-I:11-c within the past year.

This document shall be signed by a person who is authorized to legally obligate the responding Vendor. A signature on this document indicates that all State of New Hampshire terms and conditions are accepted by the responding Vendor and that any and all other terms and conditions submitted by the responding Vendor are null and void, even if such terms and conditions have terminology to the contrary. The responding Vendor shall also be subject to State of New Hampshire terms and conditions as stated on the reverse of the purchase order, if any.

Our official point of contact is:

Title:

Telephone:

Email:

Authorized Signature Printed:

Authorized Signature:

1.3. Table of Contents

The Vendor must provide a table of contents with corresponding page numbers relating to its Proposal.

1.4. Section I: Executive Summary

Section I shall provide an executive summary, not to exceed two (2) pages, identifying how the Vendor satisfies the goals of this RFP. The executive summary will also provide an overview of the Vendor’s proposed Solution and Services highlighting those factors that they believe distinguish their Proposal.

1.5. Section II: Glossary of Terms and Abbreviations

Section II shall provide a glossary of all terms, acronyms, and abbreviations used in the Vendor’s Proposal.

1.6. Section III: Responses to System Requirements and Deliverables

Section III shall include the response tables from the Business/Technical Requirements and Deliverables Appendix. The Vendor must document the ability to meet the Business Requirements, Technical Requirements and Deliverables of this RFP.

1.7. Section IV: Narrative Responses

Section IV solicits narrative responses describing the Software, Technical, Services and Project Management topics defined for this RFP Project. The Topic for Mandatory Responses Appendix is organized into sections, which correspond to the different aspects of the scoring process of the Proposal. Discussion of each topic must begin on a new page.

1.8. Section V: Corporate Qualifications

Section V shall provide the corporate qualifications of the Vendor, and any Subcontractors proposed to participate in the Project. Specific information to be provided is described in the Standards for Describing Vendor Qualifications Appendix.

1.9. Section VI: Qualifications of Key Vendor Staff

Section VI shall be used to provide required information on the Vendor’s Key Project Staff. Specific information to be provided is described in the Standards for Describing Vendor Qualifications Appendix.

1.10. Section VII: Vendor Attachments

Section VII provides for extra materials as referenced in the Topic for Mandatory responses Appendix such as Product Literature, Ad Hoc/Federal Reporting, Interface Standards, Testing (For UAT Plan) and Status Meetings and Reports.

1.11. Section VIII: Price Proposal (sealed separately)

Section VIII shall include the Price Proposal, which must describe the proposed price of the Vendor Proposal based on and reflected by the inclusion of the completed tables listed in the Pricing Appendix. As outlined in Section 2: Proposal Submission, Deadline, and Location Instructions, this price proposal must be labeled clearly and sealed separately from the Technical Proposal.

SECTION 4: EVALUATION OF PROPOSALS

1. Criteria for Evaluation and Scoring

Each responsive Proposal will be evaluated and considered with regard to the Solution and Services proposed, qualifications of the Vendor and any Subcontractors, experience and qualifications of proposed candidates, and price.

If the Agency determines to make an award, the Agency will begin negotiations with a Vendor based on these evaluations. Should the Agency be unable to reach agreement with the high scoring Vendor during Contract discussions, the Agency may then undertake Contract discussions with the next high scoring Vendor and so on; or the Agency may reject all Proposals, cancel this RFP, or solicit new Proposals under a new acquisition process.

The Agency will use a scoring scale of one hundred (100) Points. Points will be distributed as set forth in the table below.

Table 4.1: Scoring of Proposal

CATEGORIES POINTS

Technical Proposal with the following potential maximum scores for each Technical Proposal category listed below: 60

Proposed Solution 45 Vendor’s Technical, Service and Project Management Experience 10

Vendor Company and Staffing Qualifications 5 FedRAMP/StateRAMP Authorization Status 9 Price Proposal Potential Maximum Points 31

TOTAL POTENTIAL MAXIMUM POINTS AWARDED one hundred (100)

The Agency will select a Vendor based upon the criteria and standards contained in this RFP and from applying the weighting in this section. Oral interviews and reference checks, to the extent they are utilized by the Agency, will be used to refine and finalize technical scores.

2. Scoring Detail

2.1. Scoring of the Proposed Solution

The Vendor’s Proposed Solution will be allocated a maximum score Referenced in Table 4.1.

The main purpose of this section is to measure how well the Solution meets the business needs of the Agency.

Scoring is primarily measured using vendor responses in the following sections:

a) Proposal Section III: Responses to Requirements and Deliverables

b) Proposal Section IV: Narrative Responses

c) Vendor Presentation and Demonstration (if applicable)

2.2. Scoring of Vendor Technical, Service, and Project Management Experience

Vendor proposed Technical, Service, and Project Management Experience will be allocated a maximum score Referenced in Table 4.1. In this section, the State will score the technical merits of how the Vendor will carry out the Implementation and maintenance of the Solution.

Technical details of the System including security and protection of data, proposed training administrative procedures, how the Vendor manages its team and the Project will be critical.

How compatible the Vendor’s procedures and technologies are with the State contribute to an assessment of risk both in the short and long term.

Scoring is primarily measured using vendor responses in the following sections:

a) Proposal Section III: Responses to Requirements and Deliverables

b) Proposal Section IV: Narrative Responses

c) Proposed Work Plan

d) References

2.3. Scoring of Vendor Company and Scoring of Vendor Staffing Qualifications

2.4.

Vendor Company and Vendor’s Staff qualifications will be allocated a maximum score Referenced in Table 4.1. It must be established that the Vendor Company is capable of carrying out the Project through Implementation, the Warranty Period and the maintenance period. Vendor’s Staff must have the training and experience to support the Vendor’s plans to implement and support the System.

Scoring is primarily measured using vendor responses in the following sections:

a) Proposal Section V: Corporate Qualifications

b) Proposal Section VI: Qualifications of Key Staff

c) References

2.5. Scoring of Solution FedRAMP/StateRAMP Authorization Status.

If the vendor’s solution (Hosting and Product) is fully FedRAMP or StateRAMP authorized, and within periodicity, the Vendor score for this section shall be awarded at 15% of the total possible points for the technical solution. If only the Vendor’s Hosting environment is FedRAMP/StateRAMP authorized the vendor will be awarded 5% of the total possible points for the technical solution.

2.6. Scoring the Price

The Vendor’s price will be allocated a maximum score Referenced in Table 4.1. The State will only consider Pricing provided in Appendix E - Pricing Tables E-1.1 through E-1.7 The price information required in a Proposal is intended to provide a sound basis for comparing price.

The Vendor’s Price Score formula described in the Price Proposal Review and Scoring section will be utilized for this scoring portion.

3. Planned Evaluations

The Agency plans to use the following process:

a) Initial screening to ensure that the Proposals are in compliance with submission requirements.

b) Preliminary evaluation of the Proposals.

c) Oral interviews and Product Demonstrations (if applicable).

d) Final Evaluation of Technical Proposals and scoring.

e) Review of Price Proposals and scoring.

f) Select the highest scoring Vendor and begin contract negotiation.

a. Initial Screening

The Agency will conduct an initial screening step to verify Vendor compliance with the submission requirements set forth in the RFP and the minimum content set forth in the Proposal Format, Content and Required Items within this RFP. The Agency may waive or offer a limited opportunity to cure immaterial deviations from the RFP requirements if it is determined to be in the best interest of the State. A Proposal that fails to satisfy either submission requirements or minimum standards may be rejected without further consideration.

b. Preliminary Technical Scoring of Proposals

The Agency will establish an evaluation team. This evaluation team will review the Technical Proposals and give a preliminary score. Should a Vendor fail to achieve half of the maximum points in the preliminary scoring, it will receive no further consideration from the evaluation team and the Vendor’s Price Proposal will remain unopened. Price Proposals will remain unopened during the preliminary technical review, Oral Interviews and Product Demonstrations.

c. Oral Interviews and Product Demonstrations

At the Agency’s discretion, Vendors may be invited to oral interviews and/or product demonstrations including demonstrations of any proposed automated systems or technology components. The Agency retains the sole discretion to determine whether to conduct oral interviews and product demonstrations, with which Vendors, the number of interviews and the length of time provided for the interview and Product demonstration. The Agency may decide to conduct oral interviews and product demonstrations with less than all responsive Vendors.

The purpose of oral interviews and product demonstrations is to clarify and expound upon information provided in the written Proposals. Vendors are prohibited from altering the basic substance of their Proposals during the oral interviews and product demonstrations. The Agency may ask the Vendor to provide written clarifications of elements in their Technical Proposal regardless of whether it intends to conduct oral interviews.

Information gained from oral interviews and product demonstrations will be used to refine technical review scores assigned from the initial review of the Proposals. All costs associated with oral presentations/interviews shall be borne entirely by the Vendor.

d. Final Scoring of Technical Proposals

Following Oral Interviews, Product Demonstrations, Reference Checks (if appropriate) and/or review of written clarifications of Proposals requested by the Agency, the evaluation team will determine a final score for each Technical Proposal.

e. Price Proposal Review and Scoring

Price Proposals will be reviewed upon completion of the final scoring of Technical Proposals.

The Vendor’s Price Proposal will be allocated a maximum potential score Referenced in Table

4.1. Vendors are advised that this is not a low bid award and that the scoring of the price Proposal will be combined with the scoring of the Technical Proposal to determine the overall highest scoring Vendor.

The following formula will be used to assign points for Price:

Vendor’s Price Score = (Lowest Proposed Price / Vendor’s Proposed Price) x Maximum Number of Points for Price Proposal.

For the purpose of use of this formula, the lowest proposed price is defined as the lowest price proposed by a Vendor who has scored above the minimum necessary for consideration on the Technical Score.

4. No Best and Final Offer

The Proposal should be submitted initially on the most favorable terms that the Vendor can offer. There will be no best and final offer procedure. The Vendor should be prepared to accept this RFP for incorporation into a contract resulting from this RFP. Contract negotiations may incorporate some or the entire Proposal.

5. Rights of the Agency in Accepting and Evaluating Proposals

The Agency reserves the right to:

a) Make independent investigations in evaluating Proposals.

b) Request additional information to clarify elements of a Proposal.

c) Waive minor or immaterial deviations from the RFP requirements, if determined to be in the best interest of the State.

d) Omit any planned evaluation step if, in the Agency’s view, the step is not needed.

e) At its sole discretion, reject any and all Proposals at any time.

f) Open contract discussions with the second highest scoring Vendor and so on, if the Agency is unable to reach an agreement on Contract terms with the higher scoring Vendor(s).

SECTION 5 – TERMS AND CONDITIONS RELATED TO THE RFP PROCESS

SECTION 5: TERMS AND CONDITIONS RELATED TO THE RFP PROCESS

1. RFP Addendum

The Agency reserves the right to amend this RFP at its discretion, prior to the Proposal submission deadline. In the event of an addendum to this RFP, the Agency, at its sole discretion, may extend the Proposal submission deadline, as it deems appropriate.

2. Non-Collusion

The Vendor’s signature on a Proposal submitted in response to this RFP guarantees that the prices, terms and conditions, and Work quoted have been established without collusion with other Vendors and without effort to preclude the Agency from obtaining the best possible competitive Proposal.

3. Property of the State

All material received in response to this RFP shall become the property of the State and will not be returned to the Vendor. Upon Contract award, the State reserves the right to use any information presented in any Proposal.

4. Confidentiality of a Proposal

The substance of a Proposal must remain confidential until the Effective Date of any Contract resulting from this RFP. A Vendor’s disclosure or distribution of Proposals other than to the Agency without the Agency’s prior consent may be grounds for disqualification.

5. Public Disclosure

In general, the State is obligated to make public the information submitted in response to this RFP (including all materials submitted in connection with it, such as attachments, exhibits, addenda, and presentations), any resulting contract, and information provided during the contractual relationship. The Right-to-Know law (RSA 91-A) obligates the State to conduct an independent analysis of the confidentiality of the information submitted, regardless of whether it is marked confidential.

In addition, the Governor and Council (G&C) contract approval process more specifically requires that pricing be made public and that any contract reaching the G&C agenda for approval be posted online.

a. Disclosure of Information Submitted in Response to RFP

Information submitted in response to this RFP is subject to public disclosure under the Right-to-Know law after the award of a contract by G&C. At the time of closing date for Proposals, the State will post the number of responses received with no further information. Pursuant to RSA 21-G:37, the State will also post the name and rank or score of each Vendor pursuant to the timeliness requirements therein. Notwithstanding the Right-to-Know law, no information concerning the contracting process, including, but not limited to information related to proposals, communications between the parties or contract negotiations, shall be available until a contract is approved by G&C, or, if the contract does not require G&C approval, until the contract has been actually awarded. This means unsuccessful Vendors shall not be notified of the outcome until that time.

Confidential, commercial, or financial information may be exempt from public disclosure under RSA 91-A:5, IV. If a Vendor believes any information submitted in response to this request for proposal should be kept confidential, the Vendor must specifically identify that information where it appears in the submission in a manner that draws attention to the designation and must mark/stamp each page of the materials that the Vendor claims must be exempt from disclosure as “CONFIDENTIAL.” Vendors must also provide a letter to the person listed as the point of contact for this RFP, identifying the specific page number and section of the information you consider to be confidential, commercial or financial and providing your rationale for each designation. Marking or designating an entire proposal, attachment or section as confidential shall neither be accepted nor honored by the State. Vendors must also provide a separate copy of the full and complete document, fully redacting those portions and shall note on the applicable page or pages that the redacted portion or portions are “confidential.”

Submissions which do not conform to these instructions by failing to include a redacted copy (if necessary), by failing to include a letter specifying the rationale for each redaction, by failing to designate the redactions in the manner required by these instructions, or by including redactions which are contrary to these instructions or operative law may be rejected by the State as not conforming to the requirements of the proposal.

Pricing, which includes but is not limited to, the administrative costs and other performance guarantees in Proposals or any subsequently awarded contract shall be subject to public disclosure regardless of whether it is marked as confidential.

Notwithstanding a Vendor’s designations, the State is obligated under the Right-to-Know law to conduct an independent analysis of the confidentiality of the information submitted in a proposal. If a request is made to the State by any person or entity to view or receive copies of any portion of the proposal, the State shall first assess what information it is obligated to release. The State will then notify you that a request has been made, indicate what, if any, information the State has assessed is confidential and will not be released, and specify the planned release date of the remaining portions of the proposal. To halt the release of information by the State, a Vendor must initiate and provide to the State, prior to the date specified in the notice, a court action in the Superior Court of the State of New Hampshire, at its sole expense, seeking to enjoin the release of the requested information.

By submitting a proposal, Vendors acknowledge and agree that:

The State may disclose any and all portions of the proposal or related materials that are not marked as confidential and/or which have not been specifically explained in the letter to the person identified as the point of contact for this RFP;

The State is not obligated to comply with a Vendor’s designations regarding confidentiality and must conduct an independent analysis to assess the confidentiality of the information submitted in your proposal; and

The State may, unless otherwise prohibited by court order, release the information on the date specified in the notice described above without any liability to a Vendor.

Electronic Posting of Resulting Contract

RSA 91-A obligates disclosure of contracts resulting from responses to RFPs. As such, the Secretary of State provides to the public any document submitted to G&C for approval, and posts those documents, including the contract, on its website. Further, RSA 9-F:1 requires that contracts stemming from RFPs be posted online. By submitting a Proposal, Vendors acknowledge and agree that, in accordance with the above-mentioned statutes and policies, (and regardless of whether any specific request is made to view any document relating to this RFP), any contract resulting from this RFP that is submitted to G&C for approval will be made accessible to the public online via the State’s website.

6. Non-Commitment

Notwithstanding any other provision of this RFP, this RFP does not commit the Agency to award a Contract. The Agency reserves the right, at its sole discretion, to reject any and all Proposals, or any portions thereof, at any time; to cancel this RFP; and to solicit new Proposals under a new acquisition process.

7. Proposal Preparation Cost

By submitting a Proposal, a Vendor agrees that in no event shall the Agency be either responsible for or held liable for any costs incurred by a Vendor in the preparation of or in connection with the Proposal, or for work performed prior to the Effective Date of a resulting Contract.

8. Ethical Requirements

From the time this RFP is published until a contract is awarded, no vendor shall offer or give, directly or indirectly, any gift, expense reimbursement, or honorarium, as defined by RSA 15-B, to any elected official, public official, public employee, constitutional official, or family member of any such official or employee who will or has selected, evaluated, or awarded an RFP, or similar submission. Any vendor that violates RSA 21-G:38 shall be subject to prosecution for an offense under RSA 640:2. Any vendor who has been convicted of an offense based on conduct in violation of this section, which has not been annulled, or who is subject to a pending criminal charge for such an offense, shall be disqualified from applying to the RFP, or similar request for submission and every such vendor shall be disqualified from applying to on any RFP or similar request for submission issued by any State agency. A vendor that was disqualified under this section because of a pending criminal charge which is subsequently dismissed, results in an acquittal, or is annulled, may notify the Department of Administrative Services (DAS), which shall note that information on the list maintained on the State’s internal intranet system, except in the case of annulment, the information, shall be deleted from the list.

9. Debarment

Vendors who are ineligible to apply to proposals, bids or quotes issued by the Department of Administrative Services, Division of Procurement and Support Services pursuant to the provisions of RSA 21-I:11-c shall not be considered eligible for an award under this proposal.

10. Challenges on Form or Process of the RFP

A vendor questioning the Agency’s identification of the selected Vendor may request that the Agency review its selection process. Such request shall be made in writing and be received by the Agency within 5 (five) business days after the rank or score is posted on the agency website. The request shall specify all points on which the vendor believes the Agency erred in its process and shall contain such argument in support of its position as the vendor seeks to present. In response, the issuing Agency shall review the process it followed for evaluating responses and, within 5 (five) business days of receiving the request for review, issue a written response either affirming its initial selection of a Vendor or canceling the application. In its request for review, a vendor shall not submit, and an Agency shall not accept nor consider, any substantive information that was not included by the vendor in its original application response. No hearing shall be held in conjunction with a review. The outcome of the Agency's review shall not be subject to appeal.

SECTION 6 – CONTRACT TERMS AND AWARD

SECTION 6: CONTRACT TERMS AND AWARD

1. Non-Exclusive Contract

Any resulting Contract from this RFP will be a Non-Exclusive Contract. The State reserves the right, at its discretion, to retain other contractors to provide any of the Services or Deliverables identified under this procurement or make an award by item, part or portion of an item, group of items, or total Proposal.

2. Award

Any resulting Contract is contingent upon approval of the Contract by Governor and Executive Council of the State of New Hampshire and upon continued appropriation of funding for the Contract.

3. Anticipated Contract Term

The Vendor shall be fully prepared to commence work after full execution of the Contract by the parties, and the receipt of required governmental approvals, including, but not limited to, Governor and Executive Council of the State of New Hampshire approval (“Effective Date”).

The initial Contract Term will begin on the Effective Date and continue through February 1, 2031.

The Contract Term may be extended up to Two (2) year(s) (“Extended Contract Term”) at the sole option of the State, subject to the party’s prior written agreement on terms and applicable fees for each extended Contract Term, contingent upon satisfactory vendor performance, continued funding and Governor and Executive Council approval.

4. Standard Contract Terms

The Agency will require the successful vendor to execute a Not to Exceed Contract. The P-37 State of New Hampshire General Provisions and Exhibits, identified in Appendix I will form the basis of any Contract resulting from this RFP.

To the extent that a Vendor believes that exceptions to the standard form Contract will be necessary for the Vendor to enter into the Agreement, the Vendor should note those issues during the Vendor Inquiry Period. The Agency will review requested exceptions and accept, reject or note that it is open to negotiation of the proposed exception at its sole discretion. If the Agency accepts a Vendor’s exception the Agency will, at the conclusion of the inquiry period, provide notice to all potential Vendors of the exceptions which have been accepted and indicate that exception is available to all potential Vendors. Any exceptions to the standard form contract that are not raised during the Vendor inquiry period are waived. In no event is a Vendor to submit its own standard contract terms and conditions as a replacement for the State’s terms in response to this solicitation.

a. Contract Negotiations and Unsuccessful Vendor Notice

If a Vendor is selected, the State will notify the selected Vendor in writing of their selection and the State’s desire to enter into contract discussions. Until the State successfully completes discussions with the selected Vendor, all submitted Proposals remain eligible for selection by

SECTION 6 – CONTRACT TERMS AND AWARD

the State. In the event contract discussions are unsuccessful with the selected Vendor, the evaluation team may recommend another Vendor.

b. Subcontractors

The Vendor shall remain wholly responsible for performance of the entire Contract regardless of whether a Subcontractor is used. The State will consider the Vendor to be the sole point of contact regarding all contractual matters, including payment of any and all charges resulting from any Contract.

5. Related Documents Required

The selected Vendor will be required to submit the following documents prior to Contract approval:

a) Certificate of Good Standing obtained by the Secretary of State of New Hampshire.

b) Certificate of Authority/Vote - The Certificate of Authority/Vote authorizes, by position, a representative(s) of your corporation to enter into an Agreement or amendment with the State of New Hampshire.

c) Certificate of Insurance - Certificate of Insurance evidencing coverage as required under the Contract.

d) Workers’ Compensation coverage must comply with State of NH RSA 281-A.

Remainder of this page intentionally left blank.

APPENDIX A: VENDOR CONFERENCE REQUIREMENTS

APPENDIX A: VENDOR CONFERENCE REQUIREMENTS

Applicable A Mandatory Vendor Conference will be held at the following location on the date and at the time identified in the Schedule of Events:

Division of Emergency Services and Communications 110 Smokey Bear Blvd Concord, NH 03301All Vendors who intend to submit Proposals must attend the Vendor Conference. Attendance by teleconference is permitted, and conference call information will be emailed to registrants upon request. Vendors are requested to RSVP via email by the date identified in the Schedule of Events, indicating the number of individuals who will attend the Vendor Conference.

Vendors are allowed to send a maximum number of (5) representatives.

Vendors will have an opportunity to ask questions about the RFP and the State will make a reasonable attempt to answer questions it deems appropriate. Questions may include, without limitation, a request for clarification of the RFP; a request for changes to the RFP;

suggestions or changes to the RFP that could improve the RFP competition or lower the offered price; and to review any applicable Documentation.

Vendors are encouraged to email inquiries at least twenty-four (24) hours prior to the Vendor Conference. No responses will be given prior to the Vendor Conference. Oral answers will not be binding on the State. The State’s final response to Vendor inquiries and any requested changes to terms and conditions raised during the Vendor Inquiry Period will be posted to the DAS Website by the date specified as the final State responses to Vendor inquiries as specified in the Schedule of Events. Vendors are responsible for any costs associated with attending the Vendor Conference.

APPENDIX B: BUSINESS/TECHNICAL REQUIREMENTS AND DELIVERABLES

Statement of Work

1. Purpose and Scope

The New Hampshire Division of Emergency Services and Communications (DESC) is seeking a Managed Detection and Response (MDR) provider to deliver 24/7/365 cybersecurity monitoring, threat detection, and incident response services tailored to the unique requirements of the state’s critical public safety infrastructure. The solution must prioritize visibility, integrity, and operational continuity of the Motorola ASTRO Land Mobile Radio (LMR) network—specifically the Radio Network Infrastructure (RNI)—as well as the underlying NHICnet architecture, which supports statewide traffic backhaul, public safety data, and network segmentation.

This engagement will be executed in phases, with the primary and most immediate objective being the protection and monitoring of the Motorola RNI environment. The second objective is the comprehensive monitoring and threat detection across the NHICnet backbone and its segmented networks. Future expansion may include endpoint protection and detection for select systems, including Motorola dispatch consoles, as well as onboarding of additional partner networks.

2. Project Phases and Priorities

Phase 1 – Motorola RNI Cybersecurity Monitoring

The MDR provider shall:

• Establish passive or low-impact telemetry collection to monitor traffic flows to and from Motorola RNI components.

• Detect and alert on unauthorized access attempts, segmentation boundary violations, and privilege escalation across Motorola and DESC infrastructure.

• Provide visibility into Fortinet firewall rules, VPN tunnels, and access control mechanisms protecting the RNI without internet connectivity.

• Monitor traffic and segmentation boundaries across RNI components including Fortinet devices and LMR-specific infrastructure.

• Include continuous monitoring of connected partner RNI networks, specifically those operated by Grafton County, Belknap County, and Rockingham County, due to their direct connections into the statewide RNI. RNI partners should have access to and individualized monitoring console restricted to their networking environment.

• Participate in coordinated incident response with DESC technical staff and Motorola ASTRO engineering personnel in accordance with documented escalation procedures.

Phase 2 – NHICnet Infrastructure Monitoring

Following successful implementation of RNI protections, MDR coverage shall expand to:

• Monitor the multi-vendor infrastructure supporting NHICnet, focusing on Cisco Catalyst switches, Firepower firewalls, and Cisco ISE with pxGrid integration.

• Maintain full segmentation-aware visibility across Virtual Routing and Forwarding (VRF) zones, including BTOP, DESCNet, and Guest traffic.

• Detect configuration drift, unauthorized policy changes, and lateral movement attempts that may affect tenant isolation or operational continuity.

Phase 3 – Future Partner Expansion

To accommodate ongoing statewide interoperability initiatives, the MDR service must be structured to support future onboarding of additional RNI partner agencies, counties, or municipalities. The provider shall:

• Allow flexible expansion of telemetry and monitoring to new public safety partners that integrate with NHICnet or the statewide RNI.

• Maintain consistent monitoring standards, alerting, and incident response protocols across expanded participants.

• Coordinate access control and visibility to ensure operational boundaries are preserved while enabling centralized threat oversight.

• Provide pricing that is valid for the life of the contract for future partners to participate in this solution.

3. Required Capabilities

The MDR provider must deliver the following baseline capabilities:

• US-Based Monitoring Operations: All threat monitoring and response activities must be conducted within the United States by a staffed Security Operations Center (SOC). The provider must confirm compliance with NIST SP 800-171, NIST SP 800-53 (moderate or higher), and CJIS security standards.

• Passive and Agentless Telemetry Support: The provider must be capable of collecting and analyzing log, flow, and security telemetry from infrastructure without requiring endpoint agents, particularly in sensitive zones such as RNI and NHICnet core segments.

• Integration and Collaboration with DESC: The MDR provider must work directly with DESC staff during investigation and incident response efforts. This includes real-time alert sharing, coordinated investigations, and direct engagement with DESC’s managed services providers and Motorola technical contacts.

• Infrastructure Configuration Monitoring: The solution must provide drift detection and baseline enforcement for Cisco firewalls, switches, ISE policies, and segmentation controls on NHICnet; and for Fortinet appliances in the RNI domain. Alerting on unauthorized changes that impact access control or inspection policy is required across both environments.

• Comprehensive Reporting: The solution must have real-time alerting as well as customizable dashboards that can be configured per-segment. The solution must provide historical reports capabilities on, but not limited to, incident type, severity, user, host and source. Reports must also include asset discovery and change reports as well as customizable executive-level briefing reports.

• Incident Escalation and SLA Management: Defined SLAs must be in place for alert response, triage, and coordination involving DESC, Motorola, and ePlus (DESC’s current infrastructure support provider).

4. Optional and Future Capabilities

DESC welcomes proposals that include optional capabilities, which may be prioritized in future project phases:

• Endpoint Detection and Response (EDR) integration for Motorola dispatch consoles and other selected systems.

• Behavioral and Identity-Aware Threat Detection to correlate threat indicators with identity, session, role, and posture information using Cisco ISE pxGrid or equivalent.

• Correlate identity and session context using pxGrid, NetFlow, VPN logs, and posture metadata.

• Automated playbooks integrating Cisco ISE quarantine actions or FMC-based policy updates.

• Version control and rule…