The NHDOT intends, through this Request for Proposal (RFP), to seek proposals from qualified vendors to provide managed security services and field service to support NHDOT’s TSMO Bureau and TMC operations. The MSSP Vendor will supplement the current NHDoIT team assigned to the NHDOT TSMO Bureau by providing specialized cybersecurity services and field network support to ensure compliance with state and federal security requirements, maintain operational resilience, and protect critical ITS infrastructure and devices.

The New Hampshire Department of Transportation is soliciting proposals for managed security services and field service support for NHDOT's TSMO Bureau and TMC operations under RFP DoIT 2025-067, with proposals due October 13, 2026. The selected Managed Security Service Provider will supplement the existing NHDoIT cybersecurity team by delivering specialized cybersecurity expertise and on-site field network support to protect critical Intelligent Transportation Systems infrastructure.

The scope requires 24/7 security monitoring and incident response; advanced threat detection and prevention; vulnerability assessment and patch management with critical patches applied immediately and high-vulnerability patches within 15 calendar days; comprehensive access controls and identity management; and audit logging and compliance reporting. Vendors must comply with NIST SP 800-171 Revision 2 security baselines and obtain either StateRAMP or equivalent authorization (FedRAMP or HITRUST). Solutions must be hosted on pre-approved FedRAMP or StateRAMP-authorized platforms (AWS, Azure, Google Services, or Oracle Government Cloud). Web and mobile applications must meet WCAG 2.1 Level AA accessibility standards with completed VPAT 2.5 assessment submission required. Field technicians must furnish and maintain specialized equipment including network diagnostics tools (Wireshark, PuTTY, packet sniffers, fiber optic test kits), cabling and connectivity supplies, power and electrical tools, general hardware tools, and communication equipment.

The vendor must provide service level agreements guaranteeing 24/7 system hosting availability (except scheduled maintenance), unlimited phone and email support during business hours (6:30 a.m. to 5:00 p.m. Monday through Friday ET), and quarterly reporting on uptime, vulnerabilities, and incidents. Service credits apply for unmet uptime requirements. Liquidated damages of $260 per calendar day apply for milestone failures; vendors may face liability of 120% of financial damages caused by security failures due to vendor fault. Two business days' notice is required prior to all system changes or updates. The RFP includes detailed technical requirements tables, incident response procedures, field technician equipment specifications, system requirements, a standard contract form, and a pricing worksheet.