Payment Data & Payment Card Industry (PCI) Compliance Services

The Massachusetts Payment Data & Payment Card Industry (PCI) Compliance Services multi-award vehicle (PRF73) provides comprehensive cybersecurity and compliance services to eligible state and local government entities. The contract offers two primary service categories: Category 1 for Qualified Security Assessor (QSA) consulting services and Category 2 for Approved Scanning Vendor (ASV) vulnerability testing and security compliance scans. These services are designed to help Commonwealth entities validate data security compliance, minimize vulnerabilities, reduce breach risks, and ensure the security of e-commerce applications, with a specific focus on protecting personally identifiable information (PII) and cardholder data.

The contract is administered by the Massachusetts Operational Services Division (OSD) and currently features two prime contractors: Compass IT Compliance, LLC and RSI Systems, Inc. DBA RSI Security. The vehicle covers the entire Commonwealth of Massachusetts and is available to executive branch departments, municipalities, local governments, and other qualifying organizations. The current contract term runs from January 11, 2025, to June 30, 2026, with a fee-for-service structure and fixed pricing. Vendors are required to offer services at or below the maximum hourly rates listed in the COMMBUYS system, and the contract includes a mandatory supplier diversity component that encourages engagement with certified minority, women-owned, and veteran-owned businesses.