12_S-DASOBO-00008678_RFP_Attachment_L_THIRD_PARTY_VENDOR_INFORMATION.docx

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

OregonBuys Bid Solicitation: S-DASOBO-00008678

Attachment L Third Party Vendor Information

As outlined in Treasury policy FIN 214, Proposers seeking to provide services to collect, store, process, transmit, or otherwise provide certain Cash Management services on behalf of the Agency will need to be qualified by the Oregon State Treasury (Treasury) to provide the service(s). Proposer must complete this form, including Sections 1, 2, and 6 for all Proposers and Sections 3, 4, and/or 5 as applicable for the proposed services.

Proposer/Service Area Description

Please provide a description of your company and/or the service area from which the service(s) will be delivered. Include years in operation, customer base (including whether company has current or previous experience serving governmental entities), etc.

Section 3: AUTOMATED CLEARING HOUSE (ACH) SERVICES

If proposing to provide ACH Services, please provide the following information and/or certifications.

ACH Transaction Volumes

Please identify the average number of ACH transactions processed (including time period over which average is calculated).

ACH Transaction Storage, Processing, and Transmission

Please select one of the following options and provide a brief description of the service provision.

|_| Proposer provides fully hosted ACH processing services. Data is collected, stored, processed and/or transmitted by the Proposer network. Please provide a brief description of the services and means through which they are provided:

|_| Proposer provides other ACH processing services. Data is collected, stored, processed and/or transmitted by the Proposer network and may also be collected stored, processed and/or transmitted by Agency’s network. Please provide a brief description of the services and means through which they are provided:

|_| Other - Please provide a brief description of the services and means through which they are provided (this could include licenses or purchased software or hardware for use and/or installation by an agency; please check with Treasury regarding applicability):

ACH Processing Flow Diagram

Please submit a logical diagram of the ACH data environment consistent with the service provision type selected above. The diagram should identify all areas where ACH data is collected, stored, transmitted, and processed, and clearly illustrate:

· All hardware and software used to collect, store, process, or transmit sensitive ACH data;

· Who owns, maintains, and supports the hardware and software in the ACH Data Environment.

Initial diagrams will be used to assess compliance with State of Oregon requirements for ACH including any security, interface, depository, or public fund requirements. Agencies and Third Party Vendors should maintain the diagrams for ongoing ACH risk assessment purposes.

State of Oregon Requirements for ACH Services

Please certify all of the following statements.

Section 4: MERCHANT CARD ACCEPTANCE SERVICES

If proposing to provide Merchant Card Acceptance Services, please provide the following information and/or certifications.

Debit/Credit Card Transaction Volumes

Please identify the average number of merchant card transactions processed (including time period over which average is calculated).

Select one applicable service provider level as defined by Visa:

Merchant Card Transaction Storage, Processing, and Transmission

Please select one of the following options and provide a brief description of the service provision.

|_| Proposer provides fully hosted Merchant Card processing services. Data is collected, stored, processed and/ or transmitted by the Proposer network. Please provide a brief description of the services and means through which they are provided:

|_| Proposer provides other Merchant Card processing services. Data is collected, stored, processed and/or transmitted by the Proposer network and may also be collected, stored, processed and/or transmitted by Agency’s network. Please provide a brief description of the services and means through which they are provided:

|_| Other - Please provide a brief description of the services and means through which they are provided (this could include licenses or purchased software or hardware for use and/or installation by an agency; please check with Treasury regarding applicability):

Payment Card Industry (PCI) Data Security Standards

Please select one of the following options.

|_| Proposer is listed as a PCI Compliant Service Provider on Visa’s Global Registry of Service Providers list and/or MasterCard PCI Compliant Service Providers list under the following name:

Please submit a signed copy of the related Attestation of Compliance (AOC).

Please submit a signed copy of the related Attestation of Compliance (AOC).

|_| Proposer has completed a PCI Self-Assessment Questionnaire D and Network Scan validating compliance with PCI Data Security Standards. For verification purposes, please provide a copy of the SAQ D Attestation of Compliance (AOC) and the executive summary portion of your latest clean scan report evidencing compliance.

Merchant Card Acceptance Processing Flow Diagram

Please submit a logical diagram of the cardholder data environment (CDE) consistent with the service provision type selected above. The diagram should identify all areas where cardholder data is collected, stored, transmitted, and processed, and clearly illustrate:

· All hardware and software used to collect, store, process, or transmit sensitive cardholder data;

· Who owns, maintains, and supports the hardware and software in the CDE.

Initial diagrams will be used to assess compliance with PCI DSS and State of Oregon requirements including any security, interface, depository, or public fund requirements. Agencies and Third Party Vendors should maintain the diagrams for ongoing PCI DSS compliance purposes.

State of Oregon Requirements for Merchant Card Acceptance Services

Please certify all of the following statements.

Section 5: OTHER CASH MANAGEMENT SERVICES

If proposing to provide Cash Management services other than ACH or Merchant Card Acceptance Services, please clearly identify the proposed service to be provided by the Proposer.

Treasury will use this information to identify what additional information will be required from the Proposer or Agency to complete the qualification process for each distinct proposed solution. Please note that additional information will need to address the following at a minimum:

· Certification to compliance with relevant Industry Standards or Regulations.

· Certification to compliance with any relevant Treasury policies, procedures, or system requirements applicable to the proposed Cash Management services.

· Certification to compliance with Oregon Public Funds Laws.

· Certification to compliance with the provisions of the Oregon Consumer Identity Theft Protection Act.

· A process flow diagram.

Section 6: CERTIFICATION

You certify that your answers are complete and correct to the best of your knowledge, you have not deceived or attempted to deceive the examiners of this application, and are confident the answers you provided accurately reflect your organization’s actual practices, policies, and procedures.