2-Attachment B - Scope of Work.pdf

BB23-4 : Attachment B Scope of Work – Page 1

Attachment B: Scope of Work Points of Interaction (Credit Card Machines)

Solicitation #BB23-4(TJ25-25)

I. Offeror‘s solution shall satisfy the following requirements during the term of the resulting contract:

1. Provide End to End Encryption

a. Offeror solution must provide a complex encryption algorithm for end-to-end encryption.

b. Offeror must be able to encrypt at swipe/ dip/ tap and maintain encryption all the way to the payment processor.

c. Must be compatible with JP Morgan Chase Commerce Solutions’ Safetech Enterprise

Point solution, must be a PCI P2PE solution, or must be able to provide documentation to satisfy concerns for scope reduction.

2. Enable Integration to a Purchasing Entity's ERP/ Point of Sale System

a. Offeror must be able to load software that provides semi-integration to point-of-sale software or ERP used by the Purchasing Entity. Semi-integration means that only limited communication between the ERP/POS is allowed as described herein 2(c).

b. Offeror software must be deployable on Purchasing Entity owned/ leased terminal hardware.

c. Offeror software must be able to communicate awake and authorization with the point-of-sale system on the local PC without bringing that PC or the point of sale software into PCI scope.

d. Offeror must provide testing and certification of integration.

3. EMV, Swipe, Contactless

a. Offeror solution must be EMV ready.

b. Offeror solution must accept the full array of common RFID and NFC contactless.

solutions including, but not limited to: tap and go, mobile wallets, Android Pay, Apple Pay, Samsung Pay.

4. Single Contractor Solution

a. Solution must be provided by a single contractor or established hardware software partnership.

5. Hardware Solutions

a. Offeror must provide multi-media credit card terminals.

b. Offeror may also supply configurable key-in and/or SRED devices (if devices meet other listed requirements).

c. Offeror must load payment application software.

d. Offeror must inject debit and end-to-end encryption keys. Contractor must provide both lease and sale options.

BB23-4 : Attachment B Scope of Work – Page 2

6. Project Management / Sales Support

a. Offeror must provide post sales project management through full implementation.

b. Offeror project management must be coordinated with the Purchasing Entity.

c. Offeror must provide necessary engineering and product support as needed by the

Purchasing Entity.

7. Ongoing Maintenance and Support

a. Offeror must warranty the hardware.

b. Application/ Software licenses must cover patches, upgrades and other technical support.

c. Offeror must provide hardware maintenance including, but not limited to: replacement parts, tampered device replacement or rebuild. The maintenance for leased machines should include turnaround times for replacement and clearly define the costs if any above the lease for repair or replacement. Also options and cost up-charges for upgrading to a new device version on leased machines needs to be clearly stated.

8. PCI Compliance

a. Offeror must provide a current PCI AOC for State of Utah PCI Coordinator annually.

b. Offeror hardware and applications must maintain PCI compliance including PA-DSS, PTS, and P2PE as applicable.

c. Offeror must provide documentation describing how the solution may reduce PCI scope for Purchasing Entities.

II. The following solutions are optional and not strictly required from Vendor’s solution:

1. Optional Item #1: Remote Terminal Tools

a. Offeror must have a tool that will allow IT staff to remotely update and manage certain application components of the terminals.

b. The remote terminal tool must not affect PCI scope and must be secure from unauthorized access.

2. Optional Item #2: Tokenization

a. Offeror solution must provide token responses for card storage requirements.