Attachment_3_140P1224Q0067_PCI_Data_Protection_Addendum.pdf
PDF 204 KB Posted
- Solicitation number
- 140P1224Q0067
About this file
This document is a PCI Data Protection Addendum that requires the contractor to protect cardholder data in accordance with PCI DSS requirements when provided cardholder data or access to cardholder data by Rocky Mountain National Park. Key requirements include: maintaining an information security program to validate PCI DSS compliance annually, providing a copy of the Report on Compliance (ROC) and PA-DSS Implementation Guide, notifying Rocky Mountain National Park of any data breaches within 48 hours, providing access to systems and staff to support investigations, and returning or confirming destruction of cardholder data upon contract termination. The contractor must sign this addendum to comply with the requirements of the related federal contract opportunity for Rocky Mountain National Park Automated Fee Machines.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix: PCI Data Protection Addendum
Rocky Mountain National Park
PCI Data Protection Addendum Requirement
The contractor must sign the following PCI Data Protection Addendum:
Whereas, National Park Service, Rocky Mountain National Park, is a merchant that conducts transactions that include credit card payments and <contractor> is a service provider that is provided cardholder data or access to cardholder data, both parties must protect cardholder data in accordance to the Payment Card Industry Data Security Standard (PCI DSS).
<Contractor> acknowledges that when it is provided cardholder data or access to cardholder data, it shall protect that data in accordance with requirements specified in the PCI DSS.
<contractor> is responsible to provide protection for all cardholder data that it collects, processes, stored or transmits.
<contractor> shall comply with the following requirements:
• Maintain an information security program to protect cardholder data and validate compliance to the PCI DSS on an annual basis.
• Provide a copy of <contractor> Report on Compliance (ROC) with PCI DSS to Rocky Mountain National Park on an annual basis.
• Provide a copy of the <contractor> PA-DSS Implementation Guide to Rocky Mountain National Park upon award and upon any updates to the guide.
• If Rocky Mountain National Park cardholder data is compromised or suspected to have been compromised while in the possession of <contractor>, provide notice to the client of actual or potential data breach within forty-eight (48) hours.
• Rocky Mountain National Park is entitled to conduct its own investigation of any data breaches upon written request to <contractor>. Within forty-eight (48) hours of receiving Rocky Mountain National Park’s written request for investigation, <contractor> shall provide access to its systems and staff and will support both Rocky Mountain
140P1224Q0067 ROMO AUTOMATED FEE MACHINES
Appendix: PCI Data Protection Addendum
Rocky Mountain National Park
National Park client staff and contractors as well as law enforcement to conduct the investigation.
• Upon written request of Rocky Mountain National Park, <contractor> shall provide access to the Rocky Mountain National Park audit cardholder data protection controls.
• In the event that the contract expiration or termination, <contractor> shall return the cardholder data or provide confirmation of cardholder data destruction to Rocky Mountain National Park. <contractor> shall continue protecting cardholder data to the extent required by law and by the PCI DSS after contract termination.
Contractor Name: ______________________________________
Contract Number: ______________________________________
Name, Title of Contractor PCI DSS Compliance representative:
Signature and Date: ________________________________
PCI Data Protection Addendum Requirement
File details come from the government source that posted it. Updated .