Automated and Prepaid Parking Amendment 3.pdf

AMENDMENT NO. 3

RFP NO. 226017-S

AUTOMATED AND PREPAID PARKING AT THE CRUISE TERMINAL

ISSUED: March 13, 2026

The Maryland Port Administration (MPA) is issuing this Amendment No. 3 to provide clarifications and answers to questions submitted by potential Offerors. All information contained herein is binding on all Offerors who respond to this solicitation.

Questions/Answers

Advance and On-Site Reservations

1. Does MPA require specific redirect formats or tracking parameters after payment completion.

Answer 1: If the customer is paying from the app no additional redirects are needed. If they are on MPA’s website, which then takes the customer to the vendor’s payment site, once the transaction is complete, they should be redirected back to MPA’s site.

Financial Management

2. Ask whether MPA requires Level II or Level III credit card data for reconciliation.

Answer 2: MPA requires Level III credit card data for reconciliation.

3. Clarify required settlement frequency for deposits into MPA’s account.

Answer 3: Daily settlement.

4. Request expected frequency and scope of compliance audits.

Answer 4: These will be done on a randomized schedule.

IT Management

5. Can you confirm whether all data must be stored within the United States.

Answer 5: Data must be stored within the United States.

6. Clarify whether MPA requires a sandbox environment accessible to their IT team.

Answer 6: A sandbox environment accessible to MDOT IT is not required, but desirable.

7. Request details on expected data retention format (live system vs. cold storage).

Answer 7: Data retention is mandated for 3 calendar years with an option to extend for three if requested by the MPA. Data stored for up to 3 years should reside in a live system. Data stored for more than 3 years should reside in cold storage.

8. Confirm whether MPA requires specific encryption standards or compliance certifications.

Answer 8: The system must comply with the Payment Card Industry Data Security Standard (version 2025) and provide a yearly "Attestation of Compliance for Report on Compliance - Merchants". The system and the data must comply with MDOT Security Policies.

9. Does MPA require a formal security assessment or penetration test before go-live.

Answer 9: The MPA requires a formal security assessment of systems and appliances connected to the MPA intranet or to be accessed by MPA business units. This assessment is supported or potentially performed by MDOT Cybersecurity.

Note: The following two responses have been revised from the answers in amendment 2.

10. Ask whether MPA requires API access for real-time reporting or if a dashboard is sufficient

Answer 10: The capability for API access is mandatory

11. Confirm whether MPA requires contingency plans for network outages, power failures, or system downtime.

Answer 11: Yes, that is a requirement and should be part of the Problem Escalation Procedure described in section 3.9.5 of the RFP.

Other

12. Taxation: The MPA notes a sales and use tax exemption, but the Baltimore 20% parking tax is not mentioned. Should this be considered a reimbursable expense, or should parking revenue be remitted net of this tax?

Answer 12: MPA is exempt from paying sales and use taxes for its state-owned cruise terminal parking facility. This RFP seeks an offeror who can provide certain functions and capabilities to assist and support MPA in managing cruise terminal parking. Based on the limited and defined scope of services sought in this RFP, it does not appear that a successful offeror would be subject to paying the Baltimore City parking tax.

13. Credit Card Fees: Should credit card fees be included in consumer-paid fees, or should revenue be remitted net of these fees?

Answer 13: MPA currently pays the bank fees for customers using credit cards to pay for parking. A decision has not been made on credit card fees; if the MPA will pay or if the MPA will pass this fee onto the customer.

End of Amendment No. 3 Michael Keegan, Procurement Officer