ESBD_384316_1733762988493_RFP 25-13 PCI Compliance Assessment.pdf

RFP 25-13 PCI Compliance Assessment 1

REQUEST FOR PROPOSALS (RFP) #25-13

PCI Compliance Assessment

PROPOSED SOLICITATION SCHEDULE

This schedule may be modified or changed at the sole discretion of SJCCD.

DATE ACTION

December 9, 2024 RFP issued.

December 18, 2024

Virtual Pre-Proposal Meeting (non-mandatory)

9:30 a.m. Central Time

Request a link to the virtual meeting by sending an email to the Procurement Contact by 2:00 p.m. Tuesday, December 17, 2024.

December 21, 2024 – January 1, 2025 San Jacinto College – Closed for Winter Break

January 6, 2025

Questions and/or Clarifications Deadline

Requests for questions and clarifications regarding RFP documents shall be submitted through the Questions tab in IonWave by 5:00 p.m. Central Time to be considered.

January 8, 2025 Issuance of final addendum, if necessary.

January 15, 2025

Proposal Submission Deadline. All proposal documents shall be submitted before 2:00 p.m. Central Time in IonWave.

The RFP opening will take place digitally through IonWave immediately following time due. A list of vendors who submitted will be made available upon written request to the Procurement Contact.

January 30, 2025 – January 31, 2025

Virtual Presentations / Interviews (top-ranked firms only) “may” be scheduled within these dates.

Feb – March. 2025 Recommendation of award and approval to enter into contract.

Award will be announced after approval received.

E-Bidding Website: IonWave:

https://sanjac.ionwave.net

PROCUREMENT CONTACT

Melissa Fuqua, Buyer 281-998-6378

Melissa.fuqua@sjcd.edu https://sanjac.ionwave.net/ mailto:Melissa.fuqua@sjcd.edu

RFP 25-13 PCI Compliance Assessment 2

SCOPE OF WORK

1. General

San Jacinto Community College District (“SJCCD” or “College”) is soliciting sealed proposals from qualified firms to provide a comprehensive assessment of the College’s Payment Card Industry Data Security Standard (PCI DSS) compliance status.

All work performed must be in compliance with existing federal, state and local codes, statutes and requirements.

SJCCD is a public community college district organized under Chapter 130 of the Texas Education Code and is tax exempt in the State of Texas.

2. Scope of Work

This scope of work covers the requirements to provide SJCCD with a comprehensive assessment of the College’s PCI DSS requirements. The College is committed to safeguarding cardholder data and complying with PCI DSS requirements. This assessment aims to evaluate current compliance levels, identify areas of non-compliance, and establish a roadmap for remediation. The scope of this assessment will span any department that accepts payment card data. Requirements, which shall include, but are not limited to the following:

a. Assessment Areas:

• Network Architecture Review: Evaluate network and system architecture for compliance with PCI DSS requirements.

• Network Segmentation: Ensure logical and physical segmentation controls are in place.

• Policies and Procedures Review: Assess existing policies and procedures related to handling payment card data.

• Data Security and Encryption: Verify the implementation of appropriate data security measures, including encryption, data storage, and access control.

• Access Control and Authentication: Assess user access management, multi-factor authentication (MFA), and segregation of duties.

• Risk Assessment and Vulnerability Management: Review risk assessment practices, vulnerability scanning, and remediation processes.

• Third-Party Vendor Management: Review third-party agreements and relationships

(e.g., payment processors) to ensure they meet PCI compliance standards.

b. Payment Card Transactions: Identify and analyze how the college processes payment card transactions (e.g., online payments, point-of-sale (POS) systems, phone-based payments, etc.)

c. Systems and Applications in Scope: List the systems, applications, and networks involved in processing, storing, or transmitting cardholder data (CHD). This may include payment gateways, POS systems, payment terminals, e-commerce platforms, and web servers.

d. Assessment Methodology:

RFP 25-13 PCI Compliance Assessment 3

• On-Site and Remote Assessment:

o Perform on-site evaluations of systems, networks, and physical security controls.

o Interview relevant staff, including IT, finance, and operations personnel, to validate processes.

o Conduct remote assessments where necessary, using secure communication protocols.

• Interviews and Documentation Review: Detail expectations for reviewing documentation (e.g., security policies, access logs, and incident reports) and conducting interviews with relevant stakeholders (e.g., IT staff, system owners).

• Security Scanning and Testing: Include review of vulnerability scanning, penetration testing (if applicable), and other technical assessments of systems that handle cardholder data.

• Compliance Checklist: State that the assessment will use the PCI DSS Self- Assessment Questionnaire (SAQ) or an equivalent detailed checklist to evaluate the college's compliance status.

e. Deliverables:

• PCI DSS Gap Analysis Report: Provide a comprehensive report outlining gaps between the college's current environment and PCI DSS requirements, including actionable recommendations for remediation.

• Risk Assessment Findings: If applicable, provide a risk assessment that includes an evaluation of threats, vulnerabilities, and security risks associated with payment card data.

• Compliance Status: Provide a formal statement about the institution’s compliance level (e.g., fully compliant, partially compliant, non-compliant) and the areas requiring remediation.

• Remediation Roadmap: Provide a roadmap for addressing identified gaps and deficiencies, including timelines and resource requirements.

• Executive Summary: Provide a high-level summary of the findings, including key risks and compliance issues, intended for senior leadership

• Attestation of Compliance (AOC): If applicable, provide an AOC to validate compliance after remediation.

f. Timeline and Milestones:

• Assessment Start and End Dates: Provide a start and end dates for the assessment, including any important milestones such as document submission, on-site visits, or interim reports that will be provided in order to meet the final report expectations.

• Completion of Final Report: Delivery of the final PCI compliance assessment report is no later than June 30, 2025.

g. General PCI-DSS Considerations:

• The College employs a range of third-party vendors to facilitate payment processing across its operations. These include Touchnet, including its Marketplace

RFP 25-13 PCI Compliance Assessment 4 product, Modern Campus (formerly Destiny One), Transact, and the current implementation of TouchBistro. Payments can be processed either online or through credit card machines and PIN pads.

• There are five (5) campus locations that accept payments via credit card machines and/or PIN pads. The following lists the number of such machines currently in operation.

o Cafes – 6 o Campus Business Offices – 17 o Culinary Department – 1 (currently implementing) o Cosmetology – 2

3. College Locations

a. District Offices – 4620 Fairmont Parkway, Pasadena, TX 77504

b. Central Campus – 8060 Spencer Hwy, Pasadena, TX 77505

c. North Campus – 5800 Uvalde, Houston, TX 77049

d. South Campus – 13735 Beamer Road, Houston, TX 77089

e. Maritime – 3700 Old Hwy 146, La Porte, TX 77571

f. Generation Park Campus – 13455 Lockwood Rd., Houston, TX 77044

g. Edge Center – 13150 Space Center Blvd., Houston, TX 77059

4. Supplier Diversity Reporting

SJCCD does not give preference to historically underutilized or small business in the awarding of contracts. However, if the awarded contractor utilizes a subcontractor(s) to fulfill the proposed requirements, the contractor will be required to track and report the amount paid to each subcontractor along with the subcontractor’s supplier diversity classification. This information will only be used for the purpose of statistical tracking. The reportable classifications include:

• African American

• Asian Pacific American

• Caucasian

• Hispanic American

• Native American

• Small Business

• Veteran Owned

• Minority Owned

• Woman Owned

• LGBTQ

• Other / Non-disclosed

5. Special Requirements

a. All contractors, subcontractors or company representatives working at any college property or college facility shall wear a clearly visible name tag, badge, embroidered or labelled uniform shirt, or other personal or company identification at all times. Failure to comply with this requirement could result in removal from the campus until corrected.

b. Confidentiality: All findings, reports, and data shared during the assessment will be treated as confidential and comply with applicable privacy laws.

RFP 25-13 PCI Compliance Assessment 5

6. Contract Term

The contract term, if any, for contract(s) awarded from this solicitation will be from the effective date through project completion, subject to the termination provisions as further described in the sample contract terms and conditions on the Attachments tab section of this solicitation.

RFP 25-13 PCI Compliance Assessment 6

EVALUATION CRITERIA

An Evaluation Committee will review all proposals according to the criteria stated herein. The committee’s evaluations will be based on all available information, including qualification statements, subsequent interviews/presentations, reports, discussions, reference checks, and other appropriate review.

Proposals will be evaluated using the following criteria:

Factor Points

Section 1: Qualifications and Experience of Firm 15

Section 2: Qualifications and Experience of Personnel 15

Section 3: Scope Understanding, Approach, and Management 25

Section 4: References 10

Section 5: Exceptions to Terms and Conditions 5

Section 6: Price Proposal* 30

Total 100

* The price proposal for each firm will be evaluated in comparison with the other firms’ price proposals;

however, the number of points possible may be evaluated in proportion to each respondent’s evaluation score received for Section 3: Scope Understanding, Approach, and Management.

The College’s Evaluation Committee will evaluate and rank each submittal based on the criteria detailed above. The highest rated proposer(s) evaluated by the Committee may be invited to deliver a 45 minute maximum presentation with the Evaluation Committee. If interviews occur, they will be evaluated on the following criteria:

Presentation / Interview Max Points Presentation/Interview 20 Total 20

If interviews are held, the final score for selection of a firm will be obtained by combining the Evaluation Committee’s total points of the qualifications, price, and interviews as follows:

Qualifications and Price 100 points maximum Interviews 20 points maximum Total 120 points maximum

RFP 25-13 PCI Compliance Assessment 7

PROPOSAL RESPONSE REQUIREMENTS

All proposal response requirements must be submitted through IonWave. The system does not allow a proposal submission unless all requirements have been met, including Attributes and Response Attachments. These requirements include, but are not limited to, the following:

Written Proposal:

Written Proposal shall be submitted as a Response Attachment in IonWave and shall include responses to Section 1 – 3. Written Proposals shall be a single PDF document with a maximum of fifteen (15) pages (numbered 1-15). Sections must be in order and clearly labeled as outlined below.

Include a coversheet that includes your firm’s name, representative, and contact information.

Coversheet does not count towards the 15-page limit.

1. Qualifications and Experience of Firm

a. Include a description of the firm including firm’s history and size. Provide information regarding how long the proposer has provided proven expertise in PCI DSS compliance.

b. Describe previous experience with SJCCD or other public entities and/or colleges, as payment systems and data handling in colleges may be unique to other industries. Include how many public entities and/or college accounts are in your current client base. Did your company perform satisfactorily to the terms and conditions of the last award given to your company? Were there any discrepancies, issues or complaints reported concerning your organization’s performance?

c. Detail whether the firm is currently in remediation status, or has been in the past, with the PCI Security Standards Council (SSC). If so, provide the date, duration and high-level cause(s) for the remediation status.

2. Qualifications and Experience of Personnel

a. Include a project-staffing plan and organizational chart for all proposed key staff members who will be assigned to this project. Identify their respective responsibilities for this project. If personnel substitutions are contemplated on a contingency basis, they should also be identified.

b. Provide brief resumes for key staff members outlining the qualifications and experience directly related to this RFP.

c. Provide evidence of certifications and provide the number of trained and certified PCI Assessors within the firm. Detail how often the certified PCI Assessors are required to attend training to keep them apprised of all current PCI regulations/requirements.

RFP 25-13 PCI Compliance Assessment 8

3. Scope Understanding, Approach, and Management

a. Describe how your services meet the scope and specifications listed in this RFP. Address any variances between your proposal and the scope.

b. Include the management and technical approach as well as a proposed timeline to complete the project. Include details pertaining to your firm’s approach and capabilities as are relevant to this proposal.

c. Describe how your company would rectify a situation where a key staff member is unable to complete work on this project.

d. List any value-added or extra services your company provides. If these services are not included in the price proposal, clearly indicate the respective fees for these additional services, if applicable.

4. References

Include references in the Attributes tab in IonWave for the following:

a. The proposer shall provide at least five (5) references on recent projects for which the proposer's company is currently providing or has provided the same type and level of service required in this RFP within the past three years. Include the name, telephone number, and valid email address of a reference person who may be contacted for further information. It is highly preferable that these references are other colleges or public sector accounts comparable in size or larger.

b. All references will be contacted by email. Make sure email addresses are current.

Evaluations will be based on responses received from references. It is advisable to notify your references ahead of time that a reference will be requested by email.

5. Exceptions to Terms and Conditions

An exception includes any addition, deletion, or other modification. Submit exceptions to terms and conditions as an attachment in the Response Attachment tab in IonWave as follows:

a. If you select Yes to “EXCEPTIONS TO TERMS AND CONDITIONS” under the Attributes tab, you must submit a written summary of each exception to this RFP, including the scope, specifications, and/or sample contract, as applicable. The summary shall include supporting justification that clearly identifies the specific reference, page, section, and sub-section of the change, relevance of the change, the vendor’s rationale for the change, and benefit to the College for accepting the change for the submitted exceptions to be considered in the evaluation.

b. The College’s evaluation of submitted exceptions will address the quantity of exceptions, type of exceptions, and justification(s) for exceptions. Fewer exceptions and/or exceptions with a lower risk to the College, if accepted, will equate to a higher score.

RFP 25-13 PCI Compliance Assessment 9

c. Any exceptions not explicitly stated may not be considered during contract negotiations, if any. The submittal of exceptions to terms and conditions does not guarantee the College’s acceptance of exceptions. The College reserves the right to accept or reject any exceptions as necessary to negotiate a mutually beneficial contract.

6. Price Proposal

Include pricing on the Line Items tab in IonWave for the following:

Line Item 1: Not-to-exceed lump sum cost for the comprehensive assessment of the College’s PCI DSS compliance status.

Response Attachment Required: Price Breakdown

In addition to the Line Item submission, respondents are required to upload a Response Attachment document containing a detailed price breakdown for Line Item 1. This document must include:

a. Costs by Phases: Provide a clear breakdown of the project phases, detailing all costs of each phase.

b. Position and Hourly Rates: Include a list of each position assigned to the project, their respective hourly rates, and the estimated number of hours for each role within each Phase listed in the above section a.

c. Travel Costs: If applicable, specify travel fees, including the number of estimated travel days required and the associated not to exceed costs.

d. Total Costs: Summarize the total costs listed within the above sections a - c. The combined total should equal the Not-to-exceed lump sum cost entered into the Line Items tab in IonWave. Line Items Tab shall prevail in the case of any discrepancies between this Price Breakdown Form and Line Items.

e. Payment Schedule: Define a payment schedule, tying payments to specific milestones and deliverables to ensure alignment with the project timeline and outcomes.

Optional Pricing Details If there are additional costs not included in the Line Items section or Price Breakdown Attachment, respondents may upload an additional Response Attachment document to provide further details.

• Any costs not explicitly stated in the proposal response will not be charged to the College.

• Clearly describe any optional services or costs and their associated benefits.

• The College reserves the right to consider pricing submitted through the Line Items, Line

Notes, and Response Attachments.

RFP 25-13 PCI Compliance Assessment 10

List of Response Attachments:

Include the following documents in the Response Attachments tab in IonWave.

All forms are available to download under the Attachments tab in IonWave. Except when listed as Optional, all Response Attachment documents are required and failure to provide a required document may deem the proposer non-responsive and disqualify the response from consideration for award.

1. Written Proposal

2. Response Attachment: Price Breakdown

3. Conflict of Interest form

4. Proof of Insurance Requirements

5. Exceptions to Terms and Conditions (optional)

6. Additional Costs Not Included in Pricing (optional)