ESBD_512312_1778879027014_Addendum No. 1.pdf
PDF 150 KB Posted
- Attached to
- Electronic Postage Services
- Solicitation number
- AG-EXT-RFP-7083
- Issued by
- Brazos County, Texas
About this file
This is Addendum No. 1 to Request for Proposal #AG-EXT-RFP-7083 issued by Texas A&M University's AgriLife division for electronic postage services supporting multiple entities including Texas A&M AgriLife Research, Texas A&M AgriLife Extension Service, Texas A&M Forest Service, College of Agriculture & Life Sciences, and Texas A&M Veterinary Medical Diagnostic Laboratory. The addendum extends the vendor questions deadline from Friday, May 15, 2026, at 5:00 p.m. Central Time to Wednesday, May 20, 2026, at 5:00 p.m. Central Time. The proposal submission deadline remains Friday, May 29, 2026, at 3:00 p.m. Central Time. A HUB subcontracting preproposal webinar is scheduled for Thursday, May 14, 2026, at 2:00 p.m. Central Time. Vendors must register as bidders within the AggieBid procurement portal at https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=TAMU to submit electronic responses.
The addendum adds Section 5.13 establishing Payment Card Industry Data Security Standard (PCI DSS) compliance requirements for the vendor as a Third-Party Service Provider processing payment card transactions. The vendor must maintain full PCI DSS compliance for all systems, applications, and services involved in storage, processing, transmission, or security of cardholder data, including payment portals, billing platforms, hosted checkout services, and recurring payment functions. The vendor must provide current Attestations of Compliance and Reports on Compliance or Self-Assessment Questionnaires at least annually, maintain documented responsibility models identifying vendor versus agency PCI DSS obligations, and provide supporting security documentation upon request. The vendor must notify the Agency without undue delay of any actual or suspected cardholder data breaches, material security incidents, PCI DSS compliance lapses, or significant service changes impacting compliance status. Morgan Helpert, CTCD Buyer I, serves as the primary contact at 979-314-5839 or morgan.helpert@ag.tamu.edu. No pricing, award value, budget range, or incumbent vendor information is disclosed in the available documentation.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ESBD_512312_1777926528168_ESBD Posting Notice.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
May 15, 2026
Addendum No. 1 Request for Proposal #AG-EXT-RFP-7083 Electronic Postage Services
The following additions, deletions, modifications, and/or clarifications shall be made to the appropriate sections of the Request for Proposal (RFP) package. The original RFP package remains in full force and effect, except as modified by this addendum.
1) Addition of Section 5.13
5.13 Payment Card Industry Data Security Standard (PCI DSS) Compliance The Vendor, as a Third‑Party Service Provider (TPSP) that provides electronic postage services and processes payment card transactions, shall maintain full compliance with the current Payment Card Industry Data Security Standard (PCI DSS) for all systems, applications, and services involved in the storage, processing, transmission, or security of cardholder data.
This requirement applies to all payment‑related components, including but not limited to payment portals, integrated billing platforms, hosted checkout services, recurring payment functions, and any connected systems within or connected to the cardholder data environment (CDE).
The Vendor shall provide, upon request and at least annually, a current Attestation of Compliance (AoC) and, as applicable, the associated Report on Compliance (RoC) or Self‑Assessment Questionnaire (SAQ), demonstrating that the services provided under this Agreement are within PCI DSS scope and compliant.
The Vendor shall also provide written documentation describing its PCI DSS responsibility model, clearly identifying which PCI DSS requirements are the responsibility of the Vendor and which are the responsibility of the Agency.
Upon request, the Vendor shall make available supporting security documentation, including relevant policies and procedures, incident response plans, vulnerability management practices, penetration testing summaries, and evidence of third‑party assessments or remediation activities.
The Vendor shall notify the Agency without undue delay of any actual or suspected cardholder data breach, material security incident, lapse in PCI DSS compliance, or any significant change to the services that may impact PCI scope, risk, or compliance status.
2) The questions deadline has been extended to Wednesday, May 20, 2026, at 5:00 p.m. (central time).
| Addendum No. 1 |
| Request for Proposal #AG-EXT-RFP-7083 |
File details come from the government source that posted it. Updated .