Informal RFP 26-065-PSC 1 PCI Compliance Evaluation

Eugene Water & Electric Board

REQUEST FOR PROPOSALS

for

PCI Compliance Evaluation

RFP No.: 26-065-PSC Closing Date: Tuesday, May 5, 2026 Time: 2:00 PM PT

Description: EWEB is seeking qualified consultant to provide an independent, comprehensive assessment of EWEB’s current PCI DSS compliance posture and deliver a structured roadmap to achieve and sustain compliance under PCI DSS v4.0.

Purchasing Contact: Wendy Lopez (541) 685-7150 wendy.lopez@eweb.org

Pre-Proposal Conference: N/A

This is an INTERMEDIATE PROCUREMENT. E-MAILED PROPOSALS will be allowed per the instructions found in Section 1.8.

EMAILED PROPOSALS will be received until the closing date and time noted above by the EWEB PURCHASING OFFICE at wendy.lopez@eweb.org.

SINGLE POINT OF CONTACT: There will be only one point of contact for the entire Request for Proposal process. The contact point is the EWEB Purchasing Office, and the contact person is the Purchasing Contact listed above, unless otherwise stated. Any questions or issues that may arise regarding the specifications, the bidding process, and/or the award process shall be directed to the Purchasing Contact listed above. EWEB’s official response to any questions or requests will be in writing through direct emails or the Addendum process.

FOR MORE INFORMATION please refer to Part 1 “Instructions to Proposers”

Informal RFP 26-065-PSC 2 PCI Compliance Evaluation

TABLE OF CONTENTS

Section Description Page

1 Instructions to Proposers 5

2 Scope of Work 7

3 Reserved 11

4 Evaluation Process & Contractor Selection 12

5 Evaluation Criteria 16

6 Proposal Form 18

ATTACHMENTS

C Sustainability Questionnaire

EXHIBITS

Sample Contract

Informal RFP 26-065-PSC 3 PCI Compliance Evaluation

1. INSTRUCTIONS TO PROPOSERS

All proposals and contracts are subject to the provisions and requirements of the Oregon Revised Statutes 279A and 279B and EWEB Public Contracting Rules Divisions 1, 2, 3 and 6.

PROPOSAL PREPARATION

1.1 PROPOSAL FORMAT

Proposals shall be submitted on the form provided in the Request for Proposals, unless otherwise instructed.

Proposals must be emailed and received by EWEB by the submittal deadline.

1.2 CONFORMANCE TO SOLICITATION REQUIREMENTS

Proposals shall conform to the requirements of the Request for Proposals. All necessary attachments shall be submitted with the proposal and in the required format.

1.3 PREPARATION COSTS

Proposers responding to RFPs are responsible for all costs they may incur in connection with submitting

Proposals and responses to RFPs, which includes, but is not limited to: submittal preparation, submittal, travel, expenses, interviews, presentations, or evaluation of any proposal.

1.4 PROPOSER'S PROPOSED TERMS AND CONDITIONS Rule 3-0230(7)(b)

Proposers may include in the Cover Letter of their response, proposed contractual terms and conditions revisions to the Sample Contract (Exhibit 1). Proposers may not protest or request to change the entire terms and conditions of the solicitation. For example, you may not seek to replace EWEB’s terms and conditions in whole with your company’s terms and conditions, standard contract, master services agreement, etc.

EWEB reserves the right to negotiate the proposed terms and/or conditions with Proposer, and either accept or reject the proposed terms and/or conditions. REQUESTS FOR REVISION OF EWEB CONTRACTUAL

TERMS AND CONDITIONS MAY BE MADE AT TIME OF PROPOSAL SUBMISSION. THERE MAY BE NO

OPPORTUNITY TO DO SO AT A LATER DATE.

NO PROPOSED TERMS OR CONDITIONS SHALL BECOME A PART OF THE AWARDED CONTRACT UNLESS

ACCEPTED BY EWEB AND INCORPORATED INTO THE CONTRACT IN WRITING.

1.5 SIGNATURE ON PROPOSAL

Proposals shall be signed by an authorized representative of the Proposer. Signature on a proposal certifies that the proposal is made without connection with any person, firm or corporation making a proposal for the same goods and/or services and is in all respects fair and made without collusion or fraud. Signature on a proposal also certifies that the Proposer has read, fully understands and agrees with all solicitation requirements, terms and conditions. No consideration will be given to any claim resulting from proposing without fully comprehending all requirements of the Request for Proposals.

Proposers shall only enter information within the proposal document where it is requested or required.

Proposers shall NOT make any alterations to the original solicitation document. Any proposal that has been altered may be rejected.

1.6 CANCELLATION, REJECTION, DELAY OF RFP

Pursuant to Rule 3-0640, EWEB may cancel, reject in whole or in any part of any proposals, without liability incurred by EWEB at any time after issuing an RFP, if EWEB believes it is in EWEB’s interest to do so.

Informal RFP 26-065-PSC 4 PCI Compliance Evaluation

1.7 RESERVED

PROPOSAL SUBMISSION

1.8 PROPOSAL SUBMISSION

(A) Emailed proposals, including any Addenda to be acknowledged, shall be received by the EWEB Purchasing department prior to RFP closing. Proposals received after the RFP closing date and time may be rejected. To ensure that your proposal receives priority treatment within our emailing system, it should be labeled with the following information in the subject header:

RFP # 26-065-PSC, Due May 5, 2026 2:00 PM PT

EWEB is not responsible for proposals submitted in any manner, format or to any delivery point other than as required by the Solicitation Document.

(B) REQUIRED PROPOSAL PACKAGE

Complete, sign, and return the following documents as bid response. Failing to include these documents could lead to rejection of bid.

• Cover Sheet, with:

Contractual Acceptance: Statement accepting ALL terms and conditions contained in this solicitation and the Sample Contract (Exhibit 1). Statement may also include request for negotiation of proposed terms and conditions as allowed per Section 1.4

Termination for Default: Proposers shall indicate if they have had a contract terminated for default in the last five years. Termination for default is defined as notice to stop performance that was delivered to the Proposer due to the Proposer’s non-performance or poor performance and the issue of performance was either (a) not litigated due to inaction on the part of the Proposer, or (b) litigated and determined that the Proposer was in default.

NOTE: If a Proposer has had a contract terminated for default in this period, then the Proposer shall submit full details including the other party’s name, address and phone number. EWEB will evaluate the facts and may, at its sole discretion, reject the proposal on the grounds of Proposer’s past performance.

• Section 6 - Proposal Form

• Response to Minimum Qualifications (Section 3)

• Response to All Evaluation Criteria (Section 5)

(C) RESPONSIVENESS / RESPONSIBILTIY

A “Responsive” proposal is a proposal that substantially complies with the Request for Proposals instructions and requirements.

A “Responsible” Proposer can demonstrate ability to meet the requirements of the Scope of Work, has the appropriate experience, is legally qualified to do the Work, has the required certifications required, has a satisfactory record of integrity and can meet the other requirements described in

ORS 279B.110(2).

Informal RFP 26-065-PSC 5 PCI Compliance Evaluation

1.9 ADDENDA. Any VERBAL communication cannot and shall not be construed as approval of the acceptability of any deviation to any requirement. All changes to requirements and/or the solicitation documents will be made in the form of Addenda, which will be emailed to participating Proposers. The Proposer is responsible for ensuring that they are aware of and acknowledge all addenda in their RFP Response.

1.10 PROPOSAL MODIFICATION

Modifications or erasures made before proposal submission shall be initialed by the person signing the proposal. Proposals, once submitted, may be modified in writing before the time and date set for proposal closing. Any modification shall be prepared on company letterhead, shall be signed by an authorized representative, and shall state that the new document supersedes or modifies prior proposal submissions and any other prior proposal modifications. Proposal modifications shall be submitted in a sealed envelope clearly marked “Proposal Modification,” identifying the RFP number and closing date and time. Proposers may not modify proposals after RFP closing date and time.

1.11 PROPOSAL WITHDRAWALS: Proposals may be withdrawn in writing on company letterhead signed by an authorized representative and received by the EWEB Purchasing Office prior to RFP closing time. Proposals may also be withdrawn in person before RFP closing time upon presentation of appropriate identification.

1.12 EXCEPTIONS

Any exceptions to the requirements of this solicitation MUST be submitted in accordance with Item 1.3

PROTEST OF REQUIREMENTS OR CONTRACT TERMS / REQUEST FOR CHANGE. Exceptions submitted with your proposal, or in any manner other than the process provided herein, may cause your proposal to be ruled non-responsive and rejected.

1.13 ALTERNATE PROPOSALS

Proposers may submit more than one proposal. All proposals must comply with the requirements of the RFP except that additional proposals may incorporate, by reference, repetitive information which is provided in the complete proposal.

1.14 PROPRIETARY DATA/PUBLIC RECORD

This Request for Proposal, together with copies of all documents pertaining to the award of a contract, shall be kept by EWEB and made a part of a file or record which shall be open to public inspection. If a proposal contains any information that is considered a trade secret under ORS 192.345(2), each sheet of such information shall be marked with the following legend:

"This data constitutes a trade secret under ORS 192.345(2), and shall not be disclosed except in accordance with the Oregon Public Records Law, ORS Chapter 192."

The Oregon Public Records Law exempts from disclosures only bona fide trade secrets, and the exemption from disclosure applies only "unless the public interest requires disclosure in the particular instance" ORS 192.345(2). Therefore, non-disclosure of documents or any portion of a document submitted as part of a proposal may depend upon official or judicial determinations made pursuant to the Public Records Law.

The above restriction may not include cost or price information, which shall be open to public inspection.

SCHEDULE OF EVENTS

1.15 The schedule of events set out herein represent Eugene Water & Electric Board’s best estimate of the schedule that will be followed.

Informal RFP 26-065-PSC 6 PCI Compliance Evaluation

Request for Proposal released April 7, 2026

Last day for EWEB to receive questions from Proposers April 23, 2026

Last day EWEB will post Addenda April 27, 2026

Closing date (last day to submit proposals to EWEB) May 5, 2026

Responses evaluated May 6-13, 2026

Interviews / Presentations held May 14-21, 2026

Intent to Award Announcement May 22, 2026

Contract Award May 29, 2026

Informal RFP 26-065-PSC 7 PCI Compliance Evaluation

2. BACKGROUND / SCOPE OF WORK

2.1 BACKGROUND

The Eugene Water & Electric Board (EWEB) is Oregon’s largest customer-owned water and electric utility, serving approximately 200,000 residents in Eugene and the surrounding areas. Established in 1911, EWEB is governed by a publicly elected Board of Commissioners and is committed to providing safe, reliable, affordable, and environmentally responsible utility services to its community.

EWEB operates critical infrastructure across electric generation, transmission, distribution, and water treatment systems. The utility maintains a strong commitment to operational excellence, cybersecurity resilience, and regulatory compliance, recognizing the essential role utility services play in public health, safety, and economic stability.

In 2024, EWEB completed a significant modernization initiative, transitioning its legacy enterprise resource planning (ERP) system to SAP S/4HANA. This implementation included updates to financial systems, customer information integration, and billing-related workflows. The ERP transition introduced new system integrations, updated payment processing interfaces, and revised business processes that may impact the Cardholder Data Environment (CDE) and PCI DSS scope. As part of its commitment to secure system architecture and regulatory compliance, EWEB seeks to determine how these changes impact EWEB’s ability to comply with PCI DSS requirements.

EWEB processes payment card transactions on the phone and online. Given the evolving threat landscape, PCI DSS v4.01 requirements, and recent enterprise system changes, EWEB seeks to engage a qualified third-party firm to perform a comprehensive assessment of its current state, define a PCI DSS compliant architecture, and create a remediation roadmap to achieve and maintain PCI DSS compliance.

2.2 LENGTH OF CONTRACT

The contract for this project (“Contract”) will start from the date of award, and will last approximately until August 31, 2026.

2.3 LOCATION OF WORK

The location the work is to be performed, completed and managed is at Contractor’s business location.

2.4 OBJECTIVES/SCOPE OF SERVICES

Objectives:

The selected Contractor shall provide an independent, comprehensive assessment of EWEB’s current PCI DSS compliance posture and deliver a structured roadmap to achieve and sustain compliance under PCI DSS v4.0.

The assessment shall explicitly evaluate EWEB’s environment against the six primary PCI DSS control objectives:

1. Build and Maintain a Secure Network and Systems

2. Protect Account Data

3. Maintain a Vulnerability Management Program

4. Implement Strong Access Control Measures

5. Regularly Monitor and Test Networks

6. Maintain an Information Security Policy

Informal RFP 26-065-PSC 8 PCI Compliance Evaluation

Objectives include:

• Identification and documentation of all cardholder data flows.

• Validation of PCI scope considering EWEB’s 2024 SAP S/4HANA implementation and related integrations.

• Identification of control gaps under each PCI control objective.

• Definition of architectural and operational improvements to reduce PCI scope and risk.

• Development of a prioritized remediation roadmap aligned with PCI DSS v4.01 requirements.

• Delivery of executive-level and operational-level reporting.

Scope of Services:

The Contractor shall conduct the PCI DSS assessment in alignment with the six (6) PCI DSS control objectives as described below.

Control Objective 1: Build and Maintain a Secure Network and Systems

The Contractor shall assess:

• Network security controls (firewalls, segmentation, secure configurations).

• System hardening standards.

• Change management controls related to SAP S/4HANA implementation.

• Network architecture and segmentation of the Cardholder Data Environment (CDE).

• Secure configuration standards for servers, endpoints, databases, and applications.

• Third-party connectivity impacting the CDE.

Deliverable: Evaluation of network architecture and configuration controls, including identification of segmentation gaps or scope expansion risks.

Control Objective 2: Protect Account Data

The Contractor shall assess:

• Storage, processing, and transmission of cardholder data.

• Encryption mechanisms and key management practices.

• Tokenization or truncation controls.

• SAP payment-related integrations and data handling.

• Data retention and secure disposal practices.

• Transmission security (TLS configurations).

Deliverable: Detailed review of data flow diagrams and identification of any unprotected or improperly handled account data.

Control Objective 3: Maintain a Vulnerability Management Program

The Contractor shall assess:

• Anti-malware deployment and effectiveness.

• Vulnerability scanning practices.

• Patch management processes.

Informal RFP 26-065-PSC 9 PCI Compliance Evaluation

• Secure software development practices (as applicable).

• Third-party application update management.

Deliverable: Assessment of vulnerability lifecycle management and identification of deficiencies in scanning, remediation timelines, or documentation.

Control Objective 4: Implement Strong Access Control Measures

The Contractor shall assess:

• Role-based access controls.

• Identity and access management processes.

• Multi-factor authentication implementation.

• Privileged access management.

• Access provisioning and deprovisioning workflows.

• Physical access restrictions to CDE systems.

• SAP user access controls impacting financial and payment workflows.

Deliverable: Access control effectiveness evaluation and identification of excessive or unmanaged privileges.

Control Objective 5: Regularly Monitor and Test Networks

The Contractor shall assess:

• Logging and monitoring practices.

• Security event detection and alerting.

• Log retention practices.

• Penetration testing and segmentation validation.

• Intrusion detection or prevention systems.

• Incident response testing and documentation.

Deliverable: Assessment of monitoring maturity and recommendations for enhanced detection and validation testing.

Control Objective 6: Maintain an Information Security Policy

The Contractor shall assess:

• Information security policies and standards.

• Governance framework supporting PCI compliance.

• Security awareness training programs.

• Incident response plan alignment with PCI requirements.

• Vendor management oversight of PCI-relevant service providers.

• Ongoing compliance management processes.

Deliverable: Policy alignment analysis and governance maturity assessment with recommendations for sustainable PCI compliance oversight.

Informal RFP 26-065-PSC 10 PCI Compliance Evaluation

Gap Analysis

For each of the six PCI control objectives, the Contractor shall:

• Map findings to applicable PCI DSS v4.01 requirements.

• Identify compliant, partially compliant, and non-compliant controls.

• Provide risk-ranked observations.

Deliverable: PCI DSS Gap Analysis Matrix organized by the PCI DSS v4.01 requirements.

Reporting Requirements

The Contractor shall provide:

• Executive Summary organized by the six PCI control objectives.

• Detailed technical findings appendix.

• Gap matrix referencing PCI DSS v4.01 requirements.

• Documented recommended architectural and operational improvements to reduce PCI scope and risk.

• Prioritized remediation roadmap aligned with PCI DSS v4.01 requirements.

Informal RFP 26-065-PSC 11 PCI Compliance

3. MINIMUM QUALIFICATIONS - RESERVED

Informal RFP 26-065-PSC 12 PCI Compliance

4. EVALUATION PROCESS & CONTRACTOR SELECTION

EWEB intends to use a Multi-tier evaluation process. In Tier One, a Competitive Range of shortlisted finalists are determined by their qualifications/proposed pricing to fulfill the Work. In Tier Two, interviews are subsequently held to determine final award. Additional detail can be found below.

EWEB reserves the right to forego Tier Two/Interviews if an apparent Finalist is determined.

Points are assigned as follows:

Criteria Total Possible Points Tier One

Firm Qualifications 30 Project Approach 30 Project Team 20 Cost Proposal 20

Tier Two Interviews 100

TOTAL POSSIBLE SCORE 200

4.1 Review and Acknowledgment of Defective Proposals

Due to limited resources, EWEB generally will not completely review or analyze proposals that on their faces fail to comply with the minimum mandatory requirements of the solicitation documents nor will EWEB generally investigate the references or qualifications of such proposals. Therefore, EWEB will not acknowledge whether or not an unsuccessful proposal was complete, responsive, responsible, sufficient, or lawful in any respect. This is a public solicitation, the processes and procedures which are established and required by Oregon law and EWEB adopted rules. Proposers are advised to strictly follow the process, procedures, and requirements as set forth in the RFP documents and not anticipate or rely on any opportunity to negotiate, beyond such limitations that are identified herein.

4.2 Right of Rejection

Proposers must comply with all of the terms of the RFP, EWEB Rules, and all applicable local, state, and federal laws, administrative rules, and regulations. The Purchasing Contact may reject any proposal that does not comply with all of the material and substantial terms, conditions, and performance requirements of the RFP.

Proposers may not make stipulations or restrict the rights of EWEB. If a Proposer does so, the Purchasing Contact may determine the proposal to be a non-responsive counter-offer and the proposal may be rejected.

The Purchasing Contact may waive minor informalities that:

• do not affect responsiveness,

• are merely a matter of form or format,

• do not change the relative standing or otherwise prejudice other offers,

• do not change the meaning or scope of the RFQ/RFP,

• are trivial, negligible, or immaterial in nature,

• do not reflect a material change in the work, or,

• do not constitute a substantial reservation against a requirement or provision, Informal RFP 26-065-PSC 13 PCI Compliance

EWEB reserves the right to refrain from making an award if it determines that to be in its best interest.

A proposal from a debarred or suspended Proposer shall be rejected.

4.3 References

EWEB reserves the right to investigate any and all references and the past performance information provided in the proposal with respect to Respondent's successful performance of similar projects, compliance with specifications and contractual obligations, completion or delivery of a project on schedule, and lawful payment of employees and workers.

EWEB reserves the right to check any and all sources for information and to include sources other than the references provided in the Proposer's proposal. EWEB may consider information available from any such source including government bodies and regulatory authorities in evaluating respondents, including past experience EWEB has had with the Proposer.

4.4 Responsibility

EWEB reserves the right to investigate and evaluate, at any time prior to award and execution of the Contract, the apparent successful Proposer’s responsibility for performing the Contract, as defined in Rule 3-0500. Submission of a signed proposal shall constitute approval for EWEB to obtain any information EWEB deems necessary to conduct the evaluation. EWEB reserves the right to request additional information or documentation from the successful Proposer prior to award of a contract. Such information may include, but is not limited to, current and recent balance sheets, income statements, cash flow statements, or a performance bond from an acceptable surety. Failure to provide this information will result in the rescission of EWEB's Intent to Award.

EWEB may postpone the award of the Contract after announcement of the apparent successful Proposer in order to complete its investigation and evaluation. Failure of the apparent successful Proposer to demonstrate responsibility shall render the Proposer non-responsible and shall constitute grounds for rejection of the proposal.

4.5 Clarification of Response

EWEB reserves the right to request clarification of any item in any proposal, or to request additional information necessary to properly evaluate a particular proposal. All requests for clarification and responses shall be in writing.

During the evaluation of Proposals, Proposers must respond to any request for clarification from the Evaluation Committee within 24 hours of request (Monday through Friday). Inability of the Evaluation Committee to reach a Proposer for clarification and/or failure of a Proposer to respond within the time stated may result in rejection of that Proposer’s Proposal.

4.6 Evaluation Process

Proposals will be evaluated and shortlisted for up to 3 Proposers (or at a natural break in scoring). EWEB reserves the right to conduct interviews to further refine scores. Proposals will be ranked from highest score to lowest.

Pursuant to Rule 3-0230(14)(d), EWEB may employ methods of Contractor selection that include without limitation:

(A) An award or awards based solely on the ranking of proposals;

(B) Discussions leading to best and final offers, in which EWEB may not disclose private discussions leading to best and final offers;

Informal RFP 26-065-PSC 14 PCI Compliance

(C) Discussions leading to best and final offers, in which EWEB may not disclose information derived from proposals submitted by competing Proposers;

(D) Serial negotiations, beginning with the highest ranked Proposer;

(E) Multiple-tiered competition designed to identify, at each level, a class of Proposers that fall within a competitive range or to otherwise eliminate from consideration a class of lower ranked Proposers;

(H) Any combination of methods described in this Section.

4.7 Interviews / Presentations

Should a Multi-tiered process be used, the outcome of the written proposal evaluations in Tier One may result in placement on a short list of finalists. EWEB may invite up to three (3) of the highest-ranked firms (or at a natural break in scoring) to interview / present. Each Proposer’s Key Persons, as identified by EWEB, shall be prepared to attend the interview within five (5) business days of notification by EWEB, and shall be provided with information regarding what to prepare for.

The total points possible for the interview / presentation will be added to each firm’s preliminary scores.

4.8 Contractor Selection

If a Contract is awarded, EWEB shall award the Contract to the responsible Proposer whose proposal EWEB determines in writing to be the most advantageous to EWEB based on:

a) The evaluation process and evaluation factors described in this Request for Proposals;

b) Any applicable preferences allowed by EWEB Rules, Division 2; and when applicable,

c) The outcome of any negotiations authorized by this Request for Proposals

If this Request for Proposal specifies or authorizes the award of multiple public contracts, EWEB shall award public contracts to the responsible Proposers who qualify for the award of a Contract under the terms of this Request for Proposals.

The firm with the highest total score as a result of written proposal scoring AND optional interview / presentation scoring will be awarded the Contract.

4.9 Notice of Intent to Award

After the completion of the evaluation and final ranking, the Purchasing Contact will issue a written notice of Intent to Award and send copies to all Proposers. The notice will set out the names and ranks of all Proposers and identify the Contractor selected for award (“Highest Ranked Proposer” or “Finalist”.)

4.10 Contract Negotiation

EWEB will begin negotiating a Contract (refer to Exhibit 1 Sample Contract) with the Highest Ranked Proposer and will direct negotiations toward obtaining written agreement on:

a) The scope of work;

b) The Contract price as it is affected by negotiating the scope of Work; and

c) Any other terms and conditions reasonable related to those expressly authorized for negotiation in

Sections 1.3 and 1.4 of the Request for Proposal.

At any time during discussions or negotiations, EWEB may terminate such discussions or negotiations with the highest-ranked Proposer if it reasonably believes that:

a) The Proposer is not discussing or negotiating in good faith; or

b) Further discussions or negotiations with the Proposer will not result in the parties agreeing to the terms and conditions of a final Contract in a timely manner.

Informal RFP 26-065-PSC 15 PCI Compliance

If EWEB terminates negotiations, EWEB may then commence negotiations with the next highest ranked Proposer and continue the process until EWEB has determined to award the Contract to the Proposer with whom it is currently discussing or negotiating. If negotiations with any Proposer do not result in a Contract within a reasonable amount of time, as determined solely by EWEB, EWEB may reject all proposals and cancel the RFP. Nothing in the rule precludes EWEB from proceeding with a new formal solicitation for the same Work described in the RFP that failed to result in a Contract.

Informal RFP 26-065-PSC 16 PCI Compliance

5. EVALUATION CRITERIA

Instructions - Include in your proposal package a response to the following questions, listing the question first and the response directly beneath. Failure to respond to one or more questions could lower total score or cause the response to be deemed Non-Responsive and rejected.

5.1 Company Experience/Qualifications (30 points possible)

a. Provide Company overview and demonstrate qualifications to complete the requested services.

b. Experience of the firm will be evaluated on the following:

1. PCI assessment experience

2. Experience with utilities or public sector entities

3. Experience assessing SAP-integrated environments

4. Experience providing PCI DSS compliant architecture and consulting services

5. Relevant qualifications

c. Provide a description of the three (3) most recent projects completed within the last ten (10) years that most closely resemble the project that is being described in this solicitation.

Proposers shall provide the following for each project:

1. Name / city /state of the client.

2. Client Representative: Provide name, email, phone

3. Contract number or other information available to identify the contract.

4. Complete description of work performed.

5. Date work was started / Original date work was scheduled for completion, and / date work was actually finished.

6. If project was not finished on time, briefly explain the reason, and what attempts were made to bring the project back on schedule.

Points may also be determined by taking into consideration whether or not there is a record of satisfactory performance under rule 4-0120 (List of Interested Consultants; Performance Record)

5.2 Project Approach (30 points possible)

Demonstrate Proposer’s ability to clearly define the desired action to be taken and to perform the tasks and subtasks identified in the Scope of Work. Response should include the proposed work plan and schedule for delivery of key milestones and indicate management approach to be utilized when addressing key issues of the project.

Points will be awarded based on a clear demonstration of the following:

1. Understanding of EWEB’s environment

2. Methodology for PCI DSS assessment

3. Approach to SAP-related scope validation

4. GAP analysis methodology

5. Remediation planning approach

6. Quality assurance processes

7. Complete project timeline that indicates key milestones and tasks that require EWEB personnel to complete, Description of deliverables, and sample report (redacted).

Informal RFP 26-065-PSC 17 PCI Compliance

5.3 Key Staff Experience (20 points possible)

Demonstrate Proposer’s team qualifications and experience relating to the requested services. References listed, or other documented references may be used by EWEB during the evaluation of this criterion.

Response should address the following:

1. Names of key personnel

2. Roles and responsibilities of key personnel

3. Certifications and experience of key personnel

4. Availability and commitment for key personnel

5.4 Pricing Proposals (20 points possible)

a. Provide details of estimated hours and hourly rates for staff to determine a complete and not-to-exceed project fee. Sub-total between the major areas of work to match project approach.

b. Provide a breakdown and total not-to-exceed dollar amount for all anticipated expenses (travel, per-diem, etc.) to be reimbursed by EWEB during the term of the Contract.

c. Points will be awarded according to the following formula:

A = Total Possible points = xx L = Lowest cost proposed X = Cost being scored B = Awarded Score

Formula: "L" divided by "X" times "A" = "B"

Example: If A = 50 Points, L = $50,000; X = $75,000; then: $50,000 / $75,000 x 50 = 33.50 points

Informal RFP 26-065-PSC 18 PCI Compliance

6.PROPOSAL FORM

Proposals should be prepared and organized in a clear and concise manner and must include all information required by this RFP. Headers, Titles or Tabs should be used to identify required information. Responses to the Evaluation Criteria found in Section 6 shall be organized in the order listed in Section 5, preferably by re-stating the Criteria, then responding below.

A. PROPOSAL PACKAGE

RETURN THE FOLLOWING WITH YOUR RFP RESPONSE, PER SECTION 1.8(B):

(Place a check in front of the item indicating inclusion in your response)

COVER SHEET, with introduction of firm PROPOSAL FORM – Section 6 RESPONSE TO ALL EVALUATION CRITERIA listed in Section 5

ATTACHMENT C – SUSTAINABILITY QUESTIONNAIRE

B. ACKNOWLEDGMENT OF RECEIPT OF ADDENDA TO RFP DOCUMENTS:

Proposer acknowledges all Addenda and agrees to be bound by their contents.

Circle each RFP Addendum received: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10

Check if not applicable or no Addenda were received: ____

C. MWESB STATUS

EWEB encourages contracting with minority owned, woman owned, and emerging small businesses (MWESB).

The State of Oregon offers a certification process. Indicate below if your business is a MWESB and if so, which categories have been state certified.

MWESB Certified? Yes _____ No _____. If yes, indicate which categories below:

Minority Owned _____ Woman Owned _____ Emerging Small Business _____ Veteran Owned _____

D. BIDDER RESIDENCY INFORMATION:

ORS 279A.120 states, "For the purposes of awarding a public contract, a contracting agency shall":

o Give preference to goods or services that have been manufactured or produced in this state if price, fitness, availability and quality are otherwise equal; and o Add a percent increase to the bid of a non-resident bidder equal to the percent, if any, of the preference given to the bidder in the state in which the bidder resides.

“Resident Bidder” means a bidder that has paid unemployment taxes or income taxes in the state of Oregon during the 12 calendar months immediately preceding submission of the bid, has a business address in this state, and has stated in the bid whether the bidder is a Resident Bidder under this paragraph.

“Non-Resident Bidder” means a bidder who is not a Resident Bidder as defined above

1. CHECK ONE: Bidder is a ( ) RESIDENT Bidder ( ) NON-RESIDENT Bidder.

Informal RFP 26-065-PSC 19 PCI Compliance

2. If Resident Bidder, enter your Oregon business address: (physical and mailing address)

3. If a Non-Resident Bidder, enter state of residency:

4. If a Non-Resident Bidder, do you or your company receive, or are you or your company eligible for any preference in award of contracts with your state’s government or with other governmental bodies in your state?

CHECK ONE: ( ) YES ( ) NO

If YES, state the preference percentage: _________________%

If YES, but not a percentage of bid price, describe the preference:

If YES, state the law or regulation that allows the preference described (legal citation):

E. ACKNOWLEDGEMENT OF INDEPENDENT CONTRACTOR STATUS

The undersigned acknowledges that:

1. Contractor certifies its status as an independent contractor in satisfaction of Oregon law, including ORS 670.600, and shall perform all required Work as an independent contractor. EWEB holds the right (i) to determine the delivery schedule for the Work to be performed and (ii) to evaluate the quality of the completed performance, but EWEB cannot and will not control the means or manner of Contractor’s performance. Contractor is responsible for determining the appropriate means and manner of performing the Work.

2. The parties covenant that Contractor, its subcontractors, agents, officers and representatives do not qualify as officers, employees, or agents of EWEB as those terms are used in ORS 30.265, nor shall they seek such qualification relating to performance of the Work.

3. Contractor agrees it is responsible for all federal and state taxes or other payments or withholdings applicable to compensation or payments paid to Consultant under this Contract and shall hold EWEB harmless from such financial exposures.

PROPOSER SIGNATURE / EXECUTION OF RFP SUBMISSION

F. ASSURANCES:

The undersigned attests that they:

Have read and understand all instructions, requirements, Addenda, site conditions, and terms and conditions contained herein (including the attachments and exhibits listed in this solicitation).

Have the authority and/or responsibility to submit a proposal and to bind their organization in all phases of this RFP process.

Confirm the information provided is true and accurate to the best of their knowledge.

Informal RFP 26-065-PSC 20 PCI Compliance

Understand that any false statement may disqualify this offer from further consideration or may be cause for Contract termination.

Have not and will not discriminate against a subcontractor in the awarding of a subcontract because the subcontractor is a disadvantaged minority, women or emerging small business enterprise certified under ORS 200.055.

Represent and warrant to EWEB that they have the power and authority to enter into and perform work under an awarded Contract and that the Contract, when executed by EWEB and Contractor, the Contract shall be a valid and binding obligation of Contractor, enforceable in accordance with its terms.

Arrived at the specifics of the proposal, including price and amounts, independently and without communication or agreement with another Proposer, except as disclosed in a separately attached statement;

Have not directly or indirectly induced or solicited another Proposer, in order to benefit a third person, to submit a false or sham proposal, to refrain from proposing, or to change a proposal;

Have not directly or indirectly disclosed the Proposer's proposal price, a breakdown of the price, the contents of the price or information or data related to the price to another Proposer;

Have not sought through communication or agreement with a person to fix the proposal price of the Proposer or another Proposer, to fix an overhead, profit or cost element of the proposal price of the Proposer or another Proposer or to secure any advantage against the contracting agency or any other person interested in the public contract;

Have not directly or indirectly expressed an interest or lack of interest in the public contract, or paid or offered to pay a fee to a person, to cause a collusive or sham proposal;

Contractor, by signing this Proposal Form, represents and warrants that, if awarded, Contractor’s performance under this contract will create no potential or actual conflict of interest, including but not limited to conflicts of interest as defined in ORS 244.020. Contractor further warrants that no state or federal law or EWEB rule will prevent Contractor's lawful performance of an awarded contract. If Contractor is currently performing work for EWEB or another governmental entity, Contractor’s participation in other public contracts will not create a potential or actual conflict of interest in performance of this Contract, if awarded.

PROPOSER INFORMATION:

Proposer Company Name

Company Address (from which work will be performed)

Telephone Number Fax Number FEDERAL ID NUMBER

Person Signing RFP_______________________________________Title_______________________________ Please print or type Name

Informal RFP 26-065-PSC 21 PCI Compliance

Signature: _________________________________________________________________________________

Email Address: _____________________________________ Phone: ___________________________________

RFP CONTACT (if different than above)

RFP Representative_______________________________________Title_______________________________ Please print or type Name

Signature: _________________________________________________________________________________

Email Address: _____________________________________________________________________________

Phone: ____________________________________________________________________________________

ATTACHMENT C

Sustainability Questionnaire

Company Name: ______________________________________ Date: _________

The Supplier Sustainability Questionnaire must be completed and returned with your bid/proposal. This questionnaire is applicable to firms that provide services and/or goods. Responses can be up to 4 pages.

1. What policies or plans are in place to help decrease environmental or social impacts from your supply chain or manufacturer (if company is a distributor) such as decreasing use of toxic or hazardous products, efficient use of natural resources, reducing greenhouse gas emissions, waste reduction, and worker health and safety? Please provide links to documents. How does your company monitor and manage your supply chain regarding environmental and social issues?

2. What type of sustainable packaging/shipping materials do you use, such as reusable, recycled content, or compostable materials? Does your company have a Zero Waste Plan; if so, describe the progress your company has made to implement the plan. If you don’t use sustainable packaging please detail, why not.

3. Does your company have transportation strategies to reduce fossil fuel, maintain local warehouses to shorten shipping distances and lead times, or combine shipments to receive economies of scale? If so, please include link or details of plan.

4. Has your company been cited in the last 5 years for non-compliance of any permits, rules or regulations pertaining to environmental, health and/or safety? If yes, please state the reason, and outcome of the citation including a description of the steps taken by your company to rectify the problem.

5. What programs do you have in place, or are planned for to increase resource efficiency such as reducing use of electric, water, labor, or material resources?

6. Have the product(s) that you are bidding/proposing been certified by a third-party organization, such as Green Seal, Ecobiz, or ENERGY STAR. If yes, detail which ones and the relevant third-party certification?

Personal Services Contract

Contract Description

Contract No. _______

By and between

Eugene Water & Electric Board and

Contractor

Contract #xxxx / Title Rev 011-19-24

This Contract is entered into by and between the Eugene Water & Electric Board, hereinafter called EWEB, and ________________________________, hereafter called Contractor.

WHEREAS, EWEB has need for the services of an independent contractor with the particular training, knowledge, and experience offered by the Contractor; and

WHEREAS, EWEB has negotiated the following Agreement in Eugene, Oregon, and Contractor has agreed to deliver its services in Eugene, Oregon;

NOW THEREFORE, in consideration of a sum agreed to by the Parties, the Contractor agrees to perform the services as described in this Contract, in accordance with all requirements, terms and conditions of this Contract, as set forth below:

DEFINITIONS

“Consultant” or “Contractor” means the Person with whom EWEB enters into a Contract.

“Contract” or “Contracts” means the Written agreement(s), resulting from the Solicitation Document that sets forth the rights and obligations of the parties.

“Contract Administrator” or “Project Manager” means the person designated by EWEB to administrate the Contract on EWEB’s behalf.

“Contractor” or “Consultant” means the Person with whom EWEB enters into a Contract.

“Deliverable” means the outcomes resulting from the Work in accordance with the terms and conditions of this Contract.

"Person" means a natural person capable of being legally bound, a sole proprietorship, a corporation, a partnership, a limited liability company or partnership, a limited partnership, a for-profit or nonprofit unincorporated association, a business trust, two or more persons having a joint or common economic interest, any other person with legal capacity to contract or a public body.

“Personal services” requires specialized knowledge and skill in the application of technical or scientific expertise, or the exercise of professional, artistic or management discretion or judgement and usually requiring a license, certification, or registration.

“Rule” means a Rule within the EWEB Public Contracting Rules.

“Services” and "Work" means the furnishing of all materials, equipment, labor, and incidentals necessary to successfully complete any individual item or the entire Contract and successful completion of all duties and obligations imposed by the Contract.

“Working hours” means EWEB’s regular business hours, which currently are Monday through Friday, 9 a.m. to 5 p.m. (Confirm with Contract Administrator), excluding EWEB recognized holidays.

All other terms not expressly identified above shall have the meanings as set forth in EWEB Public Contracting Rules, Division 1 - Definitions.

ARTICLES

HEADINGS: The section (“Section” or “Article”) headings in this Contract are included for convenience only; they do not give full notice of any portion of the terms of this Contract and are not relevant to the interpretation of any provision of this Contract.

CONTRACT COMMENCEMENT

1. Effective Date And Duration

a. This Contract shall become effective on the date this Contract has been signed by every party hereto and, when executed by EWEB's Purchasing Supervisor. Unless terminated or extended, this Contract shall expire on ___________________, 202__. Expiration shall not extinguish or prejudice EWEB’s right to enforce this Contract with respect to any breach of a Contractor warranty or any default or defect in Contractor’s performance that has not been cured.

b. Contract Extension. This Agreement may be renewed for additional period(s), in accordance with EWEB

Rule 3-0850, Contract Amendments, subject to agreement by the Parties prior to the expiration of the current term. The maximum term for this Agreement shall not exceed five (5) years.

OR for automatic renewal option, replace “a” and “b” with:

This Contract shall become effective on the date this Contract has been signed by every party hereto and, when executed by EWEB's Purchasing Supervisor. Unless terminated in accordance with the early termination provisions in Section 12, this Agreement will automatically renew on the anniversary of the original Contract Execution Date. If Contractor does not agree to renew the Agreement for an additional term, Contractor must notify EWEB within 90 days of the anniversary of the original Contract execution date. The maximum term for this Agreement shall not exceed five (5) years.

PRICING AND PAYMENT

2. Contract Consideration

The “Maximum, Not-to-exceed Compensation” payable to Contractor under this Contract (based upon the established fees herein), which includes any allowable expenses, is $_______________. Additional pricing detail, if any, is provided in Attachment A – Statement of Services.

3. Invoicing & Payment

a. Contract Administrator - EWEB's Contract Administrator is insert name.

b. Payment Process - Interim payments to Contractor shall be made according to the following:

Cost Calculation: The Contract establishes an estimated number of hours for Contractor to complete all Work described in Attachment A - Statement of Services, as well as a Maximum Not-to-Exceed Compensation amount (Section 2) for the overall Contract. The cost of the Services shall be determined by multiplying the number of Contractor hours for each Contractor employee providing services during the invoice period multiplied by the applicable hourly billing rate identified in the Contract for each employee.

Contractor understands and agrees that it is responsible for performing all Work under this Contract without exceeding the total number of hours allocated for the Work or the maximum not-to-exceed compensation stated in the Contract. Contractor is responsible to complete the Work to EWEB's satisfaction without further compensation.

OR

[Buyer-Use this if you need a progress payment schedule instead of monthly payments.] Payment will be made according to the Payment Schedule shown on Attachment A – Statement of Services. Payment will be paid once per month.

Contractor understands and agrees that it is responsible for performing all Work under this Contract without exceeding the maximum not-to-exceed compensation stated in the Contract. Contractor is responsible to complete the Work to EWEB's satisfaction without further compensation.

Invoicing: EWEB shall pay Contractor not more than once per month upon Contractor’s submission of a sufficiently detailed invoice for Services provided to EWEB during that month. Invoices shall be submitted to EWEB's Contract Administrator for this Contract.

All invoices shall describe:

o Itemization of all Work performed, specifying by whom it was performed, including name, job title, and reference to the specific Work activity.

o All itemized expenses for which reimbursement is claimed.

o The total amount invoiced to date by Contractor prior to the current invoice.

EWEB Review: EWEB will have the right to review each invoice for compliance with the requirements and any other pertinent provisions of this Contract. If Contractor uses a billing agent, responsibility for billing errors remains with Contractor.

Payment Terms: EWEB will make payment in accordance with its regular payment schedule: Net 30 days from receipt of a valid, undisputed invoice.

Cash Discount: If EWEB is entitled to a cash discount, the period of computation shall start on the date the entire order is delivered or the date the invoice is received, whichever is later.

c. Non-Compliance with Payment Terms:

o No payment will be made for any Work performed before the beginning date or after the expiration date of this Contract.

o Contractor shall not submit invoices for and EWEB shall not pay any amount in excess of the Maximum

Not-to-Exceed Compensation stated in the Contract. If this maximum amount is increased by amendment of this Contract, the amendment must be fully approved and executed before Contractor performs Work subject to the amendment.

o EWEB reserves the right to withhold payment for Services not performed.

4. Price Adjustments Or Reserved [Buyer, the maximum increase percentage can be adjusted or deleted]

Price increases may be considered by EWEB annually prior to the beginning of the next 12-month term, up to a maximum of 2.5%. Contractor is responsible for submitting their request for any price increase 30 to 90 calendar days before the next anniversary of Contract execution, without exception.