MI Treasury RFP 250000002120.docx

Michigan.gov/MiProcurement proposal instructions Department of Treasury Qualified Security Assessor Services Request for Proposal No. 250000002120 Solicitation Manager Name: Adam Zanetti Direct Phone: 517-667-1465 Email: zanettia@michigan.gov Main Phone: 1-855-MI-PURCH 1-855-647-8724 This is a Request for Proposal (RFP) for:

Qualified Security Assessor Services RFP Timeline

*A bidder’s proposal received at 3:00:01 p.m. Eastern is late and subject to disqualification.

This RFP is subject to change. Check www.michigan.gov/SIGMAVSS for current information.

1. PROPOSAL PREPARATION. The State recommends reading all RFP materials prior to preparing a proposal, particularly these Proposal Instructions and the Vendor Questions Worksheet. Bidders must follow these Proposal Instructions and provide a complete response to the items indicated in the RFP Structure and Documentation table below. References and links to websites or external sources may not be used in lieu of providing the information requested in the RFP within the proposal. Include the bidder’s company name in the header of all documents submitted with your proposal. Note that all documents and information submitted as part of a proposal will become public record immediately upon receipt by the State. Proposals received by the State may be posted on the State’s publicly available website after bidders are notified of the award recommendation.

RFP Structure and Documentation

Informational

2. CONTACT INFORMATION FOR THE STATE. The sole point of contact for the State concerning this RFP is listed on the Cover Page. Contacting any other State personnel, agent, consultant, or representative about this RFP may result in bidder disqualification.

3. RESERVED.

4. MODIFICATIONS. The State may modify this RFP at any time. Modifications will be posted on www.michigan.gov/SIGMAVSS. This is the only method by which the RFP may be modified.

5. QUESTIONS. Bidder questions about this RFP must be emailed to the Solicitation Manager no later than the time and date specified on the Cover Page. In the interest of transparency, only written questions are accepted. Answers to questions will be posted on www.michigan.gov/SIGMAVSS. Submit questions using the format below; a Microsoft Excel format or similar is suggested.

6. DELIVERY OF PROPOSAL.

Electronic – The bidder must submit its proposal, all attachments, and any modifications or withdrawals electronically through www.michigan.gov/SIGMAVSS. The price proposal should be saved separately from all other proposal documents. The bidder should submit all documents in a modifiable (native) format (examples include but are not limited to Microsoft Word or Excel and Google Docs or Sheets). In addition to submitting documents in a modifiable format, the bidder may also submit copies of documents in PDF. Attachment file size is limited to 30 MB per document. Bidder’s failure to submit a proposal as required may result in disqualification. The proposal and attachments must be fully uploaded and submitted prior to the proposal deadline. Do not wait until the last minute to submit a proposal, as the SIGMA VSS system requires the creation of an account and entry of certain information, in addition to uploading and submitting the materials. The SIGMA VSS system will not allow a proposal to be submitted after the proposal deadline identified in the solicitation Closing On/Closing Date fields (Summary view/Detail view), even if a portion of the proposal has been uploaded.

Questions on how to submit information or how to navigate in the SIGMA VSS system can be answered by calling (517) 284-0540 or (888) 734-9749. The Solicitation Manager will not provide assistance related to the submittal of the proposal and all attachments on the day of the proposal deadline. Responsibility for a complete submission lies with the bidder. Note that all documents and information submitted in any manner as part of a proposal will become public record immediately upon receipt by the State. Proposals received may be posted by the State on the State’s publicly available website after bidders are notified of the award recommendation.

7. MANDATORY MINIMUM REQUIREMENTS. To avoid disqualification, the bidder must provide documentation to support the following:

The Bidder must attest that they are a certified Qualified Security Assessor (QSA) approved by the PCI Security Standards Council as of the submission of their proposal. Bidder must be certified to perform on-site PCI Data Security Assessments for a Level 1 & 2 Merchants and Level 1, 2, or 3 Service Providers. Proof of certification must be submitted with the proposal.

Only proposals meeting the mandatory minimum requirements will be considered for evaluation.

8. EVALUATION PROCESS. If all mandatory minimum requirements are met, the State will evaluate each proposal based on the following factors:

Proposals receiving 80 or more technical evaluation points will have pricing evaluated and considered for award.

The State may utilize all bidder information, without regard to a proposal’s technical score, to determine fair market value for goods or services sought. The State is not obligated to accept the lowest price proposal. If applicable, the State’s evaluation will include consideration of a bidder’s qualified disabled veterans/service-disabled veteran owned business(QDV/SDVOB) status under MCL 18.1261(8). Additional information on the SDVOB preference is available at: Michigan.gov/SDVOB.

The State strongly encourages strict adherence to the Contract Terms. The State reserves the right to deem a bid non-responsive for failure to accept the Contract Terms. Nevertheless, the bidder may submit proposed changes to the Contract Terms in track changes (i.e., visible edits) with an explanation of the bidder’s need for each proposed change. Failure to include track changes with an explanation of the bidder’s need for the proposed change constitutes the bidder’s acceptance of the Contract Terms. General statements, such as that the bidder reserves the right to negotiate the terms and conditions, may be considered non-responsive. Failure to respond timely to requests for proposed changes to Contract Terms during ongoing negotiations may be cause for disqualification.

The State may but is not required to conduct an on-site visit to tour and inspect the bidder’s facilities; require an oral presentation of the bidder's proposal; conduct interviews, research, reference checks, and background checks; and request additional price concessions at any point during the evaluation process.

9. NOTICE OF DEFICIENCY. The State reserves the right to issue a Notice of Deficiency to bidders if the State determines after the proposal deadline that a portion of the RFP was deficient, unclear, or ambiguous. Failure to respond to a Notice of Deficiency timely may be cause for disqualification.

10. CLARIFICATION REQUEST. The State reserves the right to issue a Clarification Request to a bidder to clarify its proposal if the State determines the proposal is not clear. Failure to respond to a Clarification Request timely may be cause for disqualification.

11. RESERVATIONS. The State reserves the right to:

a. Disqualify a bidder for failure to follow these instructions.

b. Discontinue the RFP process at any time for any or no reason. The issuance of an RFP, your preparation and submission of a proposal, and the State’s subsequent receipt and evaluation of your proposal does not commit the State to award a contract to you or anyone, even if all the requirements in the RFP are met.

c. Consider late proposals if: (i) no other proposals are received; (ii) no complete proposals are received; (iii) the State received complete proposals, but the proposals did not meet mandatory minimum requirements or technical criteria; or (iv) the award process fails to result in an award.

d. Consider an otherwise disqualified proposal if no other proposals are received.

e. Disqualify a proposal based on: (i) information provided by the bidder in response to this RFP; (2) the bidder’s failure to complete registration on www.michigan.gov/SIGMAVSS ; or (3) if it is determined that a bidder purposely or willfully submitted false or misleading information in response to the RFP.

f. Consider prior performance with the State in making its award decision.

g. Consider overall economic impact to the State when evaluating proposal pricing and in the final award recommendation. This includes but is not limited to: considering principal place of performance, number of Michigan citizens employed or potentially employed, dollars paid to Michigan residents, Michigan capital investments, job creation, tax revenue implications, and economically disadvantaged businesses.

h. Consider total-cost-of-ownership factors (e.g., transition and training costs) when evaluating proposal pricing and in the final award recommendation.

i. Refuse to award a contract to any bidder that has failed to pay State taxes or has outstanding debt with the State.

j. Enter into negotiations with one or more bidders on price, terms, technical requirements, or other deliverables.

k. Award multiple, optional-use contracts, or award by Contract Activity.

l. Evaluate the proposal outside the scope identified in the Evaluation Process section of this document if the State receives only one proposal.

12. AWARD RECOMMENDATION. The contract will be awarded to the responsive and responsible bidder who offers the best value to the State, as determined by the State. Best value will be determined by the bidder meeting the minimum point threshold and offering the best combination of the factors stated in the Evaluation Process section of this document, and price, as demonstrated by the proposal. The State will post an Award Recommendation and Evaluation Synopsis on www.michigan.gov/SIGMAVSS or in the manner it was originally published.

13. DEBRIEF MEETING AND BID PROTEST. The State will publish an Award Recommendation and Evaluation Synopsis which will provide instructions on how to request a debrief meeting.

If you wish to initiate a protest of the award, you must submit your written protest via email to zanettia@michigan.gov (Cc CollinsJ17@michigan.gov) no later than 3:00PM EST, 5 business days after the Award Recommendation and Evaluation Synopsis is posted on SIGMA VSS. The State reserves the right to adjust this timing and will publish any change.

Additional information about the protest process is available at DTMB - Programs and Policies (michigan.gov) under the “Bidder Protests” link.

14. STATE ADMINISTRATIVE BOARD. Contracts equal to $250,000 or greater than require approval by the State Administrative Board. The State Administrative Board’s decision is final; however, its approval does not constitute a contract. The award process is not complete until the awarded contractor receives a contract fully executed by all parties.

15. GENERAL CONDITIONS. The State will not be liable for any costs, expenses, or damages incurred by a bidder participating in this solicitation. The bidder agrees that its proposal will be considered an offer to do business with the State in accordance with its proposal, including the Contract Terms, and that its proposal will be irrevocable and binding for a period of 180 calendar days from date of submission. If a contract is awarded to the bidder, the State may, at its option, incorporate any part of the bidder’s proposal into a contract. This RFP is not an offer to enter into a contract. This RFP may not provide a complete statement of the State’s environment or contain all matters upon which agreement must be reached. The bidder understands that their proposal will become public record immediately upon receipt by the State. Other than verified trade secrets, proposals submitted via www.michigan.gov/SIGMAVSS are the State’s property.

16. CONFIDENTIAL TREATMENT FORM AND THE FREEDOM OF INFORMATION ACT. As a public record, all portions of the bidder’s proposal and resulting contract are subject to disclosure as required under Michigan’s Freedom of Information Act (FOIA), MCL 15.231, et seq. However, the State may exempt some information from disclosure as permitted by law. Under MCL 18.1261(13)(b), records containing “a trade secret as defined under section 2 of the uniform trade secrets act, 1998 PA 448, MCL 445.1902,” are exempt from disclosure under FOIA. In addition, “financial or proprietary information” submitted with a bidder’s proposal is exempt from disclosure under FOIA. A bidder’s failure to comply with this Section is grounds for rejecting a bidder’s proposal as non-responsive. As a part of its proposal, each bidder must follow the procedure below.

a. SUBMIT A COMPLETED CONFIDENTIAL TREATMENT FORM WITH YOUR BID. Completion and submission of the Confidential Treatment Form (CT Form) is required regardless of whether the bidder seeks confidential treatment of information. Failure to submit a completed CT Form may be cause for disqualification from the solicitation process. If a bidder fails to properly complete and submit the CT Form or otherwise fails to follow CT Form instructions, the proposal may be publicly disclosed in its entirety without redaction after an award recommendation.

Complete and sign Section 1 of the CT Form if the bidder does NOT request confidential treatment of information contained in its proposal; or Complete and sign Section 2 of the CT Form if the bidder requests confidential treatment of certain information. Bidder must also submit a copy of the proposal with the trade secret, financial, and proprietary information redacted and clearly labeled as the “PUBLIC COPY.”

Failure to complete and sign a CT Form may result in disqualification of the bidder. If a bidder fails to properly complete and submit the CT Form or otherwise fails to follow the CT Form instructions, the proposal, in its entirety, may be publicly disclosed by the State without redaction after an award recommendation.

b. FOIA REQUESTS. If a FOIA request is made for a bidder’s proposal, the Public Copy may be distributed to the public along with the bidder’s CT Form. The CT Form is a public document and serves as an explanation for the redactions to the Public Copy. Do not put any trade secret, financial, or proprietary information in the CT Form. Do not redact the CT Form itself.

c. NO ADVICE. The State will not advise a bidder as to the nature or content of documents entitled to protection from disclosure under FOIA or other laws, as to the interpretation of such laws, or as to the definition of trade secret or financial or proprietary information. Nothing contained in this provision will modify or amend requirements and obligations imposed on the State by FOIA or other applicable law. The State is not obligated to notify a bidder if a FOIA request for bidder’s proposal is received nor if bidder’s proposal is made available to the public.

d. FAILURE TO REQUEST CONFIDENTIAL TREATMENT. Failure to request material be treated as confidential as specified herein relieves the State, its agencies, and personnel from any responsibility for maintaining material in confidence.

e. Bids containing a request to maintain an entire proposal as confidential may be rejected as non-responsive. Bidders may not request confidential treatment with respect to resumes, pricing, and marketing materials. The State reserves the right to determine whether material designated as exempt by a bidder falls under MCL 18.1261 or other applicable FOIA exemptions. If a FOIA request is made for materials that the bidder has identified as trade secret, financial, or proprietary information, the State has the final authority to determine whether the materials are exempt from disclosure under FOIA.

f. Bidder forever releases the State, its departments, subdivisions, officers, and employees from all claims, rights, actions, demands, damages, liabilities, expenses and fees, which arise out of or relate to the disclosure of all or a portion of bidder’s proposal submitted under this RFP. Bidder must defend, indemnify and hold the State, its departments, subdivisions, officers, and employees harmless, without limitation, from and against all actions, claims, losses, liabilities, damages, costs, attorney fees, and expenses (including those required to establish the right to indemnification), arising out of or relating to any FOIA request, including potential litigation and appeals, related to the portion of bidder’s proposal submitted under this RFP that bidder has identified as a trade secret, or financial or proprietary information. The State will notify bidder in writing if indemnification is sought. The State is entitled to: (i) regular updates on proceeding status; (ii) participate in the defense of the proceeding; (iii) employ its own counsel; and to (iv) retain control of the defense, or any portion thereof, if the State deems necessary. Bidder will not, without the State’s written consent (not to be unreasonably withheld), settle, compromise, or consent to the entry of any judgment in or otherwise seek to terminate any claim, action, or proceeding. If a State employee, official, or law is involved or challenged, the State may control the defense of that portion of the claim. Any litigation activity on behalf of the State, or any of its subdivisions under this Section, must be coordinated with the Department of Attorney General. An attorney designated to represent the State may not do so until approved by the Michigan Attorney General and appointed as a Special Assistant Attorney General.

confidential treatment form INSTRUCTIONS. A signed and dated Confidential Treatment Form (CT Form) must be submitted with your proposal, regardless of whether your proposal contains confidential information.

1. Complete either Section 1 or Section 2 of this form and sign where indicated. Do not complete both sections. Note: Completion of Section 2 is required to request confidential treatment.

2. This form must be signed by the individual who signed the bidder’s proposal.

Failure to submit a completed CT Form with your bid is grounds for rejecting the proposal as non-responsive.

In addition, failure to follow the instructions on this form or to properly complete and submit it may result in the entire proposal being publicly disclosed by the State without redaction after an award recommendation.

See the Confidential Treatment Form and the Freedom of Information Act section of the Proposal Instructions for additional information.

Section 1. CONFIDENTIAL TREATMENT IS NOT REQUESTED This section must be completed, signed, and submitted with the proposal if the bidder does not request confidential treatment of any material contained in the proposal. If this section is completed, do not complete Section 2.

By signing below, the bidder affirms that confidential treatment of material contained in their proposal is not requested.

RFP Number

RFP Title

Signature

Date

Printed Name, Title, Company

Section 2. CONFIDENTIAL TREATMENT IS REQUESTED Bidders must complete, sign, and submit this section with the proposal, to request confidential treatment of any material contained in the proposal. If this section is completed, do not complete Section 1.

Bidders must specifically identify the information to be protected as confidential and/or proprietary and state the reasons why protection is necessary. As shown in the table below, the following details are required for each confidentiality request.

1. The proposal page number, section number, and paragraph number.

2. Whether the material referenced is Trade Secret (TS), Proprietary Financial Information (FI), or Proprietary Information (PI). Bidders may not request confidential treatment of resumes, pricing, and marketing materials.

3. An explanation of the specific legal grounds that support treatment of the material as TS, FI, or PI and a complete justification as to how the material falls within the scope of an applicable FOIA exemption or relevant case law. Bidders must not simply cite an applicable exemption or case name.

4. The person at their organization authorized to respond to inquiries by the State concerning the material and their contact information.

REQUIRED: Bidders completing this section must also submit a copy of the proposal with the trade secret, financial, and proprietary information redacted and clearly label this redacted copy as the PUBLIC COPY.

(1) Proposal Page #, Section #, Paragraph # (2) Material is Trade Secret (TS), Proprietary Financial Information (FI), Proprietary Information (PI) (3) Applicable FOIA Exemption with Written Justification (4) Bidder Contact Information

Bidders may add rows or additional pages using the same format shown in the table.

State of Michigan FOIA Requests The State reserves the right to determine whether material designated as exempt by a bidder falls under MCL 18.1261 or other applicable FOIA exemptions.

If a FOIA request is made for materials that the bidder has identified as trade secret, financial, or proprietary information, the State has the final authority to determine whether the materials are exempt from disclosure under FOIA.

The State is not obligated to notify a bidder if a FOIA request for bidder’s proposal is received nor if bidder’s proposal is made available to the public. This form, and any additional justification letters, are not exempt from release under FOIA.

By signing below, the bidder affirms that confidential treatment of material contained in their proposal is requested and has attached to this form a redacted “Public Copy” of the bidder’s proposal.

RFP Number

RFP Title

Signature

Date

Printed Name, Title, Company vendor questions worksheet Provide a detailed response to each question. “You” and “company” refers to the bidder.

1. Contact Information

Bidder’s sole contact person during the RFP process. Include name, title, address, email, and phone number.

Person authorized to receive and sign a resulting contract. Include name, title, address, email, phone number and vendor customer code in SIGMA VSS.

2. Company Background Information

Legal business name and address. Include business entity designation, e.g., sole proprietor, Inc., LLC, or LLP.

What state was the company formed in?

Phone number.

Website address.

Number of years in business.

Number of employees.

Legal business name and address of parent company, if any.

Has there been a recent change in organizational structure (e.g., management team) or control (e.g., merger or acquisition) of your company? If the answer is yes: (a) explain why the change occurred and (b) how this change has affected your company.

Discuss your company’s history. Has growth been organic, through mergers and acquisitions, or both?

Has bidder ever been debarred, suspended, or disqualified from bidding or contracting with any entity, including the State of Michigan? If yes, provide the date, the entity, and details about the situation.

Has your company been a party to litigation against the State of Michigan? If the answer is yes, then state the date of initial filing, case name and court number, and jurisdiction.

Within the last 5 years, has your company or any of its related business entities defaulted on a contract or had a contract terminated for cause? If yes, provide the date, contracting entity, type of contract, and details about the termination or default.

State your gross annual sales for each of the last 5 years.

If receiving a contract under this RFP will increase your gross revenue by more than 25% from last year’s sales, explain how the company will scale-up to manage this increase.

Describe partnerships and strategic relationships you think will bring significant value to the State.

State the physical address of the place of business that would have primary responsibility for this account if bidder is awarded a contract under this RFP.

3. Qualified Disabled Veteran/Service-Disabled Veteran-Owned Business Program

To demonstrate qualification as a qualified disabled veteran, you must provide:

(a) Proof of service and conditions of discharge (DD214 or equivalent);

(b) Proof of service-connected disability (DD214 if the disability was documented at discharge or Veterans Administration Rating Decision Letter or equivalent if the disability was documented after discharge); and

(c) Legal documents setting forth the ownership of the business entity.

In lieu of the documentation identified above, you may provide proof of certification by the National Veterans Business Development Council.

Enter the names of documents submitted with your proposal to demonstrate status as a qualified disabled veteran.

4. Participation in RFP Development or Evaluation

If you enter “YES”, you are not eligible for contract award or to work as a subcontractor for the awarded vendor.

If you enter “YES,” you are not eligible for contract award. An awarded vendor may not partner or subcontract with anyone to provide goods and services required under a resulting contract if that subcontractor or partner assisted in the development of this solicitation.

If you enter “YES”, you are not eligible for contract award or to work as a subcontractor for the awarded vendor.

5. State of Michigan Experience and Prior Experience

Does your company have experience working with the State of Michigan? If so, please provide a list (including the contract number) of the contracts you hold or have held with the State for the last 10 years.

Describe at least 3 relevant experiences from the last 5 years supporting your ability to successfully manage a contract of similar size and scope for the work described in this RFP.

Experience 1

Company name.

Contact name.

Contact role at time of project.

Contact phone.

Contact email.

City.

State.

Zip.

1. Project name and description of the scope of the project.

2. What role did your company play?

3. How is this project experience relevant to the subject of this RFP?

Dollar value.

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained.

Experience 2

Company name.

Contact role at time of project.

City.

1. Project name and description of the scope of the project.

Dollar value.

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained.

Experience 3

Company name.

Contact role at time of project.

City.

1. Project name and description of the scope of the project.

Dollar value.

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained.

6. Standard Contract Terms

Bidder must affirm agreement with the attached Contract Terms. If not in agreement, written exceptions in accordance with the Evaluation Process section of the Proposal Instructions must be provided with Bidder’s proposal.

7. Reserved.

8. Michigan Voluntary Protection Program

Number of employees currently employed at locations within the State of Michigan.

Number of additional employees to be employed at locations within the State of Michigan if awarded this Contract (if any)

Minimum wage paid to employees employed at locations within the State of Michigan.

Average wage paid to employees employed at locations within the State of Michigan.

Percentage of employees employed at locations within the State of Michigan that are covered by employer-provided health insurance.

10. Labor, Antidiscrimination and Environmental Laws Compliance

Bidder must disclose any violations of state or federal labor, antidiscrimination and employment laws and regulations received within the past five years.

Bidder must disclose any violations of state or federal environmental laws and regulations received within the past five years.

11. Other

schedule a – statement of work

Request For Proposal No. 250000002120 Qualified Security Assessor Services This schedule identifies requirements of any Contract resulting from this RFP. The term “Contractor” in this document refers to a Contractor responding to this RFP, as well as the Contractor who is awarded the contract. The term “Bidder” is used to identify where specific responses to the RFP are required.

The Contractor must respond to each requirement or question and explain how it will fulfill each requirement. Attach any supplemental information and appropriately reference within your response.

BACKGROUND

The State of Michigan (State) currently has 24 departments (with 511 merchant accounts between them) that accept credit and debit cards as a method of payment. In Fiscal Year 2024, the State processed 10 million transactions and is a Level 2 merchant. Due to this, the State must maintain Payment Card Industry (PCI) compliance. Details to consider when it comes to maintaining PCI compliance include:

· The State currently uses a Payment Card Industry (PCI) Approved Scanning Vendor (ASV) to provide quarterly vulnerability scanning services.

· State departments use various processing channels including Web-based, interactive voice response (IVR) system, dial-up card terminals, kiosk, virtual terminals and point-of-sale (POS) systems.

· The majority of the merchant accounts use the State’s Centralized Electronic Payment Authorization System (CEPAS). CEPAS currently uses a Web-based system hosted by First Data Government Solutions (FDGS).

· The State uses other third-party vendors for various applications. Some of the Web-based applications are hosted internally and others are hosted by third party vendors.

· The Cardholder Data Environment (CDE) is segmented from the internal corporate network through a segmented infrastructure. The State does not store any cardholder data electronically.

· The State has approximately 200 devices in-scope for PCI compliance. The devices include, but are not limited to, workstations, servers and network components.

· The State has approximately 65 web applications that redirect to CEPAS using a URL redirect; all cardholder data is collected, processed and stored by CEPAS. The State’s electronic receipting standard prohibits storage of cardholder data.

· State POS systems encrypt data at the point of sale using E2EE or P2PE, prior to transmission.

· Card-not-present transactions are accepted via encrypted phones and analog fax machines. Card data is processed through either a CEPAS hosted virtual terminal or P2PE terminal.

Security is a priority for the State. The Department of Treasury, along with the Department of Technology, Management, and Budget, has a diverse, dedicated team assigned to ensure PCI requirements are in place and has been PCI compliant for 15+ years.

The State is seeking to enter a contract with a certified PCI Qualified Security Assessor (QSA) to conduct annual PCI compliance assessments.

SCOPE

The selected Contractor will be responsible for evaluating the payment/credit card security processes and controls consistent with applicable PCI Data Security Standards (DSS) requirements, providing a gap analysis and recommendations for meeting any identified gaps, assisting with corrective actions and compensating controls, and certifying compliance with the current PCI DSS version. The Contractor will be required to conduct onsite and remote assessments of different payment channels and provide the State with an Attestation of Compliance, Draft Report on Compliance, and a final Report on Compliance. The Contractor will also provide subject matter expertise to provide guidance to the State’s internal PCI compliance team. On an as needed basis, the Contractor will conduct consulting services and all other services which may aid the State in maintaining PCI compliance.

1. Requirements

1.1. General Requirements

A. The Bidder must attest that they are a certified Qualified Security Assessor (QSA) approved by the PCI Security Standards Council as of the submission of their proposal. Bidder must be certified to perform on-site PCI Data Security Assessments for a Level 1 & 2 Merchants and Level 1, 2, or 3 Service Providers. Proof of certification must be submitted with the proposal.

https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors This is a Mandatory Minimum Requirement that must be met for a proposal to be considered.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

B. The Contractor must provide consulting services, Gap analysis and an annual remote and onsite assessment for PCI Data Security Standard (DSS) resulting in a compliant Attested Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) and Attestation of Compliance (AOC). Services may include, but are not limited to:

i. Assistance clarifying requirements

ii. Determining scope

iii. Recommendations for security network and solution design (as needed)

iv. Data encryption consultation

v. Reviewing security policies and recommending changes (as needed)

vi. Network attack analysis

vii. Identifying areas where the State may be at risk

viii. Providing guidance for remediating risk

ix. Providing guidance for meeting the PCI DSS requirements on a risk-based approach

x. Assist in developing Compensating Controls (as needed)

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

C. Upon award and annually thereafter, the Contractor must work with the State to determine the scope of the assessment. The scope must be approved by the State Program Manager. All sampled systems and/or applications must originate from the approved scope.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

D. The Contractor must be available to conduct the annual on-site assessment at an agreed upon date, as identified annually in the PCI assessment outline (See Section 2.1.A in Timeframes). (Note: In 2025 the on-site assessment was scheduled during the months of April & May).

List all exception(s):

E. The State must be allowed up to four months to provide evidence requested by the Contractor.

List all exception(s):

F. The Contractor must allocate a minimum of two resources for the assessments. One resource must be a Senior Auditor (See Section 4.5 Key Personnel).

List all exception(s):

G. The Contractor must draft detailed minutes for all meetings, in person and virtual. These minutes must be received by the Program Manager in the Department of Treasury within two business days of the meeting.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

H. The Contractor must provide a secure Web portal for document and evidence sharing. The portal must meet the State’s requirements for multi-factor authentication.

The portal must meet Level 3 Authentication per DTMB Technical Standard 1340.00.080.03 Identity, Credentialing, and Access Management and must also comply with DTMB Technical Standard 1340.00.080.01 Identification and Authentication.

These Standards are Non-Public and can only be acquired by signing an NDA. If Bidder requires a copy, please email the Solicitation Manager (zanettia@michigan.gov) to request an NDA. Terms of the NDA are non-negotiable

List all exception(s):

Bidder must describe how they comply with the above requirement(s). Bidder must describe methods used to limit access and secure documents shared to the Contractor’s web portable:

I. Bidder must describe any vendor tools available for tracking completion of the Self-Assessment Questionnaire (SAQ). An overview, including visual diagrams or screenshots of the tracking tool, must be provided with the proposal for review by the State.

List all exception(s):

Bidder must describe how they comply with the above requirement(s) If you provide screenshots as an attachment, please identify the file name as well:

1.2. Training

The Contractor must provide the following training:

1. The Contractor must provide training on their Web portal, including but not limited to importing, exporting, navigating, reporting and all functions required for successful use.

2. The Contactor must provide a contact to resolve questions or issues related to the portal.

3. The Bidder must explain its training capabilities and any training that is included in its proposal.

4. The Contractor must provide documentation and training materials.

List all exception(s):

Bidder must describe how they comply with the above requirement(s). Bidder must explain its training capabilities and any training that is included in its proposal:

1.3 Required Functionality Relating to Data Retention, Disposal, and Retrieval A. Contractor must only retain documentation provided by the State in accordance with the retention period as per the current Payment Card Industry Data Security Standard (PCI DSS).

B. Once the PCI DSS retention period has been met, the Contractor must permanently delete the State data and notify the Treasury Program Manager within two business days.

C. Except as otherwise stated in the Contract, Contractor must not dispose of, delete, or destroy State Data without the prior written approval of the State.

Contractor must review and explain how the data retention, disposal, and retrieval requirements will be met by the solution and describe its data management capabilities (storage limitations, duration, etc.). If the Solution does not allow the State to perform these activities itself, the Contractor must explain how it will support the State’s compliance with these requirements.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

1.4 Specific Standards

A. IT Policies, Standards and Procedures (PSP) Contractors are advised that the State has methods, policies, standards and procedures that have been developed over the years. Contractors are expected to provide proposals that conform to State IT policies and standards. All services and products provided as a result of this RFP must comply with all applicable State IT policies and standards. Contractor is required to review all applicable links provided below and state compliance for the publicly available PSPs in their response. Non-public PSPs are available to bidders under NDA.

Public IT Policies, Standards and Procedures (PSP):

DTMB - IT Policies, Standards & Procedures (michigan.gov)

List all exception(s):

B. Acceptable Use Policy To the extent that Contractor has access to the State’s computer system, Contractor must comply with the State’s Acceptable Use Policy, see 1340.00.130.02 Acceptable Use of Information Technology (michigan.gov). All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Policy before accessing the State’s system. The State reserves the right to terminate Contractor’s access to the State’s system if any violation occurs.

List all exception(s):

C. Access Control and Authentication The Contractor’s Software (the Web Portal, see Section 1.1.H) must implement identity federation with the State’s MiLogin IT Identity and Access Management (IAM) environment as described in the State of Michigan Administrative Guide (1340.00.020.08 Enterprise Identity and Access Management Services Standard (michigan.gov) .

To support federation with the SOM MILogin Software, the Contractor’s Software must support SAML or OpenID federated identity protocols.

Software running within the States internally managed IT environment may be suitable for integration with the State’s Active Directory services as identified in the 1340.00.020.08 standard.

Note: There is currently an exception request routing for this requirement. It may not be a requirement upon award, however, at this time it is required, and Bidders must respond appropriately.

If implementing this requirement would have an impact on pricing, the Bidder is requested to submit price proposals with and without consideration of Access Control and Authentication.

List all exception(s):

Bidder must describe how they comply with the above requirement(s). Bidder must state whether implementing this requirement would impact pricing:

2. Services Levels

2.1 Timeframes

A. The Contractor must work with the Department of Treasury Program Manager to document and finalize the dates and deliverables for the annual assessment activities (PCI assessment outline) by November 1st of each year.

B. The Contractor must respond to inquiries within two business days.

C. The Contractor must conduct an annual assessment (remote or in-person) and provide the signed Attested SAQ or ROC and AOC completed by the State’s annual compliance date (approximately August 5th) of each Contract year. The annual compliance date will be agreed upon during completion of the annual PCI assessment outline.

List all exception(s):

Bidder must describe how they comply with the above requirement(s):

3. Acceptance

3.1 Acceptance, Inspection and Testing

The State will use the following criteria to determine acceptance of the Contract Activities:

The Program Manager must approve and confirm all contract deliverables outlined in Section 1.1 General Requirements have been completed on time and per the specifications of the contract.

List all exception(s):

4. Staffing

4.1 Project Manager

The Contractor must appoint one Project Manager specifically assigned to State of Michigan accounts, who will respond to State inquiries regarding the Contract Activities, answer questions related to ordering and delivery, etc. (the “Project Manager”). Contractor must identify its Project Manager.

The Contractor must notify the Contract Administrator at least 14 calendar days before removing or assigning a new Project Manager.

This individual must also be listed as one of the Key Personnel (see section 4.5).

List all exception(s):

Bidder must…