PCI QSA RFP FINAL.pdf

REQUEST FOR PROPOSALS

(“RFP”)

RFP NO. CC1108-1207DU

PROJECT TITLE: PCI-DSS QUALIFIED SECURITY ASSESSOR SERVICES

WSU Department: TREASURY SERVICES

PROPOSAL DUE DATE: February 10 2025, 3:00 pm Pacific Time, Pullman, Washington, USA.

ESTIMATED TIME PERIOD FOR CONTRACT: The University anticipates utilizing the solution selected from this process until it is no longer in its best interest to do so. The initial contract period is expected to be three years with optional renewals by mutual agreement.

RESPONDENT ELIGIBILITY: This procurement is open to those Respondents that satisfy the minimum qualifications stated herein and that are available for work in Washington State.

TABLE OF CONTENTS

1. INTRODUCTION

1.1. PURPOSE

1.2. ABOUT WASHINGTON STATE UNIVERSITY

1.3. OBJECTIVES AND SCOPE OF WORK

1.4. SCOPE OF WORK

1.5. SOLUTION REQUIREMENTS

1.6. PREFERRED SOLUTION FEATURES AND CAPABILITIES

1.7 PERIOD OF PERFORMANCE…………………………………………………………………………………………….. 2

2. GENERAL INFORMATION FOR CONTRACTORS

2.1. RFP COORDINATOR

2.2. ESTIMATED SCHEDULED FOR PROCUREMENT ACTIVITIES

2.3. SUBMISSION OF PROPOSALS

2.4. REVISIONS TO THE RFP

2.5. ACCEPTANCE PERIOD

2.6. RESPONSIVENESS

2.7. PROPRIETARY INFORMATION/PUBLIC DISCLOSURE

2.8. MINORITY & WOMEN-OWNED BUSINESS PARTICIPATION

2.9. MOST FAVORABLE TERMS

2.10. MODEL CONTRACT

2.11. COSTS TO PROPOSE

2.12. NO OBLIGATION TO CONTRACT

2.13. REJECTION OF PROPOSALS

2.14. COMMITMENT OF FUNDS

2.15. ELECTRONIC PAYMENT

2.16. INSURANCE COVERAGE

3. CONTENTS OF THE PROPOSAL

4. EVALUATION AND CONTRACT AWARD

4.1 EVALUATION PROCEDURE

4.2 EVALUATION WEIGHTING AND SCORING

4.3 ORAL PRESENTATIONS MAY BE REQUIRED

4.4 NOTIFICATION TO RESPONDENTS

4.5 DEBRIEFING OF UNSUCCESSFUL RESPONDENT

4.6 COMPLAINT PROCESS

4.7 PROTEST PROCEDURE

5. RFP EXHIBITS

Exhibit A: Certifications & Assurances

Exhibit B: Contractor Information

Exhibit C: General Terms and Conditions and Data Security Addendum

Exhibit D: SAQ-D

1. INTRODUCTION

1.1. PURPOSE

Washington State University (hereafter “University”) is initiating this Request for Proposals (RFP) to solicit proposals from firms interested in participating (the “Respondent,” the “Vendor” or, post-award, the “Contractor”) for Qualified Security Assessor firms (“QSA”) to provide PCI consulting services and annual assessments to verify that University merchants meet and maintain compliance with the current version of the PCI-DSS. This may also include the services of an Approved Scanning Vendor (ASV).

1.2 ABOUT WASHINGTON STATE UNIVERSITY

University Overview Founded in Pullman in 1890 by the State legislature as the State’s land-grant research university, Washington State University today has campuses in Pullman, Spokane, the Tri-Cities and Vancouver. The University’s sixth campus, the WSU Global campus, offers online access to the University’s degrees statewide and worldwide. With offices in all 39 counties in the State, WSU Extension serves as the University’s primary outreach education unit bringing its resources to the State’s citizens. Agricultural research stations are located in Lind, Mount Vernon, Othello, Prosser, Puyallup and Wenatchee.

With 11 academic colleges and a graduate school, the University offers more than 200 fields of study, many recognized with national and international awards of excellence. Systemwide enrollment exceeded 26,490 students in academic year 2023-24. Students are served by more than 2,300 instructional faculty and 4,500 administrative professional and classified staff members.

Among the University’s faculty are members of the National Academy of Sciences, the National Academy of Engineering, the Institute of Medicine and many recipients of awards for teaching and research.

The University is a top tier research university, classified as a “very high research activity” institution by the Carnegie Foundation for the Advancement of Teaching. Carnegie has also granted the University its Community Engagement classification.

WSU is presently classified as a Level 3 merchant for purposes of PCI-DSS compliance but has previously been classified as Level 2 and anticipates attaining this classification again in the future. The University successfully completed its first PCI-DSS V4.0 assessment in October 2024. Included in that assessment were thirty (30) SAQ A, twenty-three (23) SAQ P2PE, and ten (10) SAQ B-IP merchants for a total of sixty-three (63) engagements. WSU contracted with a QSA for V4.0 preparation and for completion of a compliance assessment. University merchants are primarily focused on the flagship Pullman campus, but also include instances at the Spokane, Tri-Cities, Vancouver, and online campuses.

The University’s merchant services program primarily utilizes Bank of America and Touchnet as its acquirers. University merchants operate in a variety of payment environments including e-commerce, card-present, and MOTO settings. Merchants are presently applicable to SAQ-A, SAQ-P2PE, and SAQ-B- IP assessments.

The University’s most recent SAQ-D can be found as an exhibit to the RFP.

1.3 OBJECTIVES AND SCOPE OF WORK

The University’s PCI-DSS QSA will be expected to provide consulting services and annual compliance assessments of University merchants necessary to complete an Attestation of Compliance (AOC) and SAQ-D for the University’s merchant acquirers. This contract may include the services of a PCI-certified Approved Scanning Vendor (ASV).

1.4 SCOPE OF WORK

The Contractor must provide a solution that:

The QSA will address and provide the following to the University:

• Services as a certified QSA consultant including reviewing the existence and completeness of current documentation and providing recommendations to maintain ongoing compliance with the PCI-DSS.

• Conduct an annual PCI-DSS compliance assessment.

• Provide training solutions for University merchants.

• Advise and provide required documentation to address applicable PCI-DSS compliance requirements for the current version.

• An ASV may conduct (at least) quarterly external vulnerability scanning of University merchant IP addresses or domains.

1.5 MINIMUM SOLUTION REQUIREMENTS

The Respondent’s solution must meet these minimum requirements: These must be fully described in the proposal.

REQUIREMENT YES NO

Proposer must be a PCI Security Standards Council certified QSA

Proposer must be in the business of providing PCI certified QSA consulting services with at least five years of experience

Proposer must have PCI Compliance experience with higher education institutions like the University

Proposer must be willing to conduct on-campus visits at least once annually.

Proposer must include three or more higher education client references.

1.6 PREFERRED SOLUTION FEATURES AND CAPABILITIES

The Respondent’s solution is preferred to have the following features and capabilities: These must be fully described in the proposal.

REQUIREMENT YES NO

Proposer offers a network vulnerability scan tool service compliant with PCI

ASV requirements with the ability to scan at least quarterly and be able to export results from the scanning system.

Proposer offers PCI DSS training and educational materials available to University merchants.

1.7 PERIOD OF PERFORMANCE

The period of performance of any contract resulting from this RFP is tentatively scheduled to begin in sufficient time for all in-scope components to be deployed and in production by May 1, 2025.The University anticipates utilizing the solution selected from this process until it is no longer in its best interest to do so. The initial contract period is expected to be three years with optional renewals, but any proposals received that provide additional benefits or discounts for committing to a longer period will be considered and should be provided as an option by Respondents, which will be exercised at the sole discretion of the University. The University reserves the right to extend the contract as may be required and mutually agreeable by the parties. Amendments extending the performance period, if any, shall be at the University's sole discretion.

2 GENERAL INFORMATION FOR CONTRACTORS

2.1 RFP COORDINATOR

The RFP Coordinator is the sole point of contact in the University for this procurement. Unless otherwise provided herein, all communication between the Respondent and the University upon release of this RFP shall be with the RFP Coordinator, as follows:

Name Desiree Urban

Address Washington State University Procurement & Contract Services French Administration Building, Room 242 Pullman, WA 99164 Attn: RFP #CC1108-1207DU

E-Mail Address desiree.urban@wsu.edu

Only communication in writing between the Respondents and the RFP Coordinator will be binding.

Communication regarding the RFP directed to parties other than the RFP Coordinator may result in disqualification of the Respondent.

2.2 ESTIMATED SCHEDULE FOR PROCUREMENT ACTIVITIES

Issue Request for Proposals via WEBS January 10, 2025

Questions due to RFP Coordinator ( desiree.urban@wsu.edu) January 17, 2025

Issue last addendum to RFP via WEBS January 24, 2025

Proposals due via email to purchasing.sealed@wsu.edu February 10, 2025

Proposals Reviewed Week of February 10 & February 17, 2025

Submitter interviews, if required Week of February 24, 2025

Apparent successful bidder named Estimated Week of March 3, The University reserves the right to revise the above schedule.

2.3 SUBMISSION OF PROPOSALS

Proposals must be submitted electronically as described below and received no later than 3:00 p.m., PDT, in Pullman, Washington, on February 10, 2025. Proposals received after this deadline will be late and ineligible for consideration.

Proposals must be submitted electronically as an attachment to an e-mail to purchasing.sealed@wsu.edu.

The email subject line must include the WSU RFP number, the company name for the bidder, and RFP due date. All attachments to the e-mail must be in PDF format. Zipped files cannot be received by WSU and cannot be used for submission of proposals. The cover submittal letter and the Certifications and Assurances form need a scanned or verified digital signature of the individual within the organization authorized to bind the Contractor to the offer.

mailto:Submitter mailto:purchasing.sealed@wsu.edu

Bidders submitting proposals should allow adequate delivery time to ensure timely receipt of their responses by the RFP Coordinator. Bidders assume the risk for the method of delivery chosen.

Washington State University assumes no responsibility for delays caused by any delivery service. Late responses shall be automatically disqualified from further consideration.

2.4 REVISIONS TO THE RFP

In the event it becomes necessary to revise any part of this RFP, addenda will be published on https://fortress.wa.gov/ga/webs/. For this purpose, the published questions and answers and any other pertinent information shall be provided as an addendum to the RFP and will be placed on the website.

The University also reserves the right to cancel or to reissue the RFP in whole or in part, prior to execution of a contract.

2.5 ACCEPTANCE PERIOD

Proposals must provide for acceptance by the University for at least 180 calendar days after the due date for this RFP.

2.6 RESPONSIVENESS

All proposals will be reviewed by the RFP Coordinator to determine compliance with administrative requirements and instructions specified in this RFP. The Respondent is specifically notified that failure to comply with any part of the RFP may result in rejection of the proposal as non-responsive.

The University also reserves the right at its sole discretion to waive minor administrative irregularities.

2.7 PROPRIETARY INFORMATION/PUBLIC DISCLOSURE

Proposals submitted in response to this competitive procurement shall become the property of the University. All proposals received shall remain confidential until the contract, if any, resulting from this RFP is signed by the President of the University, or his Designee, and the Apparent Successful Bidder;

thereafter, the proposals shall be deemed public records as defined in Chapter 42.56 of the Revised Code of Washington (“RCW”).

Any information in the proposal that the Respondent desires to claim as proprietary and exempt from disclosure under the provisions of Chapter 42.56 RCW, or other state or federal law that provides for the nondisclosure of your document, must be clearly designated. The information must be clearly identified and the particular exemption from disclosure upon which the Respondent is making the claim must be cited. Each page containing the information claimed to be exempt from disclosure must be clearly identified by the words “Proprietary Information” printed on the lower right-hand corner of the page.

Marking the entire proposal exempt from disclosure or as Proprietary Information will not be honored.

If a public records request is made for the information that the Respondent has marked as "Proprietary Information," the University will notify the Respondent of the request and of the date that the records will be released to the requester unless the Respondent obtains a court order enjoining that disclosure. If the Respondent fails to obtain the court order enjoining disclosure, the University will release the requested information on the date specified. If a Respondent obtains a court order from a court of competent jurisdiction enjoining disclosure pursuant to Chapter 42.56 RCW, or other state or federal law that provides for nondisclosure, the University shall maintain the confidentiality of the Respondent's information per the court order.

https://fortress.wa.gov/ga/webs/

A charge may be made for copying and shipping, as outlined in RCW 42.56. All requests for information should be directed to the RFP Coordinator.

2.8 MINORITY & WOMEN-OWNED BUSINESS PARTICIPATION

In accordance with chapter 39.19 RCW, the state of Washington encourages participation in all of its contracts by firms certified by the Office of Minority and Women’s Business Enterprises (“OMWBE”).

Participation may be either on a direct basis in response to this solicitation or on a subcontractor basis.

However, no preference will be included in the evaluation of proposals, no minimum level of MWBE participation shall be required as a condition for receiving an award, and proposals will not be rejected or considered non-responsive on that basis.

For information on certified firms, parties may contact OMWBE at 360-753-9693 or www.omwbe.wa.gov.

2.9 MOST FAVORABLE TERMS

The University reserves the right to make an award without further discussion of the proposal submitted.

Therefore, the proposal should be submitted initially on the most favorable terms which the Respondent can propose. There may be no best and final offer procedure, however, the University reserves the right to utilize a best and final offer procedure if it is determined to be in its best interest to do so. The University also reserves the right to contact a Respondent for clarification of its proposal.

The Apparent Successful Bidder should be prepared to accept this RFP for incorporation into a contract resulting from this RFP. Contract negotiations may incorporate some or all of the Respondent’s proposal. It is understood that the proposal will become a part of the official procurement file on this matter without obligation to the University.

2.10 MODEL CONTRACT/GENERAL TERMS AND CONDITIONS

The Apparent Successful Bidder will be expected to enter into a contract including terms and conditions legally consistent with those found in Exhibit C. The Respondent may submit exceptions to the Model Contract provided in Exhibit C as allowed in the Certifications and Assurances form, Exhibit A to this RFP. The Respondent should provide alternate language for any exceptions taken to WSU’s Model Contract. All exceptions to the contract terms and conditions must be submitted as an attachment to Exhibit A, Certifications and Assurances form. The University will review any properly requested exceptions and accept or reject the same at its sole discretion. Blanket exceptions to Exhibit C, or the inclusion of any other template agreement, will not be reviewed by WSU and may result in a bid being designated as non-responsive.

2.11 COSTS TO PROPOSE

The University will not be liable for any costs incurred by the Respondent in preparation of a proposal submitted in response to this RFP, in conduct of a presentation, or any other activities related to responding to this RFP.

2.12 NO OBLIGATION TO CONTRACT

This RFP does not obligate the state of Washington or the University to contract for products or services specified herein.

http://www.omwbe.wa.gov./

2.13 REJECTION OF PROPOSALS

The University reserves the right at its sole discretion to reject any and all proposals received without penalty and not to issue a contract as a result of this RFP.

2.14 COMMITMENT OF FUNDS

The President of the University or his delegate is the only individual who may legally commit the University to the expenditures of funds for a contract resulting from this RFP. No cost chargeable to the proposed contract may be incurred before receipt of a fully executed contract.

2.15 ELECTRONIC PAYMENT

Washington State University is currently implementing an electronic payables system. The successful contractor may be provided with a form to complete with the contract to authorize electronic payments.

2.16 INSURANCE COVERAGE

The Apparent Successful Bidder is to furnish the University with a certificate(s) of insurance executed by a duly authorized representative of each insurer, showing compliance with the insurance requirements set forth in the General Terms and Conditions included as Exhibit D.

3 CONTENTS OF THE PROPOSAL

Proposals should be presented in the five sections indicated below. Sections sharing a common file format (i.e., PDF) may be combined into a single document provided that each section is clearly identifiable.

Incomplete responses may be disqualified from further consideration.

SECTION NO AND TITLE SECTION DESCRIPTION

SECTION 1

EXECUTIVE SUMMARY

The proposer should include information regarding the company including services and products offered with details such as active certifications, involvement in industry associations, relevant experience, and general staffing and organizational structure.

The Executive Summary should also include a statement on the financial stability of the proposer through a document such as an income statement or balance sheet.

This section should also address the company’s ability to meet the University’s requirements as detailed in the RFP.

SECTION 2

EXPERIENCE

In the experience response, the proposer should address the following items:

• Who are the primary company contacts that would be dedicated to this contract? Describe their experience relative to the services outlined in the

RFP.

• Are there other technical or enterprise contacts available to the University?

• Please indicate if your firm is a Minority or Women Business Enterprise (“MWBE”) and are registered as such with the Washington State Office of

Minority and Women’s Business Enterprises.

SECTION 3

PCI-DSS QSA SERVICES

• Describe your firm’s experience as a PCI QSA and in providing PCI consulting services.

• What experience does your firm have working with higher education clients?

• What experience do you have working with acquirers on behalf of merchants?

• What experience do you have in providing PCI gap analysis?

• Describe how you communicate and assist clients in preparing for changing requirements to the PCI standards?

• Describe your online solution for management of the PCI program including how it eases the assessment process for merchants. Do you have an online portal for completing SAQ’s electronically?

• Describe your recommended PCI assessment preparation including an annual timeline with items such as compiling necessary information, conducting trainings, performing remote and on-site assessments, completing remediation items, and final document preparation and review.

• What experience does your firm have in establishing or providing services to a PCI compliance governance group? Describe your experience in explaining PCI to technical as well as non-technical staff?

SECTION 4

SUPPORT SERVICES

• Describe the support services available from your firm.

• Describe your technical support processes available to clients.

• Is your firm a PCI certified ASV service provider? Describe the offered ASV services including available scanning frequencies and how results can be exported.

• Does your firm offer PCI education materials available to clients? Describe any available PCI Security Awareness training that is offered.

SECTION 5

COST PROPOSAL

Include a full cost proposal for all services outlined in the proposal, including fees or rates. Include whether there is any variation in fees or rates for on-site versus office-based services.

SECTION 6

WSU FORMS

Exhibit A Contractor Information

Exhibit B Certifications and Assurances

Exhibit C General Terms and Conditions & Data Security Addendum

4 EVALUATION AND CONTRACT AWARD

4.1 EVALUATION PROCEDURE

Responsive proposals will be evaluated strictly in accordance with the requirements stated in this solicitation and any addenda issued. The evaluation of proposals shall be accomplished by an evaluation team(s), to be designated by the University, which will determine the scoring of the proposals.

The University, at its sole discretion, may elect to select the top-scoring firms as finalists for oral interviews and may adjust scoring based on an evaluation thereof. See section 4.3. below.

The RFP Coordinator may contact the Respondent for clarification of any portion of a Respondent’s proposal.

4.2 EVALUATION WEIGHTING AND SCORING

All Proposals will be initially reviewed for administrative compliance with the requirements set forth in this RFP. Any failure to provide the information requested or to follow the instructions provided herein, may result in a determination that a proposal is not responsive. All responsive proposals will be evaluated as follows:

Evaluation Criteria Points

1. Executive Summary 10

2. Experience 25

3. PCI-DSS QSA Services

4. Support Services

5. Cost Proposal 5

Total 100

*The responsive bid with the lowest quoted cost will receive the maximum points possible for Cost. Remaining bids will receive points in accordance with the following formula:

(a/b)(c) = d a = lowest cost bid in dollars b = second (third, fourth, etc.) lowest cost bid c = maximum points for Cost category (5) d = number of points allocated to Response

The University reserves the right to award the contract to the Respondent whose proposal is deemed to be in the best interest of the University and the state of Washington.

4.3 ORAL PRESENTATIONS MAY BE REQUIRED

Written proposals and interviews, if considered necessary, will be utilized in selecting the winning proposal. The University, at its sole discretion, may elect to select the top scoring finalists from the written evaluation for an oral presentation and final determination of contract award. Should the University elect to hold oral presentations, it will contact the top-scoring firm(s) to schedule a date, time and location. The University may also elect to hold the interviews via Zoom, Teams or other platform.

Commitments made by the Contractor at the oral interview, if any, will be considered binding. The score from the interviews will be considered independently and will determine the Apparent Successful Bidder.

4.4 NOTIFICATION TO RESPONDENTS

Upon completion of the evaluation process, the University will notify its selected bidder (“Apparent Successful Bidder”), subject to completion of contract negotiations and execution of a written contract.

Bidders whose proposals were not selected for further negotiation or award will be notified separately by e-mail.

4.5 DEBRIEFING OF UNSUCCESSFUL RESPONDENT

Any bidder who has submitted a proposal and been notified that they were not selected for contract award may request a debriefing. The request for a debriefing conference must be received by the RFP Coordinator no later than 5:00 PM, local time, in Pullman, Washington, within three (3) business days after the Unsuccessful Respondent Notification is e-mailed to the Respondent. The debriefing should be held, via Zoom or telephone, within three (3) business days of the request.

Discussion at the debriefing conference will be limited to the following:

• Evaluation and scoring of the firm’s proposal;

• Critique of the proposal based on the evaluation;

• Review of bidder’s final score in comparison with other final scores without identifying the other firms.

Comparisons between proposals or evaluations of the other proposals will not be allowed. Debriefing conferences may be conducted in person or on the telephone and will be scheduled for a maximum of one hour.

4.6 COMPLAINT PROCESS

The complaint process allows bidders to focus on the solicitation requirements and evaluation process and raise issues with these processes early enough to allow the University to correct a problem before bids are submitted and time expended on evaluations.

The procurement complaint process will meet the following minimum requirements:

4.6.1. Bidders will be given an opportunity to submit a complaint to the University based on any of the following:

a. The solicitation unnecessarily restricts competition.

b. The solicitation evaluation or scoring process is unfair or flawed; or

c. The solicitation requirements are inadequate or insufficient to prepare a response.

4.6.2. Bidders will be allowed to submit complaints up to five (5) business days prior to the bid response deadline. Complaints must meet the following requirements:

d. Must be in writing.

e. Must be sent to the RFP Coordinator, or designee.

f. Should clearly articulate the basis for the complaint.

g. Should include a proposed remedy.

4.6.3. The RFP Coordinator will respond to complaints in writing.

4.6.4. The response to complaints including any changes to the solicitation will be posted as an amendment on WEBS.

4.6.5. The Director of WSU Purchasing Services or an employee delegated by the Director who was not involved in the procurement will be notified of all complaints and will be provided with a copy of the response.

4.6.6. The complaint may not be raised again during the protest period.

4.6.7. The complaint process does not include an appeal process.

4.7 PROTEST PROCEDURE

Protests may be made only by Respondents who submitted a response to this solicitation document and who have participated in a debriefing conference. Upon completing the debriefing conference, the Respondent is allowed three (3) business days to file a protest of the acquisition with the RFP Coordinator. Protests must be received by the RFP Coordinator no later than 5:00 PM, local time, in Pullman, Washington on the third business day following the debriefing. Protests may be submitted by e-mail but must then be followed by the document with an original signature.

Respondents protesting this procurement shall follow the procedures described below. Protests that do not follow these procedures shall not be considered. This protest procedure constitutes the sole administrative remedy available to Respondents under this procurement.

All protests must be in writing, addressed to the RFP Coordinator, and signed by the protesting party or an authorized Agent. The protest must state the RFP number, the grounds for the protest with specific facts and complete statements of the action(s) being protested. A description of the relief or corrective action being requested should also be included.

Only protests stipulating an issue of fact concerning the following subjects shall be considered:

• A matter of bias, discrimination or conflict of interest on the part of an evaluator;

• Errors in computing the score;

• Non-compliance with procedures described in the procurement document or University policy.

Protests not based on procedural matters will not be considered. Protests will be rejected as without merit if they address issues such as: 1) an evaluator’s professional judgment on the quality of a proposal, or 2) University’s assessment of its own and/or other agencies needs or requirements.

Upon receipt of a protest, a protest review will be held by the University. The University Purchasing Director or an employee delegated by the Director who was not involved in the procurement will consider the record and all available facts and issue a decision within five (5) business days of receipt of the protest. If additional time is required, the protesting party will be notified of the delay.

In the event a protest may affect the interest of another Respondent that also submitted a proposal, such Respondent will be given an opportunity to submit its views and any relevant information on the protest to the RFP Coordinator.

The final determination of the protest shall:

• Find the protest lacking in merit and uphold the University’s action; or

• Find only technical or harmless errors in the University’s acquisition process and determine the University to be in substantial compliance and reject the protest; or

• Find merit in the protest and provide the University options which may include:

--Correct the errors and re-evaluate all proposals, and/or --Reissue the solicitation document and begin a new process, or --Make other findings and determine other courses of action as appropriate.

If the University determines that the protest is without merit, the University will enter into a contract with the Apparent Successful Bidder. If the protest is determined to have merit, one of the alternatives noted in the preceding paragraph will be taken.

5 RFP EXHIBITS

Each exhibit is uploaded separately into WEBS (https://fortress.wa.gov/ga/webs/):

• Exhibit A: Certifications & Assurances

• Exhibit B: Contractor Information

• Exhibit C: General Terms and Conditions & Data Security Addendum

• Exhibit D: SAQ-D

End of RFP https://fortress.wa.gov/ga/webs/