PRF73 RFR PCI Data security and IR Cost Response Template 11.1.19.docx

RESPONSE SUBMITTED FOR RFR NUMBER: PRF73DESIGNATEDCTR

Cyber and Data Security, Audit, Compliance, Incident Response and Payment Card Industry (PCI) Compliance Services.

COMMONWEALTH OF MASSACHUSETTS

RESPONSE SUBMITTED FOR THE

REQUEST FOR RESPONSE (RFR)

RFR NUMBER: PRF73DESIGNATEDCTR

TITLE: Cyber and Data Security, Audit and Compliance, Incident Response Services and Payment Card Industry (PCI) PCI Compliance

BIDDER NAME: [Enter Name Here]

INSTRUCTIONS:

1. The Written RFR Response must be submitted using this “RFR Response Template” so that all Responses appear uniform and consistent for selection purposes and to enable posting on COMMBUYS once selection is completed.

2. This WORD document must be used and may not be altered, reformatted or changed in any way or the Response will be subject to rejection. This document must be saved in a WORD format and not in .pdf so that the document may be modified during negotiations if necessary. Bidders may not save this document as a .pdf format. A .pdf format will subject the Response to rejection. Attachments allowable as .pdf submissions will be specifically noted.

3. Bidders must enter, or copy and paste, information into the spaces provided for each question. The space will expand to accommodate the data entered. The Bidder may open the “footer” and add the Bidder’s Name to print on each page of the Response.

4. Bidders may not refer to outside attachments for key information related to answering the questions unless the Attachment is one of the Required Attachments for the RFR Response or is an attachment that must be completed as specified under the “Forms and Terms” tab for this RFR on COMMBUYS. This form will expand to accommodate the addition of response information.

5. Each item must be addressed specifically by entering information in the required ANSWER space. If an item is inapplicable, the Response must indicate "N/A" or “Not applicable” or other appropriate explanation.

6. The questions presented are the best guess of what information is needed to evaluate Bidders and are not exhaustive. Bidders should be as comprehensive in responding as possible and include all relevant information and considerations to assist in the review of a Response and demonstrate the full capabilities of the Bidder.

7. Bidders are responsible for reviewing the “Forms & Terms” tab under this RFR in COMMBUYS for all the listed specifications and the required Forms that must be submitted with the RFR Response (in order to be considered for selection) or upon contract award and execution. Failure to submit the required Forms with the RFR Response, as specified, will be considered sufficient grounds for rejection of the Bidders Response.

Submission of Responses Bids will be submitted solely through the www.COMMBUYS.com process required for Statewide Contracts as outlined in the RFR.

Deadline for Submission Submit Responses through COMMBUYS by Submission Deadline Date listed in the RFR.

RFR RESPONSE PART A

BIDDER AUTHORIZED CONTACT, INTRODUCTION AND CERTIFICATIONS

A-1. Authorized Representative and RFR Contact. Please complete the information below for the Individual who is an Authorized Representative of the Bidder, who can legally bind the Bidder during the RFR Interview and subsequent negotiations, and who shall serve as the RFR Contact for any questions or communication necessary during the procurement. The Bidder must identify its Legal Name as used for filing Tax Returns to the Internal Revenue Service (IRS) and its Federal Employer Identification Number (FEIN).

Bidder Legal Name:

D/B/A (if operating under this name):

Legal Address (for Tax Return Purposes):

Authorized Representative/RFR Contact Name:

Title:

Telephone:

Cell:

TTY/TTD:

Email Address:

Fax:

A-2. INTRODUCTION: In the space below “BIDDER’s INTRODUCTION”, please provide a brief introduction (not to exceed 3 pages in length) that demonstrates the Bidder's qualifications and experience to perform the work requested. Identify which of the categories the Bidder will be bidding on and include a description of the firm philosophy in providing each of the categories for which the Bidder is submitting a Response. Bidders must demonstrate a significant commitment to partner with the Commonwealth and Eligible Entities to achieve the highest level of compliance and ensure methods prevent fraud, waste and abuse of Commonwealth funds and resources due to business disruptions and costs from cyber and data compromises.

A-2. ANSWER:

Bidders will be selected in four major categories. Identify with an “X” which of the RFR Categories are being submitted under this RFR.

I. Payment Card Industry (PCI) Council Approved Quality Security Assessors (QSAs) and related QSA Consulting Services. Full suite of assessment and consulting services for Eligible Entities receiving revenue through credit cards to ensure PCI compliance and validation.

II. PCI Council Approved Scanning Vendors (ASVs) and other Scanning and Compliance and Vulnerability Testing and Security Compliance Scans and Testing. Full suite of penetration, vulnerability, testing and compliance scanning, assessments and consulting services for Eligible Entities receiving revenue through credit cards to ensure PCI compliance and validation.

III. Non-PCI Cyber and Data Security, Audit, Compliance, Cyber Readiness Services. Full suite of cyber and data security services for all non-PCI related data management activities.

IV. Emergency and Incident Cybersecurity, Containment, Mitigation, Remediation, Audit and Validation Services. Emergency Cybersecurity Incident Responses for suspected or known cybersecurity attacks, system or network data breaches or other incidents, and post-incident services after a Department has contained and remediated the incident to audit and validate that the remediation is sufficient so that the Commonwealth’s systems and other resources are not compromised.

V. Non-PCI Scanning Services. Full suite of scanning and testing services for any cyber or data security compliance, data processing system, internal or external application, network or other infrastructure for ongoing maintenance, audit, or incident response needs.

Bidders will be separately reviewed and ranked in each of the categories in which they bid, and Bidders may bid on any or all of the categories. Bidders will be ranked separately under each category and may or may not be selected to provide more than one category of services, even if a Response has been submitted for more than one category.

ENTER BIDDER’S INTRODUCTION HERE:

A-3. CERTIFICATION OF ACCEPTANCE OF COMMONWEALTH TERMS.

The order of precedence of this Statewide Contract is as follows:

1) Commonwealth Terms and Conditions

2) Standard Contract Form

3) Request for Response PRF73DesignatedOSC (as amended)

4) This Contractor’s Response, as amended during negotiations

5) Any other non-conflicting provisions, terms or materials incorporated herein by reference by the Contractor

It is expected that any legal review of the required contract forms and attachments will be done PRIOR to submission of the RFR Response and that objections to any language in the RFR or attachments will not be raised after selection and during contract negotiations. This means that the Bidder can not condition execution upon the “opportunity to negotiate final terms” after selection.

Therefore, if the Bidder has any questions related to the interpretation of any language in the required forms or Attachments, these questions must be identified as part of the “On-line Forum” for this RFR during the question and answer period prior to submission, and questions or objections may not be raised at a later date.

Any issues or concerns with the language in the Contract Forms or Attachments, or proposed additions or clarifications to this language MUST BE IDENTIFIED IN DETAIL BELOW as part of the Response, which will be evaluated as part of the selection process, and may not be raised after selection.

Bidders are not authorized to condition execution of a contract with the Commonwealth upon the Commonwealth’s execution of a Bidder contract form, or required use of Bidder Terms and Conditions. Any additional terms and conditions that the Bidder seeks to apply to this Contract MUST BE SPECIFIED IN DETAIL BELOW with a full explanation for consideration as part of the selection process. The Commonwealth shall consider any reasonable “clarification” of terms that defines or outlines the parties’ responsibilities, but does not delete or materially change the Commonwealth terms. Selection for final negotiation of a Contract shall not be interpreted as the Commonwealth’s acceptance of any terms, conditions or recommended clarifications identified in this section and shall be subject to the Commonwealth’s acceptance as part of negotiations. The Commonwealth reserves the right to redact any submitted terms.

Note that the current Statewide Contract includes additional terms in the Contract User Guide negotiated for all Contractors and will provide some guidance as to the extent of allowable clarifications of terms, rather than amendment.

The listing of numerous conditions, demands for negotiation of terms, conditioning performance on the Commonwealth’s acceptance of Bidder terms or a demonstration of an unwillingness to operate under the Commonwealth’s boilerplates and terms shall be a significant consideration as part of Qualifications for this Statewide Contract and grounds for rejection of the Bidder’s Response or a significant reduction in points.

A-3. ANSWER:

A-4. Please list the following information if applicable. Failure to identify such contingencies as part of a Response will be considered sufficient cause for immediate termination from the Statewide Contract if such information is discovered during the life of the Contract. Details of the particular incidents do not have to be provided unless to identify mitigation or resolution of the incident.

a) Penalties and Bankruptcy: A list of all bankruptcy and other similar proceedings within the past five years relating to the Bidder, any officer, director, partner or member thereof, any affiliate or any related entity.

b) Litigation: List any outstanding contingencies, such as lawsuits or other claims or charges against the Bidder related to performance of the services sought under this RFR and any and all investigations, indictments or pending litigation by any federal, state or local jurisdiction relating to the Bidder, any officer, director, partner or member thereof, any affiliate or any related company and all criminal convictions within the last five years relating to the Bidder, any officer, director, partner or member thereof, any affiliate or any related entity.

c) Civil Penalties: A list of all civil penalties, judgments, consent decrees and other sanctions within the last five years, as a result of any violation of any law, rule, regulation or ordinance in connection with its business activities relating to the Bidder, any officer, director, partner or member thereof, any affiliate or any related entity.

d) Suspensions of any permit or authority to do business: A list of all actions occurring within the last five years which have resulted in revocation or suspension of any permit or authority to do business in any jurisdiction relating to the submitting entity, any officer, director, partner or member thereof, any affiliate or any related entity.

e) Debarment from public bidding: A list of all actions occurring within the last five years that have resulted in the barring from public bidding of the Bidder, an officer, director, partner or member thereof, any affiliate or any related entity.

f) Defaults: The Bidder shall list any situation in which the Bidder’s firm (either alone or as part of a joint venture), or a subsidiary of the Bidder’s firm, defaulted or was deemed to be in noncompliance of any contractual obligations, explaining the situation, its outcome and all other relevant facts associated with the event described. Please also provide the name, title and telephone number of the principal manager of the contract user who asserted the event of default or noncompliance.

g) Other Adverse Situations or Potential Conflicts: The Bidder shall provide a description of any present facts known to the Bidder that might reasonably be expected to affect adversely its ability to perform any aspect of this Contract or present a conflict of interest or ethical issue.

A-4. ANSWER:

a) Penalties and Bankruptcy:

b) Litigation:

c) Civil Penalties or actions:

d) Suspensions of any permit or authority to do business:

e) Debarment from public bidding:

f) Defaults:

g) Other Adverse Situations or Potential Conflicts:

A-5. Provide a listing of the Bidder’s concurrent material engagements, as well as its current outstanding proposals or bids that could impact the available resources or the provision of concurrent service to multiple Eligible Entities across the Commonwealth. Bidder must be able to certify that the key personnel assigned to this contract will be assigned to Eligible Entity engagements and that the Bidder has the capacity and resources to provide concurrent services to multiple Eligible Entities across the Commonwealth. Bidders must identify in this section if the Bidder seeks to provide services primarily to state department Eligible Entities, or municipalities and local government, or state authorities or to all Eligible Entities.

A-5. ANSWER:

A-6 RESPONSE CERTIFICATION: By completion of the information in the space provided below and submission of this RFR Response, the Bidder through its Authorized Representative certifies:

1) that the Response will remain in effect for a period of 120 days from the submission deadline and thereafter until either the Bidder withdraws it, a Contract is executed, or the procurement is canceled, whichever occurs first; and

2) that the information provided is accurately represented; and

3) that the Bidder is ready, willing and able to perform the work required as specified; and

4) that if selected for final contract negotiation, the Bidder is willing to have authorized signatories meet during the period for final negotiation and contract execution (as identified in the Procurement Calendar) to execute the contract without protracted contract negotiations; and

5) that this Response is being submitted in good faith and without any collusion or fraud; and

6) that the Bidder certifies that it will comply with the Statewide Contract terms including amendments, for the duration of any contract awarded to the Bidder under this RFR; and

7) that the Bidder certifies that this Response is submitted in accordance with the order of precedence outlined in Section A.3, that any legal review of the required contract forms and attachments has been be done PRIOR to submission of the RFR Response, and that any recommended clarifications that do not modify or delete the standard terms have been identified and objections to any language in the RFR or attachments will not be raised after selection or during contract negotiations; and

8) that this Response is not conditioned upon the Commonwealth’s acceptance of any Bidder standard forms or terms, and the Bidder has not conditioned submission of this Response based upon any stated terms in section A-3, and the Bidder has not condition submission of this Response on the ability to negotiate the standard Commonwealth terms, or the Response may be subject to disqualification or a significant drop in points relative to the Qualifications section; and

9) that the Bidder certifies that if selected for a contract that the Bidder must obtain a Certificate of Good Standing from the Department of Revenue as part of Contract Execution (See https://wfb.dor.state.ma.us/webfile/Certificate/Public/WebForms/Help/LearnMore.aspx and http://www.dor.state.ma.us/rul_reg/AdminProcedure/AP613.htm); and

10) that the Bidder certifies that it must be in good standing for tax compliance and any other requirement for licensing or good standing in the Commonwealth for the duration of the Statewide Contract; including PCI SSC listing of QSA and ASV companies, the Bidder may be disqualified at any time after selection or contract execution if the Bidder is placed on remediation or terminated status by the PCI Council or loses any other required certification.

A-6. ANSWER:

Authorized Representative Printed Name Title:

Date:

RFR RESPONSE PART B - BIDDER QUALIFICATIONS

In this Section of the Response the Bidder is required to outline the Bidder’s “Qualifications”, the experience, expertise and capabilities to provide the Statewide Contract Services. Details on the specific services and performance details should be included under PART C – WORK PLAN. Part B is limited to demonstrating the Bidder’s Qualifications, and that the Bidder has the requisite skills, experience and expertise to provide the necessary services to Commonwealth Eligible Entities with details of historical demonstrated performance.

In order to promote competition and ensure the most cost effective and comprehensive availability of services, the Commonwealth intends to narrow the field of qualified contractors to the most qualified and competitive firms, not solely based upon low cost but based upon qualifications, success rates, willingness to partner with the Commonwealth, state of the art resources, privacy and security protocols, quality assurance, integrity in audit actions and supplier diversity commitments.

See background policies for current PCI program at: http://www.macomptroller.info/comptroller/business-functions/non-tax-revenue/electronic-payment.htm Bidders may respond in any of the following four (4) categories of services under this Statewide Contract. If the Bidder is not submitting a response in a category the Bidder must indicate “N/A” or “Not Applicable” in the ANSWER section for EVERY ANSWER section that is not applicable.

I. Payment Card Industry (PCI) Council Approved Quality Security Assessors (QSAs) and related QSA Consulting Services. Full suite of assessment and consulting services for Eligible Entities receiving revenue through credit cards to ensure PCI compliance and validation.

II. PCI Council Approved Scanning Vendors (ASVs) and other Scanning and Compliance and Vulnerability Testing and Security Compliance Scans and Testing. Full suite of penetration, vulnerability, testing and compliance scanning, assessments and consulting services for Eligible Entities receiving revenue through credit cards to ensure PCI compliance and validation.

III. Non-PCI Cyber and Data Security, Audit, Compliance, Cyber Readiness Services. Full suite of cyber and data security services for all non-PCI related data management activities.

IV. Emergency and Incident Cybersecurity, Containment, Mitigation, Remediation, Audit and Validation Services. Emergency Cybersecurity Incident Responses for suspected or known cybersecurity attacks, system or network data breaches or other incidents, and post-incident services after a Department has contained and remediated the incident to audit and validate that the remediation is sufficient so that the Commonwealth’s systems and other resources are not compromised.

V. Non-PCI Scanning Services. Full Suite of scanning and testing services for any cyber or data security compliance, data processing system, internal or external application, network or other infrastructure for ongoing maintenance, audit, or incident response needs.

Subcontractor and Prime Bidders. When completing responses the Bidder must indicate if the Bidder will be directly providing the services or contracting out the provision of services through a subcontractor. All subcontractor work will be billed through the Bidder as Primary Contractor under the Primary Contractor’s Tax ID. The Commonwealth will not entertain “joint” bids.

Eligible Entities may contract solely with Contractors approved under the Statewide Contract and may not enter into direct relationships with named subcontractors. Therefore, named subcontractors that desire direct contract relationships for scanning or other services independent of the Primary Contractor must submit their own Response for these services (in addition to being listed as a named subcontractor under a Prime Contractor Response) in order to be considered a Statewide Contractor that can have a direct relationship with Eligible Entities. For Bidders providing both QSA and Scanning Services the Bidder must be able to demonstrate independence of QSA services and Scanning Services to ensure the integrity between scan results and QSA service recommendations.

B-1. FIRM PROFILE

In the ANSWER section below:

a. State whether the firm is local, national, or international and the total number of employees.

b. A brief firm history.

c. State the location of the office(s) from which the work is to be managed and the location from which the work will be performed.

d. Virtual and In-State Presence. Verify that Bidder is a United States firm able to perform both virtual and on-site work in Massachusetts, with no services being provided outside the continental US. While most of the required work should be able to be performed virtually, some on-site work may be requested or required. It is preferred that Contractors have an in state presence, with a local office as opposed to a registered agent location. Pricing must include travel. Given the number of qualified firms in the New England area, it is expected that there are numerous vendors capable of providing emergency services locally, with no travel costs added. Bidders seeking to recoup travel costs must include pricing with travel included. Bidders with applications that will be accessing any Department data may not store any data in global clouds where data is travelling outside the continental US.

e. State the types of work performed by the office and the percentage of effort devoted to each type.

B-1. ANSWER:

a.

b.

c.

d.

e.

B-2. PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAS) AND RELATED QSA CONSULTING SERVICES.

Section B-2 is limited to Bidders qualified to perform traditional QSA services required by the PCI Council and acquiring banks, and also consulting assistance for the completion and independent SAQ review, and any other PCI vulnerability assessments, even if an Eligible Entity Merchant is not required to have an independent evaluation by the PCI Council or their acquiring bank. References to specific sections of the standards should be included. Standards for Payment Card Industry Council approved Vendors are posted at: https://www.pcisecuritystandards.org/assessors_and_solutions/

Bidders are instructed to provide DETAILED THOROUGH responses to EACH of the sections listed below. The Responses should NOT merely be a simple statement that the Bidder can provide the listed service. Bidders may NOT attach brochures or other marketing materials. Therefore, Bidders are expected to enter all relevant details and information in the section below that demonstrates experience, specific projects, and any other information supporting exceptional experience. Sparse answers that do not provide supporting details may subject the Response to rejection.

The Responses should NOT include standard marketing jargon but must be targeted to demonstrate the unique needs of the Commonwealth rather than just a generic bid response. Bidders will be rated on their ability to demonstrate a true understanding of the unique needs of public entities, and the needs of the Commonwealth, including demonstrating the ability to properly scope assessments for public entities with budget constraints.

EVERY ANSWER section below must be completed. Indicate “N/A” or “Not Applicable” or “Does not have this expertise” or “Does not provide these services” as appropriate.

a) PCI COUNCIL APPROVED QUALITY SECURITY ASSESSORS (QSAs) AND RELATED CONSULTING SERVICES. The Bidder must provide evidence that it is a certified Qualified Security Assessor (QSA) approved by the PCI Security Standards Council https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors as of the date of this RFR to perform on-site PCI Data Security Assessments and validation for a Level 2, 3, or 4 merchant and Level 2 service providers; and Reports on Compliance (ROC) for Level 1 merchants and service providers. The Bidder must also demonstrate that they are not currently in remediation with the PCI Council.

B-2. a) ANSWER:

b) Specific Projects And Contracts for PCI Services Providing A Full Suite Of QSA, Consulting And Remediation Services. Bidders must demonstrate that the Bidder has continuously for at least five (5) years provided government PCI services providing a full suite of QSA, consulting and remediation services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience. If the Bidder has performed for less than the five (5) year minimum, demonstrate cumulative experience of not less than five (5) years in state government PCI services and at least five (5) years in other PCI services comparable to the services required under this RFR. Bidders must also meet a minimum requirement of performance of services to at least four (4) government entities (local/state/federal) with similar PCI needs or complexity as the Commonwealth and a clear understanding of work with a government entity. Bidder should demonstrate the ability and capacity to perform the service required with numerous merchant relationships and heterogeneous cardholder data environments. List and Describe in detail specific projects and contracts, specifically government engagements, and any other information relevant to demonstrate experience and expertise in this area.

B-2. b) ANSWER:

c) Specific Projects and Contracts for Evaluating And Providing Assessments Of The Cardholder Data Environment. Bidders must demonstrate significant experience with evaluating and providing assessments of the cardholder data environment of large scale and diversified or decentralized merchants, as well as the ability to assess areas of internal risks for these type of organizations such as insider fraud, unattended devices, social engineering, third party hosting risks, data leakage prevention, and other related risks and provide emerging technology and PCI scope reductions trends and any other considerations. Describe in detail specific projects and contracts, specifically government engagements, and any other information relevant to demonstrate experience and expertise in this area.

B-2. c) ANSWER:

d) Specific Projects and Contracts for Payment Processing and Direct Payment Processing Systems. Bidders must demonstrate significant experience with payment processing experience and direct payment processing system audit experience and a clear understanding of the payment processing needs unique to government entities. Audit experience must include the ability to validate that Eligible Entity software and applications are PCI compliant if not already approved by the PCI Council software listing. Describe in detail specific projects and contracts, specifically government engagements, and any other information relevant to demonstrate experience and expertise in this area.

B-2. d) ANSWER:

e) QSA Service Requirements. Bidders must provide a detailed description of how they will meet the following requirements, and provide concrete examples of successful achievements:

1. For Eligible Entity merchants using credit cards, identify how the Bidder will assist the merchant with the successful completion of the PCI Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) for all Commonwealth merchants and/or service providers.

2. The PCI SAQ must be used to address any system(s) or system resource component(s) involved in processing, storing, or transmitting cardholder data. Identify what the process is to kick-off an engagement and whether the Bidder has an intake or engagement form to develop a Statement of Work (SOW) scope for a project.

3. Describe what tasks /work would be performed, step-by-step, when completing a QSA project. What would Eligible entity be asked to do to facilitate your normal business process? What Eligible Entity resource requirements would your company have in terms of space, dedicated staff, and computer access from an Eligible Entity? Please describe in detail.

4. Scoping and Bidders must demonstrate ability to efficiently and effectively develop PCI DSS scope assessments and price engagements reasonable for the size and complexity of the engagement, with a willingness to negotiate scope and pricing relative to the funding available for a merchant Department without compromising the duty to identify PCI risks, remediation and recommendations. Describe in detail specific projects and contracts, specifically government engagements. Summarize how a project statement of work (SOW) would be implemented, accompanied by a Schedule of Implementation to include a project timetable, by phase if applicable, and any other information relevant to demonstrate experience and expertise in this area.

5. Describe how the Bidder will identify issues of concern and communicate to the merchant entity potential deficiencies or lack of controls that may result in a potential data breach or failure to achieve PCI compliance. Describe how Bidder will present alternate remediation or compensating control options.

6. Describe how Bidder will prepare SAQ and ROC documents for submission to merchant banks.

7. Describe how Bidder will consult and advise the Commonwealth on information security in the emerging mobile payment acceptance solutions landscape as demand for these services increases.

8. Address how Bidders will meet the following requirements identified Section 4.5 of the PCI Council ASV Program Guide v3.0 (https://www.pcisecuritystandards.org/documents/ASV_Program_Guide_v3.0.pdf) which requires Qualified Security Assessors (QSAs) while performing onsite assessments, to be responsible for the following:

a. Performing PCI DSS Assessments in accordance with the PCI DSS, which includes confirming that PCI DSS Requirement 11.2.2 is “in place” and that the ASV and ASV scan solution were both on the list of Approved Scanning Vendors on the date when the respective scans were performed.

b. Providing an opinion about whether the assessed entity meets applicable PCI DSS requirements in accordance with QSA Program requirements.

c. Providing adequate documentation within the Report on Compliance (ROC) to demonstrate the assessed entity’s compliance with the PCI DSS.

d. Submitting the ROC and the Attestation of Validation (signed by the QSA and in some cases, the assessed entity).

e. Maintaining an internal quality assurance process for its QSA program-related efforts.

f. Attesting to the entity’s compliance with PCI DSS.

g. Performs QA reviews on ROCs to help ensure that the documentation of test procedures performed is sufficient to demonstrate compliance.

9. Identify any other services or value added offerings, in addition to what has been mentioned for the items above that are available for Eligible Entities, how these offerings can benefit, supplement or assist Eligible Entities and why the Bidder provides better value and should be selected as a Statewide Contractor for QSA services.

B-2. e) ANSWER:

1.

2.

3.

4.

5.

6.

7.

8.

9.

f) Please identify if the Bidder is PA-QSA qualified. https://www.pcisecuritystandards.org/assessors_and_solutions/payment_application_assessors Payment Application Qualified Security Assessor (PA-QSA) companies are organizations that have been qualified by the Council to have their employees assess compliance to the PCI PA-DSS standard. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-2. f) ANSWER:

g) Please identify if the Bidder is qualified to evaluate Pin Transaction Security (PTS). Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-2. g) ANSWER:

h) Please identify if the Bidder has PCI PFI Certification. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-2. h) ANSWER:

i) Please identify if the Bidder has Point-to-Point Encryption (P2PE) Assessor certification.

· Qualified Security Assessors Point to Point Encryption/ QSA (P2PE)s companies are organizations that have been qualified by the Council to have their employees assess PCI P2PE Solutions.

· Qualified Security Assessors Point to Point Encryption assessors are employees of these organizations certified by the Council to validate P2PE Solutions.

· Payment Application Qualified Security Assessors Point to Point Encryption / PA-QSA (P2PE)s are organizations that have been qualified by the Council to have their employees assess PCI P2PE Solutions and Application.

· PA-QSA (P2PE)s are employees of these organizations who have been certified by the Council to validate P2PE Solutions and P2PE Applications. They are the only assessors who are qualified to perform Domain 2 assessments.

Identify how long the Bidder has had any of these qualifications and the extent of expertise and experience in this area.

B-2. i) ANSWER:

j) Please identify Bidder expertise relative to providing assessments and security reviews for PCI Compliance for mobile payment acceptance solutions such as the upcoming PCI Software Security Framework. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-2. j) ANSWER:

k) Please identify any other PCI related qualifications or expertise not previously mentioned that demonstrates qualifications to provide PCI QSA services. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-2. k) ANSWER:

l) Use of Subcontractors for QSA Services. It is presumed that the selected Bidder will be responsible for and perform all the duties and requirements of this RFR. In this section, the Bidder must identify any subcontractors that will or may be used to conduct any of the work described in this Section, including the names of subcontractors, summaries of their qualifications, experience and duties and responsibilities for performance. The Bidder will remain the sole point of contact and will be responsible for all performance under the contract. For all subcontractors, the following information is required in this Response: the name of the firm that will provide direct services; the anticipated number of Full-Time Equivalent (FTE) hours the subcontractor will be utilized during a work week; and the individual performance area(s) the subcontractor will be used under a resulting contract.

B-2. l) ANSWER:

m) Qualifications to provide robust Reporting, Results and Analysis for QSA Services. Bidders must demonstrate the capability to provide detailed assessments, analysis of scoping environments, reports and any other information required by Eligible Entities. Contractors will be required to provide overall state compliance assessments, reduction in PCI scope recommendations, and other information for overall PCI compliance.

Please complete this section fully. Do not refer back to other sections.

1. Please list and describe types of reporting that your company would provide during the engagement and the frequency of the reports. Also describe a final report that your company would provide at the completion of a QSA engagement.

2. Identify if Bidder provides an on-line monitoring/reporting system and describe how the Bidder’s online system will be accessed, security, content, and cost.

3. Identify how Bidder reports can be used to assist Eligible Entity merchants with managing their PCI Security compliance needs (particularly, the PCI Self-Assessment Questionnaire, Report on Compliance, Vulnerability Scans, and Penetration tests).

4. Describe how Bidder will allow web-based access to CTR and any authorized Department for central monitoring of compliance status for all Commonwealth merchants.

5. Describe if reports provide detailed and summary level reporting to management specifying areas of risk, along with recommended corrective actions.

6. Describe if reporting applications provide the ability to report compliance status of Commonwealth merchants to the Merchant Services Provider(s).

7. Describe if reporting applications provide the ability to present an on-line Certification of Compliance Validation.

8. Describe any other relevant information detailing reporting options and recommendations for QSA engagements.

9. List the titles of available sample reports and attach samples of QSA available reports (Attachment). (Sample reports may be submitted as .pdf attachments)

B-2. m) ANSWER:

2.

3.

4.

5.

6.

7.

8.

B-3. PAYMENT CARD INDUSTRY (PCI) APPROVED SCANNING SERVICES (ASV) – QUALIFICATIONS

Bidders selected in this category must have exceptional experience and expertise in providing a full suite of scanning and security testing and penetration services to identify vulnerabilities and test remediation efforts for PCI Compliance.

When completing responses the Bidder must indicate if the Bidder will be directly providing the services or contracting out the provision of services through a subcontractor. All subcontractor work will be billed through the Bidder as Primary Contractor under the Primary Contractor’s Tax ID. The Commonwealth will not entertain joint bids. Eligible Entities may contract solely with Contractors approved under the Statewide Contract and may not enter into direct relationships with named subcontractors. Therefore, named subcontractors that desire direct contract relationships for scanning or other service independent of the Primary Contractor must submit their own Response for these services (in addition to being listed as a named subcontractor under a Primary Contractor Response) in order to be considered a Statewide Contractor that can have a direct relationship with Eligible Entities. For Bidders providing both QSA and Scanning Services, the Bidder must be able to demonstrate complete independence of QSA services and Scanning Services.

Bidders are instructed to provide DETAILED THOROUGH responses to EACH of the sections listed below. The Responses should NOT be a simple statement that the Bidder can provide the listed service. Bidders may NOT attach brochures or other marketing materials. Therefore, Bidders are expected to enter all relevant details and information in the section below that demonstrates experience, specific projects, and any other information supporting exceptional experience. Sparse answers that do not provide supporting details may subject the Response to rejection.

The Responses should NOT include standard marketing jargon but must be targeted to demonstrate the unique needs of the Commonwealth rather than just a generic bid response. Bidders will be rated on their ability to demonstrate a true understanding of the unique needs of public entities, and the needs of the Commonwealth, including demonstrating the ability to properly scope assessments for public entities with budget constraints.

EVERY ANSWER section below must be completed. Indicate “N/A” or “Not Applicable” or “Does not have this expertise” or “Does not provide these services” as appropriate.

a) PCI COUNCIL APPROVED SCANNING VENDOR (ASV). For PCI Compliance services, the Bidder must provide evidence that it is a certified Approved Scanning Vendor (ASV) approved by the PCI Security Standards Council at: https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors as of the date of this RFR to perform internal and external network vulnerability scans for all merchants and service providers with externally-facing IP addresses.

B-3. a) ANSWER:

b) For PCI compliance services, Bidders must demonstrate a minimum level of at least five (5) years experience providing the same type of full suite ASV services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience. Also, a minimum requirement of performance of services to at least four (4) government entities (local/state/federal) with similar PCI needs or complexity as the Commonwealth and a clear understanding of work with a government entity. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-3. b) ANSWER:

c) For PCI compliance services, Bidders must demonstrate ability to efficiently and effectively develop ASV scope assessments and price engagements reasonably for the size and complexity of the engagement, the PCI or other level of risk, with a willingness to negotiate scope and pricing relative to the funding available for a merchant Eligible Entity without compromising the duty to identify PCI compliance and other vulnerability risks, remediation and recommendations, and provide emerging technology and PCI or vulnerability risk scope reduction recommendations.

B-3. c) ANSWER:

d) PCI COUNCIL APPROVED SCANNING VENDOR (ASV) SERVICES TYPES: Bidders must be able to furnish a broad range of scanning services to meet the requirements of PCI ASV scanning. Bidders must identify all of the types of scanning, testing and other protocols used for ASV services, their definition of the type of scan, testing or protocols, the pros and cons of the type of scan, testing or protocols, reasonable alternatives to these types, how long the Bidder has performed these types of scans and the extent of expertise and experience in EACH area.

B-3. d) ANSWER:

e) QUALIFICATIONS TO PROVIDE ROBUST REPORTING, RESULTS AND ANALYSIS FOR ASV SCANNING SERVICES. Bidders must demonstrate the capability to provide detailed reports and any other information required by Eligible Entities related to scanning services. Contractors will be required to provide reports on compliance.

1. Please list and describe types of reporting that your company would provide during the engagement and the frequency of the reports. Also describe a final report that your company would provide at the completion of a scanning engagement, or for ongoing engagements, annual year end reporting.

2. Identify if Bidder provides an on-line monitoring/reporting system.

3. Identify what reporting or other services are available to assist Eligible Entity merchants with managing their Security compliance needs (particularly vulnerability scans and penetration tests).

4. Identify if Bidder is able to allow web-based access for central monitoring of compliance status for all Commonwealth merchants provided to CTR.

5. Identify how Bidder plans to provide detailed and summary level reporting to management specifying areas of risk, along with recommended corrective actions.

6. Describe any other relevant information detailing reporting options and recommendations for ASV engagements for PCI Compliance.

7. List the titles of available sample reports and attach samples of ASV available reports (Attachment). (Sample reports may be submitted as .pdf attachments)

B-3. e) ANSWER:

2.

3.

4.

5.

6.

7.

B-4. NON-PCI CYBER AND DATA SECURITY, AUDIT, COMPLIANCE, CYBER READINESS SERVICES. Full range of proactive audit, compliance, testing and related consulting services for non-PCI related cyber and data security, validation, physical and electronic security of records, PII and confidential information, compliance with Commonwealth Enterprise Data Security and other enterprise or Eligible Entity data security policies, G.L. c. 93H and c. 93I PII and other state and federal security and privacy statutes, and any other audits and compliance reviews related to the security and protection of data management systems, networks, applications, infrastructure, mobile devices and networks, business continuity and protection from internal and external threats.

Bidders must demonstrate the qualifications and experience to provide a full suite of non-PCI related information management, quality assurance, data management, protocol and security audit and compliance review services and resources available, and details about the various types of audit and compliance related to information management systems and procedures and security management systems and procedures and compliance audits that are geared to business improvements and efficiencies, government compliance, internal controls and quality assurance and to protect personally identifiable information and other sensitive data.

Bidders are instructed to provide DETAILED THOROUGH responses to EACH of the sections listed below. The Responses should NOT merely be a simple statement that the Bidder can provide the listed service. Bidders may NOT attach brochures or other marketing materials. Therefore, Bidders are expected to enter all relevant details and information in the section below that demonstrates experience, specific projects, and any other information supporting exceptional experience. Sparse answers that do not provide supporting details may subject the Response to rejection.

The Response should NOT include standard marketing jargon but must be targeted to demonstrate the unique needs of the Commonwealth rather than just a generic bid response. Bidders will be rated on their ability to demonstrate a true understanding of the unique needs of public entities, and the needs of the Commonwealth, including demonstrating the ability to properly scope assessments for public entities with budget constraints.

EVERY ANSWER section below must be completed. Indicate “N/A” or “Not Applicable” or “Does not have this expertise” or “Does not provide these services” as appropriate.

a) Minimum Qualifications. Bidders must demonstrate that the Bidder has continuously for at least five (5) years provided a full suite of cyber and data security, audit, compliance, and cyber readiness services to entities of similar size and complexity as the Commonwealth, with additional points or consideration to well established firms with more extensive experience. List and describe in detail specific projects and contracts, specifically government engagements, and any other information relevant to demonstrate experience and expertise in this area.

B-4. a) ANSWER:

b) Service Types. Bidders must provide a detailed response to each of the sections below identifying if they can provide the service, if not, provide reasonable alternatives and why these alternatives meet industry standards

B-4. b) ANSWER:

1. General cyber and data consulting:

2. Cyber readiness protections to prevent data breaches and unauthorized data access:

3. Cyberattack and data security vulnerability assessments:

4. Cyber and data security risk assessments:

5. Cyber and data security risk management:

6. Cyber and data vulnerability assessments:

7. Cyber and data security building internal controls for data categorization, data management, security of data at rest, in use and in transit:

8. Cyber and data security quality assurance audits:

9. Cyber and data security policies and procedures, advisory (security program, plan, and policy development):

10. Assisting state departments with compliance with EOTSS Enterprise Security Policies And Standards:

11. Data network and system security management:

12. Business continuity plans:

13. Disaster recovery plans:

14. Testing incident response program execution:

15. On-site and on-line audit and assessment capabilities:

16. Evaluation and coordination of scanning/testing, penetration testing and other vulnerability testing for networks, websites, internal and third party applications:

17. Vendor security and data security management:

18. Secure mobile infrastructure validation:

19. Cybersecurity consulting:

20. Cyber and data security training options or recommendations for cyber awareness, secure data and network management (it staff, employees, managers, vendors):

21. Cyber and data security awareness testing:

22. simulations and employee testing:

23. training:

24. Other proactive services to align data security and compliance with business goals, fiscal responsibility and building a culture of security awareness.

25. Identify any other services or value added offerings, in addition to what has been mentioned for the items above, that are available for Eligible Entities, how these offerings can benefit, supplement or assist Eligible Entities and why the Bidder provides better value and should be selected as a Statewide Contractor for these services.

c) Please identify if the Bidder has Patient Safety and Quality Improvement Act of 2005 Statute and Rule qualifications. The Patient Safety and Quality Improvement Act of 2005 (PSQIA) establishes a voluntary reporting system designed to enhance the data available to assess and resolve patient safety and health care quality issues. To encourage the reporting and analysis of medical errors, PSQIA provides Federal privilege and confidentiality protections for patient safety information, called patient safety work product. PSQIA authorizes HHS to impose civil monetary penalties for violations of patient safety confidentiality. PSQIA also authorizes the Agency for Healthcare Research and Quality (AHRQ) to list patient safety organizations (PSOs). PSOs are the external experts that collect and review patient safety. Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-4. c) ANSWER:

d) Please identify if the Bidder has HIPAA SECURITY GUIDANCE qualifications. HHS has developed guidance to assist HIPAA covered entities in complying with the risk analysis requirements of the Security Rule for entities handling health records. http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidancepdf.pdf . Identify how long the Bidder has had this qualification and the extent of expertise and experience in this area.

B-4. d) ANSWER:

e) Please identify any other security or privacy standards (NIST, ISO, FERPA etc.) that the Bidder has…