RFP 250000002120 - Questions and Answers.xlsx
XLSX spreadsheet 13 KB Posted
- Solicitation number
- RFP-271-250000002120-2
- Issued by
- Michigan
About this file
This document is a Questions and Answers (Q&A) spreadsheet for RFP 250000002120 issued by the Michigan Department of Treasury for Qualified Security Assessor Services. The RFP seeks a vendor to conduct Payment Card Industry (PCI) security assessments, specifically a Self-Assessment Questionnaire (SAQ) and Attestation of Compliance (AOC), with potential future expansion to a Report on Compliance (ROC) as transaction volumes increase. The state currently processes 10 million transactions as a Level 2 Merchant and has approximately 1,950 devices in a segmented Cardholder Data Environment (CDE).
The Q&A document addresses vendor inquiries about proposal formatting, submission guidelines, and technical specifics. Key details include allowing vendors to submit a transmittal letter, not requiring consolidated attachments, and confirming that all payment channels will be covered by a single SAQ D or ROC/AOC. The state uses MoveIt for file transfers and internally uses Microsoft Teams and SharePoint, but cannot confirm their alignment with specific technical standards outside of state configurations. Vendors are instructed to respond comprehensively to all worksheet questions, including those about Michigan business certification and convict labor practices.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Exhibit A - Form 3337.pdf | ||
| Exhibit B _Form DTMB-0928.docx | DOCX document | |
| MI Treasury RFP 250000002120.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Michigan Department of Treasury | |||||
| Qualified Security Assessor Services | |||||
| RFP 250000002120 | |||||
| Questions and Answers | |||||
| Q.# | Document and Section | Page # | Question | Answer | |
| 1 | 1.PROPOSAL PREPARATION | 2,3 | Could the State please confirm its preference for the proposal response format. Is the intention that vendors are to make a copy of the RFP and insert responses directly in line within the RFP? If so, are vendors allowed to submit a Transmittal Letter or Cover Page as a Cover to the Technical and Cost proposal documents? | Bidders are asked to provide a copy of the RFP with their responses directly inserted. Bidders should check the box applicable to their response and provide any descriptions required from the RFP. Bidders are allowed to submit a Transmittal Letter or Cover Page. Bidders are encouraged to reference the Proposal Instructions. | |
| 2 | 6. DELIVERY OF PROPOSAL. | 3 | Could the State please confirm if all required attachments and forms should be consolidated into a single technical proposal file, provided that the file size is under 30 MB?" | The State does not require all attachments and forms to be consolidated into a single technical proposal file. Please refer to Proposal Instructions Section 6. Delivery or Proposal. | |
| 3 | VENDOR QUESTIONS WORKSHEET, Section 11 | 20 | Is there an option for marking "NA" for certain worksheet responses. Specifically for the Convict Labor question. Our company does not use convict labor, so this is not applicable. | Bidder should respond to all questions to the best of their ability and in a manner that accurately represents their experience. | |
| 4 | VENDOR QUESTIONS WORKSHEET, Section 11 | 21 | For the Certification of Michigan Business under Public Act 431 of 1984, Sec. 268, can the State offer guidance on how vendors should respond if they have not yet operated in Michigan or submitted a Corporate Income Tax Return in the State? | Bidder should respond to all questions to the best of their ability and in a manner that accurately represents their experience. | |
| 5 | Section 8, 8. | EVALUATION PROCESS | 4 | Could the State provide additional details on the total evaluation criteria and scoring, specifically regarding the allocation of points between technical and cost factors? | No. The State will refer Bidders to Section 7. Mandatory Minimum Requirements, Section 8. Evaluation Process and Section 12. Award Recommendation. |
| 6 | Schedule A- SOW, 1.1,B | 20 | On Schedule B the State requests pricing for an attested SAQ and AOC, and also for a ROC and AOC. In Schedule A - Statement of Work under background the State declares they process 10 million transactions and are a Level 2 Merchant. Are there upcoming initiatives or acquiring bank mandates (based on transactions) that would require a Level 1 Merchant ROC instead of an SAQ D? | Currently we require a SAQ and AOC, but we anticipate processing volumes to increase in the coming years, which will require us to have a ROC and AOC. Currently a SAQ D Merchant applies. | |
| 7 | Schedule A- SOW, 1.1,B | 20 | Are all payment channels covered by a single SAQ D or ROC / AOC? | Yes, all payment channels are covered by a single SAQ D or ROC/AOC. Reduced scope applications are reviewed as such though (ie. P2PE, Redirects). | |
| 8 | Schedule A- SOW, 1.1,H | 22 | Are there pre-approved portals or tools that align with DTMB Technical Standard 1340.00.080.03 Identity, Credentialing, and Access Management and DTMB Technical Standard 1340.00.080.01 Identification and Authentication? For example, can the State confirm if Microsoft Teams/Sharepoint align with Standards? If not, can you provide a list of preferred solutions? | MoveIt is a File Transfer Service (FTS) which has been approved for use and being implemented at the State of MI. The State uses Teams and Sharepoint internally, but cannot confirm that these resources are in line with the referenced Technical Standards outside of State configurations or within the scope of this proposal. | |
| 9 | Schedule A- SOW, 1.1,B | 20 | Does the State require a ROC and AOC, or an SAQ and AOC? If SAQ, it appears the SAQ D Merchant is the most appropriate SAQ, is that the SAQ filled out by the State in previous years? | Currently we require a SAQ and AOC, but we anticipate processing volumes to increase in the coming years, which will require us to have a ROC and AOC. Currently a SAQ D Merchant applies. | |
| 10 | Schedule A- SOW, Background | 19 | Approximately how many devices (systems, network devices, and POIs) are in the segmented CDE? | Approximately 1950 devices. |
File details come from the government source that posted it. Updated .