RFP 250000002120 - Questions and Answers.xlsx
XLSX spreadsheet 13 KB Posted
- Solicitation number
- RFP-271-250000002120-3
- Issued by
- Michigan
About this file
This document is a Questions and Answers (Q&A) spreadsheet for RFP 250000002120 issued by the Michigan Department of Treasury for Qualified Security Assessor Services. The RFP involves a procurement for security assessment services, specifically related to Payment Card Industry (PCI) compliance, with the state currently operating as a Level 2 Merchant processing approximately 10 million transactions annually. The state currently requires a Self-Assessment Questionnaire (SAQ) and Attestation of Compliance (AOC), with potential future requirements for a Report on Compliance (ROC) as transaction volumes increase. The document provides clarification on proposal submission format, allowing vendors to insert responses directly into the RFP and submit a transmittal letter, with technical proposal files not required to be consolidated into a single document.
The procurement involves approximately 1,950 devices in a segmented Cardholder Data Environment (CDE), with all payment channels to be covered by a single SAQ or ROC/AOC. The state has indicated use of MoveIt as an approved File Transfer Service and internally uses Microsoft Teams and SharePoint, though compatibility with specific technical standards is not definitively confirmed. The Q&A document addresses vendor questions about response formatting, attachment submission, merchant level classifications, and technical compliance, providing guidance on how bidders should approach various sections of the proposal. The state has not disclosed specific evaluation criteria scoring or point allocations, directing bidders to review relevant sections of the RFP for additional details.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Exhibit A - Form 3337.pdf | ||
| Addendum 1 - RFP 25_2120.docx | DOCX document | |
| Exhibit B _Form DTMB-0928.docx | DOCX document | |
| MI Treasury RFP 250000002120.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Michigan Department of Treasury | |||||
| Qualified Security Assessor Services | |||||
| RFP 250000002120 | |||||
| Questions and Answers | |||||
| Q.# | Document and Section | Page # | Question | Answer | |
| 1 | 1.PROPOSAL PREPARATION | 2,3 | Could the State please confirm its preference for the proposal response format. Is the intention that vendors are to make a copy of the RFP and insert responses directly in line within the RFP? If so, are vendors allowed to submit a Transmittal Letter or Cover Page as a Cover to the Technical and Cost proposal documents? | Bidders are asked to provide a copy of the RFP with their responses directly inserted. Bidders should check the box applicable to their response and provide any descriptions required from the RFP. Bidders are allowed to submit a Transmittal Letter or Cover Page. Bidders are encouraged to reference the Proposal Instructions. | |
| 2 | 6. DELIVERY OF PROPOSAL. | 3 | Could the State please confirm if all required attachments and forms should be consolidated into a single technical proposal file, provided that the file size is under 30 MB?" | The State does not require all attachments and forms to be consolidated into a single technical proposal file. Please refer to Proposal Instructions Section 6. Delivery or Proposal. | |
| 3 | VENDOR QUESTIONS WORKSHEET, Section 11 | 20 | Is there an option for marking "NA" for certain worksheet responses. Specifically for the Convict Labor question. Our company does not use convict labor, so this is not applicable. | Bidder should respond to all questions to the best of their ability and in a manner that accurately represents their experience. | |
| 4 | VENDOR QUESTIONS WORKSHEET, Section 11 | 21 | For the Certification of Michigan Business under Public Act 431 of 1984, Sec. 268, can the State offer guidance on how vendors should respond if they have not yet operated in Michigan or submitted a Corporate Income Tax Return in the State? | Bidder should respond to all questions to the best of their ability and in a manner that accurately represents their experience. | |
| 5 | Section 8, 8. | EVALUATION PROCESS | 4 | Could the State provide additional details on the total evaluation criteria and scoring, specifically regarding the allocation of points between technical and cost factors? | No. The State will refer Bidders to Section 7. Mandatory Minimum Requirements, Section 8. Evaluation Process and Section 12. Award Recommendation. |
| 6 | Schedule A- SOW, 1.1,B | 20 | On Schedule B the State requests pricing for an attested SAQ and AOC, and also for a ROC and AOC. In Schedule A - Statement of Work under background the State declares they process 10 million transactions and are a Level 2 Merchant. Are there upcoming initiatives or acquiring bank mandates (based on transactions) that would require a Level 1 Merchant ROC instead of an SAQ D? | Currently we require a SAQ and AOC, but we anticipate processing volumes to increase in the coming years, which will require us to have a ROC and AOC. Currently a SAQ D Merchant applies. | |
| 7 | Schedule A- SOW, 1.1,B | 20 | Are all payment channels covered by a single SAQ D or ROC / AOC? | Yes, all payment channels are covered by a single SAQ D or ROC/AOC. Reduced scope applications are reviewed as such though (ie. P2PE, Redirects). | |
| 8 | Schedule A- SOW, 1.1,H | 22 | Are there pre-approved portals or tools that align with DTMB Technical Standard 1340.00.080.03 Identity, Credentialing, and Access Management and DTMB Technical Standard 1340.00.080.01 Identification and Authentication? For example, can the State confirm if Microsoft Teams/Sharepoint align with Standards? If not, can you provide a list of preferred solutions? | MoveIt is a File Transfer Service (FTS) which has been approved for use and being implemented at the State of MI. The State uses Teams and Sharepoint internally, but cannot confirm that these resources are in line with the referenced Technical Standards outside of State configurations or within the scope of this proposal. | |
| 9 | Schedule A- SOW, 1.1,B | 20 | Does the State require a ROC and AOC, or an SAQ and AOC? If SAQ, it appears the SAQ D Merchant is the most appropriate SAQ, is that the SAQ filled out by the State in previous years? | Currently we require a SAQ and AOC, but we anticipate processing volumes to increase in the coming years, which will require us to have a ROC and AOC. Currently a SAQ D Merchant applies. | |
| 10 | Schedule A- SOW, Background | 19 | Approximately how many devices (systems, network devices, and POIs) are in the segmented CDE? | Approximately 1950 devices. |
File details come from the government source that posted it. Updated .