WSU Draft Responses RFP Questions Answers.pdf

RFP Questions & Answers

PCI-DSS QSA Services:

• What specific standards or types of PCI assessments (e.g., SAQ, PCI DSS) are prioritized for this project? The University requires an assessment including both on-site and remote reviews of merchants adequate to furnish an SAQ-D for Merchants and AOC for the currently in-place version of the PCI DSS in order to satisfy the requirements of its merchant acquirer.

• How do you define the role of an acquirer in working with merchants for PCI compliance, and would your firm consider any restrictions or requirements in this context? The University’s primary merchant acquirers are Bank of America and Touchnet. Working with merchants for PCI compliance in the context of the acquirers could include assisting in requests related to PCI compliance matters received from an acquirer.

• How often does the University anticipate performing a PCI gap analysis or assessment? Is it on an annual basis, or will this vary? Historically, PCI assessments for furnishing an SAQ-D and AOC have been completed annually. A gap analysis may be requested on a variable basis depending on the operational needs of the University and changing PCI DSS framework.

• Are there any specific challenges or considerations the University has faced with changing PCI requirements, and how would you like your consulting firm to address them? The University incorporated incoming PCI V4.0 requirements as prep items on several years of assessments prior to the new standard taking effect. The WSU Information Technology Services network and security teams oversee and are assessed on centralized IT controls and the University’s segregated PCI network.

Preparing for changing standards and reducing the scope of the University’s PCI network are of interest.

• Can you elaborate on the expectations for a PCI program management online solution or portal? What key features would you prefer for completing SAQs and managing assessments? The PCI program management online solution or portal would preferably offer University merchants a central location to track requirements, upload documents, and submit or address comments with its QSA.

An ASV provider would preferably have an online site to submit, amend, and monitor scan targets. Additionally, an ASV provider would offer the ability for the University to request scans and export reports through its portal.

• Does the University have an existing timeline for annual PCI assessments or remediation items? If so, can you share that so we can align our preparation with your schedule? The University currently annually completes an assessment in September and furnishes an SAQ-D and AOC to its merchant acquirer in late October. The University anticipates completing its 2025 assessment in late August to early September with a final report issued by mid-October.

• Does the University have an established governance group for PCI compliance, and what specific support or education will be needed for this group? The University has a merchant services related group called the Cougar Commerce Committee. The Cougar Commerce Committee reviews requests for new merchant services engagements and collaborates on ongoing matters related to the University’s merchant services and PCI compliance programs. Occasional training and guidance support to this group is desired.

• Have there been any major changes in the payment acceptance channels since your last report? No

• Do all of your payment channels still qualify for SAQ-A, P2PE, B, and B-IP? Yes

Support Services:

• Could you clarify the types of support services that are most critical to the University during the PCI compliance process? Education and training suitable for both technical and non-technical PCI support staff. Template materials that can be utilized to complete a PCI DSS assessment. Online solution to track and complete assessment requirements. Support interpreting compliance requirements to include technical implementation recommendations where needed.

• Are there any specific technical support processes that the University prefers or has previously found effective? PANscan standalone card data discovery/scan tool.

External ASV scanning.

• If our firm is not PCI certified as an ASV, would this disqualify us, or is there flexibility to provide these services through a subcontractor? No, if the firm is not a certified ASV, this is not disqualifying. ASV services are included as an optional component of the RFP.

• What kind of PCI educational materials and training does the University require? Do they prefer in-person, online, or a mix of both? The University generally prefers online on-demand training and education opportunities. Occasional (two to four times per year) live trainings for merchants are desired. The University currently requires all employees involved in cardholder data environments to take annual cybersecurity awareness and PCI awareness trainings. Relevant information for trainings includes basic PCI DSS awareness, changes to the PCI DSS, and best practices working with cardholder data in e-commerce and card present environments.

Cost Proposal:

1. Can you clarify whether the cost proposal should include both one-time setup fees and any ongoing support or maintenance fees? Yes, please provide/include both.

2. Are there any requirements regarding the breakdown of costs between on-site and remote services, and if so, could you provide more details on this distinction?

Historically, on-site services have been performed on an annual basis through a visit to two to three University campuses to conduct PCI assessments of individual merchants. Other University merchants have been assessed on a remote basis.

Training and education provided to University merchants would also be expected to be performed remote whether through an online on-demand coursework or through a video call. As much detail as possible is appreciated when it comes to cost. Line items for each of the components and their associated costs.

• Can you please provide us with the number of Merchant ID’s that will be included in the scope of the assessment? Touchnet: 6 (The University utilizes unique TID’s for individual marketplaces which there are approximately 100 in active or inactive statuses). Bank of America Merchant Services: Approximately 80.

• Can you please provide us with the number of payment card transactions processed from 2024 to 2025? Approximately 1.12 million transactions.

• Are there any proposed significant changes that potentially would impact the scope of the assessment in the future? No.