PCI Compliance Consulting Services

The City University of New York (CUNY) is requesting proposals for Payment Card Industry Data Security Standard (PCI DSS) Compliance Consulting Services, with proposals due August 26, 2026 at 2:00 p.m. Eastern Time. CUNY has established a 30% participation goal for New York State-certified Minority-Owned and Women-Owned Businesses (MWBEs) and a 6% participation goal for Service-Disabled Veteran-Owned Businesses (SDVOBs). The Procurement Lobbying Act applies; all vendor communications must be directed to the designated contact, Helena Gacina, Purchasing Manager, at helena.gacina@cuny.edu.

The scope encompasses policy and procedure development, gap analysis, remediation guidance, training delivery (including annual PCI training and SAQ training), compliance checklists, vulnerability scanning procedures, merchant account and payment gateway management, equipment recommendations, payment solution evaluations, and ongoing advisory support for CUNY's cardholder data environment. The contractor must maintain Professional Liability/Errors & Omissions and Internet Policies insurance with minimum coverage of $1 million per occurrence and comply with CUNY's cybersecurity standards, including access controls, encryption, audit logging, incident response protocols, and data security measures under the CUNY Service Provider Standard effective July 15, 2024.

Minimum qualifications include ten years of relevant PCI DSS compliance experience, authorization to work in New York State, three professional references, and compliance with FERPA, the Federal Privacy Act, and the Gramm-Leach-Bliley Act. The contract term is three years with two optional one-year renewal periods at CUNY's sole discretion, subject to approval by the New York State Attorney General and Comptroller. Compensation is based on fully-loaded monthly rates covering all administrative and overhead costs, with payment tied to services rendered rather than guaranteed minimums.

Evaluation criteria are technical and management proposal (60 points), pricing (25 points), diversity practices questionnaire (5 points), and oral presentations for shortlisted proposers (10 points), for a maximum of 100 points. Written questions are accepted in two rounds: August 10 and August 18, 2026. No incumbent contractor is identified.