PCI Compliance Evaluation

The Eugene Water & Electric Board (EWEB), Oregon's largest customer-owned water and electric utility serving approximately 200,000 residents in Eugene and surrounding areas, issued an Informal Request for Proposals on April 7, 2026, for PCI Compliance Evaluation services with proposals due by May 5, 2026, at 2:00 PM PT. EWEB seeks a qualified independent consultant to provide a comprehensive assessment of its current PCI DSS compliance posture and deliver a structured remediation roadmap aligned with PCI DSS v4.0 requirements. The assessment will evaluate EWEB's environment against six primary PCI DSS control objectives: Build and Maintain a Secure Network and Systems; Protect Account Data; Maintain a Vulnerability Management Program; Implement Strong Access Control Measures; Regularly Monitor and Test Networks; and Maintain an Information Security Policy. Qualified contractors must demonstrate PCI assessment experience, utilities or public sector experience, experience with SAP-integrated environments, and provide details of three comparable projects completed within the last ten years with client references. EWEB will conduct a two-tier evaluation process using weighted scoring criteria: Tier One considers firm qualifications (30 points), project approach (30 points), project team (20 points), and cost proposal (20 points), with optional Tier Two interviews (100 points). An Intent to Award will be announced May 22, 2026, with contract award by May 29, 2026, and the contract will commence upon award and conclude approximately August 31, 2026. Work will be performed at the Contractor's business location rather than on-site at EWEB.

EWEB encourages minority-owned, woman-owned, and emerging small business participation and will offer price preference to resident bidders in accordance with Oregon Revised Statutes 279A.120. Contractors must provide pricing proposals that include estimated hours and hourly rates with a complete not-to-exceed project fee and anticipated expense reimbursements, with points awarded using a cost-scoring formula based on the lowest proposed cost. Proposals must include a cover sheet acknowledging all contractual terms, a completed proposal form with responses to all evaluation criteria, and a Sustainability Questionnaire. The contract requires integration with EWEB's existing SAP environment and mandates Commercial General Liability insurance ($1,000,000 per occurrence/$2,000,000 aggregate), Automobile Liability insurance ($1,000,000 combined single limit), Workers' Compensation coverage, and Professional Liability/Errors and Omissions insurance ($2,000,000 single limit maintained for one year post-completion). While no specific budget range or award value is disclosed in the RFP materials, contractors should note that cost proposals will be evaluated competitively against other qualified bidders.