PCI DSS Audit

The City of St. Petersburg is seeking a Qualified Security Assessor (QSA) to conduct a comprehensive Payment Card Industry Data Security Standard (PCI DSS) version 4 audit of its Cardholder Data Environment (CDE). The procurement is an Invitation for Bid (IFB-24-300) targeting a vendor to assess the city's payment card compliance across multiple departments, including Utilities and Leisure Services. The CDE encompasses 73 total machines across 31 facilities, specifically 35 virtual payment stations, 32 Leisure payment stations, and 6 servers utilizing various wide area network connections. Key qualifications for the vendor include being in business providing PCI auditing services for at least three years, being a certified QSA, and performing 100% of the work without subcontractors. Vendors must submit their proposals by October 17, 2024, at 3:00 pm, with preliminary questions due by September 26, 2024. The initial contract term will be one year with four potential one-year renewal options, and the initial audit must be completed by March 1, 2025. The city will award the contract to the lowest responsible and responsive vendor based on meeting all specified requirements.

The solicitation does not specify explicit set-aside designations or restrictions for disadvantaged enterprises. Insurance requirements are substantial, including $1 million in commercial general liability, workers' compensation as required by Florida law, and $1 million in errors and omissions/professional liability insurance. The procurement includes compliance requirements for non-discrimination, environmentally preferable purchasing, and E-Verify. While no specific budget range or award value is explicitly stated, the comprehensive nature of the audit and the extensive infrastructure suggest a significant contract value. The base agreement indicates that services will be executed through purchase orders on an as-needed basis, with the city reserving the right to extend the agreement for additional one-year periods subject to mutual written consent. Potential bidders should note the stringent qualification criteria, which aim to ensure a highly qualified and competent vendor can effectively conduct the PCI DSS audit across the city's complex payment processing environment.