PCI-DSS Qualified Security Assessor Services
Closed State & local contract opportunity Posted
- Solicitation number
- CC1108-1207DU
- State
- Washington
- Responses due
Opportunity facts
- NIGP codes
- 91804 Accounting/Auditing/Budget Consulting
- 91825 Compliance Consulting, American Disabilities Act (Ada)
- 91837 Economy Consulting
- 91888 Quality Assurance/Control Consulting
- 92659 Risk Assessor
- 94620 Auditing
- 94636 Credit Investigation And Reporting
- 94649 Financial Services (Not Otherwise Classified)
- UNSPSC codes
- 81162304 Expense management process as a service
- 84141601 Consumer credit gathering or reporting services
- 64101602 Money market account
- 64101603 Simple checking account
- 64111902 Principal unprotected structured financial product
- 93151609 Lotteries services
- 80101703 Specification standardization services
- 84111601 Year end audits
- 93151607 Government auditing services
- 84141701 Business credit gathering or reporting services
Show all 47
- 64101500 Time deposit accounts
- 64111901 Principal protected structured financial product
- 64101501 Certificate of deposit CD
- 64101502 Simple savings account
- 64101702 Currency exchange application
- 64111802 Subscription right
- 64111804 Warrant
- 81162010 UCF mapper software as a service
- 81141500 Quality control
- 83101808 Power quality monitoring
- 84111600 Audit services
- 78142209 Aviation-related safety audits services
- 84111602 Quarterly reviews
- 84111603 Internal audits
- 84141500 Governmental credit agencies
- 84141700 Business credit agencies
- 84141702 Value added network VAN services
- 64000000 Financial Instruments, Products, Contracts and Agreements
- 64101600 Demand deposit accounts
- 64101601 Interest bearing checking account
- 64101701 Bill paying application
- 64101704 Over draft protection
- 64111801 Allotment or bonus right
- 64111903 Exchange traded fund ETF
- 64111904 Single structured product
- 64111906 Variable annuity
- 93151605 Government finance services
- 80101514 Business regulatory and compliance research service
- 81162002 Compliance dictionaries as a service
- 64100000 Bank offered products
- 64111800 Entitlements or rights
- 64101700 Electronic fund transfer and payment products
- 64111900 Structured financial products
- 64111803 Purchase right
- 64111905 Over the rainbow structured product
- 64101703 Money transfer application
- 84131614 Underwriting service
- Point of contact
-
- Desiree Urban desiree.urban@wsu.edu (509) 372-7469
Updated .
About this opportunity
Washington State University (WSU) is soliciting proposals for a Qualified Security Assessor (QSA) to provide comprehensive Payment Card Industry Data Security Standard (PCI-DSS) consulting services and annual assessments across multiple campuses. The procurement seeks a contractor to verify that university merchants meet and maintain compliance with the current PCI-DSS standards, potentially including Approved Scanning Vendor (ASV) services. The scope encompasses approximately 100 Touchnet marketplaces and 80 Bank of America merchant IDs processing roughly 1.12 million payment card transactions annually. Required services include on-site and remote compliance reviews, generating Self-Assessment Questionnaire D (SAQ-D) and Attestation of Compliance (AOC) documentation, establishing an online compliance documentation portal, and providing educational training for merchants. The RFP evaluation will use a 100-point scale, with point allocations as follows: Executive Summary (10 points), Experience (25 points), PCI-DSS QSA Services (40 points), Support Services (20 points), and Cost Proposal (5 points). Proposals are due February 10, 2025, at 3:00 PM Pacific Time, with an anticipated service start date of May 1, 2025, and an initial three-year contract term with potential renewals.
Minimum qualifications for respondents include being a certified QSA with five years of experience, specifically demonstrating work with higher education institutions. The procurement does not explicitly indicate set-aside designations or restrictions for disadvantaged enterprises. Contractors must maintain extensive security certifications, including SSAE 18 (SOC 1 Type 2 and SOC 2 Type 2) reports, Higher Education Community Vendor Toolkit (HECVAT), and current PCI DSS certification. The current environment involves a segregated PCI network managed by WSU Information Technology Services, with the Cougar Commerce Committee overseeing merchant services and PCI compliance programs. While specific budget ranges are not explicitly stated, the RFP requires detailed cost proposals with line items for one-time setup fees and ongoing maintenance costs, including separate pricing for on-site and remote services. The university currently classifies as a Level 3 merchant but anticipates returning to Level 2 classification, and the selected vendor will be responsible for conducting annual assessments that cover approximately 63 merchants across multiple campuses with varying Self-Assessment Questionnaire types.
Opportunity text
To solicit proposals for Qualified Security Assessor firms ("QSA") to provide PCI consulting services and annual assessments to verify that University merchants meet and maintain compliance with the current version of the PCI-DSS. This may also include the services of an Approved Scanning Vendor (ASV).
Files
| File | Type | Posted |
|---|---|---|
| Exhibit C- Terms and Conditions.docx | DOCX document | |
| PCI QSA RFP FINAL.pdf | ||
| Exhibit A- Certifications & Assurances.pdf | ||
| Exhibit B- Contractor Information.pdf | ||
| WSU Draft Responses RFP Questions Answers.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Similar opportunities
- Ask GovTribe AI about this opportunity