Request for Proposal For PCI Compliance and Penetration Testing

The University of Utah has issued a Request for Proposal (RFP #UU197160555) seeking a Qualified Security Assessor (QSA) to provide comprehensive PCI Compliance and Penetration Testing services for its diverse payment processing environments. The procurement specifically targets a vendor to complete a Report on Compliance (ROC) for PCI DSS v4.0.1, Revision 1.0, covering the university's approximately 79 "Stand-Alone" merchants and 8 Point-to-Point Encrypted (P2PE) payment systems. Required deliverables include a detailed ROC Template, Attestation of Compliance, and comprehensive penetration testing across external, internal, and segmentation networks. Vendor qualifications mandate a minimum of five years of experience performing ROCs, with individual assessors requiring at least three years of PCI attestation/audit experience. The evaluation criteria will allocate 30 points for references, 20 points for QSA qualifications, 20 points for service provisions, and 30 points for costs. Key dates include proposal inquiries due by April 17, 2025, and final proposals due by May 1, 2025, at 2:30 PM mountain time, with an anticipated contract term of five years beginning July 15, 2025.

The RFP does not explicitly indicate any set-aside designations or restrictions for disadvantaged enterprises. The university operates across multiple business entities including arts, sporting events, retail, food and beverage, e-commerce, entertainment, healthcare, and charitable giving platforms, suggesting a potentially broad vendor pool. While specific incumbent vendors are not mentioned, the RFP indicates the university has already centralized its PCI compliance activities and implemented strategies to reduce PCI scope through logical segmentation, standardized policies, and secure payment solutions. The existing infrastructure encompasses credit card payment systems across campus and healthcare facilities, serving over 31,000 students and 15,000 faculty and staff. The university reserves the right to review submitted proposals and potentially not enter into any agreement, signaling a competitive procurement process. Although precise budget ranges are not specified in the documents, the cost proposal form is structured to capture estimated costs across a five-year period, with line items for assessment, reporting, and various penetration testing services.