RFP PCI DSS Management System

The University of Washington Merchant Services Department has issued a Request for Proposal (RFP) seeking a vendor to provide an eCommerce script management system that will help the institution meet specific PCI DSS requirements (6.4.3 and 11.6.1). The procurement is located in King County, with a specific focus on the Kingston CDP jurisdiction. The primary objective is to acquire a solution capable of inventorying all scripts used on eCommerce sites, confirming script authorization, and detecting unauthorized changes with robust logging and alerting capabilities that can integrate with the university's existing SIEM systems. Proposers must demonstrate a comprehensive technical approach that addresses script management, system interoperability, and security protocols. The RFP requires detailed submissions covering technical methodology, project team qualifications, relevant experience, and proposed fee structures. The contract opportunity has a posted date of November 15, 2024, with proposals due by January 3, 2025, and an anticipated contract start date prior to Q2 2025. The initial contract term will be one to two years, with potential extensions allowing for a total contract period of up to nine years.

While no mandatory Minority and Women-owned Business Enterprise (MWBE) participation is required, the RFP establishes voluntary participation goals of 6% for Minority Business Enterprises (MBE) and 4% for Women-owned Business Enterprises (WBE). Proposers must comply with specific IT accessibility guidelines and comprehensive security requirements. The evaluation criteria will assess vendors' ability to meet PCI DSS requirements, pricing competitiveness, implementation approach, and system interoperability with existing University of Washington infrastructure. Though a specific budget range is not explicitly stated, the procurement suggests the university is seeking a cost-effective and sustainable solution that can seamlessly integrate with its federated network environments. Potential vendors will need to demonstrate robust capabilities in script management, change detection, and security monitoring to be competitive in this procurement opportunity.