TREASURY - Quality Security Assessor Services RFP

The Michigan Department of Treasury is seeking a Qualified Security Assessor (QSA) through RFP No. 250000002120 to conduct comprehensive Payment Card Industry (PCI) Data Security Standard (DSS) assessments. The state currently manages 24 departments with 511 merchant accounts, processing 10 million transactions annually as a Level 2 merchant. The selected contractor will be responsible for performing remote and on-site assessments, providing gap analyses, assisting with corrective actions, and certifying compliance with current PCI DSS requirements. Mandatory minimum qualifications include being a PCI Security Standards Council-certified QSA capable of assessing Level 1 & 2 Merchants and Level 1, 2, or 3 Service Providers. The evaluation process will weight technical criteria across the statement of work, with proposals receiving 80 or more technical points becoming eligible for pricing evaluation. Key deliverables include comprehensive consulting, evidence analysis, on-site assessment, secure web portal access, monthly reporting, and compliance documentation. The proposal is due by May 19, 2025, with the contract period beginning October 1, 2025.

The RFP does not explicitly outline specific set-aside designations or restrictions for disadvantaged enterprises. The procurement appears open to qualified QSA firms meeting the technical certification requirements. While no incumbent vendors are mentioned, the state emphasizes its 15-year history of maintaining PCI compliance and seeks a contractor to support ongoing compliance efforts. The pricing structure includes fixed-fee assessments with potential additional consulting services at hourly rates, though specific budget ranges are not explicitly detailed in the provided documentation. The state's current technology infrastructure involves a segmented Cardholder Data Environment (CDE) with approximately 1,950 devices, utilizing MoveIt for file transfers and internal collaboration platforms like Microsoft Teams and SharePoint. Vendors will need to demonstrate compatibility with these existing systems and the ability to integrate seamlessly with the state's current technological ecosystem while maintaining the highest standards of security and confidentiality.