TREASURY - Quality Security Assessor Services RFP

The Michigan Department of Treasury is seeking a Qualified Security Assessor (QSA) to conduct comprehensive Payment Card Industry (PCI) Data Security Standard (DSS) assessments for its 24 departments with 511 merchant accounts. The project requires performing on-site and remote assessments across various payment channels, including web-based systems, interactive voice response, kiosks, virtual terminals, and point-of-sale systems. The selected vendor will be responsible for providing a detailed gap analysis, recommendations, and delivering an Attestation of Compliance, Draft Report on Compliance, and final Report on Compliance. The state processes approximately 10 million transactions annually and is classified as a Level 2 merchant with approximately 200 devices and 65 web applications in scope. The RFP was issued on April 21, 2025, with proposals due by May 19, 2025, and an anticipated contract start date of October 1, 2025. The technical evaluation will assess proposals across four categories: Statement of Work sections (50 points), Staffing (15 points), additional Statement of Work sections (25 points), and Vendor Questions Worksheet (10 points), totaling 100 points.

While no specific set-aside designations are explicitly mentioned, the procurement includes strict confidentiality requirements outlined in multiple exhibits, including the Contractor Security Agreement and Vendor Confidentiality Agreement. The contract will have an initial term with potential renewal options for up to three additional one-year periods. Pricing will be structured with fixed fees distributed across four 25% increments: completion of PCI Assessment Outline, Pre-Assessment Evidence Analysis, Onsite Assessment, and delivery of a draft report, with additional consulting services billed hourly and requiring prior written approval. The state emphasizes that all pricing must be inclusive, with no additional reimbursement for travel expenses. Contractors must comply with comprehensive security protocols, including adhering to Michigan Computer Crime Law, Civil Service Commission Rules, and HIPAA confidentiality requirements. While the exact contract value is not specified, the detailed scope suggests a significant engagement involving multiple state departments and complex security assessment requirements.