# San Diego Metropolitan Transit System Planet bids #G3262.0-27

MTS Solicits Five-Year PCI Compliance and Information Security Services

**Posted:** October 14, 2026
**Respond By:** December 15, 2026
**Identifier:** G3262.0-27
**NAICS:** 541512

San Diego Metropolitan Transit System (MTS) is seeking a qualified firm for a five-year PCI compliance and information security services engagement.
- **Government buyer:** San Diego Metropolitan Transit System (MTS), Purchasing Department, San Diego, California.
- **Requested services:**
  - PCI DSS compliance maintenance and independent Qualified Security Assessor (QSA) assessment, including annual and interim validation, assessment and reporting support, gap reviews, change-impact assessments, evidence and policy review, remediation guidance, training, and transition support.
  - PCI advisory services covering controls, compensating approaches, segmentation, encryption, scope reduction, service-provider compliance, and related guidance. Advisory work must preserve QSA independence.
  - On-demand cybersecurity consulting, potentially including security program and risk assessments, threat modeling, policy development, vulnerability management, incident-response preparation, supply-chain risk reviews, and security training.
- **Estimated labor quantities:** Each of five pricing years includes 250 hours of Compliance Services and 100 hours of InfoSec Services. These are estimates, not guaranteed minimums; MTS authorizes and pays for actual approved work.
- **Notable requirements:** The contractor must hold current PCI Security Standards Council QSA certification. Cybersecurity personnel must have appropriate professional certifications and at least five years of relevant experience. Services must follow applicable PCI standards, and assessment work must maintain independence and objectivity.
- **OEMs named:** **Hewlett Packard Enterprise**, **Cisco**, and **Zebra Technologies** appear in the documents; HPE and Cisco are referenced in headings for requirements marked not applicable. No brand-specific product or OEM solution is requested.
- **Other named prospective vendors:** Ardent Technologies Inc; ASIMER TECH LLC; BPM Advisors, LLC; Crowe LLP; DataHouse Consulting, Inc.; Datel Systems Incorporated; Engage Systems LLC; Floral Park Consulting LLC; Global Solutions Group Inc.; Howard Industries, Inc.; Infojini, Inc.; Insight Public Sector, Inc.; IT Devices Online, Inc.; JANUS Software, Inc.; LEIDER ENTERPRISES INC; MGT Impact Solutions, LLC; Redfox Cyber Security Pvt Ltd; Regents and Park; RubinBrown LLP; Second Life Mac; Sehi Computer Products Inc.; Shay Enterprise; SHI Inc; Tech Advanced Computers, Inc.; The Office Pal Inc; VasSecCo; and Zones IT Solutions Inc.
- **Term:** Five years. The detailed scope describes coordination with the incumbent QSA and a recurring compliance and assessment cycle. Specific contract start and end dates are not included here.

### Description

The San Diego Metropolitan Transit System (MTS) is seeking a qualified firm to provide PCI compliance and information security services. The RFP describes a scope of services for the PCI compliance program and information security, with a five-year cost-pricing schedule included in the cost form. Proposals must be submitted electronically through PlanetBids, with proposal documents and required forms uploaded as the Response File and the cost form uploaded separately as the Cost File. Both files are required.

[View original listing](https://vendors.planetbids.com/portal/14771/bo/bo-detail/147313)