San Mateo County Transportation Authority Planetbids #26-J-T-080

Annual PCI DSS penetration testing and SAQ-D assessment services

The Peninsula Corridor Joint Powers Board is seeking qualified firms for annual PCI DSS testing and assessment services supporting its payment environment. - Government buyer: Peninsula Corridor Joint Powers Board (JPB), through the San Mateo County Transit District’s Contracts & Procurement Department; based in Millbrae, San Mateo County, California. - Requested services: Proposers may offer one or both packages, with an intended award of one or two agreements. - Package A — Annual PCI DSS penetration testing: Fixed-fee internal and external testing, including network segmentation testing, severity-ranked findings, remediation recommendations, and validation retesting. Quantity: 1 engagement; part number: not applicable. - Package B — Annual PCI DSS SAQ-D support: Fixed-fee support led by an authorized PCI Qualified Security Assessor (QSA), including scope confirmation, evidence review, questionnaire support, prioritized recommendations, and submission-ready SAQ-D materials and Attestation of Compliance (AOC). Quantity: 1 engagement; part number: not applicable. - In-scope environment and safeguards: Designated network segments, point-of-sale (POS) payment devices, and supporting systems. The Agency states it does not electronically store cardholder data in the PCI environment. Testing must follow approved rules of engagement and windows and minimize disruption to transit operations. - Notable requirements: The penetration-testing provider must be organizationally independent. Proposals must describe methodology, reporting, communication, remediation and retesting, and remote/on-site delivery. SAQ-D support includes evidence-gap tracking and review deliverables. Agency information must be protected with required security controls, including encryption and multifactor authentication; breach notification is required within 24 hours. Optional out-of-scope work requires prior written approval and is priced at stated hourly rates. - Term and pricing: Anticipated five-year agreement term; the services are annual engagements, not an annual software subscription. Exact start and end dates and contract value are not specified. Fixed-fee pricing is requested for the service packages. - Other procurement considerations: Eligible small-business enterprises (SBEs), including qualifying subcontracting arrangements, may receive a five-point evaluation preference. - OEMs and named vendors: No OEMs, products, or service providers are identified by name in the solicitation materials.

Description

The Peninsula Corridor Joint Powers Board is seeking proposals for PCI DSS penetration testing, PCI DSS Self-Assessment Questionnaire D (SAQ-D) services, or both, organized as Package A and Package B. Package A covers internal and external penetration testing of the Agency’s PCI in-scope environment, including segmentation testing, reporting, and remediation retesting. Package B covers QSA-led support for the Agency’s annual SAQ-D completion, evidence review, recommendations, and a submission-ready SAQ-D support package. The agreement term is five years, proposals must be submitted electronically, and the Agency intends to award one or two agreements, subject to Board approval.

View original listing