Payment Card Industry Compliance Services

The government authority in Denver, CO requires a vendor to provide payment card industry (PCI) compliance services for a one-year contract period. Under Service Group 1 (PCI Qualified Security Assessor) and Service Group 2 (PCI Penetration Testing), the buyer expects an annual on-site assessment covering cardholder data security, confidentiality, integrity, and availability. The selected vendor must prepare deliverables including the Report on Compliance, Attestation of Compliance, Self-Assessment Questionnaires, and supporting evidence. Additional requirements include mapping risks against the latest PCI-agency version, delivering weekly updates during assessment periods, hosting quarterly advisory sessions, and developing an auditable remediation tracker. The buyer restricts eligibility to onshore vendors located in the USA only. Although the vendor conducts an annual on-site assessment, offsite performance applies to the work. Bidders must submit all questions by September 14, 2026. The buyer seeks proposals to establish the budget, and the provided text omits specific evaluation criteria.