Payment Card Industry Compliance Program and Information Security Services
- Client
- San Diego, California
- RFP Number
- ITES-11162
- Posted
- 10/15/2026
- Category
- IT Services (Computer Maintenance and Technical Services)
- Budget
- Looking for Proposal
- NAICS
- —
- Set-aside
- —
- Contact
- —
Description
AI GeneratedSan Diego Metropolitan Transit System seeks a vendor to provide offsite Payment Card Industry compliance program and information security services over a five-year contract period. The selected contractor must deliver PCI advisory support, reviews of PCI policies and service provider artifacts, change-driven impact assessments, periodic status reporting, and as-needed cybersecurity services like risk assessments, threat modeling, and incident response planning. Only onshore USA entities are eligible to submit proposals. Proposers can submit responses digitally online or via email. MTS scheduled a pre-bid meeting for November 4, 2026, and set a question deadline of November 12, 2026. An evaluation committee will first review proposals using pass/fail criteria, then evaluate and score technical and price components, with cost and price accounting for 30% of the score. Awarded vendors must provide required insurance policies and name MTS as an additional insured.
Key solicitation details
AI-extracted from 20261014124532186 G3262.0-27 PCI Compliance and Information Security Services.pdf. Confirm against the original documents before bidding.
San Diego Metropolitan Transit System is requesting proposals for PCI compliance program and information security services. The contract term will be for five years. Participation is open to eligible vendors, including onshore USA-only vendors maintaining required certifications.
- Issued by
- San Diego Metropolitan Transit System
- Pre-bid meeting
- November 4, 2026
- Questions due
- November 12, 2026
- How to submit
- Digitally via Email or Online
- Submission details
- Submit response digitally via Email or Online following instructions specified in Submission Requirements section.
- Contract term
- five years
- Place of performance
- Offsite / San Diego, CA
- Insurance and bonding
- Commercial General Liability Insurance, Automobile Liability Insurance covering Code 1 (any auto), Workers Compensation and Employers Liability Insurance, Primary and Non-Contributory Insurance, Umbrella or Excess Liability Policy.
- Funding
- 2 C.F.R. 200, 2 C.F.R. 180 Subpart C, and 48 CFR Chapter 1 Part 31
How proposals are evaluated
| Technical experience in performing work on services of a similar nature | |
| Depth of Proposer's understanding of MTS' requirements as set forth in the Scope of Work | |
| Cost and Price | 30% |
Scope of work
- Advisory support for PCI related remediation activities
- Review and assessment of PCI related policies, procedures, and standards
- Change driven PCI impact assessments for new systems, vendors, applications, or significant modifications
- Periodic compliance status meetings and reporting
- PCI Advisory and Specialized PCI Services
- Cybersecurity Services including program assessments, risk assessments, threat modeling, and incident response planning
Minimum qualifications
- Onshore (USA Only)
- Maintain a current, valid Qualified Security Assessor (QSA) certification
- Demonstrated previous experience working for or with public transportation agencies, municipalities, or other government agencies
- Personnel performing cybersecurity services shall possess appropriate professional certifications and a minimum of 5-years experience
Documents to include with the bid
- Letter of Transmittal
- Technical Proposal
- Financial Questionnaire Form
- Latest Audited Financial Statements (Appendix 1)
- Resumes for Key Personnel (Appendix 2)
- Organizational Chart (Appendix 3)
- Key Personnel Commitment Statement (Appendix 4)
- Proof of Insurance (Appendix 5)
- Cost Pricing Form (ATT 1 Cost Pricing Form)
- Certification Regarding Debarment, Suspension, and Other Responsibility Matters
Verify important details
Document checkConfirm submission instructions and amendments with the issuing agency before responding.
Personalized fit score
Sign up free to see how well this opportunity fits your company — based on your saved profile.
Sign up to see your fit score