Data Protection & PCI DSS Compliance

The contract requires strict adherence to PCI DSS standards for any entity handling payment card data, mandating comprehensive vulnerability management practices, end-to-end encryption of cardholder information, and rigorous oversight of third-party vendors involved in data processing. Compliance is non-negotiable and must be maintained throughout the lifecycle of the contract, with documented controls and regular audits to ensure ongoing adherence to industry security protocols. Breach notification procedures must be clearly defined and immediately executable in the event of a security incident involving cardholder data, ensuring timely reporting to relevant stakeholders and regulatory bodies. The subcontract is issued under the NAICS code 541990 and is tied to the Minnesota State Colleges and Universities System, with a response deadline of June 23, 2026, and an intended performance scope aligned with the organization’s information security obligations. All parties must operate under the expectation of full compliance without exception, and failure to meet these requirements may result in termination or legal consequences.