PCI DSS Penetration Test and Self-Assessment Questionnaire D

The Peninsula Corridor Joint Powers Board is soliciting proposals under solicitation number 26-J-T-080 for professional services to ensure Payment Card Industry Data Security Standard compliance. The scope is divided into two packages: Package A involves performing annual PCI DSS v4.0.1-compliant internal and external penetration testing, including network segmentation validation, while Package B requires a Qualified Security Assessor firm to support and document the annual compliance process using Self-Assessment Questionnaire D. The agency intends to award one or two agreements with a five-year term. Proposals must be submitted electronically via the PlanetBids portal by December 8, 2026, as hard copy submissions are not accepted. Evaluation is conducted by a selection committee using a weighted scoring system that considers technical qualifications and cost, with the lowest responsive cost for the five-year term receiving maximum points. Preference points are awarded to certified Small Business Enterprises meeting specific gross receipts caps. Selected consultants must adhere to strict data security and PII protection standards, maintain required insurance, and comply with non-discrimination and equal employment opportunity regulations. Invoicing is handled via email to the agency's accounts payable department.