Psst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveCLEATUS Webinar: AI for Government Contracting — Free Webinar — Wednesday, November 11 at 2:00 PM ET

Register Free →

Search

Top

Back to Contracts

PCI DSS SAQ D Compliance Support and Validation

Active

State & Local

Response Deadline12/08/2026, 01:00:00 AM UTC

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

This subcontract opportunity is for an authorized PCI Qualified Security Assessor firm to provide specialized support for prime contractors working on San Mateo County Transit District projects. The primary objective is to validate and certify annual compliance using the SAQ D framework. The selected firm will be responsible for drafting SAQ D responses, mapping evidence to specific PCI DSS requirements, performing comprehensive gap analyses, and delivering prioritized recommendations for remediation. Key deliverables for this engagement include an Evidence Gap Tracker, a complete SAQ D Support Package, and a final Attestation of Compliance. Interested parties must submit their responses by December 8, 2026. This project falls under NAICS code 541690 and is managed by the San Mateo County Transit District in California.

General Info

PCI QSA firm needed for San Mateo County Transit District SAQ D compliance.

Agency

California → San Mateo County Transit District Department of San Mateo County Transit District

NAICS

541690 - Other Scientific and Technical Consulting Services

Place of Performance

CA, USA

Set-Aside

NONE

Documents

This scope was carved out of 26-J-T-080.

The full solicitation package (16 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

PCI DSS Penetration Test and Self-Assessment Questionnaire D

AI Contract Breakdown

Uniform Contract Format

No documents to break down

The breakdown needs solicitation documents. None were found from this contract's source.

Timeline

PostedOct 30

subcontract

Response DeadlineDec 8

Submission deadline

Response Deadline

12/08/2026, 01:00:00 AM UTCin about 1 month

Ready to pursue this opportunity?

Get full access to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more

AgencyCalifornia → San Mateo County Transit District Department of San Mateo County Transit District

ContactsNo contacts available

OfficeN/A

Organization / AgencyCalifornia → San Mateo County Transit District Department of San Mateo County Transit District

Office AddressN/A

ContactsNo contact information available

Full Description

Show more

Provides authorized QSA-led support for prime contractors on San Mateo County Transit District projects to validate and certify annual compliance using SAQ D. Drafts SAQ D responses, maps evidence to PCI DSS requirements, performs gap analysis, and provides prioritized recommendations. Requires an authorized PCI Qualified Security Assessor (QSA) firm. Delivers Evidence Gap Tracker, SAQ D Support Package, and Attestation of Compliance (AOC).

Similar Contracts

Same NAICS industry code

DBE Subconsultant Opportunity – AARC Consultants

Solicitation # dbe-subconsultant-opportunity-aarc-consultants

AARC Consultants, a certified SBE, WBE, and MBE, is seeking qualified Disadvantaged Business Enterprises and other eligible small businesses for subcontracting opportunities. The project is for the Inland Empire Utilities Agency and involves providing Business Impact Analysis, Disaster Recovery, and Business Continuity Plan Services under RFP number RFP-VC-26-006. The solicitation is open to various certified entities, including SBA Small Businesses, Women-Owned Small Businesses, and SAM.gov designated Small Disadvantaged Businesses. Performance will take place in California, and interested parties must respond by November 17, 2026. Primary inquiries should be directed to Jason Richards.

AARC Consultants, LLC

POSTED

about 2 hours ago

DEADLINE

School-First Responder Integration SpecialistThis subcontract opportunity for the Town of Hopkinton in Massachusetts seeks a School-First Responder Integration Specialist to provide expert alignment between public school emergency procedures and first responder protocols. The selected specialist will support prime contractors on public safety projects by analyzing the intersection of school administrator procedures and on-scene command, reviewing safety protocols, and creating school-based incident alignment matrices. The scope of work includes delivering specialized readiness observations and providing strategic recommendations for joint drills to ensure seamless coordination during emergencies. Interested parties must respond by November 23, 2026, for this engagement categorized under NAICS code 541690.

Town of Hopkinton

POSTED

about 7 hours ago

DEADLINE

Data and Safety Monitoring Board (DSMB) ServicesThis subcontract for Data and Safety Monitoring Board services supports the National Institutes of Health and the National Institute on Minority Health and Health Disparities by providing independent safety oversight for clinical trials. The selected provider will be responsible for reviewing interim safety data, monitoring adverse events and serious adverse events, and delivering periodic safety monitoring reports. Using independent secure data review portals, the contractor will offer expert medical and scientific recommendations regarding whether to modify or terminate trials to ensure participant safety. The project requires strict adherence to Good Clinical Practice compliance and is based in Bethesda. Interested parties must respond by November 19, 2026, under NAICS code 541690. The primary objective is to maintain rigorous, independent oversight of prime contractors to ensure the scientific integrity and safety of NIH clinical research.

National Institutes Of Health Nichd

POSTED

about 10 hours ago

DEADLINE

Biostatistics and Advanced Data Analytics SupportThis subcontract for Biostatistics and Advanced Data Analytics Support provides specialized statistical analysis for prime contractors working on NIH/NIMHD clinical and behavioral research projects. The scope of work includes designing hypothesis-driven research frameworks, conducting complex data analysis for pragmatic trials and randomized controlled trials, and establishing QA/QC processes to monitor health outcomes across diverse demographics. All work must be performed in secure data environments using SAS, R, and Stata while strictly adhering to NIH data management standards. The primary deliverables for this engagement are validated data sets and comprehensive Statistical Analysis Plans. The project is associated with the National Institutes of Health and is based in Bethesda. Interested parties should note the response deadline of November 19, 2026, and the classification under NAICS code 541690.

National Institutes Of Health Nichd

POSTED

about 10 hours ago

DEADLINE

Aviation Quality Assurance & Process Auditing

Fleet Readiness Center

POSTED

about 10 hours ago

DEADLINE

Statistical Computing & ProgrammingThis subcontract opportunity, titled Statistical Computing and Programming, is issued by the FDA Office of Acquisition and Grant Services under the Department of Health and Human Services. The project focuses on providing technical statistical computing and visualization support for prime contractors engaged in FDA regulatory support projects. The selected provider will be responsible for writing scripts and performing complex analyses to support regulatory reviews, delivering validated scripts, data visualizations, and comprehensive statistical analysis reports. Technical requirements for this engagement include proficiency in SAS, R, R Shiny, Python, and C++. This is a total Small Business Set Aside under NAICS code 541690, with the place of performance located in Silver Spring. The solicitation was posted on November 4, 2026, and the deadline for responses is November 19, 2026.

FDA Office Of Acq Grant Svcs

POSTED

about 10 hours ago

DEADLINE

Specialist Clinical / Subject Matter Expert (Lot 1b)This subcontract opportunity, titled Specialist Clinical / Subject Matter Expert (Lot 1b), is issued by the East of England NHS Collaborative Procurement Hub. The contract requires the provision of deep clinical or technical expertise to support prime contractors conducting healthcare investigations for NHS England. The selected expert will be responsible for reviewing clinical records, analyzing treatment options, and delivering professional opinions on medical standards of care by applying specialized knowledge of pharmacology, pathology, physiology, and anatomy. Key deliverables for this engagement include the production of technical advisory memos and formal clinical expert reports. Interested parties must submit their responses by the deadline of December 16, 2026. The procurement is categorized under NAICS code 541690, focusing on specialized professional and technical consulting services within the healthcare sector.

East of England NHS collaborative Procurement Hub

POSTED

about 11 hours ago

DEADLINE

in about 1 month

Fire Risk Assessment ConsultantDover District Council is seeking a qualified Fire Risk Assessment Consultant to provide specialized subcontracting services for facility projects located in East Kent, UK. The selected consultant will be responsible for conducting thorough on-site inspections to identify potential fire and explosion risks while evaluating the effectiveness of current protection and control measures. The primary deliverables include the submission of detailed Fire Risk Assessment reports and the provision of professional consultancy recommendations to ensure safety and compliance. To be eligible for this contract, providers must possess specific qualifications in fire and explosion protection, categorized under CPV 71317100. Interested parties must submit their responses by the deadline of December 7, 2026. This engagement is structured as a subcontract supporting prime contractors managing the council's facility infrastructure.

Dover District Council

POSTED

about 13 hours ago

DEADLINE

in about 1 month

Provision of Fire Risk Assessments

Solicitation # ocds-h6vhtk-07b27e

Dover District Council is seeking a consultant to provide fire risk assessments and fire and explosion protection and control consultancy services in East Kent. The contract is estimated to have a total value of 120,000 GBP excluding VAT. The anticipated period of performance begins on March 3, 2027, and concludes on March 2, 2030, with an option to extend for an additional two years in yearly increments through March 2, 2032. This opportunity is noted as particularly suitable for small and medium-sized enterprises. The award will be determined based on a balanced evaluation of cost and quality, each weighted at 50 percent. Interested parties must submit their electronic tenders via the Kent Business Portal by 12:00 hours on December 7, 2026. All inquiries and submissions are managed through the Kent Business Portal or via the council's procurement contact at [email hidden].

Dover District Council

POSTED

about 13 hours ago

DEADLINE

in about 1 month

Construction Cost EstimatorThis subcontract opportunity is for a Construction Cost Estimator to provide professional cost estimation services for prime contractors working on the City of California Lifeguard Headquarters repair projects. The selected provider will be responsible for analyzing 30% and 100% plan sets to accurately quantify labor and materials using industry-standard software such as RSMeans. The primary deliverables include a comprehensive Construction Cost Estimate report and ongoing budget updates as the project design evolves. Qualified candidates must hold a Certified Cost Professional certification or an equivalent industry credential. This solicitation was posted on November 4, 2026, with a response deadline of December 3, 2026. The project falls under NAICS code 541690 and is associated with the Fire agency of California.

POSTED

about 14 hours ago

DEADLINE

Data Analytics and Modeling SpecialistThis subcontract for a Data Analytics and Modeling Specialist supports prime contractors on projects for the University of Texas M.D. Anderson Cancer Center. The scope of work focuses on technical audience segmentation and predictive modeling to identify potential donors through precise audience selection, suppression, and data modeling. The specialist is responsible for managing the end-to-end data lifecycle, including data transfers and matchback processes. Key deliverables include the provision of segmented audience files, detailed data matchback reports, and performance scorecards. The role requires the calculation of critical marketing and financial metrics, specifically Lifetime Value, Cost Per Lead, and Return on Ad Spend. The solicitation was posted on November 3, 2026, with a response deadline of December 4, 2026, falling under NAICS code 541690.

University of Texas M. D. Anderson Cancer Center

POSTED

about 23 hours ago

DEADLINE

in about 1 month

Notice of Sole Source-EPH Data & Epidemiology Unit Consultative Services

Solicitation # S-44300-00018245

The Oregon Health Authority is issuing a notice of sole source for consultative services to support the EPH Data and Epidemiology Unit. This solicitation, identified as S-44300-00018245, is managed by the state of Oregon with performance taking place in Portland. Heidi Tracy serves as the primary point of contact and purchaser for this requirement. While the notice was posted on November 3, 2026, the response deadline is set for November 10, 2026. This posting serves as a formal notice rather than a request for bids.

Oregon Health Authority

POSTED

DEADLINE

More opportunities from California → San Mateo County Transit District Department of San Mateo County Transit District

Same awarding agency

Transit Vehicle Maintenance and SupportThe Transit Vehicle Maintenance and Support subcontract involves providing essential mechanical maintenance and repair services for prime contractors operating on San Mateo County Transit District projects. The scope of work focuses on ensuring a road-worthy shuttle fleet through the execution of routine oil changes, brake inspections, engine repairs, and emergency roadside assistance. These services are performed using heavy-duty automotive diagnostic tools within designated garage facilities. To qualify for this engagement, personnel must hold ASE Certification. The primary objective of the contract is the delivery of a consistently maintained vehicle fleet to support transit operations. This opportunity is categorized under NAICS code 811112 and is associated with the San Mateo County Transit District in California.

Automotive Exhaust System Repair

POSTED

DEADLINE

Shuttle Vehicle Fleet SupplyThis subcontract for Shuttle Vehicle Fleet Supply involves providing vehicles to prime contractors working on projects for the San Mateo County Transit District in California. The scope of work includes supplying a fleet of shuttle buses, passenger vans, and electric or low-emission vehicles through either short-term rental or lease-to-own agreements. All provided vehicles must adhere to specific capacity and emission standards to ensure operational compliance. To meet the requirements of the contract, the provider must ensure all vehicles are delivered in operational condition and are accompanied by necessary manufacturer warranties and safety certifications. The primary objective is to maintain a compliant and safe fleet of transportation assets to support the district's transit initiatives.

Commercial Air, Rail, and Water Transportation Equipment Rental and Leasing

POSTED

DEADLINE

Special Needs Transportation ServicesThis subcontract for Special Needs Transportation Services involves providing specialized transportation for patrons with accessibility requirements on San Mateo County Transit District projects. The contractor is responsible for delivering inclusive last-mile connectivity by utilizing ADA-compliant shuttle vehicles equipped with ramps and wheelchair lifts. To ensure safety and regulatory adherence, the provider must maintain ADA compliance certifications and employ staff who have undergone specialized passenger assistance training. These services are managed under NAICS code 485991 to support the transit district's commitment to accessible public transportation.

Special Needs Transportation

POSTED

DEADLINE

Last-Mile Shuttle Transit OperationsThe Last-Mile Shuttle Transit Operations subcontract involves providing essential transportation services for prime contractors working on San Mateo County Transit District projects. The selected provider will be responsible for transporting patrons from transit hubs to various residential and employment destinations, ensuring seamless connectivity during regular service hours and peak commute periods. To successfully execute this contract, the provider must supply a fleet of shuttle buses or vans and employ qualified staff holding Commercial Driver's Licenses. The scope of work focuses on the delivery of daily shuttle service operations and comprehensive operational management to maintain efficient transit flow within the region.

Bus and Other Motor Vehicle Transit Systems

POSTED

DEADLINE

Notice of Upcoming Solicitation: Contracted Shuttle Services

Solicitation # 27-S-S-066

The San Mateo County Transit District is issuing a pre-solicitation notice for solicitation number 27-S-S-066 to secure a qualified firm for Contracted Shuttle Services. The scope of work involves providing the necessary vehicles and staff to transport patrons from rail stations, ferry terminals, and transit hubs to their final destinations, specifically targeting residential neighborhoods and employment venues throughout San Mateo County during regular service hours and commute periods. The District intends to award the contract to the highest ranked proposer for a seven-year base term, with the possibility of two additional one-year option terms. Interested proposers must register through the agency procurement portal and include at least one applicable NAICS code in their company profile, such as those related to mixed mode, bus, or charter transit systems. The Request for Proposals is expected to be released by the end of November. Wessam Zanaty serves as the primary procurement contact for this effort.

Bus and Other Motor Vehicle Transit Systems

POSTED

DEADLINE

Wholesale Vending Product Supply (Food & Beverage)This subcontract agreement focuses on the wholesale supply of non-alcoholic beverages and snacks for prime contractors working on projects for the San Mateo County Transit District and the Peninsula Corridor Joint Powers Board. The scope of work includes providing a variety of vending-ready inventory, such as canned sodas, juices, bottled water, coffee, tea, and a selection of healthy and gluten-free snacks. To ensure safety and compliance, all supplied products must be non-glass and adhere strictly to USDA and FDA safety standards. The opportunity is categorized under NAICS code 424410 and is managed by the San Mateo County Transit District in California. Interested parties should note that the response deadline for this solicitation is December 10, 2026.

General Line Grocery Merchant Wholesalers

POSTED

DEADLINE

in about 1 month

Commercial Vending Machine SupplyThis subcontract agreement focuses on the supply of new, latest-model commercial vending machines for prime contractors operating on projects for the San Mateo County Transit District and the Peninsula Corridor Joint Powers Board. The scope of work includes the delivery of heavy-duty snack, cold beverage, and hot beverage machines, all of which must feature integrated cashless and tap-to-pay payment modules. To ensure accessibility and regulatory compliance, all hardware must meet ADA requirements, specifically requiring that controls be positioned between 2 and 4 feet from the ground. This procurement opportunity is categorized under NAICS code 423850, with a response deadline set for December 10, 2026.

Service Establishment Equipment and Supplies Merchant Wholesalers

POSTED

DEADLINE

in about 1 month

Full-Service Vending Machine Operation and MaintenanceThis subcontract for Full-Service Vending Machine Operation and Maintenance involves the end-to-end placement, stocking, servicing, and removal of vendor-owned vending machines for prime contractors working on San Mateo County Transit District and Peninsula Corridor Joint Powers Board projects. The selected provider is responsible for installing latest-model machines, maintaining stock levels at a minimum of 50 percent, and diligently monitoring USDA and FDA recalls to ensure a fully operational and safe vending network. To qualify for this engagement, vendors must possess at least five years of relevant experience and ensure all hardware is compliant with ADA and Section 504 standards. The solicitation was posted on October 30, 2026, with a response deadline of December 10, 2026. This opportunity falls under NAICS code 445132 and is managed by the San Mateo County Transit District in California.

Vending Machine Operators

POSTED

DEADLINE

in about 1 month

Vending Services for Snacks/Food and Beverages

Solicitation # 26-S-J-S-135

The San Mateo County Transit District and the Peninsula Corridor Joint Powers Board are seeking proposals under solicitation 26-S-J-S-135 for the placement, stocking, servicing, and removal of vendor-owned vending machines. The services will be provided across multiple locations, including headquarters in Millbrae, two sites in Menlo Park, and the CEMOF facility in San Jose. The scope requires the provision of cold beverage machines with 8 to 10 product selections, hot beverage machines offering coffee and tea, and snack machines featuring healthy options and gluten-free items. All equipment must be new, the latest available model, and installed within 30 days of the contract award. The contract is structured with a five-year base term and up to three additional one-year option terms, with the vendor paying a commission percentage of net sales to the agencies. Proposers must have at least five years of continuous experience and comply with ADA and Section 504 of the Rehabilitation Act, ensuring all machine controls are located between two and four feet from the ground. Strict food safety standards are required, with recalled products removed within two business days. Evaluation is based on company qualifications, experience, and project understanding, with a five-point preference granted to certified Small Business Enterprises (SBE). Proposals must be submitted in PDF format via the PlanetBids portal by December 10, 2026. The award will be granted to the highest-ranked, most qualified, and responsible proposer.

Vending Machine Operators

POSTED

DEADLINE

in about 1 month

PCI DSS v4.0.1 Penetration TestingThis subcontract opportunity is for a qualified and organizationally independent firm to perform annual internal and external penetration testing for prime contractors working on San Mateo County Transit District projects. The primary objective is to ensure compliance with PCI DSS v4.0.1 standards by testing in-scope environments, validating network segmentation, and verifying scope-reduction controls. The selected provider will be responsible for executing remediation validation and retesting, ultimately delivering detailed reports that outline identified vulnerabilities and segmentation validation results. The solicitation was posted on October 30, 2026, with a response deadline of December 8, 2026. Classified under NAICS code 541519, the project is managed by the San Mateo County Transit District in California. Interested parties must meet the strict independence requirements set by the PCI Security Standards Council to be eligible for the contract.

Other Computer Related Services

POSTED

DEADLINE

in about 1 month

PCI DSS Penetration Test and Self-Assessment Questionnaire D

Solicitation # 26-J-T-080

The Peninsula Corridor Joint Powers Board is soliciting proposals under solicitation number 26-J-T-080 for professional services to ensure Payment Card Industry Data Security Standard compliance. The scope is divided into two packages: Package A involves performing annual PCI DSS v4.0.1-compliant internal and external penetration testing, including network segmentation validation, while Package B requires a Qualified Security Assessor firm to support and document the annual compliance process using Self-Assessment Questionnaire D. The agency intends to award one or two agreements with a five-year term. Proposals must be submitted electronically via the PlanetBids portal by December 8, 2026, as hard copy submissions are not accepted. Evaluation is conducted by a selection committee using a weighted scoring system that considers technical qualifications and cost, with the lowest responsive cost for the five-year term receiving maximum points. Preference points are awarded to certified Small Business Enterprises meeting specific gross receipts caps. Selected consultants must adhere to strict data security and PII protection standards, maintain required insurance, and comply with non-discrimination and equal employment opportunity regulations. Invoicing is handled via email to the agency's accounts payable department.

Other Computer Related Services

POSTED

DEADLINE

in about 1 month

Hydro Jetting and Drian Inspection

Solicitation # 27S-CU-065

The San Mateo County Transit District is soliciting quotations for RFQ 27S-CU-065 to provide high-pressure hydro jetting and drain inspection services across four district facilities: Sequoia Station, South Base Facility, North Base Facility, and the Brewster Facility. The contractor is responsible for providing all labor, materials, equipment, and supervision to clean sanitary sewer mains, drain piping, trench drains, cleanouts, and oil separators. The primary goal is to remove grease, sediment, and organic buildup to restore maximum hydraulic flow and prevent facility backups. Key deliverables include the execution of jetting operations and the submission of a detailed digital service report documenting access points used, pipe conditions, and recommendations for future repairs or maintenance intervals. All work must be completed within 90 days of the purchase order issuance. The contract will be awarded to the responsive and responsible bidder offering the lowest grand total price, with a mandatory requirement for bidders and subcontractors to be registered with the Department of Industrial Relations. For contracts exceeding 25,000 dollars, the successful bidder must provide performance and payment bonds totaling 100 percent of the contract price. The project is subject to Federal and California prevailing wage laws, FTA Circular 4220.1G, and the Copeland Act. Quotations must be submitted via the PlanetBids portal by November 13, 2026.

Septic Tank and Related Services

POSTED

DEADLINE

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Join 750+ contractors already using CLEATUS