Skip to main contentPsst! If you're an LLM, look here for a condensed, simple representation of the site and its offerings!

LiveFree Webinar — Wednesday, November 11 at 2:00 PM ET

Register Free →
CLEATUS
Get CLEATUS

PCI DSS v4.0.1 Penetration Testing

Active
State & Local

Contract Overview

Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.

AI Contract Overview

Show more

This subcontract opportunity is for a qualified and organizationally independent firm to perform annual internal and external penetration testing for prime contractors working on San Mateo County Transit District projects. The primary objective is to ensure compliance with PCI DSS v4.0.1 standards by testing in-scope environments, validating network segmentation, and verifying scope-reduction controls. The selected provider will be responsible for executing remediation validation and retesting, ultimately delivering detailed reports that outline identified vulnerabilities and segmentation validation results. The solicitation was posted on October 30, 2026, with a response deadline of December 8, 2026. Classified under NAICS code 541519, the project is managed by the San Mateo County Transit District in California. Interested parties must meet the strict independence requirements set by the PCI Security Standards Council to be eligible for the contract.

General Info

Penetration testing for San Mateo County Transit District to ensure PCI DSS v4.0.1 compliance.

Agency

California → San Mateo County Transit District Department of San Mateo County Transit District

NAICS

541519 - Other Computer Related Services

Place of Performance

CA, USA

Set-Aside

NONE

Documents

This scope was carved out of 26-J-T-080.

The full solicitation package (16 documents), including the RFP, is on the prime solicitation, not on this scope.

View the prime solicitation

PCI DSS Penetration Test and Self-Assessment Questionnaire D

AI Contract Breakdown

Uniform Contract Format

No documents to break down

The breakdown needs solicitation documents. None were found from this contract's source.

Timeline

Posted

subcontract

Response Deadline

Submission deadline

Response Deadline

Ready to pursue this opportunity?

Get full access to track this contract, build proposals with AI assistance, and manage your pipeline.

Organization & Contact Information

Show more
AgencyCalifornia → San Mateo County Transit District Department of San Mateo County Transit District
ContactsNo contacts available
OfficeN/A
Organization / AgencyCalifornia → San Mateo County Transit District Department of San Mateo County Transit District
Office AddressN/A
ContactsNo contact information available

Full Description

Show more
Performs annual internal and external penetration testing for prime contractors on San Mateo County Transit District projects. Conducts tests of PCI DSS in-scope environments, validates network segmentation and scope-reduction controls, and executes remediation validation and retesting. Requires a qualified and organizationally independent firm per PCI SSC standards. Delivers penetration test reports including vulnerabilities and segmentation validation.

Similar Contracts

Same NAICS industry code

NAICS: 541519
New
International
24/7 Operational Support and MonitoringThis subcontract for Cadent Gas Limited involves providing continuous 24/7/365 technical support and system monitoring for gas emergency and customer-facing services. The primary objective is to maintain system uptime of over 99 percent through the utilization of Application Performance Monitoring and Security Information and Event Management tools. The selected provider must hold ISO 27001 certification to ensure rigorous security standards. Key deliverables include constant incident response capabilities and the regular submission of SLA compliance reports to ensure all operational benchmarks are met.
Cadent Gas Limited

POSTED

about 5 hours ago

DEADLINE

N/A
View Details
NAICS: 541519
New
DIBBS
Medical Kit Integration and Packaging ServicesThe Medical Kit Integration and Packaging Services subcontract involves performing kitting, assembly, and final packaging for prime contractors supporting USMC medical supply contracts. The primary objective is the delivery of completed Combat Lifesaver Kits, specifically NSN 6545-01-571-4470, which requires the aggregation of tourniquets and gauze. All work must be performed in a medical-grade kitting and packaging facility located in Bell, California. Strict adherence to technical specifications is required, including PKGING DATA-QUP:001 for kit assembly and FED-STD-313 for the packaging of hazardous materials. This Department of Defense effort is managed through the Medical Supply Chain MD Surg FSF. Interested parties should note the response deadline of November 10, 2026.
MEDICAL SUPPLY CHAIN MD SURG FSF

POSTED

about 5 hours ago

DEADLINE

in 6 days
View Details
NAICS: 541519
New
International
LED Screen Supply and Technical SupportThis subcontract for LED Screen Supply and Technical Support involves providing comprehensive visual display services for Derby City Council live event projects. The scope of work includes the supply, installation, and management of large-scale LED screens, encompassing the transport of panels, assembly of screen arrays, and the configuration of visual feeds. To ensure operational high-resolution systems, the provider will utilize specialized LED panels, processors, rigging hardware, and control software. Due to the nature of the temporary installations, the contractor is required to hold valid electrical safety certifications. This opportunity was posted on November 4, 2026, with a response deadline of November 11, 2026. The project falls under NAICS code 541519 and is designed to support prime contractors in delivering high-quality visual infrastructure for city-led events.
Derby City Council

POSTED

about 6 hours ago

DEADLINE

in 7 days
View Details
NAICS: 541519
New
SLED
On-Site Installation, Testing, and Event SupportThis subcontract, managed by the Town Administrator's Office for the Town of Hingham, focuses on the on-site installation, testing, and event support for municipal projects. The selected provider will be responsible for the physical setup of voting equipment, conducting technical rehearsals four hours before sessions begin, and providing real-time technical support and system management, including handset recovery, to assist prime contractors. The primary deliverable is a fully installed and tested voting system. All work must be performed in compliance with M.G.L. c. 268A. The solicitation was posted on November 4, 2026, with a response deadline of December 3, 2026, falling under NAICS code 541519.
Town Administrator's Office

POSTED

about 6 hours ago

DEADLINE

in 29 days
View Details
NAICS: 541519
New
International
NOI SAP Application Management Services
Solicitation # PA24020-A
The Capital Regional District (CRD) has issued a notice of intent for a direct award contract, solicitation number PA24020-A, to Deloitte Inc. for SAP Application Management Services (AMS). This three-month contract extension is valued at an estimated 75,000 CAD plus applicable taxes and is scheduled to conclude on March 31, 2027. The primary objective is to ensure continued compatibility with existing infrastructure and systems by leveraging the supplier's proven expertise in SAP S/4HANA and SuccessFactors support. The scope of work requires the supplier to provide AMS services on an as-needed basis, focusing on incident management, system enhancements, and integration services that align with the CRD's operational and strategic goals. The procurement process is being managed by Gajanan Pujar. Interested parties wishing to object to the direct award must submit detailed written documentation demonstrating their ability to meet the specified requirements to the procurement specialist by 2:00pm Pacific Time on November 16, 2026.
Capital Regional District

POSTED

about 6 hours ago

DEADLINE

in 12 days
View Details
NAICS: 541519
New
SLED
Cisco DNA and Switching Essentials License ProviderThis subcontract opportunity with the Lincoln Electric System involves the supply and management of Cisco software licenses for prime contractors working on infrastructure projects. The selected provider will be responsible for delivering three-year Cisco DNA Essentials On-Prem and Cisco Switching Essentials Tier 1 licenses, while coordinating technical support through STD 8X5XNBD and SNTC-8X5XNBD contracts. To be eligible, providers must hold Authorized Cisco Licensing Partner status and provide LB 1300 Foreign Adversary Contracting Prohibition Act Certification. The contract requires the delivery of active licenses and support certifications, with a response deadline set for November 19, 2026.
Lincoln Electric System

POSTED

about 8 hours ago

DEADLINE

in 15 days
View Details
NAICS: 541519
New
SLED
HIPAA/Security Compliance Validation and Penetration TestingThis subcontract opportunity with Integral Care in Texas involves performing security validations and compliance audits for prime contractors. The selected provider will be responsible for conducting penetration testing and vulnerability management, while specifically verifying the implementation of TLS 1.2+ and AES-256 encryption. Key deliverables include security assessment reports, penetration test results, and formal compliance certifications. The scope of work focuses heavily on regulatory adherence, requiring the validation of HIPAA and 42 CFR Part 2 compliance, as well as audits of Role-Based Access Control and Multi-Factor Authentication. To qualify, providers must meet SOC 2 and HITRUST standards. Responses for this engagement are due by January 8, 2027.
Integral Care

POSTED

about 8 hours ago

DEADLINE

in 2 months
View Details
NAICS: 541519
New
International
Noise Monitoring Software Provision and IntegrationThe Noise Monitoring Software Provision and Integration subcontract involves the installation and licensing of an NMT-compatible software platform for prime contractors working on airport noise projects for the City of Doncaster Council. The scope of work includes configuring user access and providing the necessary software interface to enable effective noise data analysis. The primary objective is to deliver a fully installed and operational NMT software system with active user access. This procurement is categorized under NAICS code 541519, with a response deadline set for November 30, 2026.
City of Doncaster Council

POSTED

about 8 hours ago

DEADLINE

in 26 days
View Details
NAICS: 541519
New
International
Industrial Cyber Security Audit and Testing ServicesThis subcontract for Industrial Cyber Security Audit and Testing Services involves performing technical assessments and security audits for prime contractors working on manufacturing SME projects for the Lincolnshire County Council. The scope of work focuses on conducting computer audits and security testing to identify vulnerabilities within operational technology networks and industrial control systems. The selected provider will utilize network auditing software and vulnerability scanning tools to evaluate cyber resilience readiness. Key deliverables include the provision of detailed security testing results and comprehensive audit reports. The response deadline for this opportunity is November 18, 2026.
Lincolnshire County Council

POSTED

about 9 hours ago

DEADLINE

in 13 days
View Details
NAICS: 541519
New
International
EMMS Cyber Security SME Support Programme
Solicitation # PL26.084
The EMMS Cyber Security SME Support Programme, solicitation number PL26.084, is an industrial cyber security pilot initiative led by the Lincolnshire County Council. The program is designed to improve cyber resilience readiness for small and medium-sized manufacturing businesses across Leicestershire, Nottinghamshire, Derbyshire, Northamptonshire, and Greater Lincolnshire. The scope of work focuses on computer training, audit, and testing services, with a particular suitability for small and medium-sized enterprises as well as voluntary, community, and social enterprises. The contract is estimated to have a total value of 65,000 GBP excluding VAT, with a performance period spanning four months from December 1, 2026, to March 31, 2027, within the East Midlands region of England. Award decisions will be based on the Most Advantageous Tender. The solicitation was posted on November 4, 2026, with a submission deadline of November 18, 2026, at 9:00am. Fiona Fielding serves as the primary point of contact for this procurement.
Lincolnshire County Council

POSTED

about 9 hours ago

DEADLINE

in 13 days
View Details
NAICS: 541519
New
Federal
Software Support and MaintenanceThis subcontract for Software Support and Maintenance involves providing technical support and system maintenance for prime contractors operating at the Ralph H. Johnson VA Medical Center under the Department of Veterans Affairs. The primary objective is to ensure continuous system uptime and availability through software troubleshooting and user support, specifically utilizing the proprietary administrative tools found at MyCrashCarts.com. The opportunity is categorized under NAICS code 541519 and is managed by the 247-NETWORK Contract Office 7. Interested parties must submit their responses by November 23, 2026, to provide the necessary technical proficiency required to maintain the specialized MyCrashCarts.com system and deliver ongoing technical resolutions.
247-NETWORK Contract Office 7 (36C247)

POSTED

about 10 hours ago

DEADLINE

in 19 days
View Details
NAICS: 541519
New
Federal
Enterprise Software Licensing & MaintenanceThis subcontract opportunity, managed by the Department of Veterans Affairs Technology Acquisition Center Nj, focuses on the supply and management of enterprise software licenses and maintenance for prime contractors supporting VA Financial Services Center projects. The scope of work specifically involves providing yearly enterprise license subscriptions and operation and maintenance subscriptions for the F5 BIG-IP Software Suite, which is critical for supporting AI applications and high-volume data exchange. To be eligible, providers must possess OEM authorization to deliver active software licenses and comprehensive maintenance support contracts. Interested parties should note the response deadline of November 17, 2026, and the classification under NAICS code 541519.
Technology Acquisition Center Nj (36C10B)

POSTED

about 10 hours ago

DEADLINE

in 13 days
View Details

More opportunities from California → San Mateo County Transit District Department of San Mateo County Transit District

Same awarding agency

NAICS: 811112
New
SLED
Transit Vehicle Maintenance and SupportThe Transit Vehicle Maintenance and Support subcontract involves providing essential mechanical maintenance and repair services for prime contractors operating on San Mateo County Transit District projects. The scope of work focuses on ensuring a road-worthy shuttle fleet through the execution of routine oil changes, brake inspections, engine repairs, and emergency roadside assistance. These services are performed using heavy-duty automotive diagnostic tools within designated garage facilities. To qualify for this engagement, personnel must hold ASE Certification. The primary objective of the contract is the delivery of a consistently maintained vehicle fleet to support transit operations. This opportunity is categorized under NAICS code 811112 and is associated with the San Mateo County Transit District in California.
Automotive Exhaust System Repair

POSTED

3 days ago

DEADLINE

N/A
View Details
NAICS: 532411
New
SLED
Shuttle Vehicle Fleet SupplyThis subcontract for Shuttle Vehicle Fleet Supply involves providing vehicles to prime contractors working on projects for the San Mateo County Transit District in California. The scope of work includes supplying a fleet of shuttle buses, passenger vans, and electric or low-emission vehicles through either short-term rental or lease-to-own agreements. All provided vehicles must adhere to specific capacity and emission standards to ensure operational compliance. To meet the requirements of the contract, the provider must ensure all vehicles are delivered in operational condition and are accompanied by necessary manufacturer warranties and safety certifications. The primary objective is to maintain a compliant and safe fleet of transportation assets to support the district's transit initiatives.
Commercial Air, Rail, and Water Transportation Equipment Rental and Leasing

POSTED

3 days ago

DEADLINE

N/A
View Details
NAICS: 485991
New
SLED
Special Needs Transportation ServicesThis subcontract for Special Needs Transportation Services involves providing specialized transportation for patrons with accessibility requirements on San Mateo County Transit District projects. The contractor is responsible for delivering inclusive last-mile connectivity by utilizing ADA-compliant shuttle vehicles equipped with ramps and wheelchair lifts. To ensure safety and regulatory adherence, the provider must maintain ADA compliance certifications and employ staff who have undergone specialized passenger assistance training. These services are managed under NAICS code 485991 to support the transit district's commitment to accessible public transportation.
Special Needs Transportation

POSTED

3 days ago

DEADLINE

N/A
View Details
NAICS: 485113
New
SLED
Last-Mile Shuttle Transit OperationsThe Last-Mile Shuttle Transit Operations subcontract involves providing essential transportation services for prime contractors working on San Mateo County Transit District projects. The selected provider will be responsible for transporting patrons from transit hubs to various residential and employment destinations, ensuring seamless connectivity during regular service hours and peak commute periods. To successfully execute this contract, the provider must supply a fleet of shuttle buses or vans and employ qualified staff holding Commercial Driver's Licenses. The scope of work focuses on the delivery of daily shuttle service operations and comprehensive operational management to maintain efficient transit flow within the region.
Bus and Other Motor Vehicle Transit Systems

POSTED

3 days ago

DEADLINE

N/A
View Details
NAICS: 485113
New
SLED
Notice of Upcoming Solicitation: Contracted Shuttle Services
Solicitation # 27-S-S-066
The San Mateo County Transit District is issuing a pre-solicitation notice for solicitation number 27-S-S-066 to secure a qualified firm for Contracted Shuttle Services. The scope of work involves providing the necessary vehicles and staff to transport patrons from rail stations, ferry terminals, and transit hubs to their final destinations, specifically targeting residential neighborhoods and employment venues throughout San Mateo County during regular service hours and commute periods. The District intends to award the contract to the highest ranked proposer for a seven-year base term, with the possibility of two additional one-year option terms. Interested proposers must register through the agency procurement portal and include at least one applicable NAICS code in their company profile, such as those related to mixed mode, bus, or charter transit systems. The Request for Proposals is expected to be released by the end of November. Wessam Zanaty serves as the primary procurement contact for this effort.
Bus and Other Motor Vehicle Transit Systems

POSTED

3 days ago

DEADLINE

N/A
View Details
NAICS: 424410
New
SLED
Wholesale Vending Product Supply (Food & Beverage)This subcontract agreement focuses on the wholesale supply of non-alcoholic beverages and snacks for prime contractors working on projects for the San Mateo County Transit District and the Peninsula Corridor Joint Powers Board. The scope of work includes providing a variety of vending-ready inventory, such as canned sodas, juices, bottled water, coffee, tea, and a selection of healthy and gluten-free snacks. To ensure safety and compliance, all supplied products must be non-glass and adhere strictly to USDA and FDA safety standards. The opportunity is categorized under NAICS code 424410 and is managed by the San Mateo County Transit District in California. Interested parties should note that the response deadline for this solicitation is December 10, 2026.
General Line Grocery Merchant Wholesalers

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 423850
New
SLED
Commercial Vending Machine SupplyThis subcontract agreement focuses on the supply of new, latest-model commercial vending machines for prime contractors operating on projects for the San Mateo County Transit District and the Peninsula Corridor Joint Powers Board. The scope of work includes the delivery of heavy-duty snack, cold beverage, and hot beverage machines, all of which must feature integrated cashless and tap-to-pay payment modules. To ensure accessibility and regulatory compliance, all hardware must meet ADA requirements, specifically requiring that controls be positioned between 2 and 4 feet from the ground. This procurement opportunity is categorized under NAICS code 423850, with a response deadline set for December 10, 2026.
Service Establishment Equipment and Supplies Merchant Wholesalers

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 445132
New
SLED
Full-Service Vending Machine Operation and MaintenanceThis subcontract for Full-Service Vending Machine Operation and Maintenance involves the end-to-end placement, stocking, servicing, and removal of vendor-owned vending machines for prime contractors working on San Mateo County Transit District and Peninsula Corridor Joint Powers Board projects. The selected provider is responsible for installing latest-model machines, maintaining stock levels at a minimum of 50 percent, and diligently monitoring USDA and FDA recalls to ensure a fully operational and safe vending network. To qualify for this engagement, vendors must possess at least five years of relevant experience and ensure all hardware is compliant with ADA and Section 504 standards. The solicitation was posted on October 30, 2026, with a response deadline of December 10, 2026. This opportunity falls under NAICS code 445132 and is managed by the San Mateo County Transit District in California.
Vending Machine Operators

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 445132
New
SLED
Vending Services for Snacks/Food and Beverages
Solicitation # 26-S-J-S-135
The San Mateo County Transit District and the Peninsula Corridor Joint Powers Board are seeking proposals under solicitation 26-S-J-S-135 for the placement, stocking, servicing, and removal of vendor-owned vending machines. The services will be provided across multiple locations, including headquarters in Millbrae, two sites in Menlo Park, and the CEMOF facility in San Jose. The scope requires the provision of cold beverage machines with 8 to 10 product selections, hot beverage machines offering coffee and tea, and snack machines featuring healthy options and gluten-free items. All equipment must be new, the latest available model, and installed within 30 days of the contract award. The contract is structured with a five-year base term and up to three additional one-year option terms, with the vendor paying a commission percentage of net sales to the agencies. Proposers must have at least five years of continuous experience and comply with ADA and Section 504 of the Rehabilitation Act, ensuring all machine controls are located between two and four feet from the ground. Strict food safety standards are required, with recalled products removed within two business days. Evaluation is based on company qualifications, experience, and project understanding, with a five-point preference granted to certified Small Business Enterprises (SBE). Proposals must be submitted in PDF format via the PlanetBids portal by December 10, 2026. The award will be granted to the highest-ranked, most qualified, and responsible proposer.
Vending Machine Operators

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 541690
New
SLED
PCI DSS SAQ D Compliance Support and ValidationThis subcontract opportunity is for an authorized PCI Qualified Security Assessor firm to provide specialized support for prime contractors working on San Mateo County Transit District projects. The primary objective is to validate and certify annual compliance using the SAQ D framework. The selected firm will be responsible for drafting SAQ D responses, mapping evidence to specific PCI DSS requirements, performing comprehensive gap analyses, and delivering prioritized recommendations for remediation. Key deliverables for this engagement include an Evidence Gap Tracker, a complete SAQ D Support Package, and a final Attestation of Compliance. Interested parties must submit their responses by December 8, 2026. This project falls under NAICS code 541690 and is managed by the San Mateo County Transit District in California.
Other Scientific and Technical Consulting Services

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 541519
New
SLED
PCI DSS Penetration Test and Self-Assessment Questionnaire D
Solicitation # 26-J-T-080
The Peninsula Corridor Joint Powers Board is soliciting proposals under solicitation number 26-J-T-080 for professional services to ensure Payment Card Industry Data Security Standard compliance. The scope is divided into two packages: Package A involves performing annual PCI DSS v4.0.1-compliant internal and external penetration testing, including network segmentation validation, while Package B requires a Qualified Security Assessor firm to support and document the annual compliance process using Self-Assessment Questionnaire D. The agency intends to award one or two agreements with a five-year term. Proposals must be submitted electronically via the PlanetBids portal by December 8, 2026, as hard copy submissions are not accepted. Evaluation is conducted by a selection committee using a weighted scoring system that considers technical qualifications and cost, with the lowest responsive cost for the five-year term receiving maximum points. Preference points are awarded to certified Small Business Enterprises meeting specific gross receipts caps. Selected consultants must adhere to strict data security and PII protection standards, maintain required insurance, and comply with non-discrimination and equal employment opportunity regulations. Invoicing is handled via email to the agency's accounts payable department.
Other Computer Related Services

POSTED

5 days ago

DEADLINE

in about 1 month
View Details
NAICS: 562991
SLED
Hydro Jetting and Drian Inspection
Solicitation # 27S-CU-065
The San Mateo County Transit District is soliciting quotations for RFQ 27S-CU-065 to provide high-pressure hydro jetting and drain inspection services across four district facilities: Sequoia Station, South Base Facility, North Base Facility, and the Brewster Facility. The contractor is responsible for providing all labor, materials, equipment, and supervision to clean sanitary sewer mains, drain piping, trench drains, cleanouts, and oil separators. The primary goal is to remove grease, sediment, and organic buildup to restore maximum hydraulic flow and prevent facility backups. Key deliverables include the execution of jetting operations and the submission of a detailed digital service report documenting access points used, pipe conditions, and recommendations for future repairs or maintenance intervals. All work must be completed within 90 days of the purchase order issuance. The contract will be awarded to the responsive and responsible bidder offering the lowest grand total price, with a mandatory requirement for bidders and subcontractors to be registered with the Department of Industrial Relations. For contracts exceeding 25,000 dollars, the successful bidder must provide performance and payment bonds totaling 100 percent of the contract price. The project is subject to Federal and California prevailing wage laws, FTA Circular 4220.1G, and the Copeland Act. Quotations must be submitted via the PlanetBids portal by November 13, 2026.
Septic Tank and Related Services

POSTED

12 days ago

DEADLINE

in 9 days
View Details

Ready to Pursue This Opportunity?

Get AI-powered intelligence on this solicitation and the ones like it

Every page of the solicitation package shredded into a compliance breakdown

AI-powered matching based on your capabilities and past performance

Competitor and incumbent history on the requirement

Automated alerts on amendments, Q&A deadlines, and award

Miguel
Hillary
Keith Deutsch
Christine

Join 750+ contractors already using CLEATUS