PCI Compliance Assessment and Penetration Testing Services

The City and County of Denver is seeking proposals for PCI compliance services, including Qualified Security Assessor assessments, penetration testing, remediation guidance, and related consulting for City payment environments excluding Denver International Airport.

City and County of Denver > Department of General Services

General

Status:Open

Solicitation Identifier:1045A-2026

Due Date:Oct 02, 2026 06:00 PM

Posted Date:Aug 31, 2026 09:23 PM

Contract Period:1 year base + 4 × 1 year options

Type:Request for Proposal (RFP)

Level:Local

Ask AI about this solicitation

ChatGPT Claude Perplexity Grok Gemini

Original Solicitation Links

[

1045A-2026

]

payment card industry (pci) compliance services (excluding den)

Contact

Name:Veronika Hall

Email:veronika.hall@denvergov.org

Phone:+17208657515

Address:201 West Colfax Avenue, Denver, CO, USA

Submission Instructions

Method:Online

Portal:https://www.rockymountainbidsystem.com

Items via this method:Signed Coversheet, Response to Vendor Questions and Requirements: Section B.7, Completed Attachment A - Pricing Matrix, Section E Forms, Response to Attachment B - Information Security Questionnaire, Response to Attachment C - Technical Architecture Questionnaire, Completed Attachment F - Vendor Technology Services Dealbreaker Memo

Description

The City and County of Denver is soliciting proposals for two service groups: PCI Qualified Security Assessor (QSA) services and PCI penetration testing. The selected contractor or contractors will support the City's co-sourced PCI compliance program for a Level 1 merchant processing more than ten million annual Visa, MasterCard, Discover, and American Express transactions across approximately 120 physical locations and multiple online and telephone payment channels. Denver International Airport is excluded from the scope. QSA services include an annual on-site PCI DSS assessment; preparation of the Report on Compliance, Attestation of Compliance, Self-Assessment Questionnaires, and supporting evidence; risk and gap analysis; remediation recommendations and tracking; quarterly advisory sessions; weekly updates during assessment periods; compensating-control support; and as-needed PCI consulting, with consulting hours not expected to exceed 80 hours per year. Penetration-testing services include annual internal and external testing, segmentation-control verification, findings documentation, PCI mapping, remediation recommendations, and advisory support, with separate as-needed consulting hours also not expected to exceed 80 hours per year. Proposers must address the City's vendor questions and requirements and complete the required security, technical architecture, pricing, and technology-services materials.

Classification Codes

NAICS541519Other Computer Related Services

PSCDJ01Support services focused on supporting security policies/controls, processes, measuring compliance of relevant legal/compliance requirements, and responding to security breaches. Also provides support for IT Security systems providing Continuous Diagnostics and Mitigation (CDM) for real-time Cyber Security and protection such as vulnerability scanning, managing firewalls, intrusion prevention systems, and security information and event management (SIEM). Includes Disaster Recovery (DR) services to support DR policy, process and means, dedicated failover facilities and perform DR testing.

Title	Date Posted
ATTACHMENT C - Technical Architecture Questionnaire.pdf	Aug 31, 2026 09:18 PM
ATTACHMENT A - Pricing Matrix.xlsx	Aug 31, 2026 09:18 PM
RFP_1045A_2026.pdf	Aug 31, 2026 09:18 PM
ATTACHMENT B - Information Security Questionnaire.pdf	Aug 31, 2026 09:18 PM
ATTACHMENT D - Architecture Standards.pdf	Aug 31, 2026 09:18 PM
ATTACHMENT F - TS Deal Breaker Memo.pdf	Aug 31, 2026 09:18 PM
ATTACHMENT E - Sample Contract.pdf	Aug 31, 2026 09:18 PM