VIRGINIA RAILWAY EXPRESS REQUEST FOR QUOTES (RFQ) PAYMENT CARD INDUSTRY AUDIT AND ASSESSMENT RFQ ISSUED: APRIL 29, 2021 QUESTIONS DUE: MAY 7, 2021 at 10:00 A.M. ET QUOTES DUE: MAY 14, 2021 at 1:00 P.M. ET VIRGINIA RAILWAY EXPRESS 1500 King Street, Suite 202 Alexandria, VA 22314 P: (703) 684-1001 F: (703) 684-1313 www.vre.org Submit Quotes To: Amanda Vitko Purchasing and Contract Compliance Specialist Telephone/Facsimile: (703) 838-5414 Email: [email protected] Page 1 of 13 1. PURPOSE/BACKGROUND A. INTRODUCTION The Virginia Railway Express (VRE) is soliciting Quotes to establish a firm-fixed price Purchase Order with one (1) qualified and experienced Contractor to perform a Payment Card Industry (PCI) audit and to assess PCI compliance for VRE. B. VRE BACKGROUND 1. VRE is a commuter rail service linking the District of Columbia and Northern Virginia. The Northern Virginia Transportation Commission (NVTC) and the Potomac and Rappahannock Transportation Commission (PRTC) are transportation districts established under Virginia law and jointly own this service. An Operations Board consisting of members from each of the jurisdictions within the VRE service area governs the development and operation of VRE and serves as an advisory board to the NVTC and PRTC governing boards. Use of the term VRE in this RFQ refers to NVTC and PRTC. 2. VRE began operations in 1992 and carries an average of approximately 19,000 weekday trips on two (2) lines. In January 2014, VRE’s Operations Board adopted System Plan 2040 which calls for expansion of service, requiring the addition of rail cars, expansion of station and maintenance and storage facilities, as well as expanding operations to meet the goal of doubling ridership by 2040. VRE’s multi-prong program addresses short term growth needs, as well as longer term capacity improvements and investments in maintaining and servicing VRE’s equipment and facilities. 3. The primary mission of VRE is to provide commuter-oriented passenger rail service between the outlying suburbs and the Washington-Arlington-Alexandria urban core. Some tourists and “day-trippers” also ride the trains. The service is heavily oriented towards the core area in the morning peak and in the opposite direction in the evening peak. C. PROJECT BACKGROUND 1. VRE must comply with PCI standards to allow for the continued operation of the following payment services currently offered by VRE: a. VRE’s Fare Collection System: Includes Ticket Vending Machines (TVM) located at VRE stations and offices as well as Ticket Office Machines (TOM) located predominately at brick-and-mortar sales outlets. The TVMs and TOMs were manufactured by Scheidt & Bachmann USA, which maintains separate PCI compliance. b. VRE's Mobile Ticketing Application: VRE also sells fare media via a mobile ticketing application known as VRE Mobile, which was developed and is currently hosted by Page 2 of 13 Request for Quotes Payment Card Industry Audit and Assessment Americaneagle.com (AE) through their data center in Chicago, Illinois. AE also maintains separate PCI compliance. c. VRE currently maintains the relationship with the payment processor, Heartland Payment Systems, for both the fare collection system and the mobile ticketing application. 2. VRE will provide documentation of Attestation of Compliance for Onsite Assessments after award of a Purchase Order. 3. VRE must complete the latest version of the PCI Self-Assessment Questionnaire (SAQ). 4. VRE accepts the following payment types across the above-mentioned applications: Payment Type TVM/TOM VRE Mobile Visa Mastercard American Express Discover Debit Cards (incl. STAR) Apple Pay Google Pay PayPal Smart Benefits Page 3 of 13 Request for Quotes Payment Card Industry Audit and Assessment 2. SUBMISSION OF QUESTIONS A. DEADLINE 1. All questions and requests for clarification regarding the meaning or interpretation of this RFQ and other solicitation documents, or any ambiguities, discrepancies, inconsistencies, or conflicts in or between any of the technical, pricing, or contractual provisions, must be submitted no later than the date and time specified on Page 1 of this RFQ. Questions and clarifications requested after such time will not be answered unless VRE elects, in its sole discretion, to do so. 2. Any interpretation of a question made by VRE will be in the form of an addendum to the RFQ. Questions and responses will be posted on VRE’s website at www.vre.org/about/procurement for all interested Contractors. B. FORMAT FOR QUESTIONS Questions must be submitted to VRE in writing via electronic mail to the email address listed on Page 1 of this RFQ. No questions or requests for additional information, clarification or any other communication should be directed to any other individual. C. VRE POINT OF CONTACT VRE’s Senior Systems Engineer will be the point of contact following award of a Purchase Order. D. NO ORAL COMMUNICATION WILL BE ACCEPTED VRE will not be bound by any oral communications, written interpretations or clarifications that are not set forth in an addendum to the RFQ. Page 4 of 13 Request for Quotes Payment Card Industry Audit and Assessment 3. SCOPE OF WORK __________________________________________________________________________________ A. CONTRACTOR’S QUALIFICATIONS 1. The selected Contractor must be a PCI Security Standards Council (SSC) approved Qualified Security Assessor (QSA). 2. The selected Contractor must satisfy and continue to satisfy all PA-QSA Requirements applicable to employees of PA-QSA Companies who conduct PA-DSS Assessments and must be listed at https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assess ors at the time of award of a Purchase Order and throughout the duration of the project. 3. Contractors that do not have specific experience with PCI Data Security Standard (DSS) segmentation and boundary validation testing will not be considered by VRE for award of a Purchase Order. B. GENERAL REQUIREMENTS 1. The Contractor shall be responsible for providing qualified and skilled personnel as well as all material and equipment necessary to complete the following tasks: a. Perform a PCI audit and assess VRE’s PCI compliance status. b. Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of cardholder data. c. Confirm and validate the type of PCI SAQ form that is required for VRE and assist with completing the form. d. Provide and document solutions to remediate non-compliance. e. Develop scope of work requirements for remediation solutions of non-compliant controls. f. Verify all technical information given by the merchant or service provider. g. Validate the scope of the assessment. h. Evaluate compensating controls. i. Validate that vulnerabilities and risks identified have been mapped to appropriate areas of the current version of the PCI Data Security Standard (DSS). j. Provide a Gap Analysis of VRE’s current cardholder data environment and related practices against the current version of the PCI DSS. Page 5 of 13 Request for Quotes Payment Card Industry Audit and Assessment k. Provide support and guidance during the compliance process. l. Adhere to all applicable requirements of the PCI Data Security Standard Assessment process. C. WORK HOURS AND LOCATIONS 1. The Contractor’s work hours shall be 9:00 A.M. to 4:00 P.M. Eastern Time (ET), Monday through Friday. 2. Should any onsite assessments be needed, the Contractor must adhere to all local, state, and federal requirements as it relates to COVID-19. 3. The following are locations where VRE tickets can be physically purchased: a. TVMs - see Appendix 1 b. Select sales outlets located close to VRE stations – see Appendix 2 D. SUBMITTALS 1. The Contractor shall submit a draft report outlining the findings from the audit. The report must be received by VRE within ninety (90) calendar days from receipt of the signed Purchase Order from VRE. 2. The Contractor shall deliver the final report to VRE within one hundred twenty (120) calendar days from receipt of the signed Purchase Order from VRE. The final compliance report shall include the following: a. A completed SAQ Questionnaire b. A full listing of any non-compliant items c. Detailed remediation plan to address all non-compliant items d. Scope of work requirements for each remediation solution for non-compliance e. PCI Attestation of Compliance (AoC) Page 6 of 13 Request for Quotes Payment Card Industry Audit and Assessment Appendix 1 VRE TVM Locations VRE Location Address VRE Headquarters Office 1500 King Street, Suite 202, Alexandria, VA 22314 Fredericksburg Office 400 Prince Edward Street, Fredericksburg, VA 22408 Union Station 50 Massachusetts Ave. N.E., Washington, D.C. 20002 L’Enfant Station 6th & 7th St. at C St. S.W., Washington, D.C. 20024 Crystal City Station 1503 South Crystal Drive, Arlington, VA 22202 Alexandria Station 110 Callahan Drive, Alexandria, VA 22301 Backlick Road Station 6900 Hechinger Drive, Springfield, VA 22151 Rolling Road Station 9016 Burke Rd., Burke, VA, 22015 Burke Centre Station 10399 Premier Court, Burke, VA 22015 Manassas Park Station 9300 Manassas Dr., Manassas Park, VA 20111 Manassas Station 9451 West St., Manassas, VA 20110 Broad Run Station 10637 Piper Lane, Bristow, VA 20136 Franconia-Springfield Station 6880 Frontier Drive, Springfield, VA 22150 Lorton Station 8990 Lorton Station Blvd, Lorton, VA 22079 Woodbridge Station 1040 Express Way, Woodbridge, VA 22191 Rippon Station 15511 Farm Creek Dr., Woodbridge, VA 22191