Overview
Skills
Job Details
Roles/Responsibilities:
-
Task 1: PCI-DSS Compliance Management
Task 1 Deliverables:
-
Conduct a comprehensive gap analysis of current PCI controls against PCI DSS v4.0+ requirements.
-
Develop a prioritized remediation roadmap identifying control gaps, owners, and resolution timelines.
-
Facilitate and submit quarterly vulnerability scans Sourcing Event SFGOV- TM P-690
-
Provide annual attestation of Compliance (AOC) and signed SAQ-D documentation prepared and reviewed by a certified Qualified Security Assessor (QSA)
-
Advise on secure network architecture and changes that could impact PCI scope or posture.
-
Task 2: Documentation, Policies, and Procedures
Task 2 Deliverables:
-
Create and update all PCI- required policies and procedures in alignment with DSS requirements.
-
Provide templates and process documentation to support audit readiness
-
Assist departments with creating tailored operational procedures for each PCI control.
-
Task 3: Stakeholder Training, and Engagement
Task 3 Deliverables:
-
Deliver two (2) live annual staff training workshops (hybrid or onsite) covering PCI awareness and new DSS requirements.
-
Provide department-specific training modules and role-based documentation.
-
Task 4: Incident Response Planning
Task 4 Deliverables:
-
Review, update, and test the Airport's PCI incident response plan
-
Facilitate one (1) tabletop exercise annually and provide a post-incident improvement plan.
Mandatory Skills:
-
MQ1- Proposer must have successfully completed a minimum of three (3) PCI-DSS consulting or assessment projects within the past five (5) years. Each project must include:
-
Client name and type (e.g., government agency, airport, financial institution, etc.)
-
Project duration (start and end dates)
-
Scope of work and deliverables provided
-
Contact information for a client reference (name, phone, and email)
-
Client organization must be similar in size and scope to SFO
-
MQ2- Proposed consultants must each have a minimum of eight (8) years of hands-on experience performing PCI-DSS compliance engagements, including:
-
Gap assessments
-
Remediation guidance
-
SAQ/ROC preparation
-
Ongoing advisory for maintaining compliance
-
MQ3- Each consultant proposed for this engagement must:
-
Hold a current, valid PCI Qualified Security Assessor (QSA) certification
-
Provide a copy of their QSA certificate with the proposal
-
MQ4- Candidates must be willing and able to work onsite at SFO for key activities. Proposers must include all associated travel costs in their hourly rate structure per federal GSA CONUS guidelines.
-
MQ5- All proposed consultants must:
-
Be a citizen of the United States, Canada, the United Kingdom, Australia, or New Zealand
-
Be legally authorized to work in the United States
-
Successfully pass a Transportation Security Administration (TSA) threat assessment and any background checks required to obtain an SFO badge