New Hampshire Department of Administrative Services

Buyer seeks a PCI Qualified Security Assessor to validate the State's adherence to PCI DSS requirements. The environment includes 19 agencies accepting credit card payments at over 260 locations, processing 8.5 million transactions and $670 million in sales annually. The assessment scope includes 117 servers, 360 workstations, 84 network segments, 28 applications, 730 payment devices, and 33 third-party service providers. Buyer needs annual assessments, compliance reports, and remediation guidance.

• 5/5/2025 - Vendor Inquiry Period Ends
• 5/9/2025 - State Response to Vendor Questions
• 5/23/2025 - Proposal Due Date
• 6/9/2025 - Estimated Vendor Interviews
• 6/23/2025 - Estimated Vendor Selection
• 3/1/2026 - Anticipated Contract Start Date

• Must be PCI SSC certified Qualified Security Assessor (QSA)
• At least five years' experience as QSA for Level 1 merchants
• Minimum of three government entity clients with similar PCI needs
• Significant payment processing system audit experience
• Experience evaluating large-scale, diversified or decentralized merchant environments

• Validate system components in scope for PCI DSS assessment
• Determine applicable security requirements for the State
• Verify all technical information provided by the State
• Identify and analyze current information security protocols
• Perform examinations of system components and compensating controls
• Provide guidance to achieve compliance with security standards
• Determine areas of non-compliance and their extent
• Identify issues of concern and communicate potential deficiencies
• Prepare documentation required to demonstrate compliance
• Provide post-assessment executive reporting with recommendations