Payment Card Industry Consulting Services

The WCB is inviting your firm to submit a Proposal for the following: Consulting Services on Payment Card Industry (PCI) services.Description of ServicesThe WCB requires the Contractor to provide expert- level PCI consulting services on an "as needed and if required" basis (the "Consulting Services"). The Consulting Services may include, but not be limited to:a. Payment Card Industry Data Security Standard (PCI DSS) gap assessment and readiness roadmap, including:i.Mapping current controls to new PCI DSS version requirements;ii.Identification and evaluation of tailored or customized approach options (where applicable); andiii.Deliverables, which may include, without limitation: a gap assessment report with risk rating, remediation roadmap outlining recommended actions, timelines, and dependencies.b. Education and Training, including seminars or workshops for WCB staff on PCI DSS requirements and compliance best practices;c. PCI assessment by a qualified security assessor; andd. General advice and direction in relation to payment card industry complianceThe Contractor will provide the Consulting Services remotely from its own facilities in Canada and may include meetings onsite at the WCB's facilities located at 333 and 363 Broadway, Winnipeg, Manitoba, as required.The WCB shall provide the Contractor access to its premises, personnel, management, documentation and systems, as reasonably necessary to provide the Consulting Services in a timely fashion.A Vendor must provide evidence in its Proposal that it is a PCI QSA and an approved PCI security and auditing firm in order to be considered for the Consulting Services. The Vendor should also provide qualifications of its key resources that may be assigned to work with the WCB (qualifications should include relevant certifications and work experience).The Contractor will not be required to have and maintain worker compensation coverage for its workers who will be providing the Consulting Services, unless required pursuant to The Workers Compensation Act (Manitoba).The Services will be structured with an Agreement that will require the parties to enter into Statements of Work (collectively the "SOWs").The Services shall be requested by the WCB on an "as needed" basis and the WCB makes no representation to guarantee any minimum amount of work will be assigned to the Contractor via the SOWs.The Services shall normally be performed during Business Hours. However, the WCB may request some of the Services to be performed outside Business Hours from time to time, as deemed necessary, in the unfettered discretion of the WCB. The Contractor shall not be entitled to charge overtime rates unless specified in the Fee Schedule.The Vendor should have experience and knowledge with the following (which may be considered an asset when evaluating):a. Knowledge of other regulatory frameworks like National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and Center for Internet Security (CIS) Critical Security Controls.b. Experience assessing cloud-hosted cardholder systemsc. Experience supporting or leading payment card industry (PCI)forensic investigations, data breach response involving cardholder data and post-breach compliance remediation activities.The WCB requires the Successful Vendor to deploy quality and seasoned resources to provide the Services. The WCB shall reserve the right to terminate the Agreement if the respective Vendor proposes or field inadequately qualified resources in providing the Services, or such other reasons in the opinion of the WCB, acting reasonably.It is expected the Services will be required for an initial period of three (3) years with a preferred start date of August 10, 2026. The WCB shall have an irrevocable option to further extend the Services on the same terms and conditions and fees for two (2) additional periods of up to twelve (12) months each.