Qualified Security Assessor (QSA) Services

The Citadel, a public university in South Carolina, seeks a certified Qualified Security Assessor (QSA) to provide comprehensive PCI‑DSS compliance services for its campus payment environment. The contractor will conduct a full gap analysis, on‑site assessments at ten locations, produce advisory reports, complete annual SAQ D and AOC filings, and deliver ongoing monitoring, vulnerability scanning (four times per year), intrusion testing, training, and a self‑assessment portal. The engagement is a fixed‑price, five‑year contract (one‑year base term with four one‑year renewal options) and requires the contractor to hold PCI‑DSS certification, have at least five years of experience, and demonstrate prior work with comparable higher‑education institutions and the specified third‑party payment processors. • Perform off‑site documentation review, gap analysis, and on‑site PCI‑DSS assessments across 10 sites (8 retail, 2 office). • Deliver a formal advisory report, remediation roadmap, and annually complete the SAQ D and Attestation of Compliance by October 15. • Provide quarterly vulnerability scans, intrusion testing, ongoing consulting hours, training, and a proprietary SAR portal for the university.