Description
Cherokee Nation Entertainment (CNE) is seeking proposals from PCI Security Standards Council‑accredited Qualified Security Assessor (QSA) firms to conduct a comprehensive PCI DSS v4.0.1 Gap Assessment and subsequently lead the organization through certification activities (Report on Compliance or SAQ/AoC) for its FY27 payment‑card environment. The work is divided into two phases: a Gap Assessment to identify deficiencies and produce a remediation plan, followed by the certification effort to achieve PCI compliance by March 30 2027. The contract will be awarded to one or more qualified QSA firms, with requirements for tribal‑preference status, insurance, bonding, and TERO certification as applicable.
• Phase A – Gap Assessment: scope identification, policy/technical review, interviews, third‑party compliance checks, and delivery of a detailed Gap Report with remediation priorities.
• Phase B – Certification: readiness validation, on‑site/remote testing, production of the Report on Compliance (RoC) or SAQ/AoC, and executive briefings.
• Mandatory qualifications include QSA accreditation, relevant gaming‑industry experience, required insurance limits, possible performance bonds, and submission of a TERO certificate (if seeking tribal preference).