IT Services for DLL Security Metrics and PCI Compliance Management

Agency:	State of Vermont
State:	Vermont
Type of Government:	State & Local
NAICS Category:	541511 - Custom Computer Programming Services 541512 - Computer Systems Design Services 541519 - Other Computer Related Services 541611 - Administrative Management and General Management Consulting Services 541690 - Other Scientific and Technical Consulting Services
Posted Date:	Jan 21, 2026
Due Date:	Feb 11, 2026
Original Source:	Please Login to View Page
Contact information:	Please Login to View Page
Bid Documents:	Please Login to View Page

Attachment Preview

Department of Liquor and Lottery

1311 US Route 302 | Barre VT 05641

802-828-2325 phone | 802-828-2334 fax

http://liquorcontrol.vermont.gov/

SEALED BID

REQUEST FOR PROPOSAL

IT Services for DLL Security Metrics and PCI Compliance

Management

ISSUE DATE

QUESTIONS DUE

RFP RESPONSES DUE BY

January 21, 2026

January 28, 2026 – 4:30 PM (EST)

February 11, 2026 – 4:30 PM (EST)

PLEASE BE ADVISED THAT ALL NOTIFICATIONS, RELEASES, AND ADDENDUMS ASSOCIATED

WITH THIS RFP WILL BE POSTED AT:

http://www.bgs.state.vt.us/pca/bids/bids.php

THE STATE WILL MAKE NO ATTEMPT TO CONTACT INTERESTED PARTIES WITH UPDATED

INFORMATION. IT IS THE RESPONSIBILITY OF EACH BIDDER TO PERIODICALLY CHECK THE

ABOVE WEBPAGEFOR ANY AND ALL NOTIFICATIONS, RELEASES AND ADDENDUMS

ASSOCIATED WITH THIS RFP.

STATE CONTACT:

E-MAIL:

USE SUBJECT :

Kyle Emerson, State Purchasing Agent

sov.thepathforward@vermont.gov

DLL PCI COMPLIANCE

1. OVERVIEW:

1.1. SCOPE AND BACKGROUND: Through this Request for Proposal (RFP) the Department of Liquor and

Lottery (DLL) (hereinafter the “State”) is seeking to establish contracts with one or more companies that

can provide IT services for full management of the Security Metrics application to monitor PCI

compliance across its 802 Spirits retail locations. The vendor will take full responsibility for ensuring

accurate reflection of network and system configurations for PCI compliance, implementing remediation

efforts, coordinating with the 802 Spirits stores on remediation of findings, and establishing ongoing

management processes. This shifts from previous staff augmentation approaches, as DLL requires a

vendor to own this effort due to limitations on direct management of store infrastructure. The Agency of

Digital Services (ADS) will provide support and advice as needed.

1.2. CONTRACT PERIOD: Contracts arising from this RFP will be for a period of 12 MONTHS with an option

to renew for up to four additional twelve-month periods. The State anticipates the start date for such

contract(s) will be April 1, 2026.

1.3. SINGLE POINT OF CONTACT: All communications concerning this RFP are to be addressed in writing

to the State Contact listed on the front page of this RFP. Actual or attempted contact with any other

individual from the State concerning this RFP is strictly prohibited and may result in disqualification.

1.4. BIDDERS’ CONFERENCE: A bidders’ conference will not be held.

1.4.1.QUESTION AND ANSWER PERIOD: Any bidder requiring clarification of any section of this RFP or

wishing to comment on any requirement of the RFP must submit specific questions in writing no later

than the deadline for question indicated on the first page of this RFP. Questions may be e-mailed to

the point of contact on the front page of this RFP. Questions or comments not raised in writing on or

before the last day of the question period are thereafter waived. At the close of the question period a

copy of all questions or comments and the State's responses will be posted on the State’s web site

http://www.bgs.state.vt.us/pca/bids/bids.php . Every effort will be made to post this information as

soon as possible after the question period ends, contingent on the number and complexity of the

questions. All information provided by vendors during this process will be public and bidders shall not

provide confidential information, except as described in 4.1 below.

1.5. CHANGES TO THIS RFP: Any modifications to this RFP will be made in writing by the State through the

issuance of an Addendum to this RFP and posted online at http://www.bgs.state.vt.us/pca/bids/bids.php .

Modifications from any other source are not to be considered.

2. DETAILED REQUIREMENTS/DESIRED OUTCOMES:

2.1. The State of Vermont is interested in obtaining bids to meet the following business needs: Full vendor

ownership and management of the SOV Security Metrics application for PCI compliance monitoring of

point-of-sale (POS) systems in DLL's 802 Spirits retail locations. The vendor must handle all aspects,

including network mapping, store representation updates, remediation implementation, coordination with

802 Spirits stores for infrastructure changes, and ongoing compliance maintenance. This ensures

compliance with banking mandates without DLL or ADS directly managing store infrastructure.

2.2. The State of Vermont seeks to achieve the following Business Value(s):

2.2.1.Compliance: Achieve and maintain PCI compliance for all POS systems, reducing risk of non-

compliance penalties.

2.2.2.Risk Reduction: Accurate monitoring and remediation to protect against security threats in retail

environments.

2.2.3.Efficiency: Vendor-led coordination with stores to streamline remediation, freeing DLL resources.

2.2.4.Sustainability: Establishment of ongoing processes for continuous compliance and updates.

2.2.5.The vendor shall provide the following services and deliverables: Develop and maintain a network

configuration diagram mapping relevant applications and systems providing data to Security Metrics.

2.2.6.Update Security Metrics to accurately represent all 802 Spirits stores, including correct POS

configurations and network associations.

Revised: March 18, 2025

Page 2 of 20

2.2.7.Implement and validate PCI remediation efforts, leading to successful compliance for all monitored

POS systems.

2.2.8.Establish and execute processes for continuous monitoring, updates, and compliance maintenance,

including monthly/quarterly checks and reporting.

2.2.9.Coordinate directly with 802 Spirits stores for remediation of findings, including on-site or remote

support as needed.

2.2.10. Provide project management, including planning, scheduling, stakeholder communication, and

progress reporting.

2.2.11. Ensure all services comply with PCI standards and State data protection requirements as outlined

in Attachment D.

3. GENERAL REQUIREMENTS:

3.1. PRICING: Bidders must price the terms of this solicitation at their best pricing. Any and all costs that

Bidder wishes the State to consider must be submitted for consideration. If applicable, all equipment

pricing is to include F.O.B. delivery to the ordering facility. No request for extra delivery cost will be

honored. All equipment shall be delivered assembled, serviced, and ready for immediate use, unless

otherwise requested by the State.

3.1.1.Prices and/or rates shall remain firm for the initial term of the contract. The pricing policy submitted

by Bidder must (i) be clearly structured, accountable, and auditable and (ii) cover the full spectrum of

materials and/or services required.

3.1.2.Cooperative Agreements. Bidders that have been awarded similar contracts through a competitive

bidding process with another state and/or cooperative are welcome to submit the pricing in response

to this solicitation.

3.2. STATEMENT OF RIGHTS: The State shall have the authority to evaluate Responses and select the

Bidder(s) as may be determined to be in the best interest of the State and consistent with the goals and

performance requirements outlined in this RFP. The State of Vermont reserves the right to obtain

clarification or additional information necessary to properly evaluate a proposal. Failure of bidder to

respond to a request for additional information or clarification could result in rejection of that bidder's

proposal. To secure a project that is deemed to be in the best interest of the State, the State reserves the

right to accept or reject any and all bids, in whole or in part, with or without cause, and to waive

technicalities in submissions. The State also reserves the right to make purchases outside of the awarded

contracts where it is deemed in the best interest of the State.

3.2.1.Best and Final Offer (BAFO). At any time after submission of Responses and prior to the final

selection of Bidder(s) for Contract negotiation or execution, the State may invite Bidder(s) to provide a

BAFO. The state reserves the right to request BAFOs from only those Bidders that meet the minimum

qualification requirements and/or have not been eliminated from consideration during the evaluation

process.

3.2.2.Presentation. An in-person or webinar presentation by the Bidder may be required by the State if it

will help the State’s evaluation process. The State will factor information presented during

presentations into the evaluation. Bidders will be responsible for all costs associated with providing

the presentation.

3.3. CONFLICTS OF INTEREST:

3.3.1.Organizational Conflict of Interest (OCOI): An OCOI arises when a bidder as a business entity has

interests (for example, customers, partners, contracts) that could undermine, or reasonably be

perceived to undermine, its faithful and unbiased performance of a contract with the State that may

result from this solicitation.

3.3.2.Personal Conflict of Interest (PCOI): A PCOI arises when an interest held by an individual, agent or

employee of a bidder could undermine, or reasonably be perceived to undermine, its faithful and

unbiased performance of a contract with the State that may result from this solicitation.

Revised: March 18, 2025

Page 3 of 20

3.3.3.Requirements: The State does not seek to contract with any individual or business entity having a

conflict of interest which cannot be mitigated to the State’s satisfaction. To ensure the State’s

awareness of actual, potential, or reasonably perceived PCOIs and OCOIs, bidders shall:

a) Prior to submitting a proposal, conduct an internal review of its current affiliations and activities and

identify actual, potential, or reasonably perceived PCOIs or OCOIs relative to a contract with the

State that may result from this solicitation.

b) Disclose in your proposal any actual or potential PCOI or OCOI or the existence of any facts that

may cause a reasonably prudent person to perceive a PCOI or OCOI with respect to a contract

with the State that may result from this solicitation. Disclose, also, any actions proposed to mitigate

the PCOI or OCOI.

3.3.4.The State shall have sole discretion to determine whether a PCOI or OCOI can be mitigated to the

State’s satisfaction and may discuss the conflict with the bidder if and to the extent the State deems

discussion necessary to its determination. The State reserves the right to (a) reject from further

consideration any proposal having a PCOI or OCIO that cannot be mitigated to the State’s full

satisfaction and (b) terminate a contract upon discovery that a contractor failed to disclose facts

pertaining to a PCOI or OCOI in its proposal, or otherwise misrepresented relevant information to the

State.

3.4. WORKER CLASSIFICATION COMPLIANCE REQUIREMENTS: In accordance with Section 32 of The

Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), Bidders must comply with the following

provisions and requirements.

i. Self Reporting: For bid amounts exceeding $250,000.00, Bidder shall complete the appropriate

section in the attached Certificate of Compliance for purposes of self-reporting information relating to

past violations, convictions, suspensions, and any other information related to past performance

relative to coding and classification of workers. The State is requiring information on any violations

that occurred in the previous 12 months.

ii. Subcontractor Reporting: For bid amounts exceeding $250,000.00, Bidders are hereby notified that

upon award of contract, and prior to contract execution, the State shall be provided with a list of all

proposed subcontractors and subcontractors’ subcontractors, together with the identity of those

subcontractors’ workers compensation insurance providers, and additional required or requested

information, as applicable, in accordance with Section 32 of The Vermont Recovery and

Reinvestment Act of 2009 (Act No. 54). This requirement does not apply to subcontractors providing

supplies only and no labor to the overall contract or project. This list MUST be updated and provided

to the State as additional subcontractors are hired. A sample form is available online at

http://bgs.vermont.gov/purchasing-contracting/forms. The subcontractor reporting form is not

required to be submitted with the bid response.

3.5. EXECUTIVE ORDER 05-16: CLIMATE CHANGE CONSIDERATIONS IN STATE PROCUREMENTS:

For bid amounts exceeding $25,000.00 Bidders are requested to complete the Climate Change

Considerations in State Procurements Certification, which is included in the Certificate of Compliance for

this RFP.

After consideration of all relevant factors, a bidder that demonstrates business practices that promote

clean energy and address climate change as identified in the Certification, shall be given favorable

consideration in the competitive bidding process. Such favorable consideration shall be consistent with

and not supersede any preference given to resident bidders of the State and/or products raised or

manufactured in the State, as explained in the Method of Award section. But, such favorable

consideration shall not be employed if prohibited by law or other relevant authority or agreement.

3.6. METHOD OF AWARD: Awards will be made in the best interest of the State. The State may award one

or more contracts and reserves the right to make additional awards to other compliant bidders at any time

if such award is deemed to be in the best interest of the State. All other considerations being equal,

preference will be given first to resident bidders of the state and/or to products raised or manufactured in

the state, and then to bidders who have practices that promote clean energy and address climate change,

as identified in the applicable Certificate of Compliance.

3.6.1.Evaluation Criteria:

Revised: March 18, 2025

Page 4 of 20

3.6.1.1.

Qualifications and experience of proposed team in PCI compliance, IT security, and retail

POS management: 40%

3.6.1.2.

Proposed approach, methodology, and timeline for deliverables and store coordination:

30%

3.6.1.3. Cost (value for money, including total cost of ownership): 30%

3.7. CONTRACT NEGOTIATION: Upon completion of the evaluation process, the State may select one or

more bidders with which to negotiate a contract, based on the evaluation findings and other criteria

deemed relevant for ensuring that the decision made is in the best interest of the State. In the event State

is not successful in negotiating a contract with a selected bidder, the State reserves the option of

negotiating with another bidder, or to end the proposal process entirely.

3.8. COST OF PREPARATION: Bidder shall be solely responsible for all expenses incurred in the preparation

of a response to this RFP and shall be responsible for all expenses associated with any presentations or

demonstrations associated with this request and/or any proposals made.

3.9. CONTRACT TERMS: The selected bidder(s) will be expected to sign a contract with the State, including

the Standard Contract Form and Attachment C as attached to this RFP for reference. If IT Attachment D is

included in this RFP, terms may be modified based upon the solution proposed by the Bidder, subject to

approval by the Agency of Digital Services.

3.9.1.Business Registration. To be awarded a contract by the State of Vermont a bidder (except an

individual doing business in his/her own name) must be registered with the Vermont Secretary of

State’s office https://sos.vermont.gov/corporations/registration/ and must obtain a Contractor’s

Business Account Number issued by the Vermont Department of Taxes http://tax.vermont.gov/ .

3.9.2.The contract will obligate the bidder to provide the services and/or products identified in its bid, at the

prices listed.

3.9.3.Payment Terms. Percentage discounts may be offered for prompt payments of invoices; however,

such discounts must be in effect for a period of 30 days or more in order to be considered in making

awards.

3.9.4.Retainage. In the discretion of the State, a contract resulting from this RFP may provide that the

State withhold a percentage of the total amount payable for some or all deliverables, such retainage

to be payable upon satisfactory completion and State acceptance in accordance with the terms and

conditions of the contract.

3.9.5.Quality. If applicable, all products provided under a contract with the State will be new and unused,

unless otherwise stated. Factory seconds or remanufactured products will not be accepted unless

specifically requested by the purchasing agency. All products provided by the contractor must meet

all federal, state, and local standards for quality and safety requirements. Products not meeting these

standards will be deemed unacceptable and returned to the contractor for credit at no charge to the

State.

3.10.LEGAL SERVICES: If this RFP seeks a contract for legal services, the following requirements shall apply.

3.10.1. Bidders shall disclose any matters adverse to the State.

3.10.2. Bidders shall be in good standing with their relevant authority.

3.10.3. The selected bidder(s) must agree to the following additional provisions in any contract resulting

from this RFP:

3.10.3.1. Professional Liability Insurance – Before commencing work on this contract and throughout

the term of this contract, contractor shall procure and maintain professional liability insurance

for any and all services performed under this contract, with minimum coverage of

$1,000,000.00 per claim. See section 8 of Attachment C: Standard State Provisions for

Contracts and Grants (December 7, 2023).

3.10.3.2. Legal services – Contractor will be providing legal services under this contract. Contractor

agrees that during the term of the contract he or she will not represent anyone in a matter,

proceeding, or lawsuit against the State of Vermont or any of its agencies or instrumentalities.

Revised: March 18, 2025

Page 5 of 20

This page summarizes the opportunity, including an overview and a preview of the attached documents.

TITLE	QUESTIONS DUE	ANSWERS POSTED	DUE DATE	NO POSTING AFTER
IT Services for DLL Security Metrics and PCI Compliance Management	01/28/2026 04:30PM		02/11/2026 04:30PM

IT Services for DLL Security Metrics and PCI Compliance Management

Attachment Preview

Sign-up for a Free Trial, Government Bid Alerts

See Also