DEPARTMENT: Finance
DEPARTMENT HEAD: Troy Elliott
COUNCIL DISTRICTS IMPACTED: Citywide
SUBJECT:
Payment Card Industry (PCI) Attestation and Licensing
SUMMARY:
This ordinance authorizes the following with ARINC Incorporated (A) a change order to the Common Use Passenger Processing System contract to provide the Aviation Department with Payment Card Industry (PCI) security measures and after hours support in an amount not to exceed $192,618.00; and (B) a contract for PCI attestation and licensing for a total cost of $280,593.00, beginning upon approval by City Council and ending July 31, 2023. Funding is available from the FY 2021 Airport Operating and Maintenance Fund budget. Funding for subsequent years is contingent upon City Council approval of the annual budget.
BACKGROUND INFORMATION:
On March 3, 2018, City Council approved a five year contract with ARINC, Incorporated (ARINC) for a Common Use Passenger Processing System (CUPPS) in the amount of $1,774,502.00. During the term of the contract, additional enhancements and functionality have been implemented through previously approved change orders. Change order authority is statutorily limited to 25% of the original contract value. The proposed change order #4 in the amount of $192,618.00 will meet this statutory threshold as described in Item A below. As a result, this necessitated the need to enter into a new and separate contract with ARINC for attestations and licensing related to PCI security measures for the final two years of the contract as described in Item B below. This ordinance authorizes the following actions with ARINC:
A. Submitted for City Council consideration and action is the attached Change Order #4 to RFCSP 6100008601 in the amount of $192,618.00 to the existing CUPPS contract with ARINC. CUPPS enables multiple airlines, service providers, or other users to share physical check-in or gate podium positions. As a result, down time on lower use gates can support the addition of new air carrier service by maximizing the efficient use of existing airport assets. Change Order #4 will increase the CUPPS contract capacity to account for PCI security measures/attestations/licenses provided by ARINC during the third year of the CUPPS Contract and will also include capacity for future supplemental after-hours and weekend system support; gate/ticket counter equipment; and an inventory of spare hardware.
B. Submitted for City Council consideration and action is the attached offer (RFO 6100014067) from ARINC to provide the Aviation Department with a contract for future PCI attestations and associated licenses (the “Attestations Contract”), that will be required in the fourth and fifth year of the CUPPS contract, in the total amount of $280,593.00. Attestations of compliance are required by the PCI Data Security Standards (PCI DSS) for the onsite hardware, software, and network equipment associated with the existing CUPPS at the San Antonio International Airport (SAT). ARINC is the only provider that can maintain the System’s PCI compliance mandated by credit card companies. These services are being purchased as Sole Source according to the provisions of Texas Statutes, Local Government Code, Chapter 252.022.07. No other source can supply the services listed. Vendor acknowledged, with his/her signature, that all items offered are considered a Sole Source. A final report on the fifth-year attestations will be due by October 31, 2022. This contract will begin upon Council approval through completion of all work, a one-year renewal period, at the City’s option shall also be authorized by this ordinance.
ISSUE:
A. This change order will provide for PCI security measures/attestations/license renewals, equipment, inventory of spare hardware and support for year three of the CUPPS contract.
B. Change order #4 will meet the statutory change order capacity allowed under the original CUPPS contract approved by Ordinance 2018-03-01-0152.Therefore, a new and separate contract with ARINC will provide for future PCI attestations and associated licenses for years four and five to maintain PCI DSS compliance for the Aviation Department.
This award is exempt from the Small Business Economic Development Advocacy Program.
This award is an exception to the Local Preference Program.
The Veteran-Owned Business Program does not apply to non-professional services contracts, so no preference was applied to this contract.
ALTERNATIVES:
Many air carrier partners now depend on the CUPPS for their operations. Given the current fixed gate capacity at SAT, the Aviation Department may not be able to welcome new airlines or obtain new air service without the ability to expand the CUPPS. Should Change Order #4 and the Attestations Contract not be approved, attestations and licenses would lapse and the CUPPS would become PCI DSS non-compliant according to PCI Security Standards Council. This would significantly increase the City’s risk liability exposure in the event of a data breach.
FISCAL IMPACT:
This ordinance authorizes a change order in the amount of $192,618.00 with ARINC Incorporated for additional scope, equipment, and capacity to existing CUPPS contract and a new contract in the amount of $280,593.00 for additional PCI attestation and licensing for a total cost of $473,211.00. Funding for Change Order in the amount of $192,618.00 and year four software licensing renewals in the amount of $33,464.00 is available from FY 2021 Airport Operating and Maintenance Fund budget. Funding for subsequent years is contingent upon City Council appropriation of the annual budget.
RECOMMENDATION:
Staff recommends the approval of Change Order #4 in the amount of $192,618.00 for PCI security measures/attestations/license renewals, equipment and support, and a new contract in the amount of $280,593.00 for PCI attestations and associated license renewals with ARINC for the Aviation Department for the total cost of $473,211.00.
The original CUPPS Contract was procured by competitive sealed proposal process. Therefore, a Contracts Disclosure Form is required for the change order.