Subject:
Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard.
Recommended Action:
Approval and execution by the County Administrator of the Annual Self-Assessment Questionnaire (SAQ) with Bank of America (BOA) in response to the County’s required validation for full compliance to the Payment Card Industry Data Security Standard (PCI DSS).
• As the County accepts credit cards for payment, the County’s credit card service provider, Bank of America, requires an annual SAQ.
• The SAQ is required for the County to continue to process payments via credit card.
• The County must utilize compliant technology to ensure security of credit card transactions.
• The SAQ is coordinated by Business Technology Services.
• The deadline for full execution, submission and receipt to BOA is April 17, 2026.
• Noncompliance may result in fines and the loss of ability to perform self-assessments, and it would trigger future assessments to be completed by a Qualified Security Assessor at an increased cost to the County.
• Approval and execution of this questionnaire will have no fiscal impact on Pinellas County provided full compliance is demonstrated by April 17, 2026.
Strategic Plan:
Resilient Infrastructure and Environment
1.5 Strengthen resilience and adaptation.
Smart Service delivery
4.3 Improve efficiency of service delivery through technology.
Summary:
This SAQ is a response to BOA demonstrating full compliance with PCI DSS to operate as a Level 3 Merchant. The SAQ is required by BOA, the County’s payment card service provider, to continue to accept and process credit cards for County goods and services. The deadline for full execution, submission, and receipt to BOA is April 17, 2026.
Background/Explanation:
On June 30, 2016, the County was identified by BOA as a PCI Level 3 merchant based on historical transaction volume. BOA issued a 12-month deadline for full compliance. BTS coordinated an engaged effort associated with the response, which included identifying the affected departments, determining the appropriate solution(s), procuring new devices, enhancing and/or modifying the current infrastructure, ensuring all documentation is compliant and complete, and communicating the SAQ deliverable to the BOA.
The County can expect BOA to issue another notice requiring the same for the balance of non-BTS departments operating under merchant identifications, not included in this scope.
Prior Approvals of Annual Self-Assessment:
26-0279D- Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 4/17/2025
24-0433D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 5/2/2024
23-0409D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 5/11/2023
22-0505D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 5/27/2022
21-595D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 6/4/2021
20-575D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 6/5/2020
19-455D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 6/18/2019
18-379D - Annual Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 7/17/2018
17-552D - Approval of the Self-Assessment Questionnaire with Bank of America for compliance with the Payment Card Industry Data Security Standard. 7/18/2017
Fiscal Impact:
There is no fiscal impact, provided full compliance is demonstrated by April 17, 2026. Noncompliance may result in fines and the loss of ability to perform self-assessments, and it would trigger future assessments to be completed by a Qualified Security Assessor at an increased cost to the County.
Delegated Authority:
Authority for the County Administrator to sign this annual Self-Assessment Questionnaire is granted under Code Section 2-62 (1).
Staff Member Responsible:
Jeff Rohrs, Chief Information Officer, Business Technology Services
Partners:
N/A
Attachments:
Self-Assessment Questionnaire