City Council Memorandum
TO: HONORABLE MAYOR AND CITY COUNCIL DATE: APRIL 7, 2026 FROM: INNOVATION & TECHNOLOGY DEPARTMENT WARDS: ALL
SUBJECT: CHANGE ORDER NO. 2 TO EXTEND THE AGREEMENT WITH RSM US LLP FOR PAYMENT CARD INDUSTRY (PCI) CONSULTING SERVICES THROUGH JUNE 30, 2026, WITH NO CHANGE TO FEES ISSUE:
Approve Change Order No. 2 to the agreement with RSM US LLP, an Iowa limited liability partnership, to extend the term of the Payment Card Industry (PCI) consulting services agreement through June 30, 2026, with no changes to fees.
RECOMMENDATIONS:
That the City Council:
Approve Change Order No. 2 to extend the agreement with RSM US LLP for PCI consulting services through June 30, 2026, with no changes to fees; and Authorize the City Manager, or designee, to execute the Change Order, including making minor non-substantive changes.
BACKGROUND:
On December 20, 2023, the City entered into an agreement with RSM US LLP for PCI compliance consulting and Approved Scanning Vendor (ASV) services, with an original term ending December 31, 2024, for an amount not to exceed $43,925.
On November 7, 2024, Change Order No. 1 extended the term through December 31, 2025, and adjusted the scope and fees to accommodate additional hours and ASV scanning for 2025 for an additional amount of $38,800, bringing the total purchase order amount to $82,725.
DISCUSSION:
PCI Data Security Standards (DSS) apply to all organizations that process credit or debit card information, including merchants and third-party service providers that store, process or transmit credit card/debit card data. Failure to comply with PCI standards may result in fines and/or revocation of credit card acceptance.
The City of Riverside is required to undergo annual payment card industry (PCI) compliance audits to continue accepting and processing credit cards. RSM provides the City with consulting services designed to optimize the City’s PCI DSS compliance processes, which include evaluating new and updated PCI DSS requirements and ongoing remediation activities relative to the City’s payment processes.
RSM is also an Approved Scanning Vendor (ASV) as certified by the PCI Security Standards Council (SSC), and conducts mandatory quarterly scans that seek to identify any system vulnerabilities or possible security gaps.
The original agreement was approved in accordance with Purchasing Resolution 24101, Section 702 (d) which states, “Competitive Procurement through the Informal Procurement and Formal Procurement process shall not be required in any of the following circumstances: …(d) When the Procurement can only be obtained from a single source and the Manager is satisfied that the best price, terms and conditions for have been negotiated.” Change Order No. 2, dated January 20, 2026, further extends the term to June 30, 2026, or until remaining service hours (not to exceed 25) are consumed. There are no changes to fees or scope beyond the extension.
The extension is necessary to ensure continued PCI compliance support during the implementation of updated security standards and will provide assurance to the City’s customers that their credit card data/account and transaction information is safe from hackers or any malicious system intrusion.
Change Order No. 2 is pursuant to Purchasing Resolution 24101, Section 1104 “Change Orders”, which states: “Modification to a Purchase Order shall be made only by Change Order. Subject to the availability of funds, Change Orders may be utilized for purposes of…(5) modifying contract completion time or the term of a Contract. Unless otherwise specifically authorized by the Awarding Entity, Change Orders which cumulatively exceed the following will require Awarding Entity approval…(d) A Contract amendment which extends the term of the agreement beyond one year of the original expiration date.” The Purchasing Manager concurs that the recommended action is compliant with Purchasing Resolution 24101, Section 1104 (5) and (d).
FISCAL IMPACT:
There is no fiscal impact associated with this change order as this is a term extension only.
Prepared by: Vincent Price, Interim Administrative Services Manager Approved by: George Khalil, Chief Innovation Officer
Certified as to
availability of funds: Julie Nemes, Interim Finance Director Approved by: Edward Enriquez, Assistant City Manager/Chief Financial Officer/ Treasurer Approved as to form: Rebecca McKee-Reimbold, Interim City Attorney Attachments: Change Order No. 2
RSM US LLP - Change Order No. 2 ● Page 4