ATCH 04 SOO - PCI DSS Audit Readiness 3 Dec 2025.pdf

ATCH 04 - SOO - PCI DSS Audit Readiness 3 Dec 2025

STATEMENT OF OBJECTIVES (SOO)

FOR

Air Force Services Payment Card Industry Data Security Standard (PCI DSS) Audit Readiness

AT

Air Force Services Center (AFSVC), Port San Antonio, TX

Table of Contents

SECTION I

1.4 Scope

SECTION II

2.0 PROBLEM STATEMENT

2.1 Objective(s)

2.2 Final Outcome

SECTION III

3.0 CONTRACTOR QUALIFICATIONS

3.1 Contractor Qualifications

SECTION IV

4.0 DELIVERABLES AND ACCEPTANCE CRITERIA

4.1 Deliverables

4.2 Acceptance Criteria

SECTION V

5.0 CONTRACT ADMINISTRATION

5.1 Reporting

5.2 Meetings

SECTION VI

6.0 GENERAL INFORMATION

6.1 Contracting Officer’s Representative (COR) Responsibilities

6.2 Place of Performance

6.3 Government Furnished Equipment (GFE) & Personnel

6.4 Travel

6.5 Identify Known or Possible Conflicts of Interest

6.6 Security and Training Requirements

6.7 Security Clearances

6.8 Privacy Act

6.9 Cybersecurity

6.10 Security Education, Training and Awareness (SETA)

6.11 Data Stewardship and Governance

SECTION VII

7.0 APPENDIX

7.1 DEFINITIONS & ABBREVIATIONS

7.3 Sample Weekly Status Reports or as agreed upon by COR

7.4 Sample Contract Progress Report

7.5 NAFI Observed Holidays

ATCH 04 - SOO - PCI DSS Audit Remediation

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1 General. The Air Force Materiel Command’s Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio-Lackland, Texas, provides critical support to military personnel and their families through Department of the Air Force (DAF) Nonappropriated Fund Instrumentalities (NAFI) across enterprise Services programs, including food, fitness, childcare, lodging, and recreation. AFSVC is responsible for developing programs, managing support functions, and responding to high-level inquiries. Merchant card processing is vital to AFSVC’s operations, accounting for ~90% of its transaction revenue. However, current merchant processing practices are not fully compliant with Payment Card Industry Data Security Standard (PCI DSS), posing risk to the security of Department of Defense connected consumer payment card data.

1.2 Background.

1.2.1 The AFSVC DAF NAFI merchant card processing operations are currently non-compliant with the PCI DSS for a Level 1 Merchant, a designation validated by payment brands based on transaction volume. This non-compliance has resulted in fines levied by Visa. The compliance effort encompasses a comprehensive review of networks, hardware, software, policies, and procedures associated with merchant card processing.

1.2.2 This lack of compliance poses a significant risk to Department of Defense (DoD) connected consumer payment card data and jeopardizes the continuity of essential payment card services for mission execution. Addressing these vulnerabilities is critical not only for regulatory adherence, but also for safeguarding sensitive information and ensuring the operational integrity of the DAF NAFI business unit. Effective program management and strategic oversight are essential to implement the necessary changes to achieve full compliance and enhance overall security.

1.3 Volumetrics:

• Estimated 104 worldwide locations

• 2200+ business activities

• 13M+ annual credit card transactions

• Complete inventory of the Cardholder Data Environment (CDE) and payment application configurations is in progress (~55% complete).

1.4 Scope.

AFSVC is seeking support in two areas:

1.4.1 The PCI DSS compliance expert will review provided data and gap assessments related to DAF NAFI CDE to refine the PCI DSS scope, identify outstanding requirements to develop an expedited compliance path, and conduct the formal audit by end of FY26.

1.4.2 Business expert to guide maturing and/or developing end-to-end business systems and processes related to merchant processing. The contractor will identify improvement opportunities, assess the effort required, and assist with business process development to attain and sustain PCI DSS compliance across DAF NAFI enterprise business unit systems, point-of-sale (POS) hardware, software, and network infrastructures. The engagement will ensure a comprehensive understanding of compliance needs and guide development of strategic and tactical plans to ensure AFSVC PCI DSS compliance objectives are met. Additionally, the contractor will evaluate and address training gaps, delivering a recommended training strategy with facilitation support, as needed.

1.4.3 Specific milestone deliverables will be part of the Contractor Statement of Work. A cadence of status reports to AFSVC's PCI Cell members will be established to ensure ongoing alignment and transparency throughout.

1.5 Data Provision.

1.5.1 Upon contract award, the Contractor will be provided with all available data

(through the PCI Data Repository and file sharing platforms) pertaining to AFSVC’s installation locations, Merchant accounts, CDE scoping (networks, hardware, software inventories), network diagrams, scanning and vulnerability results, policies, procedures, and third-party service providers involved in cardholder data processing, relevant to the PCI DSS compliance effort. This data will be used to inform the refinement of the PCI DSS scope, identify outstanding requirements, and develop an expedited compliance path.

SECTION II

2.0 PROBLEM STATEMENT

The AFSVC credit card acceptance environment is not PCI DSS compliant across the DAF NAFI enterprise for people, processes, and technology. Historically, the POS systems environment in operation, along with gaps in network infrastructure and business processes led to fragmented efforts to achieve PCI DSS compliance. In 2024, AFSVC stood up a dedicated PCI Cell to develop an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology.

Mitigation efforts are well underway, with projected completion by early 4th quarter of FY26. AFSVC is seeking a contractor to aid in implementing this effective enterprise-wide PCI compliance program Additionally, AFSVC is pursuing support to modernize business processes for merchant processing affecting PCI DSS compliance.

2.1 Objective(s).

To secure expert insight on industry best practices to support AFSVC in achieving and maintaining compliance with PCI DSS. This initiative will focus on a strategic, business process, and sustainment approach across disparate POS, hardware and software, network infrastructures, and business processes and procedures related to merchant card servicing activities. The goal is to enhance security, mitigate risks, and ensure a robust and comprehensive approach toward compliance while optimizing business processes.

Final Outcome.

The contractor will deliver strategies, frameworks, tools, and guidance documents to aid AFSVC in developing an effective and robust enterprise PCI compliance program to achieve and maintain PCI DSS compliance, mitigate risks associated with payment card processing, and enhance overall business system processes affecting cybersecurity. The contractor will provide continuous implementation support, including audits and Report on Compliance (ROC), and ensure readiness for subsequent annual assessments.

The deliverables will also include a comprehensive suite of integrated tools and strategies that ensure full PCI DSS compliance while improving the overall security and efficiency of payment processing across business operations and geographically separated locations, protecting payment card data and streamlining related processes.

Strategic pillars (not an exhaustive list):

2.1.1 Strategic planning support, including steps required to achieve compliance, timelines, resource allocation, risk management strategies and sustainment plans.

2.1.2 QSA Assessment readiness. Deliver actionable recommendations to aid AFSVC in the development and implementation of security measures, documentation, and reporting to ensure readiness for formal PCI DSS compliance assessments.

2.1.3 Commercial expertise to recommend turnkey compliance solution suite, including tools, technologies, and processes that ensure adherence to PCI DSS standards to ensure sustainment and allow for innovation. Examples of the industry expertise requested:

• Process and procedure codification

• Merchant ID management and adjudication

• Integrated technology and data solutions with approved purchase list

• Enterprise data management strategy

• Governance framework

• Asset management process

• Lifecycle management

• Sustainment & growth strategies

• Recommendations or solutions for enterprise PCI compliance tools and services designed for geographically separated networks and technology in scope for PCI DSS compliance

• Recommendations or solutions for PCI DSS compliance oversight, to include templates for PCI DSS enterprise policies, operating procedures, and forms

2.1.4 Return on Investment (ROI) assessment of cost savings tied to utilizing a consolidated system recommended versus current state multiple disparate solutions.

2.1.5 Propose actionable solutions based on assessments and research.

Ability to implement recommended solutions and provide cost and timeframe. requirements.

SECTION III

3.0 CONTRACTOR QUALIFICATIONS

3.1 Contractor Qualifications.

AFSVC is seeking a PCI DSS compliance expert with commercial and DoD PCI DSS and a track record of successfully guiding organizations in achieving PCI DSS Compliance utilizing industry best practices. The contractor’s past performance must have a track record of driving compliance success for organizations with a dispersed business model with multiple POS systems and lacking a central network infrastructure.

Contractor must meet the following criteria:

3.1.1 Certified Qualified Security Assessor (QSA) with past performance of successfully completing PCI assessment projects of similar size and scope (Level 1 Merchant), implementing the PCI DSS standard.

3.1.1.1 QSA must have current certification (minimum: PCI DSS v4.0.1)

3.1.2 Experience facilitating PCI DSS compliance in DoD and/or Federal entities.

Candidate must include agency, scope of work, and outcome description whether successful or unsuccessful.

3.1.3 A minimum of five (5) years of experience in establishing enterprise systems, including the development of PCI DSS policies, procedures, processes, and responsibilities for a geographically separated worldwide enterprise.

SECTION IV

4.0 DELIVERABLES AND ACCEPTANCE CRITERIA

4.1 The Contractor will provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. The deliverables listed below are not expected to change. Data will be made available upon contract award to support all deliverables according to Section 1.5 Deliverables:

4.1.1 Phase 1: Initial Assessment & Scoping

4.1.1.1 A Project Plan and RASCI matrix will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days of contract award.

4.1.1.2 Strategic Compliance Roadmap Refinement: Review prior gap assessment findings and planned roadmaps to establish a clear, prioritized path for addressing critical PCI DSS compliance gaps, providing targeted remediation strategies.

4.1.1.3 Risk Assessment: Evaluate the organization's risk posture and identify potential vulnerabilities that could impact the security of cardholder data.

Identify the current level of compliance at each AF installation worldwide and at AFSVC with the most current PCI DSS regulations.

4.1.1.4 Incident Response & Contingency Planning Support: Assess existing incident response procedures related to POS systems and business processes, ensuring they are aligned with PCI DSS standards and include clear roles, responsibilities, and communication protocols for handling data breaches or security incidents.

4.1.1.5 Documentation & Reporting Support (Business Expert): Review and assess documentation of PCI DSS compliance for business processes and POS systems, ensuring that appropriate evidence is available to demonstrate adherence to standards and facilitate audits.

4.1.2 Phase 2: Gap Analysis, Planning & Remediation

4.1.2.1 Security Control Implementation & Remediation: Potential implementation and remediation of non-compliant security controls and processes to meet the requirements of the PCI DSS. Identify and prioritize the AFSVC key work areas that must be addressed and provide solutions required to complete remediation within the agreed upon timeframe.

4.1.2.2 Vulnerability Management: Identify and address vulnerabilities in the organization's systems and networks that could impact the security of cardholder data.

4.1.2.3 Merchant Services Optimization: Provide the following services related to merchant accounts and payment processing, Merchant Account Setup/Reorganization

4.1.2.3.1 Payment Gateway Integration

4.1.2.3.2 Fee Optimization

4.1.2.3.3 Payment Technology Implementation

4.1.2.3.4 Ongoing Customer Support & Training

4.1.2.3.5 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

4.1.3 Phase 3: Audit Support, Execution & Remediation Planning

4.1.3.1 Audit Preparation Support: Assist with preparation for PCI DSS audits, including providing guidance on remediation strategies and assisting with the collection of evidence for the audit.

4.1.3.2 Audit Execution: Conduct a PCI DSS audit to validate compliance by reviewing systems, documentation, and security controls, interviewing personnel, analyzing security data, and gathering supporting evidence.

4.1.3.3 Audit Findings & Remediation Plan: Present a comprehensive report detailing the findings of the PCI DSS audit, including specific non-compliant areas and recommended remediation actions. The plan will include prioritized steps, timelines, and responsible parties for addressing each identified gap.

4.1.4 Phase 4: Reporting & Strategic Guidance

4.1.4.1 PCI DSS Discovery Report: Present a written report to the COR within 21 days of completing the PCI DSS Discovery, containing:

4.1.4.1.1 Executive Summary: For management, visual, concise, covers scope, vulnerabilities, risk, and security posture comparison.

4.1.4.1.2 Narrative Body: Detailed, for non-technical audience, explains process, findings, and strategic recommendations for resolving compliance issues.

4.1.4.1.3 Compliance Verification & Support: Review and assess the effectiveness of controls and business processes related to network security and POS systems against PCI DSS requirements. This review will involve access to the PCI data repository containing Merchant and terminal ID files, documentation and artifacts (not direct access to live transaction databases). The outcome will be a report identifying any gaps in compliance.

4.1.4.2 Report on Compliance (ROC) Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.4.2.1 Executive Summary

4.1.4.2.2 Scope of Assessment

4.1.4.2.3 Methodology

4.1.4.2.4 Detailed Findings and Observations for each PCI DSS requirement

4.1.4.2.5 Validation of Compliance

4.1.4.2.6 Compensating Controls (if applicable)

4.1.4.2.7 Attestation of Compliance

4.1.4.2.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions..

4.1.5 Phase 5 – Recurring Annual Audits (for option years)

4.1.5.1 Report on Compliance (ROC) Audit Preparation Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies. Perform physical audits as needed.

4.1.5.2 Report on Compliance (ROC) Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and Observations for each PCI DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

4.1.6 A Project Plan and RASCI matrix will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days of contract award.

4.2 Acceptance Criteria

4.2.1 All deliverables must be approved by the Contracting Officer’s Representative

(COR) and designated representatives from AFSVC.

4.2.2 All data or work products generated to support this effort will be the property of

AFSVC.

4.2.3 Acceptance or rejection of named deliverables will occur within a reasonable time frame by the COR.

SECTION V

5.0 CONTRACT ADMINISTRATION

5.1 Reporting.

5.1.1 The Contractor will provide weekly progress reports (See sample in 7.3.

Weekly Status Report) and/or other updates as needed to provide the Contracting Officer’s Representative (COR) with the status of the tasks completed for the week.

The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

5.1.2 Provide a list of planned task/activities for the week in the status report.

Subsequent status reports will include completed percentage of the previous week’s planned task/activities and a new list of planned activities for the following week.

5.1.3 The Contractor will provide a monthly contract progress report, with their monthly invoice, that will be consistent with the submitted and COR approved weekly status reports. (See 7.4. Contract Progress Report)

5.2 Meetings.

5.2.1. Kick-Off Meeting. A kick-off meeting will be held virtually, no later than ten (10) business days after contract award, on a date and time agreed upon by both parties. The Contractor will designate a primary Point of Contact (POC).

5.2.2. Status Meetings. The frequency, day and time of status meetings will be determined by the COR and the Contractor after contract award. Meetings will be held virtually unless otherwise coordinated between the COR & Contractor.

5.2.3. Meeting Minutes. Status and recommendations identified or discussed in meetings or collaborative sessions will be provided in writing within two (2) business days of initial discussion unless otherwise coordinated between the COR & Contractor.

SECTION VI

6.0 GENERAL INFORMATION

6.1 Contracting Officer’s Representative (COR) Responsibilities.

6.1.1 The Contracting Officer (CO) will designate an individual as the Contracting

Officer’s Representative (COR).

6.1.2 The COR is responsible for monitoring the performance of work under this contract. In no event will any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

6.1.3 This designation will remain in effect throughout the life of the contract, unless terminated sooner in writing by the CO or due to reassignment. Primary responsibilities of the COR may include, but are not limited to, the following:

6.1.3.1 The COR is responsible for performing post-award administrative functions necessary to ensure the performance of services required by this contract. If the COR believes performance by the Contractor has not met the level required by the contract, the problem will be referred to the CO for resolution.

6.1.3.2 The COR will maintain and approve the list of all products required to be delivered by the Contractor as well as when the product is delivered and its acceptability status, this includes the project schedule.

6.1.3.3 The COR will maintain a record of all contract deliverables and a copy of the email message or cover letter used to deliver the deliverables.

6.1.3.4 The COR will work with CO to ensure the following responsibilities are adhered to:

6.1.3.4.1 Verify that the Contractor performs the technical requirements of the contract in accordance with the terms, conditions, and specifications therein. Specific emphasis will be placed on the quality provisions, for both adherences to the contract provisions and to the Contractor's own quality control program.

6.1.3.4.2 Perform acceptance for the customer of services performed under this contract.

6.1.3.4.3 Communication will be the key to success of this effort. Maintain liaison and direct communications with the Contractor and the CO. Written communications with the Contractor and other documents pertaining to the contract will be signed by the COR and a copy will be furnished to the CO.

6.1.3.4.4 Monitor the Contractor's performance, notify the Contractor of deficiencies observed and direct appropriate action to effect correction. Record and report to the CO incidents of faulty or non-conforming work, delays, or problems.

6.2 Place of Performance

6.2.1 3515 South General McMullen Bldg. 1, San Antonio, TX 78236-9854.

Remote work is authorized for a majority of the contract, however in-office work may be required as agreed upon by COR & Contractor.

6.3 Government Furnished Equipment (GFE)

6.3.1 AFSVC will provide GFE-owned PCs to do the required work and to access the applications.

6.4 Travel

6.4.1 Contractor will be required, at a minimum, to travel to San Antonio, TX to pick-up & turn-in Government Furnished Laptops (turn-in will include a Contract Closeout Meeting), and to assess a sample of bases as deemed appropriate for the Audit Readiness and ROC (4.1.3 and 4.1.4). All travel must be mutually coordinated & reimbursed by AFSVC in accordance with the Federal Travel Regulations (FTR see Clause 29 of the NAF Standard Clauses).

6.5 Identify Known or Possible Conflicts of Interest

6.6 Security and Training Requirements

6.6.1 Highest level: UNCLASSIFIED. The preponderance of work will be at the unclassified level.

6.6.2 Building Access. Unescorted access to AFSVC Building 1 is approved on a case-by-case basis and will be coordinated through the COR and AFSVC’s Security Manager.

6.6.3 Training. Cyber Awareness Challenge Training, Controlled Unclassified Information (CUI) Training (one-time) and Privileged User Cybersecurity Responsibilities (if server access is required).

All Government training required will be provided at no cost by the Government.

6.7 Security Clearances

6.7.1 The Contractor will ensure that personnel requiring access to AFSVC information systems, or its data have the proper and current cybersecurity certifications as determined by AFSVC cybersecurity teams to perform cybersecurity functions in accordance with DoDM

8140.03, Cyberspace Workforce Qualification and Management Program located at https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140- 03.pdf.

6.7.2 The Contractor shall meet the following contract/security clearance requirements, including:

6.7.2.1 The Contractor shall safeguard and comply with the rules and regulations issued under DoDI 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014; AFMAN 16-1405, Air Force Personnel Security Program; AFM 33-152, User Responsibilities and Guidance For Information Systems; DoDD

8500.01 security, 14 Mar 2014; AFI 17-130, Air Force Cybersecurity Program Management; and DoDM 8140.03, Information Assurance Workforce Improvement Program requirements and respective updates to the listed rules and regulations. The Contractor shall follow the DoD Privacy Office guidelines for submittal of Information Assurance Technical (IAT) security clearances

6.7.2.2 Contractor personnel shall not be assigned to perform duties within IAT-II or IAT-III, and or requiring “Limited Privileged Access” such as system or database administration rights, to any NAFI application or network.

6.7.3 Tier 1 requests are initiated using the Standard Form (SF) 85.

Tier 3 requests are initiated using the Standard Form (SF) 86 and are submitted to the installation Information Protection Office through the Unit Security Manager. The initiation of the Tier 1 or Tier 3 shall include the submission of all required information and verified through the Department of Defense (DoD) Defense Information System for Security (DISS) database. The Contractor shall comply with the rules and regulations under DMDC Trusted Associate Sponsor System Overview Guide, Version 5.7, Sept 2018 and associated updates; all Common Access Card (CAC) holders must, at minimum, have an initiated a favorable completion of an FBI fingerprint check, or a DoD determined equivalent investigation. The NAFI may grant a waiver to allow the Contractor to start work after submitting all required information, passing a successful FBI fingerprint check and DISS.

6.7.4 All Contractor personnel requiring system access must be adjudicated with a Favorable determination in DISS.

6.1.1 6.7.5 All Contractor personnel requiring system access must sign a non-disclosure agreement.

https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf

6.7.6 All Contractor personnel requiring system access must respond to the AFSVC Security Manager’s inquiries within three business days (excluding federal holidays), not to exceed 72 hours. If Contractor personnel do not respond to the AFSVC Security Manager’s inquiries within three business days, their non-action on this matter provides grounds for termination.

6.8 Privacy Act

6.8.1 The Contractor shall safeguard and comply with the agency rules and regulations issued under Public Law 110-53 (42 U.S.C. § 2000ee- 1) Section 803;

Air Force Policy Directive (AFPD) 33-3, Information Management; Department of Defense Directive (DoDD) 5400.11, Department of Defense Privacy Program;

Department of Defense Regulation (DoDR) 5400.11-R, Department of Defense Privacy Program; Department of Defense Instruction (DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance; DoDI 1000.30, Reduction of Social Security Number (SSN) Use Within DoD; and DoDI 1000.29, and DoD Civil Liberties Program, Privacy Act of 1974, 5 U.S.C. § 552a, E-Government Act of 2002, 44 U.S.C. §3601, Safeguarding and Responding to Personally Identifiable Information (PII) breaches, Reduction of Social Security Number (SSN) and AFI 33-332, AF Privacy and Civil Liberties Program and associated updates to the agency rules and regulations. Penalties are applied for misuse or unauthorized disclosure of PII. The Act (5 U.S.C. 552a) provides for civil remedies for injured parties, including actual damages, attorney fees, and litigation costs.

6.9 Cybersecurity

6.9.1 Where applicable, the Contractor shall ensure all components in the contractor solution, any applications that process, store, and/or transmit credit card information/cardholder data are thoroughly assessed and meet the most current version of the Payment Card Industry Data Security Standards (PCI DSS). The solution must meet all PCI DSS compliance requirements identified by the Payment Card Industry Security Standards Council. The Contractor shall provide to the NAFI sufficient evidence of PCI DSS Compliance certification regarding the solution’s PCI DSS compliance status. All contractor activities must maintain strict adherence to PCI DSS v4.0.1 or later requirements including:

• Implementation of all applicable security testing procedures per Requirement 11

• Maintenance of secure coding practices per Requirement 6.2.4

• Regular security awareness training per Requirement 12.6

• Incident response procedures per Requirement 12.10

6.9.2 Federal Cybersecurity Standards:

• Compliance with NIST SP 800-53 security controls

• Implementation of CISA cybersecurity directives

• Adherence to DoD 8500 series information assurance requirements

• Integration with DoD Risk Management Framework (RMF) processes

6.9.3 Continuous Monitoring:

• Real-time security monitoring capabilities

• Automated compliance validation tools

• Regular penetration testing and vulnerability assessments

• Continuous network segmentation validation

6.10 Security Education, Training and Awareness (SETA) and Operations Security (OPSEC) Training

6.10.1 Contractor employees will complete initial and annual refresher SETA and

OPSEC training within five days of on-boarding for initial, and annually as dictated by the unit security manager.

6.11 Data Stewardship and Governance

6.11.1 The NAFI will have unlimited rights to all technical data unless the Contractor takes specific actions and includes prescribed legends in their submission, and/or data products to limit or restrict such NAFI rights for particular identified items.

“Technical data” refers to recorded information and includes, but is not limited to, research and engineering data and drawings, specifications, standards, process sheets, manuals, technical reports and computer software documentation. It does not include computer software or financial, cost/pricing or other contract and grant administrative data but does include any developed intellectual property not specific to the data.

6.11.2 Data and information generated during this agreement is owned by the NAFI.

Data must be physically separated from the data of other users, on separate drives or computers, and appropriate firewalls must be established to prevent other users from accessing NAFI data.

6.11.3 Should the NAFI elect not to execute option years or at the end of the contract period, whichever is sooner, data must at all times be promptly accessible until converted to the new system with no additional separation fee.

6.12 Cardholder Data Protection

6.12.1 The contractor shall implement strong cryptography and security protocols per PCI DSS Requirements 3 and 4

6.12.2 All cardholder data access must be logged and monitored per Requirement 10

6.12.3 Data retention and disposal procedures must comply with Requirement 3.2

6.12.4 Any suspected security incidents must be reported within 1 hour to the COR

SECTION VII

7.0 APPENDIX

7.1 DEFINITIONS & ABBREVIATIONS

Contracting Officer (CO). The duly appointed Government agent authorized to award or administer contracts. The contracting officer is the only person authorized to contractually obligate the Government.

7.2 ACRONYMS

AFSVC - Air Force Services Center ASV - Approved Scanning Vendor CC – Commander CO – Contracting Officer CONUS – Continental United States COR – Contracting Officer Representative DAF – Department of the Air Force DISS - Defense Information System for Security (legacy JPAS) DOD - Department of Defense FTE – Full Time Equivalents GFE – Government Furnished Equipment NAFI - Nonappropriated Fund Instrumentality OCONUS – Outside the Continental United States PCI DSS – Payment Card Industry Data Security Standards PCI SSC – Payment Card Industry Security Standards Council POC - Point of Contact POS – Point of Sale QSA – Qualified Security Assessor RASCI - Responsible, Accountable, Supporting, Consulted and Informed ROC – Report on Compliance ROI – Return on Investment SAQ – Self Assessment Questionnaire SOO – Statement of Objectives

TQM – Total Quality Management VF – Financial Management & Comptroller Directorate VB – Business Operations Directorate VBL - Lodging VI- Installation Support Division VM - Mission Operations Directorate VP – NAF Procurement Directorate VT – Business Information Technology Systems Directorate

ATCH 04 – SOO - PCI DSS Audit Remediation

7.3 Sample Weekly Status Reports or as agreed upon by COR

7.4 Sample Contract Progress Report

7.5 NAFI Observed Holidays

Holiday

*New Year's Day: January 1st

Martin Luther King Jr. Day: Third Monday in January

Presidents' Day: Third Monday in February

Memorial Day: Last Monday in May

*Juneteenth National Independence Day: June 19th

*Independence Day: July 4th

Labor Day: First Monday in September

Columbus Day: Second Monday in October

*Veterans Day: November 11th

Thanksgiving Day: Fourth Thursday in November

*Christmas Day: December 25th

*(observed on the following Monday if holiday falls on a Sunday, or on the preceding Friday if the holiday falls on a Saturday)