Statement of Objectives - PCI Compliance Technical Support & Sustainment

8 APR 2026

STATEMENT OF OBJECTIVES (SOO)

FOR

Air Force Services Payment Card Industry Data Security Standard (PCI DSS) Compliance Technical Support & Sustainment

AT

Air Force Services Center (AFSVC), Port San Antonio, TX

8 APR 2026

Table of Contents

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1 General

1.2 Background

1.3 Objective

1.4 Volumetrics

1.5 Scope

SECTION II

2.0 PROBLEM STATEMENT

2.1 Objective(s)

2.2 Final Outcome

SECTION III

3.0 TERMS OF THE CONTRACT

3.1 Timeline

3.2 Contractor Qualifications

SECTION IV

4.0 DELIVERABLES AND ACCEPTANCE CRITERIA

4.1 Deliverables

4.3 Acceptance Criteria

SECTION V

5.0 CONTRACT ADMINISTRATION

5.1 Schedule

5.2 Resource Calendar

5.3 Meetings

5.4 Documentation

SECTION VI

6.0 GENERAL INFORMATION

SECTION VII

7.0 APPENDIX

7.1 DEFINITIONS & ABBREVIATIONS

7.2 ACRONYMS

7.3 Sample Weekly Status Reports or as agreed upon by COR

7.4 Sample Contract Progress Report

7.5 NAFI Observed Holidays

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1 General

1.1.1 The Air Force Materiel Command’s Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio-Lackland, Texas, provides critical support to military personnel and their families through Department of the Air Force Non-appropriated Fund Instrumentalities (DAF NAFI) across enterprise Services programs, including food, fitness, childcare, lodging, and recreation. AFSVC is responsible for developing programs, managing support functions, and responding to high-level inquiries. Merchant card processing is vital to AFSVC’s operations, accounting for ~90% of its transaction revenue. However, current merchant processing practices are not fully compliant with Payment Card Industry Data Security Standard (PCI DSS), posing risk to the security of Department of Defense connected consumer payment card data.

1.2 Background

1.2.1 Although the AFSVC DAF NAFI's network security is on track for completion by

July 2026, critical gaps in security tools and on-site technical support prevent a proactive, centrally managed defense. This creates unacceptable risk to Department of War (DoW) consumer payment data and complicates PCI DSS compliance verification.

1.2.2 AFSVC is a PCI DSS Level 1 Merchant. The cardholder data environments addressed by this SOO operate on locally managed commercial networks, which are separate from the NIPRNet.

1.3 Objective

1.3.1 The objective of this effort is to achieve a proactive, centrally-governed security posture that provides AFSVC with full visibility into the cardholder data environment, ensures long-term verifiable PCI DSS compliance, and empowers local personnel for self-sufficient operation.

1.4 Volumetrics

• Transactions: 13M+ annual payment card transactions.

• Business Activities: 2200+ lines of business.

• Locations: Estimated 20-30% of 104 worldwide locations lack the required

IT resources to ensure attainment and sustainment of PCI Compliance.

• Complete inventory of the Cardholder Data Environment (CDE) and payment application configurations is in progress (70% complete).

• Vulnerability scanning and penetration testing tools are in place, with completion projected by end of July 2026 (70% complete).

8 APR 2026

1.5 Scope

1.5.1 AFSVC is seeking expert technical support to advance its PCI DSS compliance strategy. This SOO is for technical support and sustainment of PCI DSS compliance. It is a separate and distinct effort from the PCI DSS audit itself, which is conducted by a separate, Government-engaged Qualified Security Assessor (QSA) firm. To achieve the objective, the contractor must provide the expertise and resources to perform the following two primary tasks:

1.5.1.1 Enterprise Security Suite Implementation: Deploy a standardized suite of advanced security tools (such as SIEM, DLP, and MFA) specifically within the CDE at each respective installation. This effort must result in a centralized reporting capability that feeds data directly into the AFSVC central repository.

1.5.1.2 Targeted Technical Support and Sustainment: For the subset of installations lacking local IT expertise, provide hands-on technical support for ongoing vulnerability management, incident response, and the effective operation of the new enterprise tools. A key outcome of this task is to establish long-term, self-sufficient compliance at these locations through direct support, training, and the creation of robust local Standard Operating Procedures (SOPs) and Operating Instructions (OIs).

1.5.2 Out of Scope: This effort does not include the provision or management of vulnerability scanning and penetration testing tools, which are already in place.

1.5.3 . Upon contract award, the Government will provide the contractor with access to available supporting documentation to facilitate Phase 1 analysis. This may include, but is not limited to: CDE scoping and inventory documentation, network and data flow diagrams, and lists of relevant third-party service providers.

SECTION II

2.0 PROBLEM STATEMENT

DAF installations face a critical challenge in sustaining their PCI DSS compliance due to a lack of on-site IT support with specialized expertise in vulnerability management and advanced security tool operation. This deficiency creates an unacceptable risk of security gaps re-emerging, potentially leading to data breaches and non-compliance penalties. The absence of local skills to execute effective vulnerability remediation, implement outstanding security tools, and develop or refine SOPs and OIs, necessitates a comprehensive external support solution focused on augmenting local teams and building their capacity for self-sustainment.

2.1 Objective(s)

2.1.1 To secure expert technical support for local installations, ensuring the sustained operation and management of a compliant and secure cardholder data environment. The Government intends to award all phases outlined in this SOO to a single vendor.

However, the execution of Phase 2 (Implementation) and Phase 3 (Option Years) is at the Government's discretion, contingent upon the results of the Phase 1 Gap Analysis and available funding.

8 APR 2026

2.2 Final Outcome

2.2.1 Support Local Vulnerability Management: Provide hands-on support to local IT staff to manage the remediation of vulnerabilities identified by ongoing network scans.

2.2.2 Implement and Manage PCI Security Tools: Assist local teams with the recommendation, implementation, configuration, and day-to-day monitoring of critical security tools, including SIEM, DLP, and MFA, as needed.

2.2.3 Empower and Train Local Personnel: Transfer specialized knowledge and skills to local IT staff, enabling them to independently manage vulnerability remediation and operate PCI-specific security tools.

2.2.4 Develop and Standardize Local Procedures: Document and help implement clear SOPs and OIs, leveraging enterprise policy and examples provided from our more PCI mature installations.

2.2.5 Provide Tier 2/3 Sustainment Support: Act as an escalation point for complex technical issues and provide ongoing remote support to proactively address potential security gaps.

2.2.6 Provide Ongoing Remote Support and Monitoring: Offer continuous remote support and monitoring to proactively identify and address potential security issues and maintain compliance. This includes regular vulnerability scan findings, security log analysis, and incident response assistance.

2.2.7 Establish Clear Communication Channels: Maintain clear and consistent communication with both local base personnel and headquarters regarding the status of PCI DSS compliance efforts, potential risks, and remediation activities.

2.2.8 Maintain Comprehensive Documentation: Create and maintain thorough documentation of all activities, including assessments, remediation plans, implemented solutions, and training materials.

SECTION III

3.0 TERMS OF THE CONTRACT

3.1 Timeline

The customer intends to award based on deliverables. The Contractor must provide comprehensive, on-site and remote assistance to establish a secure cardholder data environment, remediate vulnerabilities, and empower local personnel to maintain long-term PCI compliance. Performance begins upon award of the contract and concludes 12 months after contract award with additional option years considered.

Period of Performance: 12 months, with option years as required.

3.2 Contractor Qualifications

A minimum of five (5) years of hands-on experience is required. AFSVC requires a technical support contractor with expertise in cybersecurity and a track record of successfully supporting and guiding IT teams in securing and monitoring networks and expanding their knowledge base. The ideal candidate must possess a strong background

8 APR 2026

in network security and cybersecurity. Prior experience working with the Federal Government or DoW is highly desirable.

The Contractor must provide the experience necessary to complete the tasks outlined in the SOO. The Contractor must utilize established policies, standards, and sound management principles in the performance of the SOO requirements and deliverables.

The Contractor’s personnel, at a minimum, must have the following experience:

3.2.1. Required Qualifications

3.2.1.1. Security Clearance: The contractor and all personnel performing work under this contract must have the ability to obtain and maintain a Tier 1 security clearance, or level as determined by the DAF.

3.2.1.2. Cybersecurity Certifications: Key personnel must hold relevant cybersecurity certifications, such as Certified Information Systems Security Professional (CISSP), CompTIA Security+, or similar.

3.2.1.3. Vulnerability and Incident Management: 3-5 years’ experience working with the full vulnerability management lifecycle, including the use of scanning tools, remediation techniques, implementing management programs, and executing incident response procedures (containment, eradication, and recovery).

3.2.1.4. Networking: A minimum of five (5) years of hands-on experience with Transmission Control Protocol/Internet Protocol (TCP/IP), routing, firewalls, intrusion detection/prevention systems (IDS/IPS), VPNs, and other network security concepts.

3.2.1.5. Security Information and Event Management (SIEM): Ability to configure, manage, and analyze data from SIEM systems (e.g., Splunk, QRadar).

3.2.1.6. Operating Systems: Proficiency with securing and managing various operating systems (e.g., Windows, Linux, macOS).

3.2.1.7. Authentication & Authorization: Understanding of modern authentication protocols (e.g., Kerberos, OAuth, SAML) and authorization mechanisms (e.g., RBAC, ABAC).

3.2.1.8. System Architecture: At least one year’s experience working with system requirements analysis and techniques for planning current and future system architecture.

3.2.1.9. Cloud Security: At least one year’s experience working with cloud security best practices and technologies for platforms like AWS, Azure, and GCP.

3.2.1.10. Cryptography: At least one year’s experience working with encryption algorithms, hashing functions, digital signatures, and certificate management.

3.2.2. Preferred Qualifications

3.2.2.1 Experience with DAF/DoW IT Environments: At least one year experience working with DAF or DoW IT environments, including familiarity with their unique security policies, procedures, and infrastructure.

WARD, WHITNEY CIV USAF AFMC AFSVC/VPEB

Review “the working knowledge of” comments in contractor qualifications. Please clarify do you want knowledge of, or experience in.. And if experience in, how much experience is needed?

KISHMAN, ANGELA M CIV USAF AFMC AFSVC/VSX

Modified

WARD, WHITNEY CIV USAF AFMC AFSVC/VPEB

This is the Security Clearance that will be done by AFSVC? Contractor is NOT required to possess these clearances before starting the requirement, correct? Please reword this paragraph correctly.

KISHMAN, ANGELA M CIV USAF AFMC AFSVC/VSX

correct

WARD, WHITNEY CIV USAF AFMC AFSVC/VPEB

How much experience? Is there a level of experience needed in this qualification? Please quantify and/or clarify.

KISHMAN, ANGELA M CIV USAF AFMC AFSVC/VSX

adjusted

8 APR 2026

SECTION IV

4.0 DELIVERABLES AND ACCEPTANCE CRITERIA

The Contractor must provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All Government data must be exportable to a non-proprietary, machine-readable format (e.g., CSV, JSON). The following deliverables are not expected to change:

4.1 Deliverables. This program will be executed through a multi-track approach, leveraging specialized technical teams working concurrently to achieve both implementation and operational objectives. While Phases 1 and 2 focus on the foundational engineering and deployment of the security tool suite by an Implementation Team, Phase 3 represents the parallel and ongoing work of a distinct Operational Support & Sustainment Team.

4.1.1 Phase 1: Technical Tool Gap Analysis and Solution Strategy

4.1.1.1 Gap Analysis and Solution Recommendations: Assess the CDE to perform a technical gap analysis focused specifically on identifying the security tools and services required to complete the enterprise security suite. This analysis is not a formal PCI DSS assessment or scope-reduction exercise. The contractor shall deliver a formal report detailing recommendations for a complete tool suite (e.g., SIEM, DLP, MFA) and how these tools must integrate into a centralized reporting framework. The contractor is expected to collaborate with the Government’s designated QSA firm but not to perform QSA functions.

4.1.1.2 High-Level Executive Summary: Deliver a summary of key findings and recommendations for the required security tools and services to comply with PCI DSS. The contractor must prioritize the use of modern, automated, and cloud-based tools and services.

4.1.1.3 Solution Implementation Strategy: The Contractor must deliver a Solution Implementation Strategy document. This document must serve as the foundational plan and must include:

4.1.1.3.1 Recommendations for a complete enterprise tool suite to be deployed specifically within the CDE at each respective installation. The strategy must also detail how these tools must integrate into a centralized reporting framework to provide a comprehensive, enterprise-level view of the security and compliance posture.

4.1.1.3.2 A detailed cost analysis for all recommended tools.

4.1.1.3.3 A high-level implementation plan that defines the necessary steps, resource requirements, and a project timeline with a target initial completion date of August 2026.

4.1.2 Phase 2: Tools Implementation Support

Following the acceptance of the Solution Implementation Strategy, the

WARD, WHITNEY CIV USAF AFMC AFSVC/VPEB

Is this still true?

KISHMAN, ANGELA M CIV USAF AFMC AFSVC/VSX

Yes

KISHMAN, ANGELA M CIV USAF AFMC AFSVC/VSX

Phase 3 is defined as - The technical support model must be designed to provide both steady-state daily operations to up to 30 installations and flexible surge support for key activities such as assessment cycles, large-scale remediation efforts, and incident response events.

8 APR 2026

Contractor must perform the following deployment and support activities:

4.1.2.1 System Deployment: Install, configure, and ensure proper integration of all approved security tools and services into the existing AFSVC CDE infrastructure.

4.1.2.2 Validation and Documentation:

4.1.2.2.1 Develop and execute a test plan to validate that all implemented controls are effective and meet PCI DSS requirements.

4.1.2.2.2 Deliver comprehensive system documentation, including configuration guides and SOPs. The Contractor provides expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions.

4.1.2.2.3 Implementation Handover: Deliver a final report confirming successful deployment, operational readiness, and preparation for a formal PCI DSS assessment.

4.1.2.2.4 Gap Analysis Remediation Support: Remediate and close all gaps identified in the current assessment, coordinating with existing vendors and local IT teams as required to ensure successful resolution.

4.1.3 Phase 3: Operational Support & Sustainment (includes Option Years 1-4) The technical support model must be designed to provide both steady-state daily operations to up to 30 installations and flexible surge support for key activities such as assessment cycles, large-scale remediation efforts, and incident response events.

4.1.3.1 Technical Support and Monitoring

4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing vulnerability and compliance lifecycle.

4.1.3.1.2 Standard Operating Procedures (SOPs): Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.

4.1.3.1.3 24/7 Support Services: Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and

8 APR 2026

protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status.

4.1.3.2 PCI DSS Assessment Preparation Support

4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.

4.1.3.2.1.1 Evidence Gathering Support: Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

4.1.3.2.1.2 Assessment Readiness Review: A review of the base's security posture and documentation to ensure readiness for a PCI DSS assessment.

4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self- Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

4.1.3.3 Knowledge Transfer and Training

4.1.3.3.1 Training Materials: Comprehensive training materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

4.1.3.3.2 "Train-the-Trainer" Program: A program to train designated local staff to conduct ongoing PCI DSS training for new employees.

4.1.3.3.3 Ongoing Training: An annual training plan that includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials must be updated as needed to reflect any changes to the system or PCI DSS requirements.

8 APR 2026

4.1.3.4 Local Communication and Reporting

4.1.3.4.1 Project Management Plan: A detailed plan outlining the project scope, timelines, resources, and communication protocols.

4.1.3.4.2 Reporting Templates:

4.1.3.4.2.1 Remediation Implementation Reports: Reports

documenting the implementation of remediation measures, including patching, configuration changes, and security control updates.

4.1.3.4.2.2 Verification and Validation Reports: Reports confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

4.1.3.4.2.3 Quarterly Compliance Reports: Reports summarizing the solution's performance and adherence to PCI DSS controls.

4.1.3.4.2.4 Incident Response Assistance Reports: Reports

documenting assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.

4.2 AFSVC Status Reports/Meetings

4.2.1 Weekly Status Report - The Contractor must provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

4.2.1.1 A summary of all tasks and activities completed during the reporting period.

4.2.1.2 The percentage of completion for previously planned tasks.

4.2.1.3 A list of all planned tasks and activities for the next reporting period.

4.2.1.4 Any issues, risks, or problems affecting project progress, along with proposed resolutions.

4.2.2 Monthly Progress and Financial Report - Submitted with the monthly invoice, this report must be consistent with the submitted weekly reports and must also contain:

4.2.2.1 A summary of all contract funds expended during the reporting period.

4.2.2.2 A high-level overview of progress against the approved project schedule.

4.2.3 Quarterly Total Quality Management (TQM) Report - The contractor must provide a summary of quality management activities and metrics on a quarterly basis.

8 APR 2026

4.2.4 Meeting and Session Summaries - The contractor must provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.

4.3 Acceptance Criteria

All deliverables, technical services, and products must be functionally tested to ensure compatibility with Air Force systems. They must be approved by the Contracting Officer’s Representative (COR) and designated representatives from AFSVC before acceptance and must be capable of obtaining a viable assessment and authorization. Acceptance or rejection of named deliverables must occur within 14 business days after receipt by the COR.

4.3.1 Data Ownership: All data or work products generated in the support and development effort must be the property of AFSVC.

4.3.2 Acceptance or rejection of named deliverables must occur within 14 business days after receipt by the COR.

SECTION V

5.0 CONTRACT ADMINISTRATION

5.1 Schedule.

5.1.1 A detailed contract plan that must outline major tasks such as discovery/ramp up time, and environment configuration, validation/review, development and required support activities. The Contractor must deliver in accordance with (IAW) the approved schedule.

5.1.1.1 The Contractor must provide, at the scheduled kick-off meeting, a detailed contract plan (i.e. Gantt Chart) outlining major tasks such as discovery/ramp up time, environment configuration, validation/review, development and required support activities.

5.1.1.2 The Contractor must provide, thirty (30) days, after the kick-off meeting, a realistic detailed project plan outlining the tasks and subtasks for both the AF and the Contractor based on the deliverables and requirements listed in the SOO. Once the submitted plan/schedule is approved by the COR, the Contractor must deliver IAW the approved schedule.

5.1.1.3 All forecasted or unexpected delays to the schedule must be reported to the COR within one (1) business day of discovery. The Contractor must provide reason for delay and proposed resolutions to the COR no later than 1600 CST the same day.

5.1.1.4 If a delay occurs and is the result of Contractor error, the Contractor must submit a revised schedule to the COR for review and approval within two workdays of recognition of delay.

5.2 Resource Calendar.

8 APR 2026

5.2.1 At a minimum of 21 business days in advance, the Contractor must provide the COR, in writing, the projected days the Contractor’s resources must be unavailable. This information is necessary to help plan for critical support task/activities like patching, system upgrades but not limited to these activities.

This must allow AFSVC to coordinate and plan for resource availability.

5.3 Meetings.

5.3.1 Kick-Off Meeting. A kick-off meeting must be held after contract award on a date and time agreeable by both parties. The meeting must be held at the Place of Performance. The Contractor must designate a primary Point of Contact (POC) for the contract for the kick-off meeting.

5.3.2 Weekly Status Meetings.

5.3.2.1 The day and time of the weekly status meeting must be determined by the COR and the Contractor after contract award. Meetings must be held virtually unless otherwise coordinated between COR & Contractor.

5.3.2.2 Recommendations identified or discussed in meetings or collaborative sessions must be provided in writing within two (2) business days of initial recommendations. Contractor must provide any recommendations, alternate options, scenarios or configurations in writing in MS Word format or COR approved format.

5.4 Documentation. All recommendations, configurations, and guidance must be provided in writing in MS Word format or COR approved format.

5.4.1 Provide guidance and instruction for existing documentation provided such as setup and configuration documents.

5.4.2 Provide guidance and instruction to develop system documentation provided such as setup and configuration documents.

SECTION VI

6 6.0 GENERAL INFORMATION

6.0 GENERAL INFORMATION

6.1 Contracting Officer’s Representative (COR) Responsibilities.

6.1.1 The Contracting Officer (CO) must designate an individual as the COR.

6.1.2 The COR is responsible for monitoring the performance of work under this contract.

In no event must any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

6.1.3 This designation must remain in effect throughout the life of the contract, unless terminated sooner in writing by the CO or due to reassignment. Primary responsibilities of the COR may include, but are not limited to, the following:

6.1.3.1 The COR is responsible for performing post award administrative

8 APR 2026

functions necessary to ensure performance of services required by this contract. If the COR believes performance by the Contractor has not met the level required by the contract, the problem must be referred to the CO for resolution.

6.1.3.2 The COR must maintain and approve the list of all products required to be delivered by the Contractor as well as when the product is delivered and its acceptability status, this includes the project schedule.

6.1.3.3 The COR must maintain a record of all contract deliverables and a copy of the email message or cover letter used to deliver the deliverables.

6.1.3.4 The COR must work with CO to ensure the following responsibilities are adhered to:

6.1.3.4.1 Verify that the Contractor performs the technical requirements of the contract in accordance with the terms, conditions, and specifications therein. Specific emphasis must be placed on the quality provisions, for both adherences to the contract provisions and to the Contractor's own quality control program.

6.1.3.4.2 Perform acceptance for the customer of services performed under this contract.

6.1.3.4.3 Communication must be the key to success of this effort. Maintain liaison and direct communications with the Contractor and the CO.

Written communications with the Contractor and other documents pertaining to the contract must be signed by the COR and a copy must be furnished to the CO.

6.1.3.4.4 Monitor the Contractor's performance, notify the Contractor of deficiencies observed and direct appropriate action to effect correction. Record and report to the CO any incidents of faulty or non-conforming work, delays, or problems.

6.2 Place of Performance

6.2.1 3515 South General McMullen Bldg. 1, San Antonio, TX 78236-9854. Remote work is authorized for a majority of the contract, however in-office work may be required as recommended by COR and Contractor.

6.3 Government Furnished Equipment (GFE)

6.3.1 AFSVC must provide GFE-owned PCs to do the required work and to access the applications

6.4 Travel

6.4.1 Contractor must be required, at a minimum, to travel to San Antonio, TX to pick-up and turn-in Government Furnished Laptops (turn-in must include a Contract Closeout Meeting).

6.4.2 Travel to installations as necessary per the deliverables. All travel must be mutually coordinated and reimbursed by AFSVC in accordance with the Federal Travel

8 APR 2026

Regulations (FTR see Clause 29 of the SEC I – NAF Standard Clauses). Travel to installations is not expected to be full-time. Travel is authorized on an as-needed basis for efforts that cannot be completed remotely, such as providing hands-on support for physical audit preparations or complex implementations.

6.5 Identify Known or Possible Conflicts of Interest

6.6 Security and Training Requirements

6.6.1 Highest level: UNCLASSIFIED. The preponderance of work must be at the unclassified level.

6.6.2 Building Access. Unescorted access to AFSVC Building 1 is approved on a case-by-case basis and must be coordinated through the COR and AFSVC’s Security Manager.

6.6.3 Training. Cyber Awareness Challenge Training, Controlled Unclassified Information (CUI) Training (one-time) and Privileged User Cybersecurity Responsibilities (if server access is required). All Government training required must be provided at no cost by the Government.

6.7 Security Clearances

6.7.1 The Contractor shall ensure that personnel requiring access to AFSVC information systems, or its data have the proper and current cybersecurity certifications as determined by AFSVC cybersecurity teams to perform cybersecurity functions in accordance with DoDM 8140.03, Cyberspace Workforce Qualification and Management Program located at https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140- 03.pdf.

6.7.2 The Contractor shall meet the following contract/security clearance requirements, including:

6.7.2.1 The Contractor shall safeguard and comply with the rules and regulations issued under DoDI 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014; AFMAN 16-1405, Air Force Personnel Security Program; AFM 33-152, User Responsibilities and Guidance For Information Systems; DoDD 8500.01 security, 14 Mar 2014; AFI 17-130, Air Force Cybersecurity Program Management; and DoDM 8140.03, Information Assurance Workforce Improvement Program requirements and respective updates to the listed rules and regulations.

The Contractor shall follow the DoD Privacy Office guidelines for submittal of Information Assurance Technical (IAT) security clearances

6.7.2.2 Contractor personnel shall not be assigned to perform duties within IAT-II or IAT-III, and or requiring “Limited Privileged Access” such as system or database administration rights, to any NAFI application or network.

6.7.3 Tier 1 requests are initiated using the Standard Form (SF) 85. Tier 3 requests are initiated using the Standard Form (SF) 86 and are submitted to the installation Information Protection Office through the Unit Security Manager.

The initiation of the Tier 1 or Tier 3 shall include the submission of all required https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf

8 APR 2026

information and verified through the Department of Defense (DoD) Defense Information System for Security (DISS) database. The Contractor shall comply with the rules and regulations under DMDC Trusted Associate Sponsor System Overview Guide, Version 5.7, Sept 2018 and associated updates; all Common Access Card (CAC) holders must, at minimum, have an initiated a favorable completion of an FBI fingerprint check, or a DoD determined equivalent investigation. The NAFI may grant a waiver to allow the Contractor to start work after submitting all required information, passing a successful FBI fingerprint check and DISS.

6.7.4 All Contractor personnel requiring system access must be adjudicated with a Favorable determination in DISS.

6.7.5. All Contractor personnel requiring system access must sign a non-disclosure agreement.

6.7.6. All Contractor personnel requiring system access must respond to the AFSVC Security Manager’s inquiries within three business days (excluding federal holidays), not to exceed 72 hours. If Contractor personnel do not respond to the AFSVC Security Manager’s inquiries within three business days, their non-action on this matter provides grounds for termination.

6.8 Privacy Act

6.8.1 The Contractor shall safeguard and comply with the agency rules and regulations issued under Public Law 110-53 (42 U.S.C. § 2000ee- 1) Section 803; Department of the Air Force Policy Directive (DAFPD) 33-3, Information Access Programs; Department of Defense Instruction (DoDI) 5400.11, DoD Privacy and Civil Liberties Programs; DoD 5400.11-R, Department of Defense Privacy Program; Department of Defense Instruction (DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance; DoDI 1000.30, Reduction of Social Security Number (SSN) Use Within DoD; the Privacy Act of 1974 (5 U.S.C. § 552a); the E-Government Act of 2002 (44 U.S.C. 3601 et seq.); Office of Management and Budget (OMB) Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information; and AFI 33-332, AF Privacy and Civil Liberties Program and associated updates to the agency rules and regulations. Penalties are applied for misuse or unauthorized disclosure of PII. The Act (5 U.S.C. 552a) provides for civil remedies for injured parties, including actual damages, attorney fees, and litigation costs.

6.9 Cybersecurity

6.9.1 Where applicable, the Contractor shall ensure all components in the contractor solution, any applications that process, store, and/or transmit credit card information/cardholder data are thoroughly assessed and meet the most current version of the Payment Card Industry Data Security Standards (PCI DSS). The solution must meet all PCI DSS compliance requirements identified by the Payment Card Industry Security Standards Council. The Contractor shall provide to the NAFI sufficient

8 APR 2026

evidence of PCI DSS Compliance certification regarding the solution’s PCI DSS compliance status. All contractor activities must maintain strict adherence to PCI DSS v4.0.1 or later requirements including:

• Implementation of all applicable security testing procedures per Requirement 11

• Maintenance of secure coding practices per Requirement 6.2.4

• Regular security awareness training per Requirement 12.6

• Incident response procedures per Requirement 12.10

6.9.2 Federal Cybersecurity Standards:

• Compliance with NIST SP 800-53 security controls

• Implementation of CISA cybersecurity directives

• Adherence to DoD 8500 series information assurance requirements

• Integration with DoD Risk Management Framework (RMF) processes

6.9.3 Continuous Monitoring:

• Real-time security monitoring capabilities

• Automated compliance validation tools

• Regular penetration testing and vulnerability assessments

• Continuous network segmentation validation

6.10 Security Education, Training and Awareness (SETA) and Operations Security (OPSEC) Training

6.10.1 Contractor employees must complete initial and annual refresher SETA and OPSEC training within five days of on-boarding for initial, and annually as dictated by the unit security manager.

6.11 Data Stewardship and Governance

6.11.1 The NAFI must have unlimited rights to all technical data unless the Contractor takes specific actions and includes prescribed legends in their submission, and/or data products to limit or restrict such NAFI rights for particular identified items. “Technical data” refers to recorded information and includes, but is not limited to, research and engineering data and drawings, specifications, standards, process sheets, manuals, technical reports and computer software documentation. It does not include computer software or financial, cost/pricing or other contract and grant administrative data but does include any developed intellectual property not specific to the data.

6.11.2 Data and information generated during this agreement is owned by the NAFI. Data must be physically separated from the data of other users, on separate drives or computers, and appropriate firewalls must be established to prevent other users from accessing NAFI data.

8 APR 2026

6.11.3. Should the NAFI elect not to execute option years or at the end of the contract period, whichever is sooner, data must at all times be promptly accessible until converted to the new system with no additional separation fee.

6.12 Cardholder Data Protection

6.12.1 The contractor shall implement strong cryptography and security protocols per PCI DSS Requirements 3 and 4

6.12.2 All cardholder data access must be logged and monitored per Requirement 10

6.12.3 Data retention and disposal procedures must comply with Requirement 3.2

6.12.4 Any suspected security incidents must be reported within 1 hour to the COR

SECTION VII

7.0 APPENDIX

7.1 DEFINITIONS & ABBREVIATIONS

Contracting Officer (CO). The duly appointed Government agent authorized to award or administer contracts. The contracting officer is the only person authorized to contractually obligate the Government.

Contracting Officer’s Representative (COR). The COR is responsible for monitoring the performance of work under this contract. The COR has no authority to approve or execute any modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

Statement of Objective (SOO). A formal contracting document used to describe the goals and objectives expected from soliciting Contractor work.

8 APR 2026

7.2 ACRONYMS

AFSVC - Air Force Services Center CC – Commander CO – Contracting Officer CONUS – Continental United States COR – Contracting Officer Representative DAF – Department of the Air Force DISS - Defense Information System for Security (legacy JPAS) DOD - Department of Defense FTE – Full Time Equivalents GFE – Government Furnished Equipment NAFI – Non-appropriated Fund Instrumentality OCONUS – Outside the Continental United States PCI DSS – Payment Card Industry Data Security Standards PCI SSC – Payment Card Industry Security Standards Council POC - Point of Contact POS – Point of Sale QSA – Qualified Security Assessor RASCI - Responsible, Accountable, Supporting, Consulted and Informed ROC – Report on Compliance ROI – Return on Investment SAQ – Self Assessment Questionnaire SOO – Statement of Objectives TQM – Total Quality Management VF – Financial Management & Comptroller Directorate VBL - Lodging VI- Installation Support Division VM - Mission Operations Directorate VP – NAF Procurement Directorate VT – Business Information Technology Systems Directorate

7.3 Sample Weekly Status Reports or as agreed upon by COR

7.4 Sample Contract Progress Report

8 APR 2026

7.5 NAFI Observed Holidays

Holiday

*New Year's Day: January 1st

Martin Luther King Jr. Day: Third Monday in January

Presidents' Day: Third Monday in February

Memorial Day: Last Monday in May

*Juneteenth National Independence Day: June 19th

*Independence Day: July 4th

Labor Day: First Monday in September

Columbus Day: Second Monday in October

*Veterans Day: November 11th

Thanksgiving Day: Fourth Thursday in November

*Christmas Day: December 25th

*(observed on the following Monday if holiday falls on a Sunday, or on the preceding Friday if the holiday falls on a Saturday)