ATCH 05 Supplies Services and Prices 8 Apr 2026.pdf
PDF 244 KB Posted
- Attached to
- PCI DSS Compliance Technical Support
- Solicitation number
- F41999-26-Q-0055
About this file
This is a Supplies, Services and Prices attachment for a PCI Compliance Technical Support & Sustainment Services contract dated 8 April 2026. The contract is structured in four phases across a base year and four option years, with CLINs (Contract Line Item Numbers) organized to support PCI DSS (Payment Card Industry Data Security Standard) compliance for Air Force Service Venues Command (AFSVC) installations.
Phase One includes gap analysis, executive summaries, and solution implementation strategy development targeting an August 2026 completion date. Phase Two encompasses system deployment, testing plan development, documentation, implementation handover, and gap remediation support. Phase Three spans ongoing operational support including vulnerability scanning and penetration testing for up to 30 installations, 24/7 support services with SLA requirements, PCI DSS compliance attestation support, evidence gathering, assessment readiness reviews, SAQ/ROC preparation assistance, training materials development, train-the-trainer programs, and comprehensive reporting (weekly status, monthly financial, quarterly compliance, and incident response reports). All services are priced as SV (Services) units. The contract includes four option years with identical service deliverables repeating the Phase Three scope. Travel costs are reimbursable per Federal Travel Regulation (FTR) and provided when requested by the Contracting Officer or Contracting Officer's Representative. Critical service requirements include 24/7 remote support with cost-efficient staffing models, mandatory security incident reporting to AFSVC within one hour of contractor awareness, and comprehensive documentation including configuration guides and SOPs delivered with hands-on guidance while government personnel execute privileged actions.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATCH 05 - SUPPLIES, SERVICES AND PRICES
PCI Compliance Technical Support & Sustainment Services
8 APR 2026
SUPPLIES, SERVICES AND PRICES
1. GENERAL
The Contractor will provide the experience necessary to complete the task outlined in the Statement of Objectives (SOO). The Contractor will utilize established policies, standards, and sound management principles in the performance of the SOO requirements and deliverables.
Description Unit Total Price
PHASE ONE (1)
CLIN 0001
4.1.1.1 Gap Analysis and Solution: Assess the CDE to
perform a technical gap analysis focused specifically on identifying the security tools and services required to complete the enterprise security suite. This analysis is not a formal PCI DSS assessment or scope-reduction exercise.
The contractor shall deliver a formal report detailing recommendations for a complete tool suite (e.g., SIEM, DLP, MFA) and how these tools must integrate into a centralized reporting framework. The contractor is expected to collaborate with the Government’s designated QSA firm but not to perform QSA functions.
SV
(Services)
CLIN 0002
4.1.1.2 High-Level Executive Summary: Deliver a summary
of key findings and recommendations for the required security tools and services to comply with PCI DSS. The contractor will prioritize the use of modern, automated, and cloud-based tools and services.
SV
CLIN 0003
4.1.1.3 Solution Implementation Strategy: The Contractor
will deliver a Solution Implementation Strategy document.
This document will serve as the foundational plan and must include:
4.1.1.3.1 Recommendations for a complete enterprise tool
suite to be deployed specifically within the CDE at each respective installation. The strategy must also detail how these tools will integrate into a centralized reporting framework to provide a comprehensive, enterprise-level view of the security and compliance posture.
4.1.1.3.2 A detailed cost analysis for all recommended
tools.
4.1.1.3.3 A high-level implementation plan that defines the
necessary steps, resource requirements, and a project timeline with a target initial completion date of August 2026.
PHASE TWO (2)
CLIN 0004
4.1.2.1 System Deployment: Install, configure, and ensure
proper integration of all approved security tools and services into the existing AFSVC CDE infrastructure.
SV
CLIN 0005
4.1.2.2.1 Develop and execute a test plan to validate that all implemented controls are effective and meet PCI DSS requirements.
SV
CLIN 0006
4.1.2.2.2 Deliver comprehensive system documentation, including configuration guides and SOPs. The Contractor provides expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions.
SV
CLIN 0007
4.1.2.2.3 Implementation Handover: Deliver a final report
confirming successful deployment, operational readiness, and preparation for a formal PCI DSS assessment.
SV
CLIN 0008
4.1.2.2.4 Gap Analysis Remediation Support: Remediate and
close all gaps identified in the current assessment, coordinating with existing vendors and local IT teams as required to ensure successful resolution.
CLIN 0009
4.1.3.1.1 Scanning and Penetration Testing Support:
Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.
SV
CLIN 0010
4.1.3.1.2 Standard Operating Procedures (SOPs):
Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.
SV
CLIN 0011
4.1.3.1.3 24/7 Support Services: Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support will be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors will include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status.
CLIN 0012
4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver
support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.
SV
CLIN 0013
4.1.3.2.1.1 Evidence Gathering Support: Support in
gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.
SV
CLIN 0014
4.1.3.2.1.2 Assessment Readiness Review: A review of the
base's security posture and documentation to ensure readiness for a PCI DSS assessment.
SV
CLIN 0015
4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration
with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self-Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).
SV
CLIN 0016
4.1.3.3.1 Training Materials: Comprehensive training
materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.
SV
CLIN 0017
4.1.3.3.2 "Train-the-Trainer" Program: A program to train designated local staff to conduct ongoing PCI DSS training for new employees.
CLIN 0018
4.1.3.3.3 Ongoing Training: An annual training plan that
includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.
SV
CLIN 0019
4.1.3.4.1 Project Management Plan: A detailed plan
outlining the project scope, timelines, resources, and communication protocols.
SV
CLIN 0020
4.1.3.4.2.1 Remediation Implementation Reports: Reports
documenting the implementation of remediation measures, including patching, configuration changes, and security control updates.
SV
CLIN 0021
4.1.3.4.2.2 Verification and Validation Reports: Reports
confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.
SV
CLIN 0022
4.1.3.4.2.3 Quarterly Compliance Reports: Reports
summarizing the solution's performance and adherence to PCI DSS controls.
SV
CLIN 0023
4.1.3.4.2.4 Incident Response Assistance Reports: Reports
documenting assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.
SV
CLIN 0024
4.2.1 Weekly Status Report - The Contractor will provide a
weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:
4.2.1.1 A summary of all tasks and activities completed
during the reporting period.
4.2.1.2 The percentage of completion for previously
planned tasks.
4.2.1.3 A list of all planned tasks and activities for the next reporting period.
4.2.1.4 Any issues, risks, or problems affecting project
progress, along with proposed resolutions.
CLIN 0025
4.2.2 Monthly Progress and Financial Report - Submitted
with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:
4.2.2.1 A summary of all contract funds expended during
the reporting period.
4.2.2.2 A high-level overview of progress against the
approved project schedule.
SV
CLIN 0026
4.2.3 Quarterly Total Quality Management (TQM) Report -
The contractor will provide a summary of quality management activities and metrics on a quarterly basis.
SV
CLIN 0027
4.2.4 Meeting and Session Summaries - The contractor will
provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.
SV
Base Year Subtotal SV
PHASE THREE (3)
OPTION YEAR ONE (1)
CLIN 1001
4.1.3.1.1 Scanning and Penetration Testing Support:
Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.
SV
CLIN 1002
4.1.3.1.2 Standard Operating Procedures (SOPs):
Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.
CLIN 1003
4.1.3.1.3 24/7 Support Services: Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status
CLIN 1004
4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver
support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.
CLIN 1005
4.1.3.2.1.1 Evidence Gathering Support: Support in
gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.
CLIN 1006
4.1.3.2.1.2 Assessment Readiness Review: A review of the
base's security posture and documentation to ensure readiness for a PCI DSS assessment.
CLIN 1007
4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration
with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self-Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).
CLIN 1008
4.1.3.3.1 Training Materials: Comprehensive training
materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.
CLIN 1009
4.1.3.3.2 "Train-the-Trainer" Program: A program to train designated local staff to conduct ongoing PCI DSS training
CLIN 1010
4.1.3.3.3 Ongoing Training: An annual training plan that
includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.
CLIN 1011
4.1.3.4.1 Project Management Plan: A detailed plan
outlining the project scope, timelines, resources, and communication protocols.
CLIN 1012
4.1.3.4.2.1 Remediation Implementation Reports: Reports
documenting the implementation of remediation measures, including patching, configuration changes, and security control updates.
CLIN 1013
4.1.3.4.2.2 Verification and Validation Reports: Reports
confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.
CLIN 1014
4.1.3.4.2.3 Quarterly Compliance Reports: Reports
summarizing the solution's performance and adherence to PCI DSS controls.
CLIN 1015
4.1.3.4.2.4 Incident Response Assistance Reports: Reports
documenting assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.
CLIN 1016
4.2.1 Weekly Status Report - The Contractor will provide a
weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:
4.2.1.1 A summary of all tasks and activities completed
during the reporting period.
4.2.1.2 The percentage of completion for previously
planned tasks.
4.2.1.3 A list of all planned tasks and activities for the next reporting period.
4.2.1.4 Any issues, risks, or problems affecting project
CLIN 1017
with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:
4.2.2.1 A summary of all contract funds expended during
the reporting period.
4.2.2.2 A high-level overview of progress against the
approved project schedule.
CLIN 1018
4.2.3 Quarterly Total Quality Management (TQM) Report -
The contractor will provide a summary of quality management activities and metrics on a quarterly basis.
CLIN 1019
4.2.4 Meeting and Session Summaries - The contractor will
provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.
Option Year One (1) Subtotal
OPTION YEAR TWO (2)
CLIN 2001
4.1.3.1.1 Scanning and Penetration Testing Support:
Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.
CLIN 2002
4.1.3.1.2 Standard Operating Procedures (SOPs):
Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident
CLIN 2003
support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support will be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors will include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents.
A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status.
CLIN 2004
support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial
CLIN 2005
4.1.3.2.1.1 Evidence Gathering Support: Support in
CLIN 2006
4.1.3.2.1.2 Assessment Readiness Review: A review of the
CLIN 2007
4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration
with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, CLIN 2008 materials covering PCI DSS requirements, security best
CLIN 2009
4.1.3.3.2 "Train-the-Trainer" Program: A program to train
CLIN 2010
4.1.3.3.3 Ongoing Training: An annual training plan that
includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials
CLIN 2011
CLIN 2012
4.1.3.4.2.1 Remediation Implementation Reports: Reports
documenting the implementation of remediation measures, CLIN 2013
4.1.3.4.2.2 Verification and Validation Reports: Reports
confirming that implemented remediation measures have
CLIN 2014
4.1.3.4.2.3 Quarterly Compliance Reports: Reports
CLIN 2015
4.1.3.4.2.4 Incident Response Assistance Reports: Reports
documenting assistance provided during security incidents
CLIN 2016
4.2.1 Weekly Status Report - The Contractor will provide a
weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:
4.2.1.1 A summary of all tasks and activities completed
during the reporting period.
4.2.1.2 The percentage of completion for previously
planned tasks.
4.2.1.3 A list of all planned tasks and activities for the next reporting period.
CLIN 2017
with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:
4.2.2.1 A summary of all contract funds expended during
the reporting period.
CLIN 2018
CLIN 2019
4.2.4 Meeting and Session Summaries - The contractor will
provide documented recommendations, system
Option Year 2 Subtotal
OPTION YEAR THREE (3)
CLIN 3001
4.1.3.1.1 Scanning and Penetration Testing Support:
Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset
CLIN 3002
Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident
CLIN 3003
support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status
CLIN 3004
support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial
CLIN 3005
4.1.3.2.1.1 Evidence Gathering Support: Support in
CLIN 3006
4.1.3.2.1.2 Assessment Readiness Review: A review of the
CLIN 3007
4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration
with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, CLIN 3008 materials covering PCI DSS requirements, security best
CLIN 3009
4.1.3.3.2 "Train-the-Trainer" Program: A program to train
CLIN 3010
4.1.3.3.3 Ongoing Training: An annual training plan that
includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials
CLIN 3011
CLIN 3012
4.1.3.4.2.1 Remediation Implementation Reports: Reports
documenting the implementation of remediation measures, CLIN 3013
4.1.3.4.2.2 Verification and Validation Reports: Reports
confirming that implemented remediation measures have
CLIN 3014
4.1.3.4.2.3 Quarterly Compliance Reports: Reports
CLIN 3015
4.1.3.4.2.4 Incident Response Assistance Reports: Reports
documenting assistance provided during security incidents
CLIN 3016
4.2.1 Weekly Status Report - The Contractor will provide a
weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:
4.2.1.1 A summary of all tasks and activities completed
during the reporting period.
4.2.1.2 The percentage of completion for previously
planned tasks.
4.2.1.3 A list of all planned tasks and activities for the next reporting period.
CLIN 3017
4.2.2 Monthly Progress and Financial Report - Submitted
with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:
4.2.2.1 A summary of all contract funds expended during
the reporting period.
CLIN 3018
CLIN 3019
4.2.4 Meeting and Session Summaries - The contractor will
provide documented recommendations, system
Option Year 3 Subtotal
OPTION FOUR (4)
CLIN 4001
4.1.3.1.1 Scanning and Penetration Testing Support:
Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset
CLIN 4002
Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.
SV
CLIN 4003
4.1.3.1.3 24/7 Support Services: Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status
CLIN 4004
4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver
support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.
SV
CLIN 4005
4.1.3.2.1.1 Evidence Gathering Support: Support in
gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.
SV
CLIN 4006
4.1.3.2.1.2 Assessment Readiness Review: A review of the
base's security posture and documentation to ensure readiness for a PCI DSS assessment.
SV
CLIN 4007
4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration
with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self-Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).
SV
CLIN 4008
4.1.3.3.1 Training Materials: Comprehensive training
materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.
SV
CLIN 4009
4.1.3.3.2 "Train-the-Trainer" Program: A program to train designated local staff to conduct ongoing PCI DSS training for new employees.
SV
CLIN 4010
4.1.3.3.3 Ongoing Training: An annual training plan that
includes refresher sessions for AFSVC personnel and comprehensive training for new staff. Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.
SV
CLIN 4011
4.1.3.4.1 Project Management Plan: A detailed plan
outlining the project scope, timelines, resources, and
CLIN 4012
4.1.3.4.2.1 Remediation Implementation Reports: Reports
documenting the implementation of remediation measures, including patching, configuration changes, and security control updates.
SV
CLIN 4013
4.1.3.4.2.2 Verification and Validation Reports: Reports
confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.
SV
CLIN 4014
4.1.3.4.2.3 Quarterly Compliance Reports: Reports
summarizing the solution's performance and adherence to PCI DSS controls.
SV
CLIN 4015
4.1.3.4.2.4 Incident Response Assistance Reports: Reports
documenting assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.
SV
CLIN 4016
4.2.1 Weekly Status Report - The Contractor will provide a
weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:
4.2.1.1 A summary of all tasks and activities completed
during the reporting period.
4.2.1.2 The percentage of completion for previously
planned tasks.
4.2.1.3 A list of all planned tasks and activities for the next reporting period.
4.2.1.4 Any issues, risks, or problems affecting project
progress, along with proposed resolutions.
SV
CLIN 4017
4.2.2 Monthly Progress and Financial Report - Submitted
with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:
4.2.2.1 A summary of all contract funds expended during
the reporting period.
4.2.2.2 A high-level overview of progress against the
approved project schedule.
SV
CLIN 4018
4.2.3 Quarterly Total Quality Management (TQM) Report -
The contractor will provide a summary of quality management activities and metrics on a quarterly basis.
SV
CLIN 4019
4.2.4 Meeting and Session Summaries - The contractor will
provide documented recommendations, system configurations, and guidance identified or discussed during
Option Year 4 Subtotal SV
TOTAL
PRICE
Travel (Labor Category and Daily Cost) SV
Travel (Base Years and Option Years) SV
Travel will be provided by Contractor when requested by the CO or the COR
NOTES: Travel cost will be paid in accordance with the Federal Travel Regulation (FTR) https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation-ftr (see Travel Clause, Paragraph 29 of the NAF Standard Clauses).
This form can be adjusted as needed.
https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation-ftr
WARD, WHITNEY CIV USAF AFMC AFSVC/VPEB
Include with pricing proposal
File details come from the government source that posted it. Updated .