ATCH 07 Deliveries or Performances 8 Apr 2026.pdf

ATCH 07 - DELIVERIES OR PERFORMANCES

PCI Compliance Technical Support & Sustainment Services

8 APR 2026

DELIVERIES OR PERFORMANCES

1. Period of Performance (twelve months after receipt of award).

1.1. The NAFI requires delivery to be made according to the following schedule:

DELIVERY SCHEDULE

Payment Card Industry (PCI) Data Security Standard (DSS) Compliance Technical Support Team

CLIN Description NAFI Proposed Delivery Schedule

Contractor Proposed Delivery Schedule

PHASE ONE (1)

0001 4.1.1.1 Gap Analysis and Solution Recommendations: Assess the CDE to perform a technical gap analysis focused specifically on identifying the security tools and services required to complete the enterprise security suite. This analysis is not a formal PCI DSS assessment or scope-reduction exercise.

The contractor shall deliver a formal report detailing recommendations for a complete tool suite (e.g., SIEM, DLP, MFA) and how these tools must integrate into a centralized reporting framework. The contractor is expected to collaborate with the Government’s designated QSA firm but not to perform QSA functions.

Within 30 days of contract award.

Contractor Proposed Delivery Schedule

0002 4.1.1.2 High-Level Executive Summary:

Deliver a summary of key findings and recommendations for the required security tools and services to comply with PCI DSS. The contractor will prioritize the use of modern, automated, and cloud-based tools and services.

Within 45 days of

0003 4.1.1.3 Solution Implementation Strategy: The Contractor will deliver a Solution Implementation Strategy document. This document will serve as the foundational plan and must include:

4.1.1.3.1 Recommendations for a

complete enterprise tool suite to be deployed specifically within the CDE at each respective installation. The strategy must also detail how these tools must integrate into a centralized reporting framework to provide a comprehensive, enterprise-level view of the security and compliance posture.

4.1.1.3.2 A detailed cost analysis for all

recommended tools.

4.1.1.3.3 A high-level implementation

plan that defines the necessary steps, resource requirements, and a project timeline with a target initial completion date of August 2026.

Within 60 days of

Contractor Proposed Delivery Schedule

PHASE TWO (2)

0004 4.1.2.1 System Deployment: Install, configure, and ensure proper integration of all approved security tools and services into the existing AFSVC CDE infrastructure.

By 30 August 2026.

0005 4.1.2.2.1 Develop and execute a test plan to validate that all implemented controls are effective and meet PCI DSS requirements.

Within 75 days of

0006 4.1.2.2.2 Deliver comprehensive system documentation, including configuration guides and SOPs. The Contractor provides expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions.

By 31 July 2026.

0007 4.1.2.2.3 Implementation Handover:

Deliver a final report confirming successful deployment, operational readiness, and preparation for a formal PCI DSS assessment.

By 31 July 2026.

0008 4.1.2.2.4 Gap Analysis Remediation Support: Remediate and close all gaps identified in the current assessment, coordinating with existing vendors and local IT teams as required to ensure successful resolution.

By 31 July 2026.

0009 4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30

Ongoing, beginning within 60 days of contract award. (we need until June/ July to finish upgrades for scan results and

Contractor Proposed Delivery Schedule installations, managing the vulnerability and compliance lifecycle.

monitoring to be accurate)

0010 4.1.3.1.2 Standard Operating Procedures (SOPs): Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.

Ongoing, beginning within 90 days of

0011 4.1.3.1.3 24/7 Support Services:

Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support will be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors will include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status.

Ongoing, beginning within 90 days of

0012 4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver support to local teams and assistance to the Qualified Security Assessor with all aspects of

Ongoing, beginning within 60 days of

Contractor Proposed Delivery Schedule assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.

0013 4.1.3.2.1.1 Evidence Gathering Support:

Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

Ongoing, beginning

001 4.1.3.2.1.2 Assessment Readiness Review: A review of the base's security posture and documentation to ensure readiness for a PCI DSS assessment.

Ongoing, beginning

0015 4.1.3.2.2 SAQ/ROC Preparation Assistance: Collaboration with a QSA vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self- Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

Ongoing, beginning

0016 4.1.3.3.1 Training Materials:

Comprehensive training materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

Ongoing, beginning by 30 August 2026.

0017 4.1.3.3.2 "Train-the-Trainer" Program:

A program to train designated local staff to conduct ongoing PCI DSS training for new employees.

Ongoing, beginning by 30 August 2026.

Contractor Proposed Delivery Schedule

0018 4.1.3.3.3 Ongoing Training: An annual training plan that includes refresher sessions for AFSVC personnel and comprehensive training for new staff.

Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.

Initial by 30 August 2026.

Ongoing, assess and update training materials, completed by 30 March, annually.

0019 4.1.3.4.1 Project Management Plan: A detailed plan outlining the project scope, timelines, resources, and communication protocols.

Within 60 days of

0020 4.1.3.4.2.1 Remediation Implementation Reports: Reports documenting the implementation of remediation measures, including patching, configuration changes, and security control updates.

By 30 August 2026.

0021 4.1.3.4.2.2 Verification and Validation Reports: Reports confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

By 30 August 2026.

0022 4.1.3.4.2.3 Quarterly Compliance Reports: Reports summarizing the solution's performance and adherence to PCI DSS controls.

Ongoing, quarterly

0023 4.1.3.4.2.4 Incident Response Assistance Reports: Reports documenting assistance provided during security incidents (if any), including

Ongoing, beginning within 120 days of

Contractor Proposed Delivery Schedule containment, eradication, and recovery procedures.

0024 4.2.1 Weekly Status Report - The Contractor will provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

4.2.1.1 A summary of all tasks and

activities completed during the reporting period.

4.2.1.2 The percentage of completion for

previously planned tasks.

4.2.1.3 A list of all planned tasks and

activities for the next reporting period.

4.2.1.4 Any issues, risks, or problems

affecting project progress, along with proposed resolutions.

Weekly, beginning within 30 days of

0025 4.2.2 Monthly Progress and Financial Report - Submitted with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:

4.2.2.1 A summary of all contract funds

expended during the reporting period.

4.2.2.2 A high-level overview of

progress against the approved project schedule.

Monthly, beginning within 30 days of

Contractor Proposed Delivery Schedule

0026 4.2.3 Quarterly Total Quality Management (TQM) Report - The contractor will provide a summary of quality management activities and metrics on a quarterly basis.

Quarterly, beginning within 90 days of contract award.

0027 4.2.4 Meeting and Session Summaries - The contractor will provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.

Ongoing, beginning within 15 days of

PHASE THREE (3)

OPTION YEAR ONE

1001 4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.

Ongoing, monthly at a minimum.

1002 4.1.3.1.2 Standard Operating Procedures (SOPs): Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as

Ongoing, annually and as needed.

Contractor Proposed Delivery Schedule vulnerability scanning, incident response, and system patching.

1003 4.1.3.1.3 24/7 Support Services:

Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status

Ongoing, 24/7 as needed.

1004 4.1.3.2.1 Initial PCI DSS Compliance teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.

Ongoing, annually for Aug/Sep Audits

Contractor Proposed Delivery Schedule

1005 4.1.3.2.1.1 Evidence Gathering Support:

Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

Ongoing, annually

1006 4.1.3.2.1.2 Assessment Readiness posture and documentation to ensure readiness for a PCI DSS assessment.

Ongoing, annually

1007 4.1.3.2.2 SAQ/ROC Preparation vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self- Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

Ongoing, annually

1008 4.1.3.3.1 Training Materials:

covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

Ongoing, quarterly to annual reviews.

1009 4.1.3.3.2 "Train-the-Trainer" Program:

to conduct ongoing PCI DSS training for new employees.

1010 4.1.3.3.3 Ongoing Training: An annual training plan that includes refresher sessions for AFSVC personnel and comprehensive training for new staff.

Training materials will be updated as

Contractor Proposed Delivery Schedule needed to reflect any changes to the system or PCI DSS requirements.

1011 4.1.3.4.1 Project Management Plan: A detailed plan outlining the project scope, timelines, resources, and communication protocols.

1012 4.1.3.4.2.1 Remediation Implementation implementation of remediation measures, including patching, configuration changes, and security control updates.

Ongoing, weekly as support is provided.

1013 4.1.3.4.2.2 Verification and Validation Reports: Reports confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

1014 4.1.3.4.2.3 Quarterly Compliance Reports: Reports summarizing the solution's performance and adherence to PCI DSS controls.

1015 4.1.3.4.2.4 Incident Response Assistance Reports: Reports documenting assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.

Contractor Proposed Delivery Schedule

1016 4.2.1 Weekly Status Report - The Contractor will provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

Ongoing, weekly.

1017 4.2.1.1 A summary of all tasks and activities completed during the reporting period.

Ongoing, weekly.

1018 4.2.1.2 The percentage of completion for previously planned tasks.

Ongoing, weekly.

1019 4.2.1.3 A list of all planned tasks and activities for the next reporting period.

Ongoing, monthly or quarterly, as agreed upon.

OPTION YEAR TWO (2)

2001 4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.

2002 4.1.3.1.2 Standard Operating Procedures implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as

Contractor Proposed Delivery Schedule vulnerability scanning, incident response, and system patching.

2003 4.1.3.1.3 24/7 Support Services:

Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status

2004 4.1.3.2.1 Initial PCI DSS Compliance teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.

Ongoing, annually

Contractor Proposed Delivery Schedule

2005 4.1.3.2.1.1 Evidence Gathering Support:

Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

Ongoing, annually

2006 4.1.3.2.1.2 Assessment Readiness posture and documentation to ensure readiness for a PCI DSS assessment.

Ongoing, annually

2007 4.1.3.2.2 SAQ/ROC Preparation vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self- Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

Ongoing, annually

2008 4.1.3.3.1 Training Materials:

covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

2009 4.1.3.3.2 "Train-the-Trainer" Program:

to conduct ongoing PCI DSS training for new employees.

2010 4.1.3.3.3 Ongoing Training: An annual sessions for AFSVC personnel and comprehensive training for new staff.

Training materials will be updated as

Contractor Proposed Delivery Schedule needed to reflect any changes to the system or PCI DSS requirements.

2011 4.1.3.4.1 Project Management Plan: A detailed plan outlining the project scope, timelines, resources, and communication protocols.

2012 4.1.3.4.2.1 Remediation Implementation implementation of remediation measures, including patching, configuration changes, and security control updates.

2013 4.1.3.4.2.2 Verification and Validation implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

2014 4.1.3.4.2.3 Quarterly Compliance solution's performance and adherence to PCI DSS controls.

2015 4.1.3.4.2.4 Incident Response Assistance assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.

Contractor Proposed Delivery Schedule

2016 4.2.1 Weekly Status Report - The Contractor will provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

4.2.1.1 A summary of all tasks and

activities completed during the reporting period.

4.2.1.2 The percentage of completion for

previously planned tasks.

4.2.1.3 A list of all planned tasks and

activities for the next reporting period.

4.2.1.4 Any issues, risks, or problems

affecting project progress, along with proposed resolutions.

Ongoing, weekly.

2017 4.2.2 Monthly Progress and Financial Report - Submitted with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:

4.2.2.1 A summary of all contract funds

expended during the reporting period.

4.2.2.2 A high-level overview of

progress against the approved project schedule.

Ongoing, weekly.

2018 4.2.3 Quarterly Total Quality Management (TQM) Report - The contractor will provide a summary of quality management activities and metrics on a quarterly basis.

Ongoing, weekly.

2019 4.2.4 Meeting and Session Summaries - The contractor will provide documented recommendations, system configurations, and guidance identified

Ongoing, monthly

Contractor Proposed Delivery Schedule or discussed during meetings and collaborative sessions.

OPTION YEAR THREE (3)

3001 4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.

3002 4.1.3.1.2 Standard Operating Procedures implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.

3003 4.1.3.1.3 24/7 Support Services:

that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), Contractor Proposed Delivery Schedule which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status

3004 4.1.3.2.1 Initial PCI DSS Compliance Attestation: Deliver support to local teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including evidence of implemented controls and supporting documentation.

Ongoing, annually

3005 4.1.3.2.1.1 Evidence Gathering Support:

Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

Ongoing, annually

3006 4.1.3.2.1.2 Assessment Readiness posture and documentation to ensure readiness for a PCI DSS assessment.

Ongoing, annually

3007 4.1.3.2.2 SAQ/ROC Preparation vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self-

Ongoing, annually

Contractor Proposed Delivery Schedule

Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

3008 4.1.3.3.1 Training Materials:

Comprehensive training materials covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

3009 4.1.3.3.2 "Train-the-Trainer" Program:

to conduct ongoing PCI DSS training for new employees.

3010 4.1.3.3.3 Ongoing Training: An annual sessions for AFSVC personnel and comprehensive training for new staff.

Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.

3011 4.1.3.4.1 Project Management Plan: A timelines, resources, and communication protocols.

3012 4.1.3.4.2.1 Remediation Implementation implementation of remediation measures, including patching, configuration changes, and security control updates.

Contractor Proposed Delivery Schedule

3013 4.1.3.4.2.2 Verification and Validation Reports: Reports confirming that implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

3014 4.1.3.4.2.3 Quarterly Compliance solution's performance and adherence to PCI DSS controls.

3015 4.1.3.4.2.4 Incident Response Assistance assistance provided during security incidents (if any), including containment, eradication, and recovery procedures.

3016 4.2.1 Weekly Status Report - The Contractor will provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

4.2.1.1 A summary of all tasks and

activities completed during the reporting period.

4.2.1.2 The percentage of completion for

previously planned tasks.

4.2.1.3 A list of all planned tasks and

activities for the next reporting period.

4.2.1.4 Any issues, risks, or problems

affecting project progress, along with proposed resolutions.

Ongoing, weekly.

3017 4.2.2 Monthly Progress and Financial Report - Submitted with the monthly invoice, this report will be consistent

Ongoing, weekly.

Contractor Proposed Delivery Schedule with the submitted weekly reports and will also contain:

4.2.2.1 A summary of all contract funds

expended during the reporting period.

4.2.2.2 A high-level overview of

progress against the approved project schedule.

3018 4.2.3 Quarterly Total Quality Management (TQM) Report - The contractor will provide a summary of quality management activities and metrics on a quarterly basis.

Ongoing, weekly.

3019 4.2.4 Meeting and Session Summaries - The contractor will provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.

Ongoing, monthly

OPTION YEAR FOUR (4)

4001 4.1.3.1.1 Scanning and Penetration Testing Support: Monitoring of scanning and penetration testing dashboards and provision of required support and guidance for a subset of no more than 30 installations, managing the vulnerability and compliance lifecycle.

Contractor Proposed Delivery Schedule

4002 4.1.3.1.2 Standard Operating Procedures (SOPs): Development and implementation of step-by-step instructions for common tasks related to PCI DSS compliance, such as vulnerability scanning, incident response, and system patching.

4003 4.1.3.1.3 24/7 Support Services:

that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. Offerors must include their standard commercial Service Level Agreements (SLAs), which must define response and resolution time targets for Critical, High, Medium, and Low severity incidents. A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status

4004 4.1.3.2.1 Initial PCI DSS Compliance teams and assistance to the Qualified Security Assessor with all aspects of assessment and documentation to confirm that the base has achieved initial PCI DSS compliance, including

Ongoing, annually

Contractor Proposed Delivery Schedule evidence of implemented controls and supporting documentation.

4005 4.1.3.2.1.1 Evidence Gathering Support:

Support in gathering the necessary evidence to demonstrate compliance with PCI DSS requirements.

Ongoing, annually

4006 4.1.3.2.1.2 Assessment Readiness posture and documentation to ensure readiness for a PCI DSS assessment.

Ongoing, annually

4007 4.1.3.2.2 SAQ/ROC Preparation vendor to provide needed assistance with preparing for and completing PCI DSS assessments, including Self- Assessment Questionnaires (SAQs) and Reports on Compliance (ROCs).

Ongoing, annually

4008 4.1.3.3.1 Training Materials:

covering PCI DSS requirements, security best practices, incident response procedures, and PCI artifact best practices.

4009 4.1.3.3.2 "Train-the-Trainer" Program:

to conduct ongoing PCI DSS training for new employees.

Contractor Proposed Delivery Schedule

4010 4.1.3.3.3 Ongoing Training: An annual training plan that includes refresher sessions for AFSVC personnel and comprehensive training for new staff.

Training materials will be updated as needed to reflect any changes to the system or PCI DSS requirements.

4011 4.1.3.4.1 Project Management Plan: A timelines, resources, and communication protocols.

4012 4.1.3.4.2.1 Remediation Implementation implementation of remediation measures, including patching, configuration changes, and security control updates.

4013 4.1.3.4.2.2 Verification and Validation implemented remediation measures have effectively addressed vulnerabilities and that systems are secure.

4014 4.1.3.4.2.3 Quarterly Compliance solution's performance and adherence to PCI DSS controls.

4015 4.1.3.4.2.4 Incident Response Assistance assistance provided during security incidents (if any), including

Contractor Proposed Delivery Schedule containment, eradication, and recovery procedures.

4016 4.2.1 Weekly Status Report - The Contractor will provide a weekly status report detailing progress, challenges, and next steps, including, but not limited to the following:

4.2.1.1 A summary of all tasks and

activities completed during the reporting period.

4.2.1.2 The percentage of completion for

previously planned tasks.

4.2.1.3 A list of all planned tasks and

activities for the next reporting period.

4.2.1.4 Any issues, risks, or problems

affecting project progress, along with proposed resolutions.

Ongoing, weekly.

4017 4.2.2 Monthly Progress and Financial Report - Submitted with the monthly invoice, this report will be consistent with the submitted weekly reports and will also contain:

4.2.2.1 A summary of all contract funds

expended during the reporting period.

4.2.2.2 A high-level overview of

progress against the approved project schedule.

Ongoing, weekly.

4018 4.2.3 Quarterly Total Quality Management (TQM) Report - The contractor will provide a summary of quality management activities and metrics on a quarterly basis.

Ongoing, weekly.

Contractor Proposed Delivery Schedule

4019 4.2.4 Meeting and Session Summaries - The contractor will provide documented recommendations, system configurations, and guidance identified or discussed during meetings and collaborative sessions.

Ongoing, monthly

1.2. The Contractor must annotate if the timeline for a Deliverable is concurrent with another Deliverable.

1.3. The NAFI will furnish with the Contractor an award or notice of award no later than the day the award is dated. Therefore, the Contractor should compute the time available for performance beginning with the actual date of the award.

2. DELIVERY POINT

All deliverables will be delivered to and approved by the Contracting Officer Representative

(COR).