ATCH 13 Q A 3 Dec 2025.pdf

# Questions Answers

SECTION I

Background

1 1.2 Background: References 'Level 1 Merchant' but no validation source.

- Has Level 1 Merchant status been validated with Payment Brands?

- Confirm if contractor must validate merchant classification.

Level 1 Merchant status has been validated with Payment Brands, contractor does not need to validate; modified verbiage in 1.2.1.

2 SECTION I, 1.2.1. Would the Government provide information pertaining to the networks, hardware, software, policies, and procedures currently being used to support AFSVC operations?

Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

3 What prior assessments have been performed to determine non-compliance? October 2025 Gap Assessment Summary will be submitted with the Statement of Objectives (SOO); full report and remediation roadmap will be shared upon contract award.

Volumetrics 4 1.3 Volumetrics: Provides only estimated site counts.

- Will authoritative inventory (POS, gateways, hardware) be provided at award?

- Confirm whether baseline asset data will be furnished.

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

5 1.3 Volumetrics: ‘Unknown number of payment channels.'

- Should contractor identify and categorize all payment channels during discovery?

- Confirm contractor responsibility for discovery and classification.

A complete inventory of Payment Card Industry (PCI) related system components across all installations is currently in development (at 55%, targeting completion by July 2026). Data will be provided upon contract award. Contractor is not responsible for discovery and classification.

6 1.3. The SOO notes an "Unknown number of payment channels" and an "Unknown number of disparate network cardholder data environments".

1. What existing documentation, resources, or dedicated Government personnel will be provided immediately upon contract award to assist the contractor in the initial inventory and discovery necessary to refine the PCI DSS scope during Phase 1?

2. What is the level of knowledge and experience the dedicated Government personnel have related to PCI DSS requirements?

3. Have these Government personnel been involved with the PCI DSS existing

Data Provided: Site assessements and scoping Inventories, PCI related policies, processes and detailed gap assesment (Oct 2025 completion) and roadmap (verbiage added in new Paragraph1.5 Data Provision).

Personnel: A dedicated PCI Cell and Air Force Services Center (AFSVC) Information Technology (IT) team (moderately PCI knowledgeable, but no Internal Security Assessor on staff).

7 1.3. AFSVC has an estimated 104 worldwide locations and 2200+ business activities.

1. Can the Government provide an organized list of these 104 installations, including approximate transaction volume per location and a preliminary inventory of the types of Point-of-Sale (POS) systems known to be in use?

2. Does the Government currently have a list of third-party service providers which are considered part of the cardholder data environment, and will that list be shared with the contractor?

Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

8 The scope of worldwide locations is set to 104. Are we able to get an indication of those 104, whether they can be further categorized into Tier 1, Tier 2, or Tier 3 locations?

a. Tier 1 - Strategic location, in terms of size, personnel, different payment channels, and number of payments processed annually (likely to be hundreds of thousands of transactions being processed annually).

b. Tier 2 - Standard location that has multiple payment channels but in PCI context sits between Tiers 1 and 3. (likely to be tens of thousands of transactions being processed annually).

c. Tier 3 - Remote location, considered to be less significant in PCI context, and might only have a few payment terminals or process only a few hundred or thousand transactions annually.

Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

9 Will contractors be able to conduct sampling of installations/locations for those that are using similar technology for payment processing?

Representative Sampling is preferred; relevant data will be provided upon contract award.

10 Is cardholder data electronically stored at any of the locations? Very minimal cardholder data is being stored; any storage is cloud based, payment processor approved.

11 Are there any e-commerce payment channels or card flows currently in place? AFSVC does have a few e-commerce payment channels.

12 How many of the 104 locations are OCONUS (Outside Continental United States), and what unique challenges (e.g., network latency, local regulations, or connectivity issues) exist for those sites?

~30 OCONUS sites; challenges - Status of forces agreements differ, different ISP provider/separate contracts. A dedicated PCI Cell and AFSVC IT team will coordinate challenges, as needed.

13 Can you provide more details on the current payment channels and cardholder data environments (CDEs)? The SOO mentions an unknown number of channels and disparate configurations across 104 locations—what is the estimated breakdown (e.g., in-person POS, e-commerce, phone orders, mobile payments)?

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference revised Paragraph 1.3 Volumetrics and 1.5 Data Provision.

14 What approach/who will be responsible for determining the various payment channels and cardholder data environments? How many interviews (i.e. locations) will be required to determine this information?

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference revised Paragraph 1.3 Volumetrics and 1.5 Data Provision.

15 Scope and Environment: Regarding the Unknown number of payment channels and disparate network cardholder data environments mentioned in Section 1.3, has any preliminary analysis been performed to create a rough estimate of the number and types of these channels (e.g. retail POS, e-commerce, MOTO)?

Does AFSVC have any existing, even if incomplete, inventories that can be

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference revised Paragraph 1.3 Volumetrics and 1.5 Data Provision.

16 Are locations connected to centralized networks and gateways, or do they operate independently with separate processors and acquiring relationships?

Locations are connected to disparate networks using enterprise approved configurations (e.g., segmentation) Data will be aggregated into Enterprise PCI Data Repository, currently in development.

17 What is the current hosting model for POS and payment applications: on-premises, cloud, or hybrid?

Hybrid Point of Sale (POS) model.

18 Is there a current inventory of PCI related system components that exist in the 104 installations/locations (Point of Sale (POS), server, workstation, wireless, network, etc.)?

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

19 Does AFSVC anticipate the Contractor will need to physically visit each of the 104 locations?

Representative Sampling is preferred; relevant data will be provided upon contract award.

20 Is there an expectation for any of the contractors to physically visit each of the 104 installations/locations to perform the scoping, training, and other requirements in the RFP?

Representative Sampling is preferred; Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

Questions and Answers (Q&A) 3 Dec 2025

21 Sampling vs 100% site visits: Will AFSVC accept a risk-based sampling methodology for on-site validation across ~100+ locations?

Representative Sampling is preferred; Data will be provided upon contract award; reference new Paragraph 1.5 Data Provision.

22 Will contractors have direct access to local stakeholders at all 104 locations/installations for data collection?

Not necessary. Data will be housed in an enterprise PCI Data Repository; installations will upload outstanding artifacts and confirm outstanding PCI Controls.

Scope 23 1.4 Scope: Mentions 104 sites and 'unknown payment channels.'

- Clarify whether PCI DSS scope includes all merchant environments or only POS networks.

Scope includes entire CDE.

24 1.4 Scope: Notes review of 'provided data' but no specific diagrams listed.

- Will AFSVC provide existing network and payment data-flow diagrams for scoping validation?

- Identify whether diagrams will be Government-furnished or contractor-developed.

Data will be provided upon contract award; reference new SOO Paragraph 1.5 Data Provision.

25 1.4.1. "…and conduct the formal audit by the end of FY2026". Is the government's intention for the offeror to provide both the audit readiness support and to conduct the formal audit?

See revised SOO 4.1.3.

26 1.4.1. Based on the overall goal to conduct the formal audit by the end of FY26.

What are level of resources is AFVSC able to deploy to meet the completion of Phase 2 (Remediation) to ensure readiness for the formal audit preparation (Phase 3)?

The PCI Cell is a small fully dedicated team, whose role is more strategic in nature, but pulls in the appropriate SME's to support specific project milestones and procures the required suport as gaps are identified. As part of that strategic vision, they have identified the need for additional installation level IT support where there are gaps, and are in the process of procuring.

27 1.4.2: Training strategy required; no alignment specified.

- Should training deliverables align with PCI DSS Req. 12.6 and Air Force SETA standards?

Training aligned to PCI DSS 4.0.1 or latest version. AFSVC has developed comprehensive training , requesting review and guidance.

28 Who comprises the AFSVC PCI Cell and what are their roles for functional, technical, and compliance oversight?

The PCI Cell is a small fully dedicated team, whose role is more strategic in nature, but pulls in the appropriate SME's to support specific project milestones and procures the required suport as gaps are identified. The roles are strategic program mgmt, communications, training, IT security, Risk Management Framework (RMF), and cybersecurity.

29 Will all 104 global locations and 2,200+ business activities be included within the PCI DSS scope, or will the assessment focus on a representative sample of sites?

The entire Nonappropriated Fund Instrumentality (NAFI) CDE is in scope; however only a representative sample is required for assessment.

30 Will cloud-based or third-party payment gateways be considered part of the in-scope cardholder data environment (CDE)?

Yes, the entire NAFI CDE is in scope.

31 Does the Government intend for the contractor to provide only advisory and assessment services, or to also execute technical remediation tasks?

AFSVC is currently procuring technical support contract to implement the remediation efforts identified.

32 Will there be a single consolidated merchant ID across the enterprise, or multiple IDs maintained by individual business units?

Multiple Merchant IDs maintained by business activities aligned to a single AFSVC Merchant Account.

33 How will the PCI DSS program be aligned with existing DoD Risk Management Framework (RMF) cybersecurity processes and controls?

It is a subset of the overarching RMF.

34 Will AFSVC provide an initial inventory of all POS hardware/software platforms and payment applications at contract start, or should this inventory be developed by the contractor?

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference new SOO Paragraph

1.5 Data Provision.

35 What is the intended scope boundary — all NAFI locations worldwide, or only specific major bases/business units?

The entire NAFI CDE is in scope.

36 Timeline Feasibility: The objective to conduct the formal audit by the end of FY26 is an aggressive timeline for an enterprise of this complexity. Has AFSVC allocated dedicated internal technical and business personnel to support the contractor and execute the required remediation activities in parallel to meet this deadline?

The PCI Cell has stood up an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology. Mitigation efforts are well underway, to be completed by early 4th quarter of FY26. An audit leveraging the central PCI Repository data and artifacts align with a representative sample of site audits (10-20 preferred, defer to industry professional to make quantity recommendation).

37 Is there a current inventory of PCI related system components that exist in the 104 installations/locations (Point of Sale (POS), server, workstation, wireless, network, etc.)?

A complete inventory of PCI-related system components is underway across all installations (55% complete). Data will be provided upon contract award; reference new SOO Paragraph

1.5 Data Provision.

38 The number of payment channels and cardholder data environments is listed as "unknown" (1.3), but the scoping work necessary to identify them, which must be done to correctly scope any kind of assessment (gap, attested, or otherwise), has been removed. The wording of section 4.1.1.1 implies that you actually have more information about the in-scope environment than 1.3 implies. Is this a correct inference? That information will be necessary for any bidder to accurately scope the requested gap assessment and ROC assessment work requested.

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award. A complete inventory of PCI-related system components across all installations is currently in development (55%, complete). Data will be provided upon contract award.

Refer to revised 1.3 verbiage to reflect in progress.

Objective 39 Should the contractor provide both advisory services and hands-on implementation of remediation, or will implementation be a separate effort after assessment?

Implementation will be a separate effort after assessment.

AFSVC requires a detailed remediation and/or implementation plan.

40 Will the selected contractor perform the QSA audit or prepare AFSVC for a third-party QSA assessment?

Both aspects are preferred.

41 Is the expectation to design the enterprise PCI compliance program only, or also to provide program management and execution across all locations?

The expectation is to strengthen and solidify the Enterprise PCI program, currently in development.

42 Will AFSVC require a single enterprise ROC or multiple ROCs for distinct CDEs? Single Enterprise ROC; refer to Paragraph 1.2.1 The AFSVC DAF NAFI merchant card processing operations are currently non-compliant with the PCI DSS for a Level 1 Merchant.

43 May the contractor use representative site sampling for assessments, and if so, what sampling size or criteria does AFSVC prefer?

Representative Sampling is preferred; relevant data will be provided upon contract award (10-20 sites unless more than 20% sample is otherwise required).

44 Technical Environment: To better understand the challenge of the disparate POS, hardware and software, network infrastructures, can AFSVC please provide a high-level list of the most common POS system vendors and payment applications currently in use across its operations?

A complete inventory of PCI-related system components across all installations is currently in development (55%, complete).

Data will be provided upon contract award. The current state assessment summary attached to the SOO, depicts the PCI maturity across each major POS.

SECTION II

45 2.0. The current environment has "gaps in network infrastructure and business processes" leading to "fragmented efforts".

Are there any preliminary reports or existing findings (e.g., network diagrams, data flows, previous audit documentation) that can be shared regarding the current state of network segmentation or the major non-compliant business processes?

The PCI Cell has stood up an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology. Mitigation efforts are well underway, to be completed by early 4th quarter of FY26. October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

46 2.1.3. The contractor is requested to recommend a turnkey compliance solution suite.

Is AFSVC locked into a particular technology stack, credit card processor, payment solutions, etc.? If the answer is yes what limitations? As that can affect the selected contractor’s ability to remediate PCI DSS gaps.

Refer to revised 2.1.3.

47 Section 2.1.5 mentions the contractor's "Ability to implement recommended solutions" and provide a cost and timeframe estimate.

Is the intent of this contract solely to recommend and plan implementation, or should offerors' proposals account for potential staffing and resources required to execute the implementation of the recommended turnkey compliance solutions?

NOTE: Estimating the price/level of effort for the implementation would present a significant challenge without the completion of scoping and gap analysis.

Refer to revised 2.1.5. October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

48 What POS systems, hardware, software, and payment applications are currently in use across the DAF NAFI enterprise? Are there specific vendors (e.g., Oracle, Square, custom solutions) or versions we should be aware of for compatibility and scoping purposes?

A complete inventory of PCI-related system components across all installations is currently in development (55%, complete).

Data will be provided upon contract award; reference new SOO Paragraph 1.5 Data Provision.

49 As part of the people, process, and technology changes, does AFSVC anticipate standardizing solutions, or will each organization be able to determine the best solution for their organization?

AFSVC PCI Cell is standardizing, though business activities can request solutions and innovate following the AFSVC central innovation and change management process.

50 To support sustainment, should the contractor include train-the-trainer materials and capability transfer plans?

Refer to revised training verbiage - industry standard solutions.

Training is listed throughout 4.1.2.3.5, 4.1.4.3.8, 4.1.5.2.8.

51 What are the biggest known challenges or blockers AFSVC has identified in past PCI efforts (technology, staffing, governance)

The primary challenge in the past was a decentralized structure that treated each installation as a separate business entity.

Over the past year, AFSVC has focused on centralizing and building an Enterprise Complianced Program with a split focus on immediate compliance and longer term build for sustainment.

52 Does AFSVC have a list of all Merchant IDs in use with organizations and points of contact? Or will the Contractor support discovery efforts?

AFSVC does have a list of Merchant IDs and all associated information that will be provided upon contract award;

reference new SOO Paragraph 1.5 Data Provision.

53 Authoritative inventory: Is there a current list of merchant IDs, locations, POS types/images, gateways, e-commerce, TPSPs? If not, can Phase 0 discovery be included as a funded task?

A complete inventory of PCI-related system components complete). Reference new SOO Paragraph 1.5 Data Provision.

54 Tooling constraints: Are there enterprise-mandated tools for vulnerability scanning/patching, network segmentation validation, and security log monitoring (SIEM), or may the contractor propose commercial tools subject to Government approval?

Enterprise Scanning and pen testing tools are already in place;

AFSVC is looking to procure others, such as Data Loss Prevention (DLP), SIEM and others, as required.

55 The SOO requests an ROI assessment for consolidated vs. disparate systems. What key metrics (e.g., cost savings, risk reduction) should be prioritized, and can you provide baseline cost data?

Key metrics will be delivered in the Phase 1 contract; AFSVC can provide basline cost data and cost data estimates after recommendation is made.

56 Regarding implementation of recommended solutions (2.1.5), is the expectation for the contractor to only provide estimates, or potentially execute implementation if approved?

Refer to revised 2.1.5 and 4.1.2.1 Security Control Implementation & Remediation.

SECTION III

Contractor Qualifications

57 SECTION III, 3.1. Does the qualification for a PCI DSS experience with commercial and DoD need to come from the prime vendor, or may the experience come from a sub vendor?

Key personnel requirement.

58 SECTION III, 3.1. Would the Government confirm if the requirements provided in

3.1 apply to the vendor providing the services or to a key personnel requirement?

Personnel performing the role must meet requirements in 3.1.

59 3.1.1. The SOO states that the contractor must be a Certified QSA and must also provide a business expert to guide maturing processes.

Should the technical proposal clearly define the distinction and integration points between the QSA staff (handling technical assessment and ROC readiness) and the business expert staff (handling process codification and training strategy)?

Yes.

60 3.1.2. Experience with DoD and Federal entities. Is the government amenable to updating this requirement to be "experience with DoD NAF entities"?

No.

61 3.1.3. Can AFSVC please clarify what it means to have five years of experience in establishing enterprise systems? Does the contractor qualify if its cumulative past performance or corporate experience meets or exceeds five years in total?

Yes.

62 QSA role/eligibility: Will a QSA subcontractor be acceptable to perform/sign the ROC/AOC while a non-QSA prime leads PMO/training/rollout? (Keeps us eligible as prime.)

Yes.

63 Is the DOD/Federal experience requirement just general experience, experience with specific frameworks, or experience with PCI with DOD/Federal?

See revised SOO 3.1.2.

64 Does AFSVC require all contractors to be PCI QSA certified for all phases of this project?

The Teaming partnership (prime and subcontractor/Teaming partner) must meet all qualifications of SOO 3.0 "Contractor Qualifications".

65 Are there citizenship requirements for QSA personnel to perform this work? See revised SOO paragraph 6.7.3.

66 Are only U.S. citizens permitted on this engagement, or are lawful permanent residents acceptable with required adjudication?

See revised SOO paragraph 6.7.3.

67 The SOO requires security clearances and training (e.g., Tier 1 or Tier 3 investigations, Cyber Awareness Challenge). Can you clarify the exact level required for QSA personnel (e.g., unclassified only, or potential for controlled unclassified information/CUI access)?

Refer to 6.6.1 - Highest level: UNCLASSIFIED; 6.6.3 Training refers to general DoD training courses required to obtain access to DoD UNCLASSIFIED network.

68 Should the contractor demonstrate its own organizational PCI DSS compliance or comparable certifications during proposal evaluation?

Contractor must be recognized by the PCI Security Standards Council as a qualified QSA; Proof of QSA certification is required.

69 Is previous work with Nonappropriated Fund Instrumentalities (NAFIs) specifically required, or will DoD-wide experience suffice?

DoD and/or Federal experience is required.

SECTION IV

Deliverables and Acceptance Criteria

70 Are Phases 1 through 5 strictly sequential, or may they overlap to accelerate outcomes?

Seeking industry to determine if overlap is necessary.

71 What secure platforms and formats should be used for deliverables and evidence exchange, for example DoD SAFE, SharePoint, or Teams?

All are options and can be discussed at kick-off meeting.

72 Will AFSVC provide formal review timelines for deliverable acceptance to support invoicing and schedule management?

Deliveries or Performances with timelines will be delivered.

Formal review timeline is within 10 business days of receipt of deiverable.

73 The SOO outlines five major phases. Would the Government consider adding quarterly progress milestones to improve visibility and risk management?

Proposed milestones will be accepted.

74 Will the contractor be responsible for developing standardized templates and dashboards for reporting compliance progress to AFSVC leadership?

AFSVC is developing a PCI Data repository that will provide such reporting; guidance in the finalization would be accepted from the vendor.

75 The SOO lists specific deliverables like the PCI DSS Discovery Report. Are there preferred formats (e.g., Word, PDF, templates) or tools (e.g., for ROI assessments) we should use?

Format agreed upon at kick-off meeting.

76 Would the Government consider integrating an adaptive learning framework that ties employee training results directly to compliance performance metrics?

Seeking industry to determine best approach.

77 Outcome/Deliverables: Is the objective ROC completion (v4.0.1) this year or audit-readiness with a remediation plan by a date? Please confirm required deliverables.

Sep 2026 is deadline for Report on Compliance (ROC) AND remaining remediation plan. Refer to revised 2.1.

78 For training and awareness support (repeated across phases), what is the estimated number of personnel needing training, and do you have existing programs or platforms (e.g., LMS) we can integrate with?

AFSVC is seeking an evaluation of completeness and effectiveness of the training program currently in place. Refer to revised Training & Awareness Support paragraph for each deliverable.

79 In addition to the PCI compliance support, is there an expectation that contractors perform a Level 1 Merchant assessment with Report on Compliance and Attestation in 2026? Will this assessment phase be part of the bid for this RFP?

ROC is required by September 2026; refer to Paragraph 4.1.4.3 Report on Compliance (ROC) Development Deliverable.

Phase 1: Initial Assessment and Scoping 80 Existing Documentation: Sections 1.4.1 and 4.1.1.1 mention a review of prior gap assessment findings. Could you provide:

1. The date these assessments were completed.

2. The entity that performed them.

3. Whether they covered the full enterprise or only a subset of the 104 locations?

Assessment of AFSVC Enterprise PCI Compliance Program to include representative sample of installations completed in October 2025 by a firm subcontracted through Accenture Federal Services. Remediation Roadmap will be delivered December 2025. Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

81 The SOO references prior gap assessments and planned roadmaps (e.g., in Phase 1). Can you share these documents or summaries to help refine our understanding of the current compliance posture and avoid redundant work?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

82 Contractor's Implementation Role: Section 4.1.2.1 states the contractor will assist with the implementation and remediation of non-compliant security controls.

Could you please clarify the expected level of involvement?

Is the contractor's role intended to be primarily advisory and oversight, or will the contractor be expected to perform the hands-on technical configuration and implementation of solutions?

Contractor's role is intended to be primarily advisory and oversight - implementation plan.

Phase 2: Gap Analysis, Planning & Remediation 83 Which DoD or Air Force cybersecurity teams will participate in remediation and governance activities?

Personnel: A dedicated PCI Cell and AFSVC IT team will coordinate across relevant cyber security teams, as needed.

84 For merchant services optimization (e.g., Merchant ID management, fee optimization), do you have current data on merchant accounts, transaction volumes per location, or fee structures that can be shared?

Yes, refer to new Paragraph1.5 Data Provisioning.

85 In Phase 2, vulnerability management is mentioned. Have any recent vulnerability scans or penetration tests been conducted, and can results be shared?

Yes, refer to new Paragraph1.5 Data Provisioning.

86 The gap assessment must be completed and non-compliant security controls and processes identified in order to determine the correct level of effort for Security Control Implementation & Remediation (4.1.2.1). How are bidders expected to respond to this requirement without the completed gap assessment?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

Phase 4: Reporting & Strategic Guidance 87 SECTION IV, 4.0. This section states, “Due date intervals are not expected to change but actual dates may be revised depending upon actual contract start date”; however, interval information is not provided.

Would the Government provide this information?

Refer to revised SOO 4.0.

88 SECTION IV, 4.1, Deliverables, 4.1.1.1. Does the Government intend to provide the prior gap assessment to the selected vendor?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

89 SECTION IV, 4.1, Deliverables, 4.1.1.1. Does the Government intend to include the prior gap assessment as part of the solicitation process to allow vendors to more accurately assess the findings to determine a course of action for proposal?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

90 SECTION IV, 4.1, Deliverables, 4.1.1.1. Would the Government provide information regarding who conducted the prior gap assessment?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

91 SECTION IV, 4.1, Deliverables, 4.1.1.2. Would the Government provide a previous assessment made for compliance at each United States Air Force (AF) installation and AFSVC? Additionally, will the contractor be expected to travel to each AF installation to conduct an inspection?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

92 SECTION IV, 4.1, Deliverables, 4.1.2.1. Would the Government clarify if work to mitigate PCI DSS areas of concern will be added to this contract vehicle, or will those efforts be added to a separate contract?

Refer to the revised SOO Paragraph 4.1.2.1.

93 SECTION IV, 4.1, Deliverables, 4.1.2.3.4. Would the Government consider providing Offerors with the estimated labor mix and Level of Effort (LOE) expected in total hours by year and/or contractor Full-Time Equivalents (FTE) for the services outlined within Section IV, 4.1, Deliverables, 4.1.2.3.4? This information is imperative, as it provides Offerors with a more in-depth understanding about how to appropriately staff the contract and will ultimately aid the Government during pricing evaluations (e.g., if all Offerors are required to bid the same labor mix/hours, then the Government will be able to perform a fair evaluation across all the Offerors’ price proposals).

AFSVC seeks the advice from the industry based on industry standard.

94 SECTION IV, 4.1, Deliverables, 4.1.2.3.4. Would the Government provide information regarding whether the training can be performed virtually or in person?

Refer to 4.1.4.3.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

95 SECTION IV, 4.1, Deliverables, 4.1.2.3.4. Would the Government provide information regarding whether training can be conducted virtually? Is there a preferred platform to use?

Refer to 4.1.4.3.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

96 SECTION IV, 4.1, Deliverables, 4.1.3.1. If a PCI audit is already being prepared, would the Government provide information regarding who is currently conducting the audit?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

97 4.1.2.3. (All subsections) "Merchant Services Optimization: Provide the following services related to merchant accounts and processing, Merchant Account Setup/Reorganization ....". Could the government clarify the nature of the services requested? Is the intention to 'provide recommendations for the following services related to merchant accounts and payment processing'?

AFSVC is requesting an assessment and guidance.

98 4.1.2.3. The scope includes identifying improvement opportunities and assisting with business process development. Phase 2 deliverables include Merchant Account Setup/Reorganization and Payment Gateway Integration/Fee Optimization.

Does AFSVC currently utilize a sole primary payment processor or gateway, and is the Government interested in evaluating alternative processors as part of the fee optimization?

AFSVC currently utilizes a sole primary Merchant processor and their approved payment gateways. Evaluation of alternatives is in scope of this contract.

99 4.1.4. "Report on Compliance (ROC) Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements...". Is the ROC expected to be a report to share with the Bank, or a readiness evaluation for the PCI Cell?

ROC will be shared with AFSVC Merchant processor and payment card brands.

100 4.1.4. Is the government expecting the ROC report to be provided by end of FY26?

Or, is the government expecting readiness testing for the ROC to be completed by end of FY26 with the ROC delivered at a later date?

Sep 2026 is deadline for ROC AND remaining remediation plan.

Refer to revised 2.1 and 4.1.3.

101 SECTION IV, 4.1.4.1. Would the Government confirm if 21 days will be either calendar or business days?

Business Days; can be disucssed and agreed upon at the kick-off meeting.

102 Sections 4.1.4.3 and 4.1.5.2 refer to "ROC Development". Is this intended to be the formal audit resulting in a ROC attested to by the QSA bidder, or simply the completion of a draft ROC based on prior activities for reference by AFSVC? The inclusion of these two sections next to Audit Preparation Support (4.1.3.1 and

4.1.5.1 respectively) makes this confusing.

Refer to revised SOO 4.1.3.

103 SECTION IV, 4.2, Acceptance Criteria, 4.2.1. Would the Government provide information on compatibility with AF Systems to include and what its current requirements are?

Refer to revised 4.2.1.

104 SECTION IV, 4.2, Acceptance Criteria, 4.2.3. This section states, “Acceptance or rejection of named deliverables will occur with a reasonable timeframe by the

COR.”

Would the Government define what is considered a reasonable Ɵme frame?

Mutually agreed upon at kick-off meeting.

105 4.2.1. The SOO states that Deliverables must be functionally tested for compatibility with Air Force systems.

Can the acceptable criteria used by the COR be shared with offerors to provide an understanding of the guidelines of what is permitted or not related to this requirement?

Refer to revised 4.3.1.

106 For the PCI DSS Discovery Report, does AFSVC prefer findings organized by PCI DSS requirement, by business process, or both?

Proposed milestones will be accepted.

107 Training model: May we deliver role-based micro-learning with LMS tracking/attestations rather than only classroom sessions?

Refer to 4.1.4.3.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

108 Does the Government anticipate providing a level of effort (LOE) to meet the requirements for this effort?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

109 For training deliverables, is the Government expecting live sessions, asynchronous e-learning modules, or both?

Refer to 4.1.4.3.8 Training & Awareness Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

Phase 5: Recurring Annual Audits 110 For the Report on Compliance (ROC), should the same QSA that supports readiness perform the final validation, or will an independent validation QSA be required?

An independent validation will be required.

111 Would AFSVC be open to leveraging AI-based audit simulation tools for continuous readiness testing between annual ROC cycles?

Yes, there may be an opportunity to propose AI-based audit simulation tools for continuous readiness testing as recommendations in 4.1.2 or 4.1.4.

112 For option years (Phase 5: Recurring Annual Audits), what is the anticipated frequency and scope of these audits? Will they be full ROCs each year, or could they include interim assessments?

Annual frequency. Scope of the assessments is centrally from the Enterprise PCI Data Repository with representative onsite audits as required by PCI Council.

SECTION V

Reporting

113 Should weekly and monthly reports follow the sample templates in the appendix, or may the contractor propose equivalent formats?

Formats are a guide.

114 For reporting (weekly/monthly status reports), are the sample formats in Appendix 7.3 and 7.4 mandatory, or can they be customized?

Formats are a guide.

Meetings 115 What governance cadence is preferred, for example weekly COR meetings only or periodic broader stakeholder reviews?

Refer to SOO paragraph 5.2.1-5.2.3.

116 Schedule & reporting cadence: Please confirm desired phasing (Phase 0→3) and weekly/monthly KPI expectations.

Refer to SOO paragraph 5.2.1-5.2.3.

117 What technologies/methods are acceptable in the event remote interviews and meetings are required or needed? (Web/video Teleconferencing, phone, etc.)

Teams.

118 Are executive briefings expected at defined intervals, for example monthly or quarterly to senior leadership?

Status updates will be used to develop summaries for senior leadership. Formal briefings will be required at the point of the formal ROC in Q4 FY26 4.1.4.3 Report on Compliance (ROC) Development: The QSA will develop a comprehensive and accurate ROC…

SECTION VI

Contracting Officer's Representative (COR)

119 Will a single point of contact coordinate data calls, site access, and scheduling across locations?

Refer to SOO paragraph 6.1.

120 Will there be a designated point of contact at each location to assist with coordination and evidence uploads?

Refer to SOO paragraph 6.1. The COR will make available all necessary POCs.

121 What resources will we have access to internally? For example, a dedicated Project Management (PM) resource; an organization email address and list of key contacts to liaise with; or, are we required to be entirely self-sufficient?

Refer to SOO paragraph 6.1.

Place of Performance 122 Can QSA personnel operate remotely under approved DoD cybersecurity controls, or will on-site presence be required for specific assessment tasks?

Refer to SOO paragraph 6.2.

123 The place of performance allows remote work for most tasks. What percentage of the effort do you estimate will require in-office presence at Port San Antonio?

Refer to SOO paragraph 6.2.

Government Furnished equipment 124 6.3.1. The SOO states that AFSVC will provide GFE-owned PCs for required work and application access.

To support compliance activities (e.g., vulnerability management and assessment), what specific Government Furnished Equipment (GFE) software, tools, or access permissions (e.g., to network monitoring, inventory, or scanning tools) will be available to the contractor?

Contractor will have access to the PCI Data Repository and MS Teams channels for file review of artifacts not yet included in the repository.

125 What Government Furnished Equipment (GFE) will be provided beyond laptops (e.g., access to network diagrams, vulnerability scanning tools, or ASV reports)?

Laptops and access to the PCI Data Repository (that would include inventories, network diagrams, scanning and penetration testing reports) along with MS Teams channel access for file review of artifacts not yet included in the repository.

Travel 126 6.4 Travel. "assess a sample of bases as deemed appropriate for the Audit

Readiness and ROC". Does the government intend for travel to bases to conduct mock audits as a component of this effort? If so, can the government clarify the estimated number of bases/mock audits and location (CONUS/OCONUS)?

Refer to 6.4 Travel - AFSVC would like to audit a sampling bases as deemed appropriate for the Audit Readiness and ROC.

127 Will the contractor be expected to travel to each AF installation to conduct an inspection?

Refer to 6.4 Travel.

128 The SOO mentions travel to assess a sample of bases for audit readiness and ROC.

How many locations do you anticipate needing on-site visits, and what criteria will be used to select them?

Refer to 6.4 Travel.

Security Clearances 129 Will contractor personnel be issued CACs, or will alternative credentialing be used for remote access?

CACs will be issued.

130 Will the contractor receive direct system access for assessment and evidence collection, or will access be mediated by government personnel?

Contractor will have access to the PCI Data Repository (that would include inventories, network diagrams, scanning and penetration testing reports) along with MS Teams channel access for file review of artifacts not yet included in the repository.

131 Do Tier 1 versus Tier 3 adjudication requirements vary by role, or will all team members require Tier 3 due to data sensitivity?

Refer to SOO 6.7.3.

132 Will contractors be required to have a background check performed? Refer to SOO paragraph 6.7.3.

133 Is the time to complete the background checks built into the timeline of the project?

Yes.

134 Will contractors be able to perform any work prior to the background checks completed?

No.

Cybersecurity 135 Segmentation validation windows: Will test windows be provided for segmentation/pen testing and packet capture where required?

Pen testing is conducted through another vendor; 55% complete.

General/Misc.

136 Are there known legacy or end-of-life POS platforms that must be documented but are out of scope for remediation?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

137 Would the Government confirm if the Air Force Service Center (AFSVC) received an audit confirming it is noncompliant with PCI standards?

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

138 Are there any third-party service providers (e.g., payment gateways, tokenization services) already integrated, and if so, have their SAQs (Self-Assessment Questionnaires) or ROCs (Reports on Compliance) been completed?

AFSVC does use Third-party service providers and is in the process of validating all Attestations of Compliance (AOCs) and sunsetting those not in acceptance by our Merchant Processor.

139 How many AFSVC personnel (e.g., PCI Cell members) will be dedicated to this project, and what roles will they play in supporting assessments, remediation, and data provision?

The PCI Cell is a small fully dedicated team, whose role is more strategic in nature, but pulls in the appropriate SME's to support specific project milestones and procures the required suport as gaps are identified.

140 Has AFSVC previously engaged a QSA or advisory firm (e.g., for PCI discovery, gap analysis, or ROC support)? If so, please identify the role and scope (e.g., discovery only vs. ROC/AOC) and whether incumbent artifacts (merchant inventory, data-flow diagrams, segmentation docs) will be made available to the awardee.

October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award. Data will be provided upon contract award;

reference new Paragraph 1.5 Data Provision.

141 Security boundary: What IL/FedRAMP boundary should house PCI evidence and assessment artifacts (e.g., IL4/IL5 enclave vs FedRAMP SaaS)?

The PCI Cell has stood up an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology, including development of a central PCI Repository housing PCI evidence and assessment artifacts.

142 Governance: Who is the designated PCI Program Owner/Decision Authority for exceptions, SAQ choices, and compensating controls?

AFSVC PCI Cell will be the primary point and handle all coordination and approval processes.

143 Does the AFSVC plan to establish a centralized governance model for PCI DSS oversight after initial compliance is achieved?

A centralized PCI Cell was stood up in Nov 2024, developed an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology, including dvelopment of a central PCI Repository housing PCI evidence and assessment artifacts.

144 Are any P2PE (Point-to-Point Encryption) validated solutions implemented? AFSVC Merchant processor approved Point-to-Point Encryption (P2PE) are implemented.

145 Will AFSVC provide existing inventories, network diagrams, prior gap assessments, and processor or acquirer information as a baseline?

A complete inventory of PCI-related system components across all installations is currently in development (55%, complete).

Data will be provided upon contract award; reference new SOO Paragraph 1.5 Data Provision. October 2025 Gap Assessment Summary will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

146 Should the contractor plan to coordinate directly with third-party processors, gateways, and acquiring banks for evidence and validation?

No. A centralized PCI Cell was stood up in Nov 2024, developed an Enterprise PCI Compliance Program taking a centralized approach across people, policy, process, and technology, including dvelopment of a central PCI Repository housing PCI evidence and assessment artifacts.

147 Are contractors allowed to utilize their own resources for evidence collaboration, review and/or report writing (such as a hosted compliance portal)?

AFSVC is developing a PCI Data repository that will provide such reporting; guidance in the finalization of the repository strucure would be accepted from the vendor.

148 Are there installations that involve storing credit card information on AFSVC-managed servers (e.g., in a database). The physical locations housing these servers would be considered in scope for PCI, making AFSVC subject to the relevant PCI DSS requirements for those facilities.

No credit card information is stored on servers; minimal storage in cloud-based, merchant processor approved solutions. The October 2025 Gap Assessment includes more detail.

149 Are any scoping reduction solutions or technologies in place such as Point to Point Encryption (P2PE) or tokenization?

For each activity type (golf, bowling, food, etc.), the business utilizes a distinct POS system. However, to reduce the scope of review, AFSVC Merchant Processor-approved Point-to-Point Encryption is implemented on all but one POS. Consequently, only that single remaining system falls within the current review.

150 Should risk, POA&M, and compliance status be maintained in government systems or in a contractor-managed repository with shared access?

AFSVC is developing a PCI Data repository that will store such reporting.

151 Should the contractor propose a change management and continuous monitoring framework, including RASCI, configuration management, and a risk register?

AFSVC is developing a PCI Data repository that will provide such reporting; guidance in the finalization of the repository strucure would be accepted from the vendor.

152 How many POS solutions are currently in use across all locations? The business utilizes one POS system for each activity type (golf, bowling, food, etc), only one system falls within the scope of this review. Other activities currently rely on a third-party card processing solution provided by the AFSVC Merchant processor.

153 Are there specific controls required for the contractor’s corporate environment, such as FIPS 140-2 validated encryption and RMF-aligned safeguards for remote work?

Specific applicable controls will be discussed during the kick-off meeting.

154 Would AFSVC like the contractor to deliver a formal RASCI for PCI DSS roles across AFSVC, NAFI, and contractor teams?

Refer to SOO paragraph 4.1.1.3 for Incident Response & Contingency planning deliverable. More information on the topic is included in the October 2025 Gap Assessment Summary that will be submitted with SOO; full report and remediation roadmap will be shared upon contract award.

155 Will AFSVC provide a master project schedule and fiscal milestones, or should the contractor propose one with assumed dates?

Refer to revised SOO 4.1.6

156 What is the date of the fiscal year end for which the Report on Compliance is expected to be completed?

By 30 Sep 2026

157 What is the expected completion date for the readiness review? Refer to Deliveries and Performances attachment.

Contracting Questions

158 What contract type does AFSVC anticipate, for example firm fixed price, time and materials, or a hybrid approach?

This is a competitive Lowest Price Technically Acceptable (LPTA) Request for Quote (RFQ) in which price is considered the most important factor for Contractors deemed technically acceptable.

This is a Firm-Fixed Price Contract, however, if…