ATCH 05 Supplies Services and Prices 14 Jan 2026.pdf

ATCH 05 - SUPPLIES, SERVICES AND PRICES

Payment Card Industry Data Security Standard Audit Readiness

14 January 2026

SUPPLIES, SERVICES AND PRICES

1. GENERAL

The Contractor will provide the experience necessary to complete the task outlined in the Statement of Objectives (SOO). The Contractor will utilize established policies, standards, and sound management principles in the performance of the SOO requirements and deliverables.

Description UNIT Total Price

CLIN 0001

4.1.1.1 A Project Plan and RASCI matrix will be created by

the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 60 days from contract award.

SV

(Services)

CLIN 0002

4.1.1.2 Strategic Compliance Roadmap Refinement: Review

prior gap assessment findings and planned roadmaps to establish a clear, prioritized path for addressing critical PCI DSS compliance gaps, providing targeted remediation strategies.

CLIN 0003

4.1.1.3 Risk Assessment: Evaluate the organization's risk

posture and identify potential vulnerabilities that could impact the security of cardholder data. Identify the current level of compliance at each AF installation worldwide and at AFSVC with the most current PCI DSS regulations.

CLIN 0004

4.1.1.4 Incident Response & Contingency Planning

Support: Assess existing incident response procedures related to POS systems and business processes, ensuring they are aligned with PCI DSS standards and include clear roles, responsibilities, and communication protocols for handling data breaches or security incidents.

CLIN 0005

4.1.1.5 Documentation & Reporting Support (Business

Expert): Review and assess documentation of PCI DSS compliance for business processes and POS systems, ensuring that appropriate evidence is available to demonstrate adherence to standards and facilitate audits.

CLIN 0006

4.1.2.1 Security Control Implementation & Remediation:

Potential implementation and remediation of non-compliant security controls and processes to meet the requirements of the PCI DSS. Identify and prioritize the AFSVC key work areas that must be addressed and provide solutions required to complete remediation within the agreed upon timeframe.

CLIN 0007

4.1.2.2 Vulnerability Management: Identify and address

vulnerabilities in the organization's systems and networks that could impact the security of cardholder data.

CLIN 0008

4.1.2.3 Merchant Services Optimization: Provide the

following services related to merchant accounts and payment processing, Merchant Account Setup/Reorganization

4.1.2.3.1 Payment Gateway Integration

4.1.2.3.2 Fee Optimization

4.1.2.3.3 Payment Technology Implementation

4.1.2.3.4 Ongoing Customer Support & Training

4.1.2.3.5 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

CLIN 0009

4.1.3.1 Audit Preparation Support: Assist with preparation

for PCI DSS audits, including providing guidance on remediation strategies and assisting with the collection of evidence for the audit.

SV

CLIN 0010

4.1.3.2 Audit Execution: Conduct a PCI DSS audit to

validate compliance by reviewing systems, documentation, and security controls, interviewing personnel, analyzing security data, and gathering supporting evidence.

CLIN 0011

4.1.3.3 Audit Findings & Remediation Plan: Present a

comprehensive report detailing the findings of the PCI DSS audit, including specific non-compliant areas and recommended remediation actions. The plan will include prioritized steps, timelines, and responsible parties for addressing each identified gap.

CLIN 0012

4.1.4.1 PCI DSS Discovery Report: Present a written report

to the COR within 21 days of completing the PCI DSS Discovery, containing:

4.1.4.1.1 Executive Summary: For management, visual, concise, covers scope, vulnerabilities, risk, and security posture comparison.

4.1.4.1.2 Narrative Body: Detailed, for non-technical

audience, explains process, findings, and strategic recommendations for resolving compliance issues.

4.1.4.1.3 Compliance Verification & Support: Review and

assess the effectiveness of controls and business processes related to network security and POS systems against PCI DSS requirements. This review will involve access to the PCI data repository containing Merchant and terminal ID files, documentation and artifacts (not direct access to live transaction databases). The outcome will be a report identifying any gaps in compliance.

CLIN 0013

4.1.4.2 Report on Compliance (ROC) Development: The

QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.4.2.1 Executive Summary

4.1.4.2.2 Scope of Assessment

4.1.4.2.3 Methodology

4.1.4.2.4 Detailed Findings and Observations for each PCI

DSS requirement

4.1.4.2.5 Validation of Compliance

4.1.4.2.6 Compensating Controls (if applicable)

4.1.4.2.7 Attestation of Compliance

4.1.4.2.8 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI

CLIN 1001

(Option Year 1)

4.1.5.1 Report on Compliance (ROC) Audit Preparation

Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies.

Perform audits as needed.

CLIN 1002

(Option Year 1)

4.1.5.2 Report on Compliance (ROC) Development: The

QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and Observations for each PCI

DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI

CLIN 1003

(Option Year 1)

4.1.6 A Project Plan and RASCI matrix will be created by

the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days from option year award.

CLIN 2001

(Option Year 2)

4.1.5.1 Report on Compliance (ROC) Audit Preparation

Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies.

CLIN 2002

4.1.5.2 Report on Compliance (ROC) Development: The

QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and Observations for each PCI

DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI

CLIN 2003

4.1.6 A Project Plan and RASCI matrix will be created by

the Contractor, with AFSVC approval, to identify roles and

CLIN 3001

(Option Year 3)

4.1.5.1 Report on Compliance (ROC) Audit Preparation

Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing

CLIN 3002

4.1.5.2 Report on Compliance (ROC) Development: The

QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and Observations for each PCI

DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI

CLIN 3003

4.1.6 A Project Plan and RASCI matrix will be created by

the Contractor, with AFSVC approval, to identify roles and

CLIN 4001

(Option Year 4)

4.1.5.1 Report on Compliance (ROC) Audit Preparation

Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing

CLIN 4002

(Option Year 4)

4.1.5.2 Report on Compliance (ROC) Development: The

QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and Observations for each PCI

DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness Support: Evaluate the

effectiveness of employee training programs related to PCI

CLIN 4003

(Option Year 4)

4.1.6 A Project Plan and RASCI matrix will be created by

the Contractor, with AFSVC approval, to identify roles and

TOTAL PRICE

CLIN 0014 Travel (Base Year and Option Years) SV

Cost will be provided by Contractor when requested by the CO or the COR

NOTES: Travel cost will be paid in accordance with the Federal Travel Regulation (FTR) https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation-ftr (see Travel Clause, Paragraph 29 of the NAF Standard Clauses).

https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation-ftr

This form can be adjusted as needed.