ATCH 07 Deliveries or Performances 14 Jan 26.pdf

ATCH 07 - DELIVERIES OR PERFORMANCES

Payment Card Industry Data Security Standard Audit Readiness

14 January 2026

DELIVERIES OR PERFORMANCES

1. Period of Performance (twelve months after receipt of award).

1.1. The NAFI requires delivery to be made according to the following schedule:

DELIVERY SCHEDULE

Payment Card Industry (PCI) Data Security Standard (DSS) Audit Readiness

CLIN Description NAFI Proposed Delivery Schedule

Contractor Proposed Delivery Schedule

0001 4.1.1.1 A Project Plan and RASCI matrix will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 60 days from contract award.

Within 60 days from contract award.

0002 4.1.1.2 Strategic Compliance Roadmap Refinement: Review prior gap assessment findings and planned roadmaps to establish a clear, prioritized path for addressing critical PCI DSS compliance gaps, providing targeted remediation strategies.

Within 60 days

0003 4.1.1.3 Risk Assessment: Evaluate the organization's risk posture and identify potential vulnerabilities that could impact the security of cardholder data.

Identify the current level of compliance at each AF installation worldwide and at AFSVC with the most current PCI DSS regulations.

Within 90 days

Contractor Proposed Delivery Schedule

0004 4.1.1.4 Incident Response & Contingency Planning Support: Assess existing incident response procedures related to POS systems and business processes, ensuring they are aligned with PCI DSS standards and include clear roles, responsibilities, and communication protocols for handling data breaches or security incidents.

Within 60 days

0005 4.1.1.5 Documentation & Reporting Support (Business Expert): Review and assess documentation of PCI DSS compliance for business processes and POS systems, ensuring that appropriate evidence is available to demonstrate adherence to standards and facilitate audits.

Ongoing, beginning 90 days after contract award.

0006 4.1.2.1 Security Control Implementation & Remediation: Potential implementation and remediation of non-compliant security controls and processes to meet the requirements of the PCI DSS. Identify and prioritize the AFSVC key work areas that must be addressed and provide solutions required to complete remediation within the agreed upon timeframe.

Ongoing, beginning 90 days after

0007 4.1.2.2 Vulnerability Management:

Identify and address vulnerabilities in the organization's systems and networks that could impact the security of cardholder data.

Ongoing, beginning 120 days after

0008 4.1.2.3 Merchant Services Optimization:

Provide the following services related to merchant accounts and payment

Within 90 days of contract end date.

Contractor Proposed Delivery Schedule processing, Merchant Account Setup/Reorganization

4.1.2.3.1 Payment Gateway Integration

4.1.2.3.2 Fee Optimization

4.1.2.3.3 Payment Technology

Implementation

4.1.2.3.4 Ongoing Customer Support &

Training

4.1.2.3.5 Training & Awareness Support:

Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

0009 4.1.3.1 Audit Preparation Support: Assist with preparation for PCI DSS audits, including providing guidance on remediation strategies and assisting with the collection of evidence for the audit.

Ongoing, beginning within 30 days after

0010 4.1.3.2 Audit Execution: Conduct a PCI DSS audit to validate compliance by reviewing systems, documentation, and security controls, interviewing personnel, analyzing security data, and gathering supporting evidence.

Ongoing, beginning within 90 days after

0011 4.1.3.3 Audit Findings & Remediation Plan: Present a comprehensive report detailing the findings of the PCI DSS audit, including specific non-compliant areas and recommended remediation actions. The plan will include prioritized steps, timelines, and responsible parties for addressing each identified gap.

Completed by August 2026.

Contractor Proposed Delivery Schedule

0012 4.1.4.1 PCI DSS Discovery Report:

Present a written report to the COR within 21 days of completing the PCI DSS Discovery, containing:

4.1.4.1.1 Executive Summary: For

management, visual, concise, covers scope, vulnerabilities, risk, and security posture comparison.

4.1.4.1.2 Narrative Body: Detailed, for

non-technical audience, explains process, findings, and strategic recommendations for resolving compliance issues.

4.1.4.1.3 Compliance Verification &

Support: Review and assess the effectiveness of controls and business processes related to network security and POS systems against PCI DSS requirements. This review will involve access to the PCI data repository containing Merchant and terminal ID files, documentation and artifacts (not direct access to live transaction databases). The outcome will be a report identifying any gaps in compliance.

Completed by July 2026.

0013 4.1.4.2 Report on Compliance (ROC) Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.4.2.1 Executive Summary

Completed by 14 September 2026

Contractor Proposed Delivery Schedule

4.1.4.2.2 Scope of Assessment

4.1.4.2.3 Methodology

4.1.4.2.4 Detailed Findings and

Observations for each PCI DSS requirement

4.1.4.2.5 Validation of Compliance

4.1.4.2.6 Compensating Controls (if

applicable)

4.1.4.2.7 Attestation of Compliance

4.1.4.2.8 Training & Awareness

Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

1001 (Option Year 1)

4.1.5.1 Report on Compliance (ROC)

Audit Preparation Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies. Perform audits as needed.

Ongoing, within 30 days from option year award.

1002 (Option Year 1)

4.1.5.2 Report on Compliance (ROC)

Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

Completed by 30 August (annually).

Contractor Proposed Delivery Schedule

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and

Observations for each PCI DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if

applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness

Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

1003 (Option Year 1)

4.1.6 A Project Plan and RASCI matrix

will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days of contract award.

Within 30 days from option year

2001 (Option Year 2)

4.1.5.1 Report on Compliance (ROC)

Audit Preparation Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing

Ongoing, within 30 days from option year award.

Contractor Proposed Delivery Schedule any findings or deficiencies. Perform audits as needed.

2002 (Option Year 2)

4.1.5.2 Report on Compliance (ROC)

Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and

Observations for each PCI DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if

applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness

Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

2003 (Option Year 2)

4.1.6 A Project Plan and RASCI

matrix will be created by the Contractor, with AFSVC approval, to identify roles

Within 30 days

Contractor Proposed Delivery Schedule and responsibilities of each stakeholder within 30 days of contract award.

3001 (Option Year 3)

4.1.5.1 Report on Compliance (ROC)

Audit Preparation Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies. Perform audits as needed.

Within 30 days

3002 (Option Year 3)

Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

4.1.5.2.4 Detailed Findings and

Observations for each PCI DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if

applicable)

4.1.5.2.7 Attestation of Compliance

Contractor Proposed Delivery Schedule

4.1.5.2.8 Training & Awareness

Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

3003 (Option Year 3)

4.1.6 A Project Plan and RASCI matrix

will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days of contract award.

Within 30 days

4001 (Option Year 4)

4.1.5.1 Report on Compliance (ROC)

Audit Preparation Support: Assist with preparation for PCI DSS audits, including reviewing prior audit reports and providing guidance on addressing any findings or deficiencies. Perform audits as needed.

Within 30 days

4002 (Option Year 4)

Development: The QSA will develop a comprehensive and accurate ROC that includes all required elements, such as:

4.1.5.2.1 Executive Summary

4.1.5.2.2 Scope of Assessment

4.1.5.2.3 Methodology

Contractor Proposed Delivery Schedule

4.1.5.2.4 Detailed Findings and

Observations for each PCI DSS requirement

4.1.5.2.5 Validation of Compliance

4.1.5.2.6 Compensating Controls (if

applicable)

4.1.5.2.7 Attestation of Compliance

4.1.5.2.8 Training & Awareness

Support: Evaluate the effectiveness of employee training programs related to PCI DSS compliance, identify gaps and recommend industry standard solutions.

4003 (Option Year 4)

4.1.6 A Project Plan and RASCI matrix

will be created by the Contractor, with AFSVC approval, to identify roles and responsibilities of each stakeholder within 30 days of contract award.

Within 30 days

1.2. The Contractor must annotate if the timeline for a Deliverable is concurrent with another Deliverable.

1.3. The NAFI will furnish with the Contractor an award or notice of award no later than the day the award is dated. Therefore, the Contractor should compute the time available for performance beginning with the actual date of the award.

2. DELIVERY POINT

All deliverables will be delivered to and approved by the Contracting Officer Representative

(COR).