ATCH 15 Q_A 14 Jan 2026.pdf

# Questions Answers 1 QSA requirement and proof of cerƟficaƟon

a. Is a PCI QSA required as the Prime contractor, or is it acceptable for the QSA function to be performed by a subcontractor/teaming partner?

b. If a subcontractor QSA is acceptable, will proof of QSA certification be required with the quote, or only within 10 calendar days after award?

a. See quesƟon 62 of ATCH 13 Q A 3 Dec 2025.

b. See 7.2 of ATCH 01 InstrucƟons to Contractors 3 Dec 2025.

2 Format requirements for deliverables Please confirm any required formats/templates for key deliverables ( Project Plan + RASCI, Strategic Roadmap, Risk Assessment, Discovery Report, ROC artifacts) and whether Government-provided templates must be used.

See SOO paragraph 4.1.

3 The RFP menƟons that the vendor will have a dedicated COR assigned to the project however will the 3rd party consultants be given AFSVC email addresses and a list of key contacts to liaise with?

Per SOO para 6.1. The key Contractor resources will work directly with the assigned NAFI Contracting Officer Representative (COR) any other points of contacts will be provided through the COR. Yes, Air Force emails will be issued to the key Contractor resources for the duration of the project.

4 PCI DSS scope and version.

a. Please confirm the PCI DSS standard/version to be used for this effort (PCI DSS v4.0, or another specified baseline).

b. Please confirm whether the Government is seeking a formal QSA-signed ROC as part of the base period deliverables, or “audit readiness” support culminating in ROC development per the schedule.

a. PCI DSS v4.0.1 or later (anticipated update coming this spring) per SOO Section 3.

b. Both - Refer to SOO 4.1.1 - 4.1.4 for audit readiness and 4.1.4.2 and 4.1.5 specifically addressing culmination to the ROC.

5 Deliverable acceptance and “kickoff” definiƟon.

a. For the 30/60/90-day deliverables, does the clock start at “date of award,” “notice to proceed,” or the “kickoff meeting date”?

b. Who is the approval authority for deliverable acceptance (COR only, or COR +

CO/CS)?

Clock for deliverables starts within 60 days of contract award. COR will be the acceptance & rejection authority. See SOO paragraph 4.2 & paragraph 2 (Delivery Point) of ATCH 07 Deliveries or Performances dtd 14 January 2026.

6 Travel expectations for planning purposes (pricing handled per FTR) For planning/scheduling only (not pricing), please indicate the expected approximate number of site visits during the base period and whether OCONUS visits are anticipated.

AFSVC is currently in the process of developing a central data and evidence repository for the bulk of the assessment with a statistically representative sample of 15-20 sites, including OCONUS, physically assessed annually.

7 Access to required repositories and data.

Please confirm the expected timeline post-award for granting contractor access to the PCI Data Repository / file sharing resources referenced in the SOO, and any constraints on tools, endpoints, or remote access (GFE-only, VPN requirements).

GFE and full access requires a CAC, timeline depends on current CAC status or acquiring timeframe. In the meantime, select unclassified files can be shared via DoD Safe.

8 Data sensiƟvity / handling requirements.

Please confirm whether any of the artifacts/data provided will be designated CUI and whether any specific marking, storage, encryption, or transmission requirements apply beyond the secured email submission requirement.

Artifacts and data will be controlled unclassified information - internal or DoD. No storage required. Vendor must acquire a CAC and GFE, access will be granted to appropriate ednvironments.

9 OpƟon year exercise assumpƟons For scheduling purposes, please confirm whether the annual ROC-related support in option years is expected to align to a fixed annual target date ( late August each year) and whether the Government anticipates exercising the first option year immediately after the base period, subject to funding/need.

The option years for ROC-related support will align to the Fiscal Year budget and funding approvals, likely commencing in October of each year.

10 Do any payment channels uƟlize scope reducƟon technologies (P2PE, ecommerce iframe, etc.) that would thus be eligible to reduce applicable controls (as outlined in PCI FAQ 1331 / PCI ROC section 3.1)?

Scope is managed centrally, with a majority of business activities leveraging P2PE solutions or devices. A centralized e-commerce solution is being piloted in FY26 to drive standardization and further reduce scope.

11 Do you outsource any services or security funcƟons that are in scope for PCI DSS compliance to third parties? If yes, please describe.

Network security, scanning and PenTesting are outsourced; POS hardware is partially outsourced.

12 Has AFSVC implemented standardized processes and controls across the environment - to provide consistency between each item in sample sets and facilitate reduced sample sizes—for example, automated system build processes, configuration change detection, etc.? Please describe.

AFSVC has implemented a range of standardized processes and controls across its environment to provide consistency, enhance efficiency, and facilitate reduced sample sizes for audits and assessments. The approach centers on a centralized oversight model, with dedicated teams and comprehensive documentation to standardize everything from Policies and accountability, Merchant approval, change control and vulneraiblity managment processes to IT infrastructure and POS solutions.

13 Can you provide details around AFSVC's informaƟon sharing technologies and capabilities? In the past we have used Air Force specific sites for requesting and downloading documentation.

Select unclassified files can be shared via DoD Safe.

Questions and Answers 14 January 2026

14 What are the expectaƟons around onsite versus remote acƟviƟes? Some of the bases requiring onsite work might be in difficult to get to countries/areas.

AFSVC is currently in the process of developing a central data and evidence repository with remote access for the bulk of the assessment with a statistically representative sample of 15-20 sites representing 60-80% of transactions physically assessed annually.

15 Past Performance quesƟonnaires (PPQs) process

a. Will PPQs be sent directly by the Government to the points of contact listed in the Offeror PPI worksheets?

b. Is there a recommended lead time or any deadline by which references must respond to PPQs for consideration?

See 11.3.6. of ATCH 01 Instructions to Contractors 3 Dec 2025. a. Information will be sent to the references directly from Contracting Officer/Contracting Specialist.

b. CO/CS will provide respond by date to reference.

16 Secure submission method and file limits

a. For the “secured email” requirement, is password-protected PDF/ZIP acceptable, or is a specific encryption method required ( DoD SAFE, S/MIME, encrypted portal)?

b. Is there a maximum total email size / attachment size limit, and do you prefer multiple emails if the package exceeds that limit?

a. See ATCH 01 Instructions to Contractors dtd 3 Dec 2025, Paragraph 5.4 The email containing the documents should be password protected not the individual documents. Quotes can be sent in an email in a zip file.

2. See ATCH 01 Instructions to Contractors dtd 3 Dec 2025, Table 2 for volume page limits. If quote response is kept to these limits it will not exceed any email limits.

17 Pricing submission format / Government template:

We understand pricing will be submitted in accordance with ATCH 05 (Supplies, Services and Prices) and the ATCH 01 requirement to include an incremental and total price summary (submitted in PDF). Please confirm whether the Government will provide a pricing template or cost model (e.g., spreadsheet) for submission, or whether offerors should submit pricing using their own format as long as it clearly aligns to the CLIN structure in ATCH 05 and includes the required incremental/total summary.

Contractors can convert provided ATCH 05 Supplies Services to a "Word or Excel" document to utlize and/or provide your own document in same format. As stated at bottom of ATCH 05 "This form can be adjusted as needed".

18 Invoicing cadence and payment process.

Please confirm the expected invoicing cadence ( monthly) and whether any additional administrative steps are required for payment via NAF Purchase Card, including the withholding/retainage structure described in the Contract Admin Data.

See paragraph 4, ATCH 08 Contract Admin Data dtd 3 Dec 2025. Air Force Services Center’s contract payment schedule is 75% of the contract amount (not including travel) will be divided over the base period of the contract. 25% will be held back until the final delivery is received & accepted for the base period of the contract.

Option years will be billed seperately from the base period

19 Quote validity period (apparent inconsistency):

ATCH 06 states quote validity of at least 120 days, while ATCH 01 states at least 180 days. Please confirm which quote validity period governs for this solicitation.

See corrected paragraph 3, ATCH06, Evaluation Factors. Quote validity is at least 180 days.