RFQ Q_A 20 Apr 2026.pdf

# Questions

Is AFSVC’s expectation that the MSS provider will assume co-management of the AFSVC SIEM (QRadar) and how many SIEM’s (Consoles)? How many Event Collectors and Processors? How many actionable investigations result (Highs, Criticals) occur per month?

SOO 2.2 outlines a collaborative approach. Contractor will assist local teams with the recommendation, implementation, configuration, and day-to-day monitoring of security tools, including SIEM. The quantity information is expected to be determined during the Phase 1 Gap Analysis. There are 938 PCI network sites scanned.

What SEIM will be used and would you accept other SEIM’s? If migrating, would AFSVC want help with that migration?

Vendor gap assessment and tool recommendation requested (SOO 4.1.1)

The assumption is that app PCI DSS endpoint data is fed to the SIEM. Does AFSVC primarily see the engagement as Co-SOC or is there a perceived MDR element (where Endpoint EDR technology would also be co-managed and monitored)?

The objective is to achieve "self-sufficient operation" (SOO 1.3) by empowering and training local personnel (SOO 2.2). The contractor will provide hands-on support, act as a Tier 2/3 escalation point, and offer ongoing remote support (SOO 2.2), which is characteristic of a Co-SOC model.

As part of the Phase 1 Technical Tool Gap Analysis, the contractor will recommend a complete tool suite (SOO 4.1). If EDR is deemed necessary for PCI

DSS compliance, it should be included in the contractor's recommendation.

Would like to confirm this is under the DTIC IAC MAC contract vehicle? No, this is a new Non-Appropriated Funds requirement and is NOT associated with any other contract vehicles.

Is the intent for offerors to propose a single Firm Fixed Price for the entire base year (all phases combined), or will pricing be broken out by phase and/or CLIN? Should option year pricing be included in the initial quote?

Pricing will be broken out by CLINs and by Phases (see Pricing Sheet)

Is AFSVC willing to accept subcontractor or teaming partner past performance references where the prime contractor's personnel served in a lead technical role, even if the contract was held by another entity?

Yes. The Government evaluates the past performance of the offeror as a whole, which includes the prime contractor and any major subcontractors or teaming partners. The NAFI will assess the quality of recent performance, with an emphasis on efforts that are relevant to the requirements outlined in the SOO. See ATCH 06, para. 4.2.

Can AFSVC confirm the full list of required submission documents and whether all attachments (ATCH 01 through ATCH 14) have been released?

All attachments were released on SAM.gov.

8 For the approximately 70-80 installations NOT requiring hands-on support, is the contractor's role limited to remote monitoring and reporting, or are there additional deliverables expected at those locations?

The SOO (Section 1.5) states the scope includes deploying a standardized security Tool suite with centralized reporting for all installations.

9 Given that Phases 2 and 4 are at AFSVC's discretion pending Phase 1 results, should offerors price all four phases in the base proposal, or only Phase 1 with separate not-to-exceed estimates for Phases 2-4?

Yes, provide pricing estimate based on industry expertise.

10 The SOO references collaboration with a "Government-designated QSA firm" (SOO 4.1.1.1, 4.1.3.2.2). Is this QSA firm the anticipated awardee of RFQ F41999-26-Q-0007 (PCI DSS Audit Readiness), or is this a separate engagement? Understanding this relationship is critical for defining the collaboration model in our technical solution.

Yes. The SOO (Section 1.5) clarifies this is a separate and distinct effort from the PCI DSS audit itself, which is conducted by a separate, Government-engaged Qualified Security Assessor (QSA) firm. The contractor is expected to collaborate with the QSA but not perform QSA functions (SOO 4.1.1.1).

11 Will the Phase 1 gap analysis contractor have access to the QSA firm's current or in-progress assessment findings (e.g., SAQ-D results, identified control gaps) to inform the tool gap analysis, or is the contractor expected to perform an independent assessment of the CDE?

The SOO (Section 1.5) states that upon contract award, the Government will provide the contractor with access to available supporting documentation, which may include CDE scoping, inventory, network diagrams, and third-party service provider lists. There will still be independent CDE assessment required.

ATCH 06, Section 4.2 states that subcontractors completing at least 10% of the work require separate past performance evaluation. Is there a maximum percentage of work that may be performed by subcontractors, or any minimum work share required for the prime contractor?

No.

ATCH 01, Section 7.4.1 directs the CSOW narrative to address SOO Sections III–V and 6.5–6.11.

ATCH 06, Section 4.1 directs the CSOW to address SOO Paragraphs 3–6.12. Can the Government confirm the correct scope of SOO paragraphs to be addressed in the CSOW?

The CSOW will include, at a minimum, a narrative addressing paragraphs 3.0 through 6.12 of the Statement of Objectives (SOO). See ATCH 01 dated 16

April 2026.

For the installations that already have enterprise tools like IBM QRadar or Trellix deployed, will the scope of Phase 2 be limited to configuration and policy tuning, or will it require full re-deployment?

If existing tools are part of the approved solution, the work would likely be configuration and tuning.

15 For Phase 3 24/7 sustainment and continuous monitoring, please confirm whether AFSVC expects the contractor to provide active 24/7 monitoring and first-level alert triage for the CDE, or only on-call escalation, investigation, and remediation support after alerts are identified by Government/local personnel.

SOO Section 4.1.3.1 specifies Comprehensive 24/7 support services that encompass all operational security functions necessary to ensure the continuous monitoring and protection of the CDE. Primarily only escalations identified by government personnel and central scanning tools.

The RFQ requires that the deployed SIEM, DLP, and MFA tools integrate into a "centralized reporting framework that feeds data directly into the AFSVC central repository." What are the technical specifications, platform details, or API requirements for this existing AFSVC central repository?

The AFSVC PCI Central Repository is Telos Xacta.360 and Xacta.io, a federated, API-driven GRC platform that acts as AFSVC's authoritative PCI system of record and integrates with security tools via API + JSON ingestion. FedRAMP High authorized (cloud deployments) Ingestion path should be API-based or scheduled export (JSON) and adhere to all FedRAMP and NIST standards.

Do the existing tools (such as IBM QRadar and Trellix) already successfully feed into the AFSVC central repository, or will establishing this centralized reporting integration be part of the Phase 2 deployment?

Not currently, this integration will be part of the contractor's work in Phase 2.

18 The RFQ specifies that AFSVC is not looking for a fully vendor-managed SOC, but still requires 24x7 continuous monitoring and support. What specific monitoring and triage tasks (e.g., Tier 1 alert triage) are local IT staff expected to handle before escalating to the contractor's Tier 2/3 sustainment team?

The SOO (Section 2.2) states the contractor will act as a Tier 2/3 Sustainment Support escalation point. Local personnel will handle initial (Tier 1) monitoring and triage before escalating more complex issues. The goal is to empower local personnel for self-sufficient operation (SOO 1.3).

For the 1-hour suspected incident reporting requirement, will the contractor's team be directly monitoring the SIEM/DLP alerts 24x7 to trigger this notification, or will local personnel monitor the dashboards and notify the contractor for containment and eradication support?

SOO Section 4.1.3.1 states, A suspected security incident must be reported to AFSVC within one hour of the Contractor's initial awareness, regardless of the detection source or confirmation status. Once central tool reporting is successfully integrated into the PCI repository automated alerts and tracking will be implemented. Local personnel will be responsible for monitoring except for the ~30 without proper IT support per SOO Section 1.4.

What is the breakdown of users by role (e.g., privileged users, local IT staff) at installations needing hands-on support?

This data would be gathered during the Phase 1 Gap Analysis to properly scope the implementation of access controls and MFA.

What specific vulnerability scanning and penetration testing tools are currently in place (70% complete, full by July 2026), including versions and configurations?

AFSVC has a robust vulnerability management program featuring automated scanning and regular penetration testing in collaboration with Mid-Atlantic

Broadband (MABB) and Fortra.

Can you provide details on the current payment stack (e.g., Aloha POS, Ingenico Move 5000) and any existing enterprise technologies like IBM QRadar or Trellix?

Aloha and Ingenico Move 5000 are the primary in-scope terminals. Additional data provided after kick-off, but majority of this detail would be gathered during the Phase 1 Gap Analysis to properly scope the implementation of access controls and MFA.

For the enterprise security suite (SIEM, DLP, MFA), what integration requirements exist with the AFSVC central repository for centralized reporting?

Central repository ingestion path should be API-based or scheduled export (JSON).

What are the precise specifications for prioritizing modern, automated, cloud-based tools in the Phase 1 Gap Analysis recommendations?

The preference is to enable enterprise-scale security control coverage across all installations, with centralized visibility and management. Contractor to recommend tools that align with this strategic direction during the Phase 1 Gap Analysis.

Does the scope require contractor-led monitoring of scanning/pen testing dashboards and security logs, or only oversight and remediation guidance?

Primarily oversight and remediation guidance. Once central tool reporting is successfully integrated into the PCI repository automated alerts and tracking will be implemented. Local personnel will be responsible for monitoring except for the ~30 without proper IT support per SOO Section 1.4.

What specific incident response activities are expected (e.g., containment, eradication, recovery), and how do they integrate with local teams?

The contractor's expected experience includes incident response procedures covering containment, eradication, and recovery (SOO 3.2.1.3). The contractor will act as a Tier 2/3 escalation point (SOO 2.2) to support local teams and will provide Incident Response Assistance Reports (SOO 4.1.4.2).

For 24x7 support services covering all CDE operational security functions, what are the exact SLA response/resolution times for Critical, High, Medium, Low incidents?

Response times are required in accordance with the latest PCI DSS version (currently 4.0.1) and outlined in our PCI Security policy available upon contract award.

Is 24x7 support primarily remote/on-call, or does it include on-site presence for steady-state operations at the 20-30 installations?

SOO Section 4.1.3.1 states primary support must be delivered remotely, with cost-efficient staffing models, including 'on-call' support, preferred. On-site presence is not the primary mode for steady-state operations.

Confirm Government procures all software/hardware/licensing—does this include any recurring fees for the recommended tools (SIEM, DLP, MFA)?

The government is open to either government or contractor procured solution. The contractor is required to deliver a detailed cost analysis for all recommended tools (SOO 4.1.1.3.2), which would be includive of all fees.

Are there preferred vendors or existing contracts for tool procurement that the contractor must align with?

No.

What level of hands-on support is required post-deployment (e.g., Tier 2/3 escalation, surge for assessments/incidents) at sites without local expertise?

The SOO (Section 4.1.3) describes a technical support model that provides both steady-state daily operations to up to 30 installations and flexible surge support for key activities such as assessment cycles, large-scale remediation efforts, and incident response events. The contractor will also act as a Tier

2/3 escalation point (SOO 2.2).

32 For Phase 2 (System Deployment), if remote access is insufficient for certain complex implementations at the 20-30 remote sites, will the Government allow us to utilize "smart hands" (local base personnel acting under our remote guidance) to avoid deployment delays, or should we anticipate traveling to these sites for the initial deployment?

Yes, enabling local self- sufficiency is the goal. The use of "smart hands" is plausible, per SOO 4.1.2.2 the contractor provides expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions.

Could the government kindly share information on whether there are any pain points or challenges with this contract that we should be aware of while proposing a solution?

The SOO (Section 2.0) highlights the primary challenge - a lack of on-site IT support with specialized expertise in vulnerability management and advanced security tool operation. This deficiency and the need to build capacity for self-sustainment are the core problems to be solved. Of important note, there are ~938 individual PCI network sites.

Is there any specific methodology / tools Dept of Defense that we should be aware of while proposing a solution?

The SOO (Section 3.2.2) states that experience with DAF/DoW IT Environments...including familiarity with their unique security policies, procedures, and infrastructure is a preferred qualification. Section 6.9.2 also requires compliance with NIST SP 800-53, CISA directives, DoD 8500 series, and the DoD Risk

Management Framework (RMF). AFSVC's vulnerability management program features automated scanning and regular penetration testing in collaboration with Mid-Atlantic Broadband (MABB) and Fortra. Installation specific decentralized Tools will be identified during the phase 1 gap

35 Could the government kindly extend the proposal due date by one week?

Yes, RFQ close date is extended until 4:00PM, CST, Thursday, 7 May 2026.

What security controls are currently in place (e.g., firewalls, encryption, access management)?

AFSVC has implemented comprehensive security controls aligned with PCI standards, including operational boundary firewalls and Point-to-Point

Encryption (P2PE) to safeguard the Cardholder Data Environment. Our proactive approach includes a robust vulnerability management program featuring automated scanning and regular penetration testing in collaboration with Mid-Atlantic Broadband (MABB) and Fortra.

How much (%) of the infrastructure is in cloud? AFSVC is working toward a more cloud hosted target state, but is currently at less than 25%.

Can the Government provide: (a) the anticipated number of on-site visits expected during the base year of performance; (b) the estimated average duration per visit; and (c) whether any in-scope installations are located OCONUS?

Per SOO (Section 1.4), direct technical support will be furnished for up to 30 installations, primarily located in CONUS. The support will consist of a hybrid of onsite and remote expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions. Per SOO (Section 4.1.1) gap assessment will be required to conduct a thorough gap analysis, which could inlcude up to 5 site visits dependent upon solutioning ability via central data.

ATCH 10 requests Past Performance Information within the last five years. May offerors submit past performance references performed by proposed Key Personnel under a prior employer, where the offeror is a recently established entity?

Yes. The Government evaluates the past performance of the offeror as a whole, which includes the prime contractor and any major subcontractors or teaming partners. The NAFI will assess the quality of recent performance, with an emphasis on efforts that are relevant to the requirements outlined in the SOO. See ATCH 06, para. 4.2.

40 Following Phase 2 implementation, will the contractor maintain persistent access to the deployed monitoring and alerting infrastructure during Phase 3, or will AFSVC operate the tools and escalate to the contractor upon identified events?

To fulfill the Phase 3 requirement for 24/7 support services, AFSVC will escalate to the contractor upon identified events except in the case of the ~30 installations without proper IT support per SOO Section 1.4. To ensure the continuous monitoring and protection of the CDE (SOO 4.1.3.1), the contractor may require persistent access to the monitoring infrastructure or, at a minimum, receive central repository alerts for certain locations.

41 Section 4.1.1.3.3 references a target Phase 2 initial completion date of August 2026. Will this date be adjusted based on actual contract award date, or is it a firm requirement regardless of when award is made?

It is a firm date regardless of when award is made in order to attain a succussul PCI Report on Compliance (ROC) in September 2026, unless the QSA deems a remediation plan is acceptable for a ROC with conditions.

42 For pricing purposes, is the 30-installation ceiling a firm planning figure, or will the actual number of in-scope installations be determined during Phase 1 and reflected in a contract modification before Phase 2 begins?

Yes, the 30-installation ceiling a firm planning figure for installations lacking required IT support. Phase 3 support is for a subset of no more than 30 installations (SOO 4.1.3.1).

43 How many installations are expected to require on-site physical presence during Phase 2 versus remote guidance? The SOO authorizes travel for efforts that cannot be completed remotely but does not quantify the expected frequency.

Per SOO (Section 1.4) Locations: Estimated 20-30% of 104 worldwide locations lack the required IT resources to ensure attainment and sustainment of

PCI Compliance. At a minimum 30 installations will require direct, hands-on support, either remotely or onsite, as needed. AFSVC cannot determine the travel frequency to this subest of locations, but at least once annually should be planned.

Will the government-furnished equipment provided at contract kickoff include access credentials and remote connectivity to all in-scope CDE environments, or will the contractor be responsible for establishing access independently at each installation?

GFE will be furnished and accesses to required envorinments will be granted upon receipt of completion of proper security meaures, specifically obtaining Common Access Cards (CACs) per SOO 6.7.3.

Will the Government consider commercial PCI DSS experience equally relevant to federal experience making it less restrictive?

The SOO (Section 3.2) requires a minimum of five years of hands-on cybersecurity experience. Experience with Federal Government or DoW is highly desirable and experience with DAF/DoW IT Environments is a preferred, not required, qualification (SOO 3.2.2). Strong commercial PCI DSS experience will be considered relevant.

Will CPARS evaluations be used in lieu of, or in addition to, PPQs?

No. We don't have access to CPARS as this is a Nonappropriated Funds (NAF) Solicitation not Appropriated Funds.

See ATCH 01, paragraphs 11.3-11.3.6

What level of relevance is expected for past performance (e.g., PCI DSS-specific, cybersecurity operations, federal/DoD experience)?

See SOO, para. 3.2 and ATCH 01, para. 4 and ATCH 06, para. 4.2. Acceptable: Present/past performance effort involved similar scope and magnitude of effort and complexities this solicitation requires.

Are there budget constraints or ceilings for implementation and sustainment? This is a competitive award and the Government is seeking industry to establish ceilings for implementation and sustainment.

Are there standard formats/tools (e.g., SharePoint, ServiceNow, Jira) required for reporting?

The government is open to contractor project managment solutions. Tools reporting will be required to integrate with the PCI Repository via API-based ingestion or scheduled export (JSON).

Should training materials align with DoD-specific frameworks (e.g., DoDM 8140.03)?

SOO Section 6.7.1 requires contractor personnel to have certifications that align with DoDM 8140.03. While not explicitly stated that the training materials for local staff must align, it would be a best practice to ensure the content is consistent with DoD cybersecurity workforce requirements.

May we include additional pages for abbreviations and references, and will those be excluded from the stated page limit?

See ATCH 01, para. 7.8

Is there a defined target architecture for the enterprise security suite, or is the contractor expected to fully design it?

SOO Section 4.1.1 requires the contractor to perform a Technical Tool Gap Analysis and Solution Strategy and deliver recommendations for a complete

Tool Suite and a Solution Implementation Strategy document. The contractor leads the technical effort by performing the gap analysis, designing the target architecture, and recommending a comprehensive security tool suite. The government facilitates the project by providing system access and technical oversight while maintaining final approval authority over the implementation strategy. Both parties work collaboratively to deploy and validate the new suite, ensuring the successful closure of all identified PCI security gaps across the enterprise.

What is the expected depth of training (awareness vs. hands-on operational capability)?

The objective is to empower local personnel for self-sufficient operatiion (SOO 1.3). The training program is expected to Transfer specialized knowledge and skills to local IT staff, enabling them to independently manage vulnerability remediation and operate PCI-specific security tools (SOO 2.2), including a 'Train-the-Trainer' Program" (SOO 4.1.3.3.2).

What is the expected depth of training?

The objective is to empower local personnel for self-sufficient operatiion (SOO 1.3). The training program is expected to Transfer specialized knowledge and skills to local IT staff, enabling them to independently manage vulnerability remediation and operate PCI-specific security tools (SOO 2.2), including a 'Train-the-Trainer' Program" (SOO 4.1.3.3.2).

Are there existing training platforms or LMS systems? Yes, Genius and Blackboard are the primary existing training platforms.

What are the data retention and logging requirements?

SOO Section 6.12.3 states that Data retention and disposal procedures must comply with Requirement 3.2 of the PCI DSS. SOO 6.12.2 requires that All cardholder data access must be logged and monitored per Requirement 10. These PCI DSS requirements mandate that audit logs be retained for at least one year, with a minimum of three months immediately available for analysis.

Are there performance/scalability benchmarks for the centralized reporting platform?

Performance/scalability benchmarks would be defined by the contractor for discusson wih the government as part of the Solution Implementation

Strategy in Phase 1.

What level of Government staff availability exists for collaboration? AFSVC has a central PCI Team available for collaboration. SOO Section 5.3 outlines a regular meeting schedule, including Weekly Status Meetings.

How will training effectiveness be measured?

Training effectiveness will be measured by the number of Tools related questions (implementation, management, alerts, etc) coming from the field to the AFSVC central PCI team tracked in the PCI repository.

What level of involvement is expected in forensics?

The contractor's role is focused on incident response (containment, eradication, recovery) and support. Deep forensic analysis is a specialized function handled by a separate team, but the contractor will be required to support with evidence and reporting, as requested.

How will deliverable acceptance be evaluated beyond COR approval? See SOO, para. 4.3 and ATCH 07, para. 2.

How should offerors plan for transition between phases?

It is the offeror's responsibility to develop and propose a comprehensive approach to project management and scheduling that ensures a smooth and efficient transition between all phases of the contract in accordance with the requirements of the SOO.

How should contractors handle incomplete inventory?

The SOO (Section 1.4) acknowledges that the Complete inventory of the Cardholder Data Environment (CDE) and payment application configurations is in progress (70% complete), now 85% complete and projected to be 100% complete by August 1.

What contingencies are expected for resource-constrained installations?

This contract is the contingency. The SOO (Section 2.0) states the effort is needed because of a lack of on-site IT support with specialized expertise. The contractor is expected to provide hands-on support, training, and documentation to augment these resource-constrained installations and build their capacity for self-sustainment.

Can the Government confirm that **privileged actions (e.g., requiring Tier II/III admin rights)** will be executed by local IT personnel or existing vendors, with the Contractor providing coordination, validation and application configuration?

SOO Section 4.1.2.2 states, The Contractor provides expert, hands-on guidance while designated government personnel or CDE vendors execute final privileged actions. This confirms the contractor's role is to guide, not execute, privileged actions.

For Phase 2 activities, can the Government clarify whether the Contractor is expected to **guide and coordinate implementation**, rather than perform full deployment of security tools?

The role is a mix. SOO 4.1.2.1 states the contractor will Install, configure, and ensure proper integration of all approved security tools. However, for privileged actions, the contractor's role is to provide expert, hands-on guidance while government personnel execute the actions (SOO 4.1.2.2).

Can the Government clarify any known constraints or dependencies with existing contracts or vendors that may impact **implementation sequencing or coordination**?

The only known dependency would be with the completion of the network securtiy and scanning implementation, targeted for August 1, 2026.

Can the Government confirm whether the Contractor may propose a **phased prioritization approach**, focusing initial efforts on higher-risk installations before scaling enterprise-wide?

Yes.

Can the offerer confirm intended start date for the base year so that the contractor can price accordingly for number of months preparation that must occur before the audit?

The Government cannot guarantee a specific start date but within 90 days of RFQ closing.

Can the Government clarify the minimum level of detail required in the Contractor Statement of Work

(CSOW) for a proposal to be rated “Acceptable” under Factor 1 See ATCH 06, para. 4.1.

Of the SOO paragraphs (3–6.12), does the Government consider any specific requirements higher priority for evaluating technical acceptability, or will all paragraphs be evaluated equally?

All paragraphs will be evaluated equally, either acceptable or unacceptable.

Under Factor 3, can the Government clarify how it will determine whether a proposed price is realistic versus “unrealistically low” for the purpose of price realism evaluation?

Based on competition and the Government IGCE.

Will the Government provide additional guidance or examples of what constitutes “materially unbalanced” pricing for this solicitation?

Based on competition and the Government IGCE.

Can the Government clarify whether all SOO tasks require continuous support throughout the Period of

Performance, or whether certain tasks may be performed on an as‑needed or surge basis while still being deemed technically acceptable?

The SOO (Section 4.1.3) specifies a support model that includes both steady-state daily operations for some installations and flexible surge support for key activities like assessments and incident response. This indicates that not all tasks require continuous, day-to-day effort.

PCI DSS Compliance Technical Support & Sustainment (AF Installations) Questions and Answers 20 April 2026