RFP Section C - CPCS SOO .pdf

F41999-26-R-0003

COMMERCIAL PURCHASING CARD SERVICES

DATED 20 AUG 2026

C-1

SECTION C

STATEMENT OF OBJECTIVES (SOO)

FOR

NON-APPROPRIATED FUND (NAF) COMMERCIAL PURCHASE CARD

SERVICES

C. SECTION C – STATEMENT OF OBJECTIVES

C.1. OBJECTIVE: The Air Force Materiel Command, Air Force Services Center

(AFMC/AFSVC) is seeking a web-based solution which must be commercially available, and (multi) web browser accessible to provide organizational purchase card services. The requirements described in this SOO are necessary to support a worldwide program. Note all references to regulations and statutes are subject to change throughout the duration of the solicitation and contract period of performance.

C.2. GENERAL: AFSVC, is a Non-Appropriated Fund Instrumentality (NAFI

Agency/Organization) located at Joint Base San Antonio-Lackland, Texas that provides services programs and activities to build and sustain ready and resilient Airmen and families. AFSVC supports the bases, major commands, and air staff by providing technical assistance, new initiatives, developing programs, procedures and managing central support functions. The current commercial purchase card system supports morale, welfare, recreation and resale programs. The data below reflects the amount of spend for NAFIs currently being supported.

Historical Program Data:

C.2.1. This agreement will be open to other NAFI Agency/Organizations, therefore all references to NAFI Agency/Organization will be interchangeable with any NAFI

Agency/Organization that elects to join this agreement.

C.3. OFFEROR MINIMUM QUALIFICATIONS: The offeror shall be an FDIC-insured, credit-card issuing; commercial bank, credit union, or savings institution. The offeror shall have assets of $1.5 billion or more and capital of $100 million or more that involve similar scope and magnitude of effort and complexities this solicitation requires. The

Calendar Year CNIC USNA MCCS NEXCOM AFS CY25 $131,719,727.00 $18,459,894.00 $58,651,045.00 $54,622,911.00 $223,007,434.00 CY24 $139,322,489.00 $12,164,905.00 $40,972,873.00 $38,715,909.00 $238,102,850.00 CY23 $172,014,401.00 $15,887,753.00 $57,835,616.00 $53,826,366.00 $215,944,971.00 CY22 $139,787,775.00 $15,897,633.00 $50,365,207.00 $46,108,248.00 $198,891,433.00 CY21 $135,968,386.00 $13,043,308.00 $47,006,699.00 $25,706,070.00 $194,181,087.03

Annual Purchase Card Spend

C-2 offeror shall have regularly and continuously engaged in the business of providing purchasing cards for a minimal twenty (20) organizations that meet or exceed the scope requirements below for at least five (5) years as evidenced by references submitted.

C.4. PROGRAM REQUIREMENTS: The purchase card program system solution must contain the following elements:

C.4.1. Unique Bank Identification Number (BIN): The Offeror shall provide a singular unique prefix common to each card issued under this contract. The Offeror shall not utilize the same numbering system or sequence for other business purposes. It is imperative that the numbering system be unique to the Government, as it serves as an important control mechanism to access government-only products and services. AFSVC reserves the right to require multiple prefixes, separate numbering systems or sequences for control purposes. The Offeror shall provide

AFSVC with a list of the Bank Identification Numbers (BINs) they will be utilized for the purposes of this contract with their proposal submission. All BINs provided by the Offeror must be approved by the AFSVC Contracting Officer before cards are developed for this contract.

C.4.2. Electronic Access System (EAS) Web-Based Software: The Offeror shall provide a secure, internet-based electronic access system (EAS) that allows two-way communication between the NAFI Agency/Organization and the Offeror, and which performs the functions as described below. The Offeror, at its expense, shall provide all associated software and communication connections required, to allow each requesting NAFI Agency/Organization to connect with and facilitate the timely exchange of data between the Offeror and the NAFI

Agency/Organization system. The electronic method of access must be compatible with a variety of computer systems (including personal computers and mainframes) to each requesting NAFI Agency/Organization level at the Offeror’s expense. This does not include providing to the requesting NAFI

Agency/Organization any underlying operating system (e.g., UNIX, OS/2, Macintosh, DOS, or Windows), commercially available web browser software

(e.g., Netscape Navigator, Microsoft Internet Explorer), computer hardware, or providing any instruction on how to use the underlying operating system or computer hardware. For access through modems, the Offeror shall provide each requesting NAFI Agency/Organization the appropriate communications parameter information and any necessary procedural information baud rate, function keys, screen sequences). Comply with all National Institute of Standards and

Technology (NIST) 800 requirements for the protection of Personally Identifiable

Information (PII).

1. The Offeror shall provide the file layout for each file as requested by the NAFI

Agency/Organization.

C-3

2. All program and transaction data shall be available electronically. At a minimum, the electronic access system shall:

a. Provide authorized individuals/systems with the ability to electronically access program data,

b. Provide authorized individuals/systems with the ability to maintain program and transaction data.

c. Provide single sign-on capability, if required by the NAFI

Agency/Organization, in accordance with the security requirements stated in

Paragraph 19, Security of the Statement of Objectives (SOO). Updates to user password shall apply to all Offeror systems.

d. Maintain a complete audit trail of all account activity, updates, and user activity by card management personnel (e.g., primary vs. alternate Program

Manager), as specified in section 19, Security.

e. Allow authorized individuals with the ability to post comments to accounts

(e.g. a detailed explanation of reason account was suspended).

f. Provide cardholders with online access to their accounts, including but not limited access to online statements and online payment options.

g. Provide authorized individuals/systems with electronic review and manipulation of all captured transaction information to include the ability to:

support electronic reconciliation and certification of invoices, sort data by any field, filter out unnecessary information, edit account allocation manually as needed, and split transaction amounts into sub-units for multi-account allocation. This includes summary roll-up, review, and manipulation at different levels.

h. Provide authorized individuals/systems with automatic default cost allocations for each transaction to include: the ability to assign an NAFI

Agency/Organization account code automatically to each transaction as determined by the Program Manager; to assign a code based on the merchant, merchant category, cardholder or any combination of these fields; the account code must be sufficiently long to accommodate the accounting string of any

NAFI Agency/Organization (maximum 150 characters); and the ability of the

Program Manager to override the default code (NAFI Agency/Organization will specify if they require multiple accounting codes at the task order level);

i. Provide the ability for users to electronically review, filter, manipulate transaction data and sort by a specific value in a line of accounting (e.g., searching and sorting by organization codes within a common line of accounting).

C-4

j. Provide authorized individuals/systems with the ability to flag and generate reports on transactions where state and local taxes have been assessed.

k. Provide authorized individuals/systems with standard commercial reports.

l. Provide authorized individuals/systems with the ability to generate reporting capabilities such as ad hoc reports.

m. Be user-friendly.

n. Provide user-defined date ranges (e.g., quarterly, biannually, annually, etc.)

for report generation.

o. Ensure that all program and transaction data of the government card program(s) is secured, at a minimum according to standard commercial practices and as required in Paragraph 20, Security

p. Update program and transaction data (to include delinquency information) as listed in Paragraph 4.4, Data Management & Transaction Support to reflect all payments and transactions as of 11:59 p.m. EST on the previous business day;

q. Provide connectivity that facilitates electronic information sharing among agencies/organizations to include: the ability to allow multiple users concurrent access to the application and, if requested by the NAFI

Agency/Organization, allow data via a local or wide area network

(LAN/WAN); the ability to send email notification to cardholders of online statement availability; and a variety of connectivity options necessary to electronically link participating hierarchies of the NAFI Agency/Organization using the agency’s/organization’s preferred technology (options shall include

LAN, WAN, client/server, internet, and e-mail);

r. Provide authorized individuals/systems with the ability to download data from the system. This includes the automatic creation and daily transmission of files containing accounting data (via secure electronic transfer) to NAFI

Agency/Organization internal accounting systems. The Offeror shall provide program and transaction data in a format and frequency specified at the task order level (See 4.4, Data Management and Transaction Support). If requested by the NAFI Agency/Organization, this shall include a custom interface file to any internal system(s) designated by the NAFI Agency/Organization. This custom interface file shall be created in such a manner that it can be imported into the agency’s/organization’s system without interaction, special programming, or manual entry of transaction data. The Offeror must also have the capability to compress these custom interface files into zip files. The

Offeror shall make adjustments or updates to the NAFI Agency/Organization interface as required by the NAFI Agency/Organization for revisions to

C-5 agency systems, migration to new agency systems, and/or if the NAFI

Agency/Organization contracts with a government shared service center for financial management services; Provide authorized individuals/systems with the ability to discern how a transaction is completed (point of sale, internet, etc.), if passed by the merchant.

s. Provide authorized individuals/systems with the ability to change category block templates (e.g., Merchant Category Code (MCC) blocking templates), purchase limits, and activation status by hierarchy.

t. Provide robust connectivity options for multiple concurrent users.

u. Enable downloading of data from the system, including automatic daily transactions.

v. Allow users to discern how a transaction was completed.

w. Provide authorized individuals/systems with the ability to dispute transactions electronically, track transactions from the time of charge through final resolution of the charge, electronically cancel disputes, and automatically notify Program Administrator and cardholder of the final resolution and/or cancellation of dispute.

x. Provide a system for electronically disputing and tracking transactions.

y. Be available 24 hours a day, 7 days a week, with notice for routine maintenance and periodic upgrades for which the Offeror shall give a minimum of 30 calendar days’ notice prior to the event.

z. Be compliant with the requirements of Section 508 of the Rehabilitation Act.

aa. Provide authorized individuals/systems with the ability to limit the value of large intra-governmental transactions (e.g., not allowing transactions greater than $100,000);

bb. Provide the ability to accept and process cardholder applications online including the ability to track application status and verify receipt.

cc. Provide automatic activation and deactivation of accounts on the date specified by NAFI Agency/Organization. No transactions shall be authorized on a deactivated account. If an account is deactivated, the Government assumes no liability for transactions made on that account.

dd. Provide a purchase card log functionality with reporting capabilities from the purchase log data (e.g., aggregated strategic source data); and

C-6

ee. Be able to adapt to meet additional future requirements due to program volume growth and technological advances at the Offeror’s expense.

C.5. Data Management & Transaction Support: The Offeror shall interface with NAFI

Agency/Organization systems and provide program and transaction data in a format and frequency specified at the task order level.

C.5.1. The Offeror shall make adjustments or updates to the NAFI Agency/Organization interface as required by the NAFI Agency/Organization for revisions to agency systems, migration to new NAFI Agency/Organization systems, and/or if the NAFI

Agency/Organization contracts with a government shared service center for financial management services.

C.5.2. The Offeror shall establish consistency in interagency information sharing and government-wide data management, reporting, and analysis. The Government may define a uniform set of data and technology standards. These standards must establish:

1. Standard interface requirements for transmitting program and transaction data between Offeror systems and NAFI Agency/Organization systems. This includes, but is not limited to, infrastructure standards, security/privacy standards, data exchange format, and modes of transmission; and standard definitions for program and transaction data including, but not limited to, field names, descriptions, types, and length.

C.5.3. The Offeror shall, at a minimum

1. Provide the ability to receive and pass level 1, 2 & 3 transaction data.

2. Forward to the NAFI Agency/Organization all data received from the merchants and obtained by the Offeror, as described in the paragraph below; and

3. The Offeror shall support a secure interface to each NAFI Agency/Organization system (e.g. financial, procurement, data warehouse). The Offeror shall provide program and transaction data, including invoice data, at a frequency specified by each NAFI Agency/Organization. The Offeror shall provide the program and transaction data via secure electronic file transfer as requested by the agency. File formats that must be supported by the Offeror are XML, XBRL, and ASCII, unless otherwise specified by the NAFI Agency/Organization at the task order level.

4. The Offeror shall restrict access to program and transaction data and the ability to request changes to the information therein. Specifically:

C-7

a. Provide a single sign-on capability if required by the NAFI

Agency/Organization, in accordance with the security requirements stated in

Security Requirements. Updates to user password shall apply to all Offeror systems.

b. Maintain an audit trail of account activity, updates, and user activity by card management personnel (e.g., primary vs. alternate Program Administrator), as specified in Security Requirements.

c. Provide authorized individuals with the ability to post comments to accounts

(e.g. a detailed explanation of reason account was suspended).

d. Provide cardholders with online access to their accounts, including access to online statements.

C.5.4. The program and transaction data will be available through the Offeror’s electronic access system. The system shall be able to provide an electronic review of all captured transaction information to include the ability to: support electronic reconciliation and certification of invoices, sort data by any field, filter out unnecessary information, edit account allocation manually as needed, and split transaction amounts into sub-units for multi-account allocation. This includes summary roll-up, review, and manipulation at different levels.

C.5.5. The Offeror’s purchase card program system solution must allow for simultaneous access for 5000 users.

C.5.6. The Offeror must provide secure controlled username/password access to the system.

1. Password requisites must meet current NAFI Agency/Organizational protocol.

2. The Offeror must provide NAFI Agency/Organization with the capability to establish/reset passwords.

C.5.7. The Offeror must provide NAFI Agency/Organization with the capability to create hierarchy levels throughout with varying roles and levels of access and authority.

C.5.8. The Offeror must provide NAFI Agency/Organization with the capability to create customizable roles within the hierarchies based on duties assigned.

C.5.9. The Offeror’s purchase card system solution must allow users the ability to customize their individual view of the data.

C-8

C.5.10. The Offeror’s purchase card solution must provide the option to utilize system generated notifications (i.e. email) for pending actions.

C.5.11. The Offeror’s purchase card solution must provide NAFI Agency/Organization with the ability to upload and edit the chart of accounts data.

C.5.12. The Offeror’s purchase card solution must provide NAFI Agency/Organization with the capability to utilize a chart of account constraints based on roles and hierarchy.

C.5.13. The Offeror’s purchase card solution must allow users, based on the assigned role(s), to add transaction notes, review, approve and edit account data based on individual purchase.

C.6. ONLINE FUNCTIONALITY FOR AGENCY PROGRAM ADMINISTRATORS

(PA): The software capabilities must provide the PA with the ability to perform, but not be limited to, the following tasks:

C.6.1. Terminate/suspend/cancel accounts; effective immediately.

C.6.2. Adjust single and monthly purchase limitations, which will be available to the cardholder immediately.

C.6.3. Create new users and accounts.

1. Cards must be delivered within 5-7 business days.

2. The Offeror must offer an overnight rush delivery option.

C.6.4. Input and update addresses by the hierarchy

C.6.5. Adjust/restrict Merchant Category Codes (MCCs) by hierarchy and individual card accounts.

C.6.6. Create Merchant Category Groups to be utilized by Program Administrator (PA) to manage purchases.

C.6.7. Build customized fields to comply with business rules.

C.6.8. Ability to add/remove program features.

C.7. CONTROLS & RESTRICTIONS:

C.7.1. Cash advances will be prohibited.

C-9

C.7.2. Each NAFI Agency/Organization will determine the business rules of the overall program consistent with the terms of the agreement.

C.7.3. NAFI Agency/Organization will specify individual card:

1. Single Purchase Limitations

2. Monthly/Cycle Purchase Limitations

3. Daily Transaction Limitations

4. Restrictions by Merchant Category Codes

C.7.4. Program Administrators will have the authority/ability to communicate with the

Offeror directly to make specific account adjustments on behalf of the cardholder

(i.e. the status of ordered cards, change of expenditure levels, fraud, etc.)

C.8. GENERAL LEDGER/ACCOUNTING:

C.8.1. The Offeror must identify existing general ledger capabilities must be flexible to accommodate the NAFI Agency/Organization’s accounting fields.

C.8.2. The Offeror’s system must have the capability of being modified should NAFI

Agency/Organization require additional fields in the future.

C.9. REBATES: NAFI Agency/Organization shall receive a rebate for all products and services purchased using the government purchase card. The rebate shall be based upon the purchase card spend volume and payment volume. The DAF NAFI pays Net 7 days volume rate for purchases. The offeror may propose a flat rate rebate or choose to offer a tiered separately priced schedule based on different spending categories and those categories must be identified and listed the corresponding rebate percentage. The offeror is incentivized by the aggregate expenditure of all NAFI Agency/Organizations utilizing the contract based upon the total calendar year spending and the speed of payment. The offeror’s Rebate Management System will distribute rebate outputs to a designated account instead of the original transaction account or provide rebates through a process which the offeror and Government agree upon. The offeror will distribute rebates to each NAFI Agency/Organization based upon their respective portion of the aggregate spend. Rebate payments will be made on a quarterly basis no later than 30 days from the end of the quarter (Quarter will be aligned with fiscal year, Oct-Dec, Jan-Mar, Apr-Jun, and Jul-Sep). In addition, a quarterly report will be provided in Excel format (.xls or .xlw) thoroughly detailing rebate payment calculations at the time of payment.

C.10. SYSTEM SUPPORT:

C-10

C.10.1. The Offeror must provide its expert advice/recommendation to systematically prevent improper and/or fraudulent card abuse.

C.10.2. The Offeror must assist the NAFI Agency/Organization in developing a multi-tiered hierarchy within its card-management system enabling administrators to effectively monitor and control card activity by creating, managing, and editing profiles within the program.

C.11. SOFTWARE UPDATES/RELEASES:

C.11.1. The Offeror must notify the NAFI Agency/Organization prior to the release of any major update to allow 30 working days to evaluate the impact of such changes and assist NAFI Agency/Organization with accommodating changes with minimal interruption to its daily business. If the impact is significant to users, the Offeror will provide training aid with screen shots to facilitate users notifications.

C.12. CARD DESIGN/LOGO: The Offeror shall issue chip-enabled cards to the NAFI

Agency/Organization. The Offeror must work with the NAFI Agency/Organization administrators in designing/branding of the new cards. The plan must include, but not be limited to the following:

C.12.1. Card design

C.12.2. Card production

C.12.3. Card delivery to the designated address(es)

C.12.4. The card must contain the following:

1. Logo as designated by NAFI Agency/Organization

2. The phrase “For Official U.S. GOVERNMENT Purchases Only U.S. Government

Tax Exempt”

C.12.5. The following elements will be embossed:

1. Cardholder’s name, account number, expiration date and a 19-character alphanumeric field for NAFI Agency/Organization use (may be used for tax exempt number).

a. The rear of the card shall include the Offeror’s customer service toll-free telephone number TTY number (if different). The Offeror may include other information on the rear of care (e.g., e-mail address) as approved.

C.13. CREDIT SETUP:

C-11

C.13.1. Credit shall be based on NAFI Agency/Organization’s creditworthiness.

C.13.2. At no time shall credit or background checks of individual cardholders be made to establish credit limitations.

C.13.3. The Offeror will not report individual data to credit bureaus. This program shall not impact the credit score of any individual cardholder.

C.14. BILLING CYCLE/PAYMENT DEADLINES:

C.14.1. During the transition, the Offeror must work with NAFI Agency/Organization to establish billing cycle dates and payment deadlines that will apply to the remainder of the contract term.

C.15. CONTINUING PROGRAM REQUIREMENTS:

C.15.1. Dedicated Customer Service Representatives: The Offeror shall provide key skilled personnel together with the supervisory, management, and administrative services necessary to successfully meet the government requirements.

C.15.2. Key Personnel Categories: The skill categories listed below are essential for successful Offeror performance. The Offeror shall assign dedicated personnel to the listed positions below. Dedicated personnel are defined as personnel that solely manage and administer federal government accounts.

1. Project Manager: The Offeror shall designate a dedicated Project Manager to the

NAFI Agency/Organization for responsibilities including but not limited to:

a. Day-to-day and special support activities

b. Implementation

c. Billing

d. Reconciliation

e. Suspension

f. Cancellation

g. Transaction Overrides

h. Contract Administration

i. Supervision

C-12

j. Coordination

k. Customer service support

l. Transaction Support

i. This individual shall be well versed in all aspects of the card program(s), readily accessible, and be an overall point of contact for the NAFI Agency/Organization and contracting support staff. The

Offeror shall also designate an alternate in the event of the absence of the primary dedicated point of contact. The Offeror shall provide dedicated project management staff for the NAFI

Agency/Organization from 8:00 a.m. EST until 5:00 p.m. EST each business day.

2. Customer Service Representative: The Offeror provides dedicated Call

Center/Help Desk personnel and resources.

a. Customer Service Representative must be familiar with NAFI

Agency/Organization program.

b. The Customer Service Representative must be available 24 hours.

C.15.3. Additional or Replacement Card Distribution: The distribution of additional/replacement cards must be handled in the same manner as the initial disbursement of the cards.

C.15.4. Lost and/or Stolen Cards:

1. The Offeror must provide a 24-hour contact number to report lost or stolen cards.

2. The Offeror must immediately cancel and provide emergency issuance of a replacement for the reported lost or stolen card.

3. Replacement cards must be issued within 24 hours of being reported lost or stolen.

C.15.5. Transaction Dispute Resolution:

1. The Offeror must offer a transaction dispute resolution process pursuant to industry’s best practices.

2. The Offeror must describe the mechanism that would be set up for NAFI

Agency/Organization Cardholders to dispute charges attributed to their purchasing cards.

C-13

3. The transaction review process must be completed by the Offeror within ninety

(90) days of the dispute.

C.15.6. Ongoing Training: In addition to the initial program training, the Offeror must provide ongoing training and/or remedial support for all Commercial Purchase

Card Services appointed staff. This support must include:

1. Face-to-Face Training

2. Teleconferences

3. Recorded Presentations

4. Electronic Materials (i.e. FAQs, Manuals, etc.). The NAFI Agency/Organization reserves the right to adjust these materials in accordance with current business rules.

C.16. FINANCIAL MANAGEMENT SYSTEM (FMS) INTEGRATION

REQUIREMENTS:

C.16.1. The full benefits of a program cannot be achieved until Commercial Purchase

Card Services data is channeled directly from the Offeror’s card-management system into its FMS, thereby eliminating manual entry of data, human error, and additional paperwork. The Offeror must provide support, expertise, and a robust, secure process for implementing this integration.

C.16.2. Integration Support: The Offeror must provide support to assist NAFI

Agency/Organization with planning, developing, and implementing Commercial

Purchase Card Services/FMS integration. Support may include but is not limited to, requisite expert resources, data mapping and migration assistance, and an ongoing process for securely transmitting Commercial Purchase Card Services data from the Offeror’s software system to FMS.

C.16.3. Electronic Billing File: The Offeror must, at a minimum, provide billing files electronically for an interface to NAFI Agency/Organization’s FMS.

1. Files must contain all requisite Commercial Purchase Card Services purchase information.

2. All interfaces to and from the FMS system, which would potentially cause any change to the data, must be approved by NAFI Agency/Organization which owns the data. In the case of accounting interfaces, NAFI Agency/Organization must approve all interfaces with the accounting data.

C-14

3. The Offeror must provide an electronic billing file of all transactions for the card cycle formatted according to the needs of NAFI Agency/Organization.

4. The Offeror must work with the NAFI Agency/Organization to define the process for cost allocation, workflow, approvals, and mapping to General Ledger and payment.

5. The Offeror must work with NAFI Agency/Organization to create and test such a file and transmit the data on at least a daily basis in a secure and reliable manner, in accordance with NAFI Agency/Organization requirements and standards.

6. The Offeror must make all changes to the billing file format in the future if requested to do so by NAFI Agency/Organization.

C.17. DELIVERABLES/REPORTS:

C.17.1. Management Reports: The Offeror must provide reporting capability via a secure, Internet-based solution that meets NAFI Agency/Organization’s security needs for Internet viewing of financial information and transaction monitoring.

1. The Internet-based solution must provide NAFI Agency/Organization users with the ability to view Commercial Purchase Card Services transaction information using username/password-protected access.

2. In addition to providing the reporting capability, the Offeror must work directly with the NAFI Agency/Organization Commercial Purchase Card Services

Administrator and Agency Commercial Purchase Card Services Administrators to develop customized Agency reports that fulfill both current and future Agency requirements.

C.17.2. Program Management Reports: The Offeror must provide, via its online software system, reports that include, but are not limited to, the following Essential

Reports:

1. The Offeror shall offer its standard commercial reports. Where the following reports are required by the NAFI Agency/Organization, the Offeror shall provide them to the NAFI Agency/Organization through the Electronic Application

Software (EAS) via secure electronic file transfer, unless otherwise specified by the NAFI Agency/Organization at the task order level., for the time period (if applicable) and at the frequency (if applicable) requested by the NAFI

Agency/Organization.

2. User/Agency spend analysis.

3. Exception reports (i.e. declined transactions, disputed transactions, etc.)

C-15

4. User transaction reports including Level I, II, and III detail.

5. Financial settlement reports

6. Monthly billing

7. Agency expenditure data, as required by the Agency.

8. A summary report statement for each Cardholder each month

9. A consolidated Agency statement each month to the Agency Commercial

Purchase Card Services Administrator or his/her designee

10. Online queries for individual cardholder statements shall be printable.

NOTE: If the Offeror has a commercial report that will meet the stated specific need, it may propose that report in lieu of the one specified and demonstrate how the proposed substitution meets the need.

C.18. CARD USAGE:

C.18.1. Liability Waiver: The Offeror must assume all liability for any unauthorized use of cards, account numbers, etc. that are fraudulently used, lost or stolen pursuant to industry-wide best practices.

C.18.2. The Offeror must obtain and maintain standard insurance for purchase cards pursuant to industry-wide practices.

C.19. RECORD RETENTION AND RETRIEVAL

C.19.1. The Offeror shall be the Government’s agent for the document repository as it relates to all transactions under the card program(s). The Offeror shall maintain electronic records of all transactions for a period of 10 years. Upon written request of the Contracting Officer or Program Administrator, the Offeror shall provide the requested information in an electronic format within 30 calendar days, unless otherwise specified at no additional cost to the Government.

C.19.2. Offeror shall provide online access to data for a minimum of 36 months after the transaction occurs.

C.20. SECURITY

C.20.1. The Offeror shall, at a minimum, meet the security requirements/measures/procedures required of the Payment Card Industry (PCI)

C-16

Security Standards, as commercially applicable, and comply with all applicable

Department of the Air Force, Department of Defense (DoD), and Federal cybersecurity regulations for web-based applications hosting government data.

Additionally, the Offeror shall provide services and design technology systems that are compliant with all applicable sections of the U.S. Code and the Code of

Federal Regulations including, but not limited to:

1. All applicable Office of Management and Budget (OMB) Circulars.

2. All applicable Office of the Comptroller of Currency (OCC) regulations.

3. E-Government Act of 2002, Title III, Federal Information Security Management

Act (FISMA); and

4. Any other relevant legislation that is enacted throughout the course of the program.

C.20.2. Cardholder Data Security and PCI DSS Compliance Mandate: The Offeror shall deliver, operate, and maintain a web-based purchase card solution that achieves and maintains 100% compliance with the latest version of the PCI DSS for all transactional, processing, and storage components.

C.20.3. Verification, Responsibility, and Audit Trail:

The Offeror shall provide continuous, verifiable assurance of compliance throughout the life of the contract.

• The Contractor is required to deliver an annual Attestation of Compliance

(AOC) signed by a certified Qualified Security Assessor (QSA).

• The Contractor shall, in coordination with the Government, establish and maintain a detailed PCI DSS Responsibility Matrix to clearly delineate security boundaries between the Contractor and the Government. This matrix must be finalized within ninety (90) days of contract award and reviewed annually.

CRITICAL: The Government reserves the right to conduct independent security assessments, vulnerability reviews, and audits of the Contractor’s hosting environments and systems associated with this contract.

C.20.4. The Government anticipates that Offeror systems will store personal information

(e.g., social security numbers) as well as government financial and procurement information. The sensitive nature of this information requires the Government to implement additional security controls. For this reason, the Offeror shall physically maintain all systems that store government information, including all call centers, backup facilities, and other sites which store government data, in a

C-17 secure facility (or facilities) located within the United States. The Government recognizes that transactions will occur around the world and data must, therefore, travel over foreign data networks. As a result, authorized Government personnel located outside of the United States (such as cardholders and Program

Administrators) shall have role-based access to data and full EAS functionality, with appropriate levels of security necessary to protect the interests of the United

States government and its employees.

C.20.5. The Offeror shall ensure that all third-party data processing providers that handle government information shall meet or exceed the same security requirements/measures/procedures, as listed above. The Offeror is responsible for monitoring, updating, and maintaining compliance with the above requirements and regulations set forth in this section.

C.20.6. Incident Response and Government-Prioritized Notification:

The Offeror shall establish, maintain, and annually test a formalized Incident

Response Plan (IRP).

• Prior Notification Constraint: In the event of any suspected or confirmed security incident, data breach, or unauthorized access impacting government systems or cardholder data, the Contractor shall notify the designated

Government Contracting Officer (CO) and Contracting Officer’s Representative

(COR) within two (2) hours of initial discovery, and strictly PRIOR to releasing any information to the public, media, or other third-party entities.

• Response & Forensics: The Contractor's proposed IRP must detail rapid containment, mitigation, and eradication protocols, including immediate deployment of a certified PCI Forensic Investigator (PFI) at no additional cost to the Government. A copy of the PFI’s findings shall be delivered directly to the

Government CO and COR.

C.20.7. Security Plan:

1. The Offeror shall provide a plan that describes its security program and how the

Offeror shall satisfy the security requirements as identified in this section, including how improved security-related processes and technologies are to be incorporated into the master contract as they become commercially available. The plan shall address the Offeror’s security measures and safeguards to ensure that all information systems utilized by the Offeror and any third-party personnel (e.g., sub-Offerors):

a. Operate effectively and accurately.

C-18

b. Are protected from unauthorized alteration, disclosure, and/or misuse of information processed, stored, or transmitted.

c. Can maintain the continuity of support for organization missions, programs, and functions.

d. Incorporate management, operational, and technical controls sufficient to provide cost-effective assurance of the system’s integrity and accuracy.

e. Have technical, personnel, administrative, environmental, and access safeguards.

f. Includes procedures for notifying the government of all vulnerabilities found.

2. At a minimum, the security plan shall discuss the following:

a. Organizational security roles.

b. Physical security of Offeror systems.

c. Risk assessment procedures.

d. Maintenance and testing of security systems.

e. Security monitoring procedures.

f. Procedures and time frames for resolving security deficiencies.

g. Procedures for the prevention of and response to security breaches; and

h. Include a designated contact for security-related issues.

3. The Offeror shall implement standard procedures to be outlined in their security plan for reacting to fraudulent/questionable activity and security breaches including, but not limited to, the following:

a. Immediately notifying the Program Administrators and cardholders when their accounts are compromised:

b. Assigning new account numbers to accounts that are compromised.

c. Providing additional monitoring for accounts that are known to have been compromised.

C-19

d. Regardless of the impact on the program, the Offeror shall immediately notify the designated NAFI Agency/Organization point of contact of any security breach that the Offeror experiences.

The Offeror’s security requirements/measures/standard procedures shall protect the integrity, security, and proper functioning of all databases and systems involved in the operation of the Government’s card program(s). The databases and information processing systems containing government information shall have sufficient security measures to protect against the deliberate or inadvertent loss, degradation, alteration, release, or damage of information. The Offeror shall be held responsible for any misuse or fraud resulting in information mistakenly released by the Offeror. This plan will be included in any resulting contract for Offeror compliance.

C.20.8. Masking Sensitive Data: Unless otherwise specified by the NAFI

Agency/Organization, the Offeror shall mask all sensitive cardholder data on reports, statement of accounts, invoices, master files, and other applicable areas on which it appears (e.g., the Social Security Number 123-45-6789 would appear as xxx-xx-6789). Sensitive cardholder data includes, but is not limited to, social security numbers and account numbers.

C.20.9. Identification and Access Controls for Program Systems: The Offeror shall provide measures to enforce access control to card program systems. Program systems shall use identification and authorization data to determine user access to information. Program systems shall be able to define and control access between subjects and objects in the computer system. The enforcement mechanism (e.g., self/group public controls, access control lists, and roles) shall allow users to specify and control sharing of those objects by other users, or defined groups of users, or by both, and shall provide controls to limit access rights to the system. The discretionary access control mechanism shall, either by explicit user action or by default, provide that objects are protected from unauthorized access. These access controls shall be capable of including or excluding access to the granularity of a single user. Access permission to an object by users not already possessing access permission shall be assigned only by authorized users.

1. To ensure access control, the system shall, at a minimum:

a. Include a mechanism to require users to uniquely identify themselves to the system before beginning to perform any other actions that the system is expected to mediate.

b. Random generation of unique passwords for account access.

c. Be able to maintain authentication data that includes information for verifying the claimed identity of individual users (e.g., passwords):

C-20

d. Protect authentication data so that it cannot be accessed by any unauthorized user.

e. Be able to enforce individual accountability by providing the capability to uniquely identify each individual computer system user.

2. The Offeror must provide a Technology Uptime Commitment and Disaster

Recovery Plan.

3. The Offeror must provide an overall commitment to ensure the card-management software system is available 24 hours a day, seven (7) days a week.

4. The Offeror must enter into a Service Level Agreement (SLA) with NAFI

Agency/Organization that prescribes safeguards to ensure service continuity to maintain maximum uptime, planned downtime for system maintenance, penalties for failure to remediate system problems within prescribed time limits, and response time parameters for system problem resolution.

5. The Offeror’s SLA must include details of the Incident Response Plan (IRP).

C.21. CYBER SECURITY

C.21.1. The Contractor shall comply with Risk Management Framework requirements and cybersecurity policies and instructions outlined in Department of Defense

Instructions (DODI): 1015.16, 5205.13, 8520.02, 8551.01, DAFI 34-101; 2019

National Defense Authorization Act Sections 881, 1631-1657; current versions of

National Institutes of Standards and Technology (NIST) publications 800-53, 800-37, 800-161, 800-34, 800-60 Vol 1 and 2, 800-122, 800-171; 800-172, 800-

128; 800-63A; current DOD CIO policies located at https://dodcio.defense.gov/Library/; and current version of PCI-DSS.

1. The Contractor shall comply with applicable Security Technical Implementation

Guide (STIG) and Security Requirements Guides (SRG) under purview of the

NAFI. Applicable Correlating Control Indicators (CCI) are available on the DoD

Cyber Exchange (https://public.cyber.mil/stigs/cci/).

2. The Contractor shall provide pertinent administrative, technical documentation support, data, topologies, hardware, software, firmware listings and inventory to the NAFI for review and acceptance to support a successful identify management, cloud access/internet access point, cybersecurity service provider, and Payment

Card Industry Data Security Standards (if applicable).

https://dodcio.defense.gov/Library/ https://public.cyber.mil/stigs/cci/

C-21

3. Pursuant to the Office of Management and Budget (OMB) Memorandum M-21-

07, contractors shall ensure that information systems using internet protocol (IP) technologies will be IPv6-enabled before implementation and operational use.

C.21.2. The contractor shall provide cyber security for systems according to the

DFARS clauses incorporated by reference below:

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor

Reported Cyber Incident Information.

252.204-7012 Safeguarding Covered Defense Information and Cyber

Incident Reporting. (DEVIATION 2024-O0013)

252.204-7021 Cybersecurity Maturity Model Certification Requirements.

252.239-7001 Information Assurance Contractor Training and Certification.

252.239-7010 Cloud Computing Services.

C.21.3. Where applicable, the Contractor shall ensure all components in the contractor solution, any applications that process, store, and/or transmit credit card information/cardholder data are thoroughly assessed and meet the most current version of the Payment Card Industry Data Security Standards (PCI DSS). The solution must meet all PCI DSS compliance requirements identified by the

Payment Card Industry Security Standards Council. The Contractor shall provide to the NAFI sufficient evidence of PCI DSS Compliance certification regarding the solution’s PCI DSS compliance status.

1. The PCI DSS assessment and compliance validation of the appropriate Self-

Assessment Questionnaire (SAQ) control identified and must be completed by a certified Qualified Security Assessor (QSA) with sufficient expertise. Qualified

Security Assessor (QSA) companies are organizations that have been qualified by the PCI Council to have their employees assess compliance to the most current version of PCI DSS standard. Qualified Security Assessors are employees of these organizations who have been certified by the Council to validate an entity's adherence to the most current version of PCI DSS.

2. If payment applications are used within the solution, the applications must be PCI certified applications as derived from the PCI Data Security Standard requirements and Security Assessment Procedures. Contractor shall comply with all PCI annual requirements.

C.22. COOPERATION WITH FRAUD, WASTE AND ABUSE REVIEWS:

C-22

C.22.1. The Offeror shall assist the NAFI Agency/Organization in investigations and audits as detailed below.

C.22.2. Investigation Assistance: The Offeror shall assist any authorized investigative unit (e.g., The Office of Inspector General or authorized representative, the ordering or NAFI Agency/Organization Contracting Officer or authorized representative) of the U.S. Government concerning alleged wrongdoing or suspected fraud, waste, or abuse by NAFI Agency/Organization employees or those entities doing business with the NAFI Agency/Organization using the card program(s). If charge card records are required to assist in the authorized investigative unit’s investigation efforts, the Offeror shall provide, at no additional cost to the NAFI Agency/Organization, any data requested within the time frames mutually agreed to by the Offeror and the authorized investigative unit, unless otherwise specified by the ordering or NAFI Agency/Organization

Contracting Officer.

C.23. AUDIT ASSISTANCE:

C.23.1. The Offeror shall assist any authorized audit unit (the ordering or NAFI

Agency/Organization Contracting Officer, or an authorized representative, or the

Comptroller General of the United States, or an authorized representative) of the

U.S. Government by providing access to all card program(s) administrative, financial, and management data. If charge card records are required to assist in the authorized audit unit’s efforts, the Offeror shall provide, at no additional cost to the NAFI Agency/Organization, any data requested within the time frames mutually agreed to by the Offeror and the authorized audit unit, unless otherwise specified by the ordering or NAFI Agency/Organization Contracting Officer.

C.24. MISUSE ASSISTANCE:

C.24.1. The Offeror shall assist NAFI Agency/Organization representatives with identifying and investigating possible misuse of charge card and charge card related products and services. At a minimum, this assistance shall include providing a toll-free number for NAFI Agency/Organization representatives

(Program Administrators, Cardholders, etc.) and merchants to contact if misuse is suspected. Additionally, the Offeror shall provide the findings of any resulting investigation to the NAFI Agency/Organization upon receiving the findings.

C.25. SINGLE USE ACCOUNT (SUA)/SINGLE USE GHOST ACCOUNT (SUGA):

C.25.1. The Offeror must transfer payment information electronically via SFTP and

HTTPS to include customizable data elements.

C.25.2. The Offeror must provide customizable transaction mapper files.

C-23

C.25.3. The Offeror will provide the ability to NAFI Agency/Organization to retrieve customized data elements as part of transaction data via mapper file.

C.25.4. The Offeror will provide merchant e-mail notification upon account request and reminders.

C.25.5. The Offeror will return files with full 16-digit account numbers, expiration date, authorized amount and CVC.

C.26. DATA MINING/AUDIT MANAGEMENT: The Offeror must provide continuous monitoring software, implementation, consulting and support services. Consultants must provide expertise in purchase card analytics to ensure maximum usage and benefits of the software. The software may be owned by the Offeror or third party. If third-party it will be the Offerors’ responsibility to ensure data is provided to and from the Offeror to the NAFI Agency/Organization in a secure manner.

C.26.1. The program must be able to produce both ad hoc and standard reports to identify various program violations to include, but not limited to:

1. Split/Multi line Transactions

2. Sales Tax

3. Volume by Cardholder

4. Suspicious Totals

5. Single Purchase Violations

6. Summary by merchants/cardholders

C.27. ADDITIONAL AUDIT CAPABILITY: The Offeror must:

C.27.1. Provide the ability for administrators to design business rules to fit a living program environment.

C.27.2. Provide statistically valid random samples.

C.27.3. Identify trends and risk level management.

C.27.4. Provide a casework environment for administrators and users to process flagged transactions.

C.27.5. Provide the ability to sample large data sets, identify irregularities or patterns in transactions to increase and/or identify internal control weaknesses or non-compliance of set guidelines and laws.

C-24

C.27.6. Software must have the ability to provide program metrics by automating control tests, tracking results, and trends and sharing exceptions.

C.27.7. Software must have the ability to flag transactions for compliance review.

C.27.8. Software must be able to automatically upload daily transactions/customizable data files from the online banking software.

C.27.9. Software must be able to maintain three (3) years of active records and two (2) years of archived information.

C.28. TRANSITION

C.28.1. The Offeror must provide extensive support and assistance to ensure a smooth transition from the present Offeror in the event a new Offeror is selected at the end of the contract period. The level of involvement of NAFI

Agency/Organization in the transition process must be minimal. The transition period will be critical to the program’s continued success and potential.

C.28.2. Both the incumbent…