SAM #F41999-26-Q-0055

Air Force Seeks PCI DSS Compliance Technical Support and Sustainment for Enterprise Installations

The Air Force Services Center (AFSVC), under the Department of the Air Force, is seeking a contractor to provide comprehensive Payment Card Industry Data Security Standard (PCI DSS) Compliance Technical Support and Sustainment Services across up to 104 Air Force installations, with primary operations at Joint Base San Antonio-Lackland, Texas. - Government Buyer: - Department of the Air Force, Air Force Services Center (AFSVC), Air Education and Training Command, and Air Force Materiel Command - Contracting managed by AF NAF Procurement Office (AFNAFPO) and AFSVC/VPEB - Scope of Services: - Enterprise-wide PCI DSS compliance technical support and sustainment - Deployment and management of a standardized security tool suite (SIEM, DLP, MFA) for the Cardholder Data Environment (CDE) at up to 104 installations - Hands-on vulnerability management, incident response, and 24/7 operational support (remote and on-call) - Gap analysis, solution recommendations, and phased implementation strategy targeting initial completion by August 2026 - Development of SOPs, training materials, and "Train-the-Trainer" programs for local personnel - Continuous monitoring, compliance attestation support, and collaboration with Qualified Security Assessors (QSAs) - Project management, reporting (weekly, monthly, quarterly), and quality management deliverables - Unique/Notable Requirements: - Contractor must have cybersecurity expertise and security clearances - Support for over 13 million annual payment card transactions and 2,200+ business lines - Emphasis on a proactive, centrally governed security posture with local empowerment - Adherence to DoD standards (NIST SP 800-53, DoD RMF) and rapid incident reporting (1-hour trigger) - Government-furnished tools; contractor provides implementation and sustainment - Nonappropriated Fund (NAF) procurement—FAR does not apply - OEMs and Vendors: - No specific OEMs or vendors are named; solutions must support or integrate with SIEM, DLP, and MFA technologies - Place of Performance: - Primary: JBSA Lackland, San Antonio, TX - Additional: Up to 104 Air Force installations nationwide, with centralized support at AFSVC facilities - Period of Performance: - Base year (12 months) with up to four option years for ongoing support and sustainment - Key deliverables and tool deployment targeted for completion by August 2026

Description

THIS IS A NONAPPROPRIATED FUND (NAF) COMBINED SYNOPSIS/SOLICITATION AND FEDERAL ACQUISITION REGULATION (FAR) RULES DO NOT APPLY. THERE IS NO REQUIREMENT FOR SET-ASIDES.  NO FURTHER INFORMATION WILL BE PROVIDED OTHER THAN WHAT IS STATED BELOW.

This is a NAF purchase, and it does not obligate appropriated funds of the United States Government. This purchase does not involve federal tax dollars.  This solicitation and subsequent award are in accordance with the NAF Standard Clauses (30 May 2025). The FAR clauses and provisions do not apply to NAF purchases. 

This solicitation is being issued as a Request for Quote (RFQ) with an assigned solicitation number of F41999-26-Q-0055.  This announcement constitutes the only solicitation.  The Government is not obligated to and will not pay for quotes received as a result of this announcement.

Air Force Materiel Command’s Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio-Lackland, Texas, provides critical support to military personnel and their families through Department of the Air Force (DAF) Nonappropriated Fund Instrumentalities (NAFI) across enterprise Services programs, including food, fitness, childcare, lodging, and recreation. AFSVC is responsible for developing programs, managing support functions, and responding to high-level inquiries. Merchant card processing is vital to AFSVC’s operations, accounting for ~90% of its transaction revenue. However, current merchant processing practices are not fully compliant with Payment Card Industry Data Security Standard (PCI DSS), posing risk to the security of Department of Defense connected consumer payment card data.

Your company is invited to submit a price quote to achieve a proactive, centrally governed security posture that provides Air Force Services Center (AFSVC) with full visibility into the cardholder data environment, ensures long-term verifiable PCI DSS compliance, and empowers local personnel for self-sufficient operation. AFSVC is seeking expert technical support to advance its PCI DSS compliance strategy. The Air Force Nonappropriated Fund Procurement Office (AFNAFPO) intends to award a Firm-Fixed Price contract to the offeror whose quote is the Lowest Price Technically Acceptable (LPTA). Place of Performance is JBSA Lackland, TX 78236 USA.

There is always a possibility that no award will be made as a result of this solicitation.  Potential quoters will not be compensated for any costs associated with the preparation of quotes.  Potential quoters are requested to keep quotes valid for a minimum of 120 days.

The following documents and information to include those outlined in ATCH 01 are required to be submitted in Adobe PDF format (if feasibly possible) for consideration for award:

Price Quote along with a technical response to the deliverables that demonstrates a thorough understanding of all requirements of the Statement of Objectives (SOO). Confirmation of acceptance or exceptions to NAF Standard Clauses (30 May 2025). Ensure to physically complete paragraphs 32-34. Confirmation of acceptance or disagreement to Contract Admin Data (ATCH 08), paragraphs 2-4.

Method of Payment. Air Force Services Center’s preferred method of payment is by NAF Purchase Card (Visa) within 30 days of receipt of proper invoice & NAFI acceptance.

Questions and Answers (Q&A) for the Request for Information (RFI) and Pre-Solicitation Notification are attached. 

Interested contractors desiring to ask additional questions related to this RFQ must submit their questions by email to Ms. Whitney Ward, whitney.ward.1@us.af.mil and Mrs. Valerie Baltimore, valerie.baltimore@us.af.mil no later than (NLT) 4:00 PM, CST, Tuesday, 14 April 2026.  A consolidated list of questions and answers will be posted NLT 4:00 PM, CST, Thursday, 16 April 2026.

View original listing