- Gap review, remediation roadmap, and implementation support
- Policy package, evidence mapping, and submission prep
- Designed for primes and subs across non-tech and tech work
Payment Card Industry Data Security Standards Audit Readiness.
Combined Synopsis Solicitation from DEPT OF THE AIR FORCE • DEPT OF DEFENSE. Place of performance: TX. Response deadline: Jan 29, 2026. Industry: NAICS 541618 • PSC R710.
CMMC support options for this DoD solicitation
As DoD CMMC rollout expands, approximately 80%+ of DoD solicitations are expected to include cybersecurity/CMMC requirements, including many non-tech scopes.
- Structured checklist, AI guidance, and progress tracking
- Build evidence and controls with clearer next-step workflows
- Ideal for teams that want speed plus affordability
Market snapshot
Awarded-market signal for NAICS 541618 (last 12 months), benchmarked to sector 54.
Related hubs & trends
Navigate the lattice: hubs for browsing, trends for pricing signals.
Point of Contact
Agency & Office
More in NAICS 541618
Description
THIS IS A NONAPPROPRIATED FUND (NAF) COMBINED SYNOPSIS/SOLICITATION AND FEDERAL ACQUISITION REGULATION (FAR) RULES DO NOT APPLY. THERE IS NO REQUIREMENT FOR SET-ASIDES. NO FURTHER INFORMATION WILL BE PROVIDED OTHER THAN WHAT IS STATED BELOW.
This is a NAF purchase, and it does not obligate appropriated funds of the United States Government. This purchase does not involve federal tax dollars. This solicitation and subsequent award are in accordance with the NAF Standard Clauses (30 May 2025). The FAR clauses and provisions do not apply to NAF purchases.
This solicitation is being issued as a Request for Quote (RFQ) with an assigned solicitation number of F41999-26-Q-0007. This announcement constitutes the only solicitation. The Government is not obligated to and will not pay for quotes received as a result of this announcement.
The Air Force Materiel Command’s Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio-Lackland, Texas, provides critical support to military personnel and their families through Department of the Air Force (DAF) Nonappropriated Fund Instrumentalities (NAFI) across enterprise Services programs, including food, fitness, childcare, lodging, and recreation. AFSVC is responsible for developing programs, managing support functions, and responding to high-level inquiries. Merchant card processing is vital to AFSVC’s operations, accounting for ~90% of its transaction revenue.
AFSVC is seeking Payment Card Industry Data Security Standard (PCI DSS) compliance expert to review provided data and gap assessments related to DAF NAFI cardholder data environments to refine the PCI DSS scope, identify outstanding requirements to develop an expedited compliance path, and conduct the formal audit by end of FY26. Additionally, AFSVC requires a business expert to guide maturing and/or developing end-to-end business systems and processes related to merchant processing (see the attachment for Contractor Qualifications in the Statement of Objectives).
Questions and Answers (Q&A) for the pre-solicitation Request for Information is attached. Interested contractors desiring to ask additional questions related to this RFQ must submit their questions by email to fay.cameron@us.af.mil and valerie.baltimore@us.af.mil no later than (NLT) 4:00 PM CST Monday, 12 January 2026. A consolidated list of questions and answers will be posted NLT 4:00 PM CST Wednesday, 14 January 2026.
Files
Files size/type shown when available.
BidPulsar Analysis
A practical, capture-style breakdown of fit, requirements, risks, and next steps.
The U.S. Department of the Air Force is seeking bids for an audit readiness service to comply with Payment Card Industry Data Security Standards (PCI DSS). This is part of an effort to ensure that the agency meets necessary security compliance for payment processes. The solicitation is posted with a response deadline set for January 29, 2026. Companies with experience in cybersecurity audits, particularly in the context of PCI DSS, are encouraged to submit proposals.
The buyer aims to prepare for a PCI DSS audit, ensuring compliance with data security standards critical for processing payment card information. This will involve assessment, recommendations, and possibly implementation guidance.
- Review current PCI DSS compliance level
- Identify gaps in current practices
- Develop an action plan for compliance
- Conduct training sessions if necessary
- Prepare documentation and reports for audit processes
- Proof of PCI DSS experience
- List of previous federal contracts
- Cost proposal detailing service fees
- Certifications relating to cybersecurity and data protection
- Proposed timeline for completing audit readiness
Source coverage notes
Some notices publish limited source detail. Confirm these points before final bid/no-bid decisions.
- Detailed scope of services required for audit readiness
- Budget range for the contract
- Any existing compliance issues identified
- Information on previous audits conducted
- Required certifications for bidding
FAQ
How do I use the Market Snapshot?
It summarizes awarded-contract behavior for the opportunity’s NAICS and sector, including a recent pricing band (P10–P90), momentum, and composition. Use it as context, not a guarantee.
Is the data live?
The signal updates as new awarded notices enter the system. Always validate the official award and solicitation details on SAM.gov.
What do P10 and P90 mean?
P10 is the 10th percentile award size and P90 is the 90th percentile. Together they describe the typical spread of award values.