PCI DSS Compliance Technical Support & Sustainment

This contract, titled PCI DSS Compliance Technical Support & Sustainment, was awarded through a competitive Lowest Price Technically Acceptable (LPTA) process, where price was the dominant factor for contractors deemed technically acceptable. The solicitation, issued under number 75D30125R73235 and awarded as contract 75D30126C21030, was managed by the Centers for Disease Control and Prevention (CDC) on behalf of the Department of Defense, with performance based in Atlanta, Georgia. The base period runs from May 19, 2026, to May 18, 2027, with four optional one-year periods extending through May 18, 2031, and a total potential value up to $7.3 million if all options and surge capacities are exercised. The primary scope involves supporting CDC’s Influenza Division through routine Hemagglutinin Inhibition (HAI) testing of human serum samples and the development, validation, and transfer of a next-generation high-throughput serology platform to replace HAI, with stringent performance criteria requiring at least 97% accuracy in documentation and 99% on-schedule delivery for critical milestones like training and sample return. The contract includes optional surge capacity tasks that allow for testing volumes up to 75% above the base level during peak demand, with pricing structured as firm-fixed-price for core tasks and cost-plus-fixed-fee for optional development and gap analysis tasks. Contract administration is governed by a comprehensive set of FAR clauses including those related to termination for convenience, default, excusable delays, changes, subcontracting, government property, and anti-kickback procedures, with several deviations applied for changes, stop-work orders, litigation, and confidential information. Invoicing must be submitted electronically through the Department of Treasury’s Invoice Processing Platform, excluding WAWF unless authorized. A Contracting Officer’s Representative based in Atlanta, supported by CDC subject matter experts, is responsible for inspection and acceptance, ensuring all deliverables meet defined quality standards and Section 508 accessibility requirements. The contractor must comply with strict ethical and financial controls, including a salary cap aligned with Federal Executive Schedule Level II, full disclosure of organizational conflicts of interest, and adherence to HHS-approved cybersecurity protocols for data handling and media sanitization. Travel is limited to pre-approved personnel for training activities, and all electronic data must be sanitized or returned within 30