2026-0083 Cyber Operations Mgmt System Demonstration (NS) - FRI 21 Aug RELAUNCH

Updates are highlighted in bold and underlined in the SOW. Bidding instructions are now included in the SOW, so a technical proposal is expected for this RFQ, not only CVs. Initial submitted bids can be resubmitted together with the now required technical proposal. BIDDING INSTRUCTIONS Price Quote: The Bidder shall submit a quote in accordance with the NTE provided in the Project Overview on page 1. Technical Quote: Bidders shall submit a proposal clearly providing the following information: a. The proposed approach to address the required scope of work and the defined deliverables. The proposed approach should address at the minimum: i. Sufficient details to allow assessment of the bidder’s understanding of the requirements; ii. Previous similar experience; and iii. Relevant experience of the proposed personnel. b. CV(s) and attestation(s) of the assigned personnel for the project. Deadline Date: Friday 21 August 2026 (was Wednesday 19 August 2026) Requirement: Cyber Operations Management System (COMS) Demonstration Location: Offsite Note: Please refer to your Subcontract Agreement, article 6.4.1.a, which states “Off-Site Discount: 5% (this discount is applicable to all requirements, and applies when the assigned personnel are permitted to work Off-Site, such as at- home)". Please be sure to price this discount in your overall price proposal when submitting bids against off-site RFQs Period of Performance: EDC + 4 months. Estimated start date: 1 September 2026 (tentative) Required Security Clearance: NATO SECRET SECTION 1 – INTRODUCTION 1.1 Background The NATO Communications and Information Agency (NCIA) is dedicated to acquiring, deploying, and defending communication systems for NATO's political decision-makers and Commands. It operates on the frontlines against cyber-attacks, collaborating closely with governments and industry to prevent future debilitating attacks. The NCI Agency plays a crucial role in maintaining NATO's technological edge and ensuring the collective defence and crisis management capabilities of the Alliance. In pursuit of this mission, NCIA requires specialized advisory services to enhance its interim workforce capacity. The Cyber Operations Management System (COMS) demonstration is a high priority task which aims at: Building a mock-up environment on the NATO Software Factory to obtain a functionally equivalent environment to the operational version of Cyber Operations Management System (COMS) today. Capturing the requirements and demonstrating to industry the functionalities of the current capabilities by demonstrating on the mock-up environment. COMS operates on the NCSC NROP and NCSC NSOP CIS and is accessible from NATO-wide stakeholders from their respective low-side and high-side environments. COMS supports Cyber Incident Response and Defensive Cyber Operations and is therefore a critical component of the NATO Cyber Security Centre (NCSC) today and the NATO Integrated Cyber Defence Centre (NICC) tomorrow. 1.2 Scope of Work The purpose of this Statement of Work (SOW) is to acquire contractor support to build a mock-up environment of the current COMS NR and COMS NS. Based on the mock-up of the environment, the contractor shall identify and capture the requirements of what COMS is able to deliver today in a video demo to be presented at a planned industry engagement day. SECTION 2 – PERFORMANCE REQUIREMENTS 2.1 Deliverable D1: Mock-up of COMS NR/NS Environment on the NATO Software Factory The contractor shall build a mock-up environment that simulates what is doable today on COMS NR and COMS NS, including the relation between Atlassian JIRA, Atlassian Confluence, and all plugins currently installed on the production environment. It will notably replicate all Jira processes supporting the execution of the DEFEND branch missions, as well as all other supporting Jira processes (including but not limited to 'STAGIL assets' projects). It will also replicate the mechanism allowing low-side workflows tracking from the high-side with the associated hand-over/take-over mechanism, the dynamic wiki page publications based on Jira issues changes, and the use of dynamic page templates (scaffolding/reporting-based). Acceptance Criteria D1 All existing processes at the first day of Contract Award on COMS (Jira) NR and COMS (Jira) NS have a functional equivalent process on the mock-up environment. All data-types used for any of these processes have corresponding mock-up data implemented that will allow at least 10 different instances of each process to be run without using the same data twice. Any Confluence space and pages used in support of these processes must also exist on the mock-up environment, including dynamic elements, labelling, and all plugins as on production. The simulation of the Data diode and the replication mechanism must be implemented. Due Date: 60 days from Base Period EDC Payment Milestone: 40% of contract value. After deliverable completion and signed Delivery Acceptance Sheet (DAS). 2.2 Deliverable D2: Identification and Documentation of the COMS Requirements Based on the mock-up environment established in D1, the contractor shall identify and capture the functional and non-functional requirements of what COMS is able to deliver today into a NATO AQAP conforming format that is readable and unambiguously understandable by a third-party company having no prior knowledge of NCSC, NCIA, or NATO. The requirements shall be organized in logical groups to facilitate the production of a video in D3. The requirements shall be written such that a third party could recreate, using one or multiple technical capabilities, a solution that would satisfy the identified requirements. The requirements will be captured within the COMS Confluence environment until final review is agreed. The final deliverable will be in Word document format. Acceptance Criteria D2 The requirements shall meet the following principles: each requirement must be unique, testable, verifiable, unambiguous, traceable and necessary in accordance to the relevant NATO AQAP. Due Date: 45 days from Base Period EDC Payment Milestone: 20% of contract value. After deliverable completion and signed DAS. 2.3 Deliverable D3: Creation of a Video Demonstrating the Identified Requirements in D2 The contractor shall produce a recorded video introducing what COMS is today, and going through the different requirements captured in D2. The requirements document shall identify the timestamp in the video at which each requirement is being presented. The video in D3 and the requirements in D2 will be made available to industry as part of pre-solicitation industry engagements. The video shall be securely hosted by the contractor. A copy shall be delivered to NCIA. The video shall remain available on the contractor-hosted platform, and as per D4, for a duration of contract end plus 2 months. Acceptance Criteria D3 The video shall be endorsed by NCIA. Minimum resolution: 1920x1080p using H.264/AVC encoding. Supporting audio shall be a minimum of 44 kHz. The voice explaining the content of the video must be from a person having STANAG 6001 Speaking skills of level 4 minimum or from an English native speaker. The content of the material shall meet or exceed ISO 40180, and cover all requirements identified and endorsed in D2. Due Date: 70 days from Base Period EDC Payment Milestone: 20% of contract value. After deliverable completion and signed DAS. 2.4 Deliverable D4: Demonstration of the COMS Mock-up Environment The contractor shall present a live demo of the COMS mock-up environment as part of an industry engagement day organized by NCIA. The demo will take place online. The live demo shall cover the points of the video in D3, with an authorized level of interaction (questions from industry). The Q&A session may be organized at the end of or during the demo, as best determined by the contractor. NCIA is responsible for inviting industry and setting the date of the demo. The contractor shall ensure availability and full working condition of the environment at the time of the demo. Depending on the risk of non-availability, an alternate date may be set by common agreement between NCIA and the contractor. NCIA will be present during the demo to answer questions. Acceptance Criteria D4 The live-demo occurred and all invited industry members who expressed their confirmation to attend have been able to attend. No disruption of video, audio of more than 5 seconds or dropping connection for participants caused by the contractor have happened. Due Date: 100 days from Base Period EDC Payment Milestone: 20% of contract value. After deliverable completion and signed DAS. SECTION 3 – CONTRACTOR QUALIFICATIONS 3.1 Contractor Experience [See Requirements] 3.2 Personnel Requirements The Contractor shall determine and provide the appropriate number and composition of personnel — possessing the necessary qualifications, skills, and experience — to successfully fulfil all requirements of this effort, taking into consideration the very tight delivery timeline. NCIA expects 3 persons to work on this SOW to meet the deadlines. The Contractor shall ensure that the proposed team is capable of delivering high-quality, timely, and fully compliant deliverables as specified in this SOW. Only the company's project manager must hold a NATO SECRET security clearance, necessary to access the production environment. Other contractor staff must be authorized at NATO RESTRICTED level. The work shall be executed fully at the contractor's facilities. SECTION 4 – PROJECT MILESTONES AND DELIVERABLES Deliverable D1: Mock-up of COMS NR/NS environment on the NATO Software Factory. Due: 60 days from Base Period EDC. Payment: 40% of contract value. Deliverable D2: Identification and documentation of the COMS requirements. Due: 45 days from Base Period EDC. Payment: 20% of contract value. Deliverable D3: Creation of a video demonstrating the identified requirements in D2. Due: 70 days from Base Period EDC. Payment: 20% of contract value. Deliverable D4: Demonstration to selected industry members of the COMS mock-up environment. Due: 100 days from Base Period EDC. Payment: 20% of contract value. Payment is dependent upon successful acceptance of each deliverable and the signed Delivery Acceptance Sheet (DAS). Invoices shall be accompanied by the DAS, signed by the contractor and the NCIA POC. SECTION 5 – COORDINATION AND REPORTING Reporting mechanisms will be defined during the kick-off meeting. SECTION 6 – SCHEDULE The Task Order will be effective immediately after contract signature. The estimated starting date is 15 July 2026 (tentative), with a period of performance of EDC + 4 months. SECTION 7 – TRAVEL There is no travel expected. Exceptionally, if any travel is required, costs are considered to be included in the overall contract price and will not be reimbursed separately. SECTION 8 – PURCHASER-FURNISHED INFORMATION AND RESOURCES NCIA to fund the access to the NATO Software Factory. NCIA to deliver the laptops necessary to access the NATO Software Factory (maximum 3 laptops). NCIA to provide technical support (1 hour per working day) to assist the contractor in delivering on scope, time, schedule, and expected quality. Requirements 3. CONTRACTOR QUALIFICATIONS Required Experience and Skills Excellent knowledge (5+ years) of Atlassian JIRA Datacenter administration. Excellent knowledge (5+ years) of Atlassian Confluence Datacenter administration. Prior experience working on the NCIA COMS Environment. Excellent knowledge in scripting languages (e.g., Bash, Python) for automation and customization tasks. Excellent knowledge in deploying solutions on Microsoft Azure environments. Excellent knowledge of Java, Groovy, and ScriptRunner. Strong experience in dynamic content management and integration between Atlassian JIRA and Confluence. Strong experience in managing metadata in Atlassian Confluence, Office and PDF documents, and Microsoft SharePoint. Strong understanding of the inner workings of Atlassian JIRA and Confluence instances, including at database level. Experience with the management of Linux servers (preferably RedHat). NATO SECRET security clearance required for the project manager. NATO RESTRICTED authorization required for all other contractor personnel.