Cyber Operations Management System Demonstration MON 22 Jun

Deadline Date: Monday 22 June 2026 Requirement: Cyber Operations Management System (COMS) Demonstration Location: Offsite Note: Please refer to your Subcontract Agreement, article 6.4.1.a, which states “Off-Site Discount: 5% (this discount is applicable to all requirements, and applies when the assigned personnel are permitted to work Off-Site, such as at-home)". Please be sure to price this discount in your overall price proposal when submitting bids against off-site RFQs Period of Performance: EDC + 4 months. Estimated start date: 15 July 2026 (tentative) Required Start Date: 15 July 2026 (tentative) Required Security Clearance: NATO SECRET SECTION 1 – INTRODUCTION 1.1 Background The NATO Communications and Information Agency (NCIA) is dedicated to acquiring, deploying, and defending communication systems for NATO's political decision-makers and Commands. It operates on the frontlines against cyber-attacks, collaborating closely with governments and industry to prevent future debilitating attacks. The NCI Agency plays a crucial role in maintaining NATO's technological edge and ensuring the collective defence and crisis management capabilities of the Alliance. In pursuit of this mission, NCIA requires specialized advisory services to enhance its interim workforce capacity. The Cyber Operations Management System (COMS) demonstration is a high priority task which aims at:

• Building a mock-up environment on the NATO Software Factory to replicate the functionalities that exist in the operational version of COMS today.
• Capturing the requirements and demonstrating to industry the functionalities of the current capabilities by demonstrating on the mock-up environment.

COMS operates on the NCSC NROP and NCSC NSOP CIS and is accessible from NATO-wide stakeholders from their respective low-side and high-side environments. COMS supports Cyber Incident Response and Defensive Cyber Operations and is therefore a critical component of the NATO Cyber Security Centre (NCSC) today and the NATO Integrated Cyber Defence Centre (NICC) tomorrow. 1.2 Scope of Work The purpose of this Statement of Work (SOW) is to acquire contractor support to build a mock-up environment of the current COMS NR and COMS NS. Based on the mock-up of the environment, the contractor shall identify and capture the requirements of what COMS is able to deliver today in a video demo to be presented at a planned industry engagement day. SECTION 2 – PERFORMANCE REQUIREMENTS 2.1 Deliverable D1: Mock-up of COMS NR/NS Environment on the NATO Software Factory The contractor shall build a mock-up environment that simulates what is doable today on COMS NR and COMS NS, including the relation between Atlassian JIRA, Atlassian Confluence, and all plugins currently installed on the production environment. It will notably replicate all Jira processes supporting the execution of the DEFEND branch missions, as well as all other supporting Jira processes (including but not limited to 'STAGIL assets' projects). It will also replicate the mechanism allowing low-side workflows tracking from the high-side with the associated hand-over/take-over mechanism, the dynamic wiki page publications based on Jira issues changes, and the use of dynamic page templates (scaffolding/reporting-based). Acceptance Criteria D1 All existing processes at the first day of Contract Award on COMS (Jira) NR and COMS (Jira) NS are replicated on the mock-up environment. All data-types used for any of these processes have corresponding mock-up data implemented that will allow at least 10 different instances of each process to be run without using the same data twice. Any Confluence space and pages used in support of these processes must also exist on the mock-up environment, including dynamic elements, labelling, and all plugins as on production. The simulation of the Data diode and the replication mechanism must be implemented. Due Date: 60 days from Base Period EDC Payment Milestone: 40% of contract value. After deliverable completion and signed Delivery Acceptance Sheet (DAS). 2.2 Deliverable D2: Identification and Documentation of the COMS Requirements Based on the mock-up environment established in D1, the contractor shall identify and capture the functional and non-functional requirements of what COMS is able to deliver today in a video demo to be presented at a planned industry engagement day. Acceptance Criteria D2 The identified requirements are documented in a clear and concise manner, with all necessary details provided for each requirement. Due Date: 45 days from Base Period EDC Payment Milestone: 20% of contract value. 2.3 Deliverable D3: Creation of a video demonstrating the identified requirements in D2 The contractor shall create a video that demonstrates the identified requirements in D2, showcasing the capabilities and functionalities of COMS NR/NS environment. Acceptance Criteria D3 The video is clear, concise, and easy to understand, providing a comprehensive overview of the identified requirements. Due Date: 70 days from Base Period EDC Payment Milestone: 20% of contract value. 2.4 Deliverable D4: Demonstration to selected industry members of the COMS mock-up environment The contractor shall demonstrate the COMS NR/NS environment to selected industry members, showcasing its capabilities and functionalities. Acceptance Criteria D4 The demonstration occurred and all invited industry members who confirmed attendance were able to attend. No disruption of video or audio of more than 5 seconds, and no dropping of participant connections caused by the contractor, occurred. Due Date: 100 days from Base Period EDC Payment Milestone: 20% of contract value. SECTION 3 – CONTRACTOR QUALIFICATIONS 3.1 Contractor Experience [See Requirements] 3.2 Personnel Requirements The Contractor shall determine and provide the appropriate number and composition of personnel — possessing the necessary qualifications, skills, and experience — to successfully fulfil all requirements of this effort, taking into consideration the very tight delivery timeline. NCIA expects 3 persons to work on this SOW to meet the deadlines. The Contractor shall ensure that the proposed team is capable of delivering high-quality, timely, and fully compliant deliverables as specified in this SOW. Only the company's project manager must hold a NATO SECRET security clearance, necessary to access the production environment. Other contractor staff must be authorized at NATO RESTRICTED level. The work shall be executed fully at the contractor's facilities. SECTION 4 – PROJECT MILESTONES AND DELIVERABLES Deliverable D1: Mock-up of COMS NR/NS environment on the NATO Software Factory. Due: 60 days from Base Period EDC. Payment: 40% of contract value. Deliverable D2: Identification and documentation of the COMS requirements. Due: 45 days from Base Period EDC. Payment: 20% of contract value. Deliverable D3: Creation of a video demonstrating the identified requirements in D2. Due: 70 days from Base Period EDC. Payment: 20% of contract value. Deliverable D4: Demonstration to selected industry members of the COMS mock-up environment. Due: 100 days from Base Period EDC. Payment: 20% of contract value. Payment is dependent upon successful acceptance of each deliverable and the signed Delivery Acceptance Sheet (DAS). Invoices shall be accompanied by the DAS, signed by the contractor and the NCIA POC. SECTION 5 – COORDINATION AND REPORTING Reporting mechanisms will be defined during the kick-off meeting. SECTION 6 – SCHEDULE The Task Order will be effective immediately after contract signature. The estimated starting date is 15 July 2026 (tentative), with a period of performance of EDC + 4 months. Required Start Date: 15 July 2026 (tentative) SECTION 7 – TRAVEL There is no travel expected. Exceptionally, if any travel is required, costs are considered to be included in the overall contract price and will not be reimbursed separately. SECTION 8 – PURCHASER-FURNISHED INFORMATION AND RESOURCES NCIA to fund the access to the NATO Software Factory. NCIA to deliver the laptops necessary to access the NATO Software Factory (maximum 3 laptops). NCIA to provide technical support (1 hour per working day) to assist the contractor in delivering on scope, time, schedule, and expected quality. Keywords: ["Atlassian JIRA", "Atlassian Confluence", "Microsoft Azure", "Java", "Groovy", "ScriptRunner", "Linux servers", "RedHat", "NATO SECRET", "NATO RESTRICTED"]