Cyber Operations Management System Demonstration MON 22 Jun

Period of Performance: EDC + 4 months. Estimated start date: 15 July 2026 (tentative)

Required Start Date: 15 July 2026 (tentative)

Required Security Clearance: NATO SECRET

SECTION 1 – INTRODUCTION

1.1 Background

The NATO Communications and Information Agency (NCIA) is dedicated to acquiring, deploying, and defending communication systems for NATO's political decision-makers and Commands. It operates on the frontlines against cyber-attacks, collaborating closely with governments and industry to prevent future debilitating attacks. The NCI Agency plays a crucial role in maintaining NATO's technological edge and ensuring the collective defence and crisis management capabilities of the Alliance. In pursuit of this mission, NCIA requires specialized advisory services to enhance its interim workforce capacity.

The Cyber Operations Management System (COMS) demonstration is a high priority task which aims at:

• Building a mock-up environment on the NATO Software Factory to replicate the functionalities that exist in the operational version of COMS today.
• Capturing the requirements and demonstrating to industry the functionalities of the current capabilities by demonstrating on the mock-up environment.

COMS operates on the NCSC NROP and NCSC NSOP CIS and is accessible from NATO-wide stakeholders from their respective low-side and high-side environments. COMS supports Cyber Incident Response and Defensive Cyber Operations and is therefore a critical component of the NATO Cyber Security Centre (NCSC) today and the NATO Integrated Cyber Defence Centre (NICC) tomorrow.

1.2 Scope of Work

The purpose of this Statement of Work (SOW) is to acquire contractor support to build a mock-up environment of the current COMS NR and COMS NS. Based on the mock-up of the environment, the contractor shall identify and capture the requirements of what COMS is able to deliver today in a video demo to be presented at a planned industry engagement day.

SECTION 2 – PERFORMANCE REQUIREMENTS

2.1 Deliverable D1: Mock-up of COMS NR/NS Environment on the NATO Software Factory

The contractor shall build a mock-up environment that simulates what is doable today on COMS NR and COMS NS, including the relation between Atlassian JIRA, Atlassian Confluence, and all plugins currently installed on the production environment. It will notably replicate all Jira processes supporting the execution of the DEFEND branch missions, as well as all other supporting Jira processes (including but not limited to 'STAGIL assets' projects). It will also replicate the mechanism allowing low-side workflows tracking from the high-side with the associated hand-over/take-over mechanism, the dynamic wiki page publications based on Jira issues changes, and the use of dynamic page templates (scaffolding/reporting-based).

Acceptance Criteria D1

All existing processes at the first day of Contract Award on COMS (Jira) NR and COMS (Jira) NS are replicated on the mock-up environment. All data-types used for any of these processes have corresponding mock-up data implemented that will allow at least 10 different instances of each process to be run without using the same data twice. Any Confluence space and pages used in support of these processes must also exist on the mock-up environment, including dynamic elements, labelling, and all plugins as on production. The simulation of the Data diode and the replication mechanism must be implemented.

Due Date: 60 days from Base Period EDC

Payment Milestone: 40% of contract value. After deliverable completion and signed Delivery Acceptance Sheet (DAS).

2.2 Deliverable D2: Identification and Documentation of the COMS Requirements

Based on the mock-up environment established in D1, the contractor shall identify and capture the functional and non-functional requirements of what COMS is able to deliver today into a NATO AQAP conforming format that is readable and unambiguously understandable by a third-party company having no prior knowledge of NCSC, NCIA, or NATO. The requirements shall be organized in logical groups to facilitate the production of a video in D3. The requirements shall be written such that a third party could recreate, using one or multiple technical capabilities, a solution that would satisfy the identified requirements. The requirements will be captured within the COMS Confluence enviro