CO-424389-COMPS.pdf

Acquisition Office

NCIA/ACQ/2026/ 07600

PP.A3(03.26)

NOTIFICATION OF PROCUREMENT OPPORTUNITY (NPO)

Pre-Solicitation Notice

NATO Competitive Procurement Provision of Centralized Operations and Maintenance Patching Services - IT

Infrastructure

NCIA Reference #:CO-424389-COMPS

Date of NPO Publication: 07/08/2026

Anticipated Solicitation Release Date: 04/09/2026 Anticipated Solicitation Closing Date: 09/10/2026

Anticipated Contract Award Date: 30/12/2026

Rough Order of Magnitude1: EURO 3.900.000 Point of Contact: Mihaela Zoicas,Contracting Officer

Anamaria Pascaru, Senior Contracting Assistant

CO-424389-COMPS@ncia.nato.int

1 This Rough Order of Magnitude is informational only and reflects NCIA’s estimate. Actual contract value may vary based on competitive submissions.

mailto:CO-424389-COMPS@ncia.nato.int

Introduction

The NATO Communications and Information Agency (NCIA) hereby notifies the following Procurement Opportunity in accordance with the Procedure for NATO Competitive Procurement (link). This notification is issued to foster open and fair competition among eligible vendors from participating nations. This notification does not constitute a commitment to award a contract.

Vendors are invited to review the requirements described herein and to submit their bids in accordance with the instructions provided in the subsequent solicitation documentation. All interested vendors are reminded that timely registration and compliance with eligibility requirements are essential, as deadlines for submission may not be extended. Vendors are advised to regularly check for updates to this notification.

This opportunity reflects NATO’s commitment to transparency, equal treatment of suppliers, and the efficient delivery of goods, works, and services in support of NATO missions and participating nations.

All eligible and responsible sources may submit a quotation, bid, or proposal, which shall be considered by the NCIA.

1. Title of Procurement Opportunity

Provision of Centralized Operations and Maintenance Patching Services - IT Infrastructure

2. Description of Requirement

The Purchaser, NCIA CSU Brussels referred to as NATO Owned Contractor Operated Services operates and maintains a complex and evolving Information Technology (IT) infrastructure that supports critical business services, internal operations, and digital service delivery. This infrastructure includes operating systems, enterprise applications, monitoring platforms, and database systems that must remain secure, available, and compliant with applicable security and operational standards.

Maintaining these environments requires continuous operations, maintenance, security patching, vulnerability remediation, and lifecycle management activities. These activities are essential to ensure: system availability and operational continuity, compliance with cybersecurity standards and policies, timely remediation of security vulnerabilities, alignment with industry best practices for IT service management.

In order to strengthen operational resilience, maintain service continuity, and address capacity and expertise requirements, the NCIA intends to outsource specific Operations and Maintenance (O&M) and Patching services to an external Contractor.

The outsourcing initiative aims to supplement internal operational capabilities by providing specialized technical expertise and operational support while ensuring that services are delivered according to recognized industry practices and other applicable cybersecurity and operational governance frameworks.

The NCIA must ensure the secure, reliable, and continuous operation of its IT infrastructure platforms and applications.

Key operational challenges include:

1. Managing regular security patching cycles across multiple technology platforms;

2. Ensuring timely vulnerability remediation to reduce cybersecurity risk exposure;

3. Maintaining operational monitoring and maintenance platforms;

4. Supporting enterprise collaboration and messaging systems;

https://www.nato.int/content/dam/nato/webready/documents/finance/procurement-procedure_en.pdf

5. Ensuring the availability and integrity of database services;

6. Maintaining consistent client workstation patch compliance;

The Contractor shall perform the services in strict accordance with this SOW to deliver the described services and achieve measurable results, including system availability, data integrity, automated workflow functionality, compliance with applicable IT governance and security standards, operational reliability, end-to-end technical performance, and continuous improvement.

These activities require specialized skills, sustained operational capacity, and the ability to adapt to evolving technology stacks. To address these needs, the NCIA seeks to establish a contract with a qualified Contractor to deliver Operations and Maintenance Patching Services.

The Contractor will complement internal teams by performing operational maintenance activities, implementing security updates, supporting monitoring systems, and assisting with vulnerability remediation activities.

Expected Results

Within the general Operations and Maintenance framework described above, the NCIA currently anticipates the outsourcing of support for the following technology domains:

1. Server Operating Systems Operations and maintenance services for server operating systems, including: patch management, security update deployment, vulnerability remediation, operational maintenance; Primary platform currently in scope: Microsoft Windows;

2. Enterprise Messaging and Collaboration Platforms; Maintenance and patching support for enterprise messaging and collaboration services, including: security patch deployment. platform update management, vulnerability mitigation, operational health checks Technologies include: Microsoft Exchange Server, Skype for Business Server

3. Infrastructure Monitoring and Observability Platforms; Operations and maintenance services for monitoring platforms used to supervise infrastructure and service health.

Technologies in Current scope: Zabbix;

4. Client Endpoint Operating Systems - Patch management and vulnerability remediation for client workstation operating systems used within the NCIA’s environment. Primary platform currently in scope: Microsoft Windows

5. Database Platforms - Operations and maintenance services for enterprise database systems, including security patching and update management. Primary platform currently in scope: Microsoft SQL Server

Patching and remediation encompass the systematic process of identifying, prioritizing, and applying updates to software and hardware within the designated infrastructure to mitigate vulnerabilities and address security issues. Security-related patches should be applied according to defined deployment schedules-NCSC deployment timing, while general environment updates, such as bug fixes, should adhere to the manufacturer’s recommended patching cycle. These schedules may be adjusted as necessary to accommodate the evolving operational and security requirements of the NCIA flexible needs environment.

Patching, updates and remediation: routine, preventive, and emergency patching of databases, middleware, and applications, including associated testing and validation.

Monitoring and Performance: Continuous monitoring, performance management, and optimization to ensure system availability and reliability.

Backup and Recovery: Execution of backup, recovery, and data integrity procedures in accordance with the NCIA policies.

Security and Compliance: Compliance with all relevant security, operational, and regulatory standards.

Documentation and Reporting: Accurate reporting and documentation of all maintenance, support, and related activities.

3. Vendor Eligibility

a. Participation in this Procurement Opportunity is restricted to vendors from participating NATO nations.

b. This restriction applies to the eligibility of the vendors only and does not require that the goods, works, or services themselves be manufactured or produced within participating nations.

4. Access to Solicitation Documentation

a. Interested vendors may participate to and access the solicitation documentation for this Procurement Opportunity as of the Anticipated Solicitation Release Date as follows:

i. Indicating your interest by emailing the Point of Contact listed above to request being added to the bidder’s list and receive the solicitation (no Declaration of Eligibility (DoE) required).

5. Security Requirements

a. This opportunity is classified as NATO SECRET (NS) and interested vendors are required to meet the above-mentioned security level.

6. Language of Solicitation and Bid Submission

a. Solicitation Documentation and Proposal Submission Language(s): English

7. Additional Engagement Opportunities

a. The NCIA may organize the following engagement activities:

i. Industry Day: Not Applicable

ii. Pre-Bid Conference: Not Applicable

End of Notification