RFI-42630696-NICC.pdf

PP.A2(07.25)

Request for Information (RFI)

NATO INTEGRATED CYBER DEFENCE CENTRE (NICC)

URGENT REQUIREMENT PROJECT

RFI-42630696-NICC

NCIA/ACQ/2026/07851

Friday, 16 October 2026

NCIA Pre-competitive Engagement Calling Notice - Request for Information (RFI)

To: Industry Partners

1. The NATO Communications and Information Agency (NCIA) is conducting pre-competitive market engagement as market research to gather input on potential solutions to support the upcoming acquisition for the technology pillar of the NATO Integrated Cyber Defence Centre (NICC). To that end, we are issuing the attached Request for Information (RFI) RFI-42630696-NICC and holding a dedicated workshop at NATO Edge to solicit feedback from capable and interested industry partners.

2. This Calling Notice RFI is issued for planning purposes only and is not a request for bids.

It is part of NCIA’s effort to engage early to inform and ensure it has a clear understanding of the marketplace, available capabilities, and potential acquisition strategies.

3. We value your insight and invite you to review and comment on our draft high level problem statement (Annexes A and B) with a view in providing recommendations for improving performance outcomes, competition, and efficiency; and identifying any risks or concerns that should be considered during planning.

4. Feedback can be provided in writing in accordance with submission instructions and/or by attending a dedicated Business Workshop: “Uplifts for Cyber Capabilities” taking place at NATO Edge on 17-19 November in Izmir (Türkiye), where NCIA will respond to clarifying questions and invite comments from participants.

5. Submission instructions and additional details can be found in the enclosure to this RFI.

6. Only companies from a NATO member country can participate in or respond to this RFI (https://www.nato.int/cps/en/natohq/nato_countries.htm) or attend a dedicated workshop.

7. Should you have any questions or need clarification, please contact Line Sigh at RFI- 42630696-NICC@ncia.nato.int.

8. We thank you in advance for your time and input, and we look forward to engaging with you as we shape this potential acquisition.

For the Chief of Acquisition:

Line Sigh Senior Contracting Officer https://www.nato.int/cps/en/natohq/nato_countries.htm mailto:RFI-42630696-NICC@ncia.nato.int

Enclosure:

• Request for Information with Annexes A and B

• Distribution List

Distribution List

1. NATO Delegation (Attn: Infrastructure Adviser)

1. Albania 12. Greece 23. Poland

2. Belgium 13. Hungary 24. Portugal

3. Bulgaria 14. Iceland 25. Romania

4. Canada 15. Italy 26. Slovakia

5. Croatia 16. Latvia 27. Slovenia

6. Czechia 17. Lithuania 28. Spain

7. Denmark 18. Luxembourg 29. Sweden

8. Estonia 19. Montenegro 30. Türkiye

9. Finland 20. Netherlands 31. United Kingdom

10. France 21. North Macedonia 32. United States

11. Germany 22. Norway

2. All NATEXs

Table of Contents

REQUEST FOR INFORMATION

A. Introduction

B. Submission Instructions

C. Industry Engagement

D. Disclaimer

E. Use of Information Provided through Responses

F. RFI Point of Contact

Annex A – Requested Information

Annex B – Problem Statement and Questions

Background and Scope

Implementation Approach

Objective of the Early Engagement

Work Packages & Questions

WP1: The NICC Platform

WP2: Enhancements to Situational Awareness (SA) (Cyber Event Timeline and Analysis Capability)

WP3: Enhancements to the Red Teaming (Adversary Emulation) Capability

WP4 - Rapid Reaction Teams (RRT)

WP5: Cyber Operations Management and Engagement Tool (COMET)

Implementation

REQUEST FOR INFORMATION

A. Introduction

1. This RFI covers four out of the five independent Work Packages (WPs) that support the

NICC mission. Interested parties are invited to submit their response to one or several WPs.

2. Attendance at the dedicated business workshop at NATO Edge (see section C), taking place on 17-19 November in Izmir is not a prerequisite to respond to this RFI, and we invite any interested party to provide their feedback.

B. Submission Instructions

1. Interested parties are invited to respond in accordance with the instructions below or provide feedback during Industry Engagement:

a. Submit responses via the email address in section F, no later than 12:00 hours Central European Time (CET) on 09 November 2026.

b. Responses should be submitted in PDF or Word format and must not exceed 10 pages per WP, including:

i. Responses to Annex A excluding:

- Cover page

- Company brochures or product literature (if included)

- Attachments such as past performance references.

c. Use the following subject line for submission:

i. “Response to RFI [RFI Number] – [Company Name] – [applicable WP(s)].”

d. All responses should address the items listed in Annex A – Requested Information.

e. Respondents are also encouraged to review and comment on the draft problem statement and questions in Annex B.

C. Industry Engagement

1. Planned industry engagement will take place in the form of Business Workshop: Uplifts for Cyber Capabilities at NATO Edge, taking place on 17-19 November in Izmir (Türkiye).

2. During the workshop, NCIA will brief the project’s overview and the problem statement (Annex B), respond to clarifying questions and invite comments from participants, based on the questions shared (Annex B) in the open forum, as well as in bilateral meetings (schedule allowing).

3. More information on NATO Edge attendance and registration is available on event’s official website - https://www.natoedge.nato.int/.

4. As abovementioned, attendance at the NATO Edge workshop is not a prerequisite to respond to this RFI, and we invite any interested party to provide feedback.

https://www.natoedge.nato.int/

D. Disclaimer

1. This RFI is for planning and informational purposes only and shall not be construed as a solicitation or obligation on the part of the NCIA. The NCIA does not intend to award a contract based on responses to this RFI. Respondents are solely responsible for all costs incurred in responding to this RFI. The NCIA will consider and analyse all information received from this RFI and may use these findings to develop a future solicitation. The NCIA will consider all responses as confidential commercial information and will protect it as such.

2. NCIA reserves the right, at any time, to cancel this informal market survey, partially or in its entirety. No legal liability on the part of NCIA for payment of any sort shall arise and in no event will a cause of action lie with any prospective participant for the recovery of any costs incurred in connection with the preparation of documentation or participation in response hereto. All effort initiated or undertaken by prospective informal market survey participants shall be done considering and accepting this fact.

E. Use of Information Provided through Responses

1. Confidentiality of Responses

The NCIA may incorporate industry comments and responses, in part or in whole, into a future release of a solicitation. Should respondents include proprietary data in their responses that they do not wish to be disclosed to the public for any purpose, or used by NCIA (except for internal evaluation purposes), they must:

a. Mark the title page with the following legend:

This document includes data that shall not be disclosed outside NATO and shall not be duplicated, used, or disclosed – in whole or in part – for any purpose other than for NCIA internal evaluation purposes, unless otherwise expressly authorised by [insert company name]. This restriction does not limit the NCIA’s right to use information contained in this data without restriction if it is obtained from another source. The data subject to this restriction are contained in sheets [insert numbers or other identification of sheets].

b. Mark each sheet of data it wishes to restrict with the following legend:

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

F. RFI Point of Contact

1. Line Sigh at RFI-42630696-NICC@ncia.nato.int

Annex A – Requested Information

1. Respondents are encouraged to provide the following information in their response:

a. Company Information

i. Legal Business Name

ii. Address

iii. Website

iv. Primary Point of Contact

v. Email address

b. Technical Capability

i. Summary of relevant capabilities and past performance

c. Feedback and Recommendations

i. Responses to the RFI Questions in Annex B for WP1, WP2, WP4, WP5, and Procurement. No input is requested for WP3.

ii. Innovations or alternatives

iii. Comments on the draft Problem Statement

d. Questions or Concerns

i. Risks, concerns, or barriers

ii. Suggestions for risk mitigation or enhancing competition

Annex B – Problem Statement and Questions

Note: This following problem statement is a DRAFT and subject to change.

Background and Scope

The NATO’s Integrated Cyber Defence Centre (NICC) mission is to strengthen the protection of both NATO and its Allies, to enable the use of cyberspace as an operational domain, to reinforce secure yet rapid communication, collaboration and coordination across key actors, while enhancing the collective response to cyber threats.

In order to support the NICC’s mission, the NICC community requires:

• The delivery of new Communications and Information Services (CIS) capabilities, and

• The operational uplift of existing capabilities.

Both objectives will be delivered by the NICC Urgent Requirement (UR) project.

The project consists of five (5) Work Packages (WP):

• WP1: The NICC Platform (new capability);

• WP2: Enhancements to Situational Awareness - Cyber Event Timeline and Analysis Capability (new capability);

• WP3: Enhancements to the Red Teaming (Adversary Emulation) Capability (enhancement of existing capability) (out of scope of this RFI);

• WP4: Rapid Reaction Team (RRT) (enhancement of existing capability); and

• WP5: Cyber Operations Management and Engagement Tool (COMET) (enhancement/replacement of existing capability).

Implementation Approach

Timeline: All WPs shall be delivered no later than Q3 2030.

Solicitation: To support parallel execution of the WPs and accelerate the implementation of the highest priority requirements and expedite the delivery of the most urgent operational needs, NCIA may cluster the WPs in two separate solicitations: IFB 1 (WP1 & WP2) and IFB 2 (WP3, WP4, WP5). Contracts will be awarded to Integrators capable of delivering multiple WPs simultaneously.

To streamline the evaluation process and improve the decision making, NCIA will apply a phased Down-Select approach. Proposals are planned to be evaluated in a two-step submission with the first step being a 10-page capability statement. Bidders receiving the highest confidence rating will then be invited to submit a full proposal and to attend a challenge-based acquisition event, after which NCIA will reach contract award decision.

Implementation: Where technically feasible, the project will adopt an Agile delivery approach, developing software iteratively through short delivery cycles. Requirements will be captured and prioritised through user stories, enabling continuous stakeholder feedback, progressive refinement, and integration with existing platforms and systems. This incremental approach supports early validation of functionality, reduces implementation risk, improves solution quality, and ensures continued alignment with evolving business requirements.

All WPs support the NICC concept, however the WPs are not directly related or dependent on each other.

Objective of the Early Engagement

Input received will assist in refining requirements, identifying capabilities, and shaping the strategy for any future solicitation.

During this early engagement process, the NCI Agency seeks industry engagement with the following objectives:

• To gain validation and feedback on the business case and benefits;

• To gain feedback on the envisioned approach, including but not limited to:

o Timeline, phasing & overall approach;

o Contracting approach;

o Estimated contract value;

o Envisioned operating model; and o Key Constraints.

• To gain understanding of the solution space, including but not limited to:

o Operating models;

o Architecture;

o Enabling technology; and o Implementation.

Work Packages & Questions

The details for each WP are described in the following sections. Questions for each WP are inserted in extension of each section.

WP1: The NICC Platform

NATO requires a resilient1, secure and governable Platform that provides authorised users with secure communication, collaboration, coordination and information-sharing services during normal, degraded and crisis conditions.

The Platform is intended to complement - rather than replace - the existing cyber security infrastructure and services. As such, the NICC Platform is not a Security Operations Centre (SOC) platform, but a platform for cyber collaboration.

The Platform shall operate on multiple classification levels (NU, NR, NS), and enable communication and collaboration between the NATO Enterprise cyber entities, Nations, and authorised external organisations, including industry and academia.

The Services of the Platform and associated Service Level Agreement (SLA) targets are:

• Mission Critical Services (Monthly Avail: 99.9%, Recovery Time Objective (RTO) < 30min, Recovery Point Objective (RPO) < 5 min): VTC, Instant Messaging (person-to-person and group communication);

• Business Critical Services (Monthly Avail: 99.5%, RTO < 60min, RPO < 30min):

Email, File Sharing, Document Co-Creation capabilities;

• Business Operational Services (Monthly Avail: 99%, RTO < 8h, RPO < 24h):

Collaboration Portals and Tools (e.g. SharePoint or MS-Teams like capabilities), Wiki/Knowledge Management Capability.

The Platform shall meet the abovementioned SLA targets and maintain its confidentiality, integrity, usability and operational control, when NATO Enterprise IT infrastructure, connectivity, or supporting services, are degraded or unavailable.

Access to the NICC Platform and Network/Backbone Resilience

The NATO Enterprise NICC users shall be able to access the NU and NR instances of the Platform via an Internet-connected NR laptop device. Access to the NS instance of the Platform will only be possible via NS terminals. Such terminals can be located in different physical locations.

Authorized users from the academia and industry will only be able to access services on the NU NICC Platform (e.g. Internet accessible Wiki or similar), while users from NATO Nations can use their NS Terminals to access the NS NICC Services.

Please note: The project will not provide any CIS to users outside the NATO Enterprise, so any NICC services offered to them shall be accessible by standard-terminals (e.g. via a web browser etc), without requiring specialized hardware or tokens.

1 This refers to cyber resilience which is defined as the ability to anticipate, withstand, recover from and adapt to disruptions and/or cyber incidents that cause an unplanned, negative deviation from the expected delivery levels of core services. The primary focus is on ensuring the continuity and resilience of systems, infrastructure, and technology resources. Business continuity and resilience considerations relating to physical work facilities such as buildings and equipment, and people-related continuity and resilience considerations, will be addressed primarily through the relevant lines of effort of the NICC which is outside of the scope of the NICC UR.

The NICC Platform will depend on the existing Enterprise backbone network. Although the resilience of this network is outside the NICC UR scope, the project must provide alternative connectivity (such as 5G or high-speed satellite connectivity), in order to maintain Platform access and communications for at least NATO Enterprise NICC stakeholders, during disruption of the Enterprise backbone network.

Depending on the recommended architecture, the alternative communication means might need to be available for both the backend (Platform CIS) and the end-users. Example scenarios (not exhaustive):

• If the platform is to be setup on-premise, then for resiliency reasons there must be NICC server rooms in different physical locations (e.g. location A and B). In this case, the alternative communication means will only be required for the connection between the NICC server rooms in locations A and B (assuming the end users are also based in these locations and thus can connect to the local NICC server room even when the backbone network is not available).

• Alternatively, if the NICC platform is to be Cloud-based, then alternative communication means must be available at the physical locations of the NICC users, so they can access the NICC platform on the Cloud in case the main network/Internet connectivity is degraded/unavailable.

WP1 - High Level Objectives (HLOs):

HLO-1 - Resilient Communications and Collaboration Provide secure and usable communications, collaboration and information-sharing services that meet defined availability and performance requirements during normal, degraded and crisis operating conditions.

HLO-2 - Operational Independence and Continuity Ensure that critical Platform services can continue to operate for defined periods when the underlying NATO Enterprise infrastructure, connectivity or supporting services (e.g. Active Directory, Identity and Access Management) are degraded, compromised or unavailable, through appropriate autonomy (i.e. meeting SLA targets), redundancy and alternative operating modes.

HLO-3 - Cyber and Technology Resilience Harden the capability to cyber-attack, common-mode failures, supply-chain risks and compromise of underlying infrastructure through appropriate design, encompassing isolation, technology diversity, defence-in-depth, and other cyber resilience by design measures.

HLO-4 - Secure Multi-Level and External Collaboration Enable authorised users to communicate and collaborate across the required security/classification domains and with authorised Nations, industry and academia, while maintaining appropriate segregation, access control, information flow control, releasability and accreditation.

HLO-5 - Recoverability and Crisis Operations Enable the capability to withstand disruption attempts, operate in degraded modes, and rapidly restore and reconstitute critical services following service/infrastructure disruptions or cyber incidents.

HLO-6 - Sustainable and Governable Capability

Provide a scalable, interoperable and manageable capability that will be accreditable, will support lifecycle management and have reduced dependency on individual vendors or proprietary technologies.

Engagement Objective for WP1

This RFI seeks industry input on realising the above-described HLOs and in particular it invites industry to propose architectures, deployment models and operational approaches for this secure and resilient NICC Platform such that it:

• supports controlled collaboration;

• minimises critical dependencies; and

• maintains continuity of secure communications during major disruptions or loss of essential enterprise services.

Questions for WP1

# Title Description

Reference architecture

Please describe your proposed high-level reference architecture for a resilient CIS supporting secure communication, collaboration and coordination across geographically dispersed Enterprise entities, Nations, and authorised external partners.

Please highlight key security boundaries, dependencies, resilience mechanisms and management capabilities.

Deployment Model

Please compare on-premises, private cloud and hybrid deployment models for this capability, considering security, resilience, accreditation, operational control, scalability, cost, time to deploy, and risk with respect to cloud usage and data sovereignty.

Please provide your recommended approach and the rationale for it.

Enterprise Independence

How would your solution remain operational if critical Enterprise infrastructure or services-including network connectivity, identity, DNS, PKI, monitoring or management platforms-were degraded or unavailable?

Please identify the key dependencies and how they would be mitigated.

Resilience and Recovery

How would your architecture meet the required availability and Recovery Time Objective (RTO) targets during infrastructure failure, loss of a site, cyber-attack or other major disruption?

Please describe your approach to redundancy, backup, restoration, cyber recovery, Recovery Point Objective (RPO) and recovery testing.

Cyber and Common- Mode Resilience

How would you prevent a compromise or vulnerability affecting the wider Enterprise or underlying infrastructure from simultaneously compromising the Platform?

Please describe your approach to isolation, defence-in-depth, technology diversity and other measures that reduce common-mode failure.

Technology and Vendor Dependency

How would you minimise dependency on a single vendor, cloud provider, identity platform, hypervisor, operating system, database or security technology?

Please identify any significant proprietary dependencies and explain how technology or vendor substitution could be achieved.

Multi-Level and External Collaboration

How would you support environments operating at different classification levels while enabling controlled collaboration with Nations, industry and academia? (collaboration with academia/industry at NU, Nations at NU/NR/NS)

Please describe your approach to segregation, cross-domain interaction, identity, data protection and accreditation.

Crisis Operations

How would the Platform be operated and supported during a major Enterprise-wide crisis when underlying IT, security and support capabilities are degraded or unavailable?

Please describe the minimum operational capability required to maintain secure communications and restore critical services.

WP2: Enhancements to Situational Awareness (SA) (Cyber Event Timeline and Analysis Capability)

A new cyber investigation capability called Cyber Event Timeline and Analysis Capability is required for reducing investigation time and enabling more informed, timely decision-making by operational leadership.

The objective of this capability is to enable rapid, evidence-based reconstruction and analysis of cyber incidents by bringing together relevant security, threat intelligence and forensic data into a coherent, interactive representation of events, entities, and relationships.

The capability shall facilitate scalable data ingestion, normalization and processing of large volumes of cybersecurity-related data from multiple sources (including network traffic, system logs, forensic artefacts, etc.).

It shall reconstruct chronological timelines of cybersecurity events, correlate associated activities, and enable the pattern and anomalies recognition within large-scale and heterogenous datasets. Subject to security, accreditation, data handling and operational validation, the latter shall be supported by Artificial Intelligence (AI)-assisted automation features.

The capability shall enable analysts to establish and maintain an auditable understanding of what happened, when it happened, how activities were connected, what is known or inferred, and where uncertainty remains. It shall enable this understanding to be communicated efficiently to technical, operational and senior leadership audiences, supporting timely and informed decision-making, while preserving the origin and analytical context of the underlying evidence.

WP2 - HLOs:

HLO-1 - Multi-Source Event Assembly Allow analysts to acquire, normalise and assemble relevant events and contextual information from authorised security, intelligence, network and forensic sources into a common analytical representation, enabling analysts to trace analytical events and conclusions back to the underlying source information.

HLO-2 - Timeline Reconstruction and Visualisation Enable analysts to construct a scalable, accurate, and chronological representations of cyber activity, including related events, supporting activities, and the relationships among them. The capability shall support configurable time ranges and varying levels of temporal granularity and precision. It shall enable interactivity, allowing analysts to navigate between broad patterns and individual events, to show or hide events by attributes (i.e. activity type, confidence level, etc.), and select timeline events to explore their details, relationships, and supporting evidence. It shall represent uncertain, estimated, and conflicting chronological information explicitly, while preserving visibility of and traceability to the underlying source data.

HLO-3 - Correlation and Analytical Exploration Enable analysts to identify, investigate and navigate chronological, entity-based and contextual relationships between events, entities and activities. The capability shall support analytical correlation, search, filtering, pivoting and drill-down across multiple levels of detail, while clearly distinguishing source-derived relationships from system-generated correlations and analyst hypotheses on technical attribution.

HLO-4 - Analytical Context, Annotation and Reconstruction Enable analysts to develop, maintain and revise an evidence-based reconstruction of an incident by adding annotations, tags, relationships, assessments, hypotheses and narrative groupings. The capability shall preserve the distinction, origin and chronological history of source-derived information, system-generated analysis and analyst-generated interpretation, including the ability to represent confidence, uncertainty and competing technical attribution hypotheses.

HLO-5 – Concurrent Contributors Enable multiple analysts to add and update timeline data concurrently, without loss or unintended overwriting, while maintaining an auditable history of each contribution, including the analyst’s identity, timestamp, source references, and changes made.

HLO-6 - Analytical Communication and Decision Support Enable analysts to communicate incident reconstructions, findings, assessments and relevant evidence to technical, operational and senior leadership audiences through configurable visualisations in multiple formats, while preserving event relationships, temporal information, confidence level, and source traceability.

HLO-7 - Secure, Sovereign and Disconnected Deployment Enable the capability to operate within appropriately controlled organisational infrastructure without dependence on external connectivity or externally hosted services. The capability shall support deployment within restricted-connectivity or fully disconnected environments, where appropriate security, access control, data protection and operational management controls are present.

Engagement Objective for WP2

In line with these HLOs, industry is invited to propose solutions for reconstructing, analysing and communicating cyber incidents through integrated, evidence-linked timelines. The proposed solutions shall support collaboration and scalability, be deployable within existing security environments, and support export visualisations tailored to technical and non-technical audiences.

Questions for WP2

Incident reconstruction

How does your solution help an analyst to:

1. reconstruct a cyber incident,

2. determine and present what happened and when it happened,

3. determine and present how events relate to each other, and

4. determine and present how the incident develops over time?

Multi-source timelines

How can your solution bring together events from existing SIEM, EDR, network, forensic, threat-intelligence and other sources into a single incident timeline, while retaining links back to the original source data?

Time and uncertainty

How flexible is your timeline model?

Can it represent precise timestamps, durations, time ranges, approximate or uncertain times, different time zones, and events whose timing is subsequently revised?

Correlation and relationships

How does the solution identify and represent relationships between events, entities and activities-for example sequence, correlation, dependency or potential causality?

Can analysts distinguish confirmed relationships from hypotheses or analytical assessments?

Analyst-driven investigation

How can an analyst interact with the timeline-for example filtering, searching, grouping, tagging, pivoting between related events and entities, drilling into underlying evidence, and creating alternative views of the same incident?

Analytical context and evidence

What information can an analyst attach to an event or relationship-such as notes, screenshots, documents, source references, confidence, classifications and supporting evidence-and how does the solution distinguish source information from analyst assessment?

Collaboration and narrative

How do multiple analysts collaborate on an evolving timeline?

Can they annotate events, identify significant events and decision points, build incident narratives, and preserve the history of how the investigation developed?

Different audiences and reporting

Can the same underlying incident be presented at different levels of detail-for example a detailed analyst view and a simplified executive chronology?

What reporting and export capabilities are available?

Scale and performance

What is the largest and most complex incident timeline you have deployed in practice?

How many events, sources, concurrent users and timelines can it support while remaining interactive, and how does the solution handle very large timelines visually?

Deployment and integration

How can the timeline capability be deployed within an organisation's existing security infrastructure, including on-premises, private cloud or restricted/disconnected environments?

Which capabilities require external connectivity or vendor-hosted services, and what APIs or integration mechanisms are available?

11 Timelines:

Generic

If you were designing a Cyber Event Timeline capability for a large incident-response organisation today, what capability do you think customers most often underestimate, forget or get wrong?

WP3: Enhancements to the Red Teaming (Adversary Emulation) Capability

This WP3 was already subject to an earlier RFI (RFI-42619136-RT) and is therefore out of scope of this RFI. The below description is included herewith for awareness purpose only.

Please note that this WP will still feature in the future NICC UR Solicitation Package.

The Red Teaming capability provides an objective-based assessment to test the resilience of a target network, mimicking a malicious actor to assess the people, process and technology in terms of prevention, detection and response capabilities to a cyber threat. The NATO Red Teaming capability supports NATO's cyber defence capabilities by providing advanced tools for mission planning, real-time operations management, evidence collection, and comprehensive reporting, all while ensuring operational security and compliance with NATO policies.

In the earlier RFI (RFI-42619136-RT), NATO requested input to the design and development of the following custom-built CISs:

• a Red Teaming Mission Planning, Execution, and Debriefing (RT-MPEDS) system to manage the complete lifecycle of NATO Red Team operations, from initial planning through active execution to comprehensive debriefing and archiving; and

• an infrastructure to serve as the daily working environment for the Adversary Emulation service. This infrastructure is referred to as RTNet and provides a secure repository for the storage, organisation, and distribution of artefacts required to conduct Adversary Emulation activities, including offensive security tooling, operational artefacts, scripts, intelligence, and assessment data.

For the purpose of this RFI, NATO is not seeking any additional feedback on WP3 from the industry.

WP4 - Rapid Reaction Teams (RRT)

The RRT kits are designed as a deployable, mission-ready, defensive cyber operations platform. They enable the specialized Rapid Reaction Teams to rapidly respond to cyber security incidents, crisis situations and high-priority DCOs across diverse and constrained environments.

The NATO Cyber Defence Rapid Reaction Team/Security Response Team Provides rapid, technical cyber defence assistance to NATO organisations and to individual NATO Allies. The RRT security experts make use of deployable RRT kits which deployable cyber investigation kit enabling the experts to conduct: Computer & Network Forensics, Malware Analysis, Event/security Log collection, etc.

The current RRT kits need to be refreshed and uplifted, to meet the current operational needs.

This project will procure 4 new enhanced RRT kits: 3 to be used by each of the rapid reaction teams concurrently and 1 to be used as a spare on stand-by mode. All kits have to be delivered as a single, unified capability to ensure consistency, interoperability and ease of sustainment.

Each kit must be fully pre-configured, security hardened, and documented, enabling immediate operational use.

NATO is seeking industry input on the intended enhancements to the NATO Rapid Reaction capability. The enhancements shall ensure the following requirements are met:

• The enhanced RRT capability must centre on a standardized, transportable kits that integrate secure hardware, re-configurable software, and operational tooling into a single cohesive capability ensuring rapid deployment, interoperability, and operational effectiveness.

• The intended architecture must enable rapid, non-disruptive integration into target environments while maintaining the ability to operate independently when required (e.g. in air-gapped or compromised environments). The target environments can be both unclassified and classified.

• The system architecture of the RRT kits must be modular and comprised of the following replaceable, upgradable, interchangeable modules:

o Compute module (laptops and portable server nodes);

o Storage module (encrypted, removable storage);

o Network module (network taps, switches, routers);

o Power Module (Uninterrupted Power Supply (UPS), adapters for global deployment);

o AI accelerated module capable of supporting cybersecurity operations (such as malware analysis, digital forensic support, password analysis, etc.).

o Multiple tools for computer forensics, network forensics, malware analysis etc.

• The RRT kits shall be designed using a modular and vendor-neutral architecture that allows independent replacement, upgrade, and integration of hardware and software components without vendor lock-in, supporting lifecycle refresh and integration of alternative technologies.

• The RRT kits shall ensure full traceability of ownership and control of all collected and processed data, support export in standardized, non-proprietary formats, and maintain forensic integrity through chain-of-custody logging, without allowing external access or retention by the supplier.

More specifically, the enhanced RRT capability shall provide the features listed below:

• Digital Forensics: integrated forensic tooling and secure evidence handling;

• Malware Analysis: local sandboxing and AI-assisted analysis;

• Event/Security Log Collection: portable Security Information and Event Management (SIEM) with standardized ingestion;

• Intrusion Detection System (IDS): network module with IDS capabilities;

• Full Packet Capture: dedicated capture infrastructure with scalable storage;

• Online Vulnerability Assessment: integrated scanning tools with offline capability;

• Threat Hunting: correlated analytics across network and endpoint data;

• Compromise Assessment: combined forensic and SIEM-driven insights; and

• Out of band reach-back to the NATO Enterprise (e.g. 5G routers, high speed satellite communication)

Engagement Objective for WP4

This RFI seeks industry input on these deployable RRT kits to support on-site incident response, rapid triage and the secure collection and acquisition of digital evidence. Industry is invited to describe solutions that combine field-ready hardware, forensic software and supporting accessories.

Questions for WP4

There are no specific questions for WP4, please respond in line with the above-described engagement objective.

WP5: Cyber Operations Management and Engagement Tool (COMET)

At present, a dedicated Cyber Operations Management System (COMS) facilitates the cyber incident response lifecycle at NATO, and in parallel acts as a dynamic Information and Knowledge Management (IKM) system.

While COMS is built on existing commercial solutions (namely Atlassian’s JIRA and Confluence), it has been heavily customised to meet NATO’s specific operational needs.

A new capability called Cyber Operations Management and Engagement Tool (COMET) is to replace the current COMS, preserve and optimise the existing workflows and features.

COMET must serve as a secure cyber incident response collaboration and case management environment, combining incident ticket/case management and a dynamic Information and Knowledge Management (IKM) system.

Furthermore, the development of COMET must also ensure a seamless migration from COMS, that preserves the integrity and continuity of all existing data and workflows.

Accumulated knowledge, custom-built modifications, and existing functionalities in COMS must be retained and remain fully operational. Business and technical continuity must be maintained throughout the transition. Where feasible, existing manual workflows should also be optimised and automated to improve efficiency and reduce manual intervention.

Engagement Objective for WP5

As such, this RFI seeks input specifically on products/capabilities that can be used to migrate from the existing software stack, and allow data migration and knowledge retention to ensure continuity, enable portability and interoperability. Input shall also focus on mechanisms to avoid future vendor lock-in, by enabling the complete data export in documented, open formats and migration without reliance on proprietary vendor tooling.

Questions for WP5

1 Reference Architecture

Describe how the solution supports a flexible workflow that can facilitate the complete cyber incident response lifecycle, from initial notification/intake and triage through investigation, containment, eradication, recovery, closure, lessons learned and subsequent knowledge capture.

2 Reference Architecture

Describe the solution's ticket/case-management capabilities, including unique incident identifiers, workflows, severity/priority, assignment, escalation, task/sub-task management, SLA tracking, approvals, dependencies, notifications and customisable incident states.

3 Reference Architecture

Explain how the platform provides secure collaboration during an active incident, including document sharing, concurrent editing, comments, activity feeds, incident-specific workspaces, tasking and integration with email/chat or other enterprise collaboration capabilities.

4 Reference Architecture

Describe the integrated knowledge-management/wiki capability, including articles, runbooks, playbooks, lessons learned, templates, version control, approval workflows, metadata/taxonomy, full-text search, linking between knowledge and incidents, and mechanisms for preventing obsolete guidance from being used operationally.

5 Security Measures

Describe the platform's security and access-control model, including RBAC/ABAC, need-to-know restrictions at incident/document level, MFA/SSO, privileged administration, external-user access, encryption, audit logging and integration with enterprise identity and security-monitoring systems.

6 Auditing Measures

Explain the platform's audit, records-management and evidential capabilities, including immutable activity history, document/version history, retention schedules, records disposition and the ability to reconstruct actions and decisions made throughout an incident.

Data Migration & Knowledge Retention Approach

Describe your approach to migration from an incumbent commercial incident-management/knowledge-management platform that has been extensively customised. Address migration of tickets/cases, comments, attachments, wiki/knowledge articles, metadata, relationships, hyperlinks, users/groups, permissions, workflow states, version histories, audit histories and timestamps. Clearly identify any data types or historical information that cannot be migrated without loss.

Data Migration & Knowledge Retention Approach

Describe the proposed migration methodology and assurance process, including source-system discovery, data mapping, transformation, deduplication, migration tooling, test migrations, reconciliation, validation of record counts and cryptographic hashes where applicable, permission validation, user acceptance testing, cut-over, rollback and preservation of the legacy environment.

State how you would demonstrate that the migrated repository is complete and accurate.

Vendor Lock-in Mitigation/Sustainability Approach

Explain how the solution avoids future vendor lock-in.

Identify mechanisms for complete export of incidents, tickets, attachments, knowledge articles, metadata, relationships, permissions and audit information into documented/open formats, and describe how data could subsequently be migrated to another platform without dependence on proprietary vendor tooling.

Implementation

Industry is invited to submit their feedback on the overall implementation and contracting approach. They may be guided by the following questions:

Solicitation

Please provide your feedback on the option to cluster multiple WPs into two solicitations.

Does combining multiple WPs in one competition help or hinder you? Under what conditions would a split change your answer?

Do you see any issues with this approach, constraints, dependencies, risks? What are your alternative suggestions (if any)?

Would you bid as prime for the combined scope? If only as a subcontractor or consortium member, what specifically blocks prime participation? To which WPs would you bid?

2 Solicitation

To streamline the evaluation process and improve the decision making, NCIA intend to apply a down-select process as part of its acquisition strategy.

Please provide your feedback on this approach; do you see any issues with this approach, opportunities, constraints, dependencies, risks?

What are your alternative suggestions to enhance competition (if any)?

3 Implementation

Please provide your feedback on the desired agile implementation approach, the timeline, and phasing as described in Annex B.