NCIA/ACQ/2026/07577

0 August 2026

NCIA Request for Information (RFI) To: Industry Partners

Subject: NATO COMMON PROCUREMENT PLATFORM: SOURCE-TO-CONTRACT, CONTRACT

LIFECYCLE MANAGEMENT, AND VENDOR MANAGEMENT CAPABILITIES

RFI-CO-424390-PIVOT

1. The NATO Communications and Information Agency (NCIA), in coordination with the NATO Digital Transformation programme and relevant NATO entities is conducting market research to understand market capabilities and gather input on potential Commercial Off- The-Shelf (COTS) solutions to support the acquisition of e-procurement capabilities across Source-to-Contract (S2C), Contract Lifecycle Management (CLM), Vendor Management (VM) and associated cross-cutting platform services.

2. The downstream finance-facing Procure-to-Pay (P2P) component (i.e., invoice capture, three-way matching, payments, budget control and commitments, and non-PO spend) is treated as an Enterprise Resource Planning (ERP) Tool dependency and is out of scope for this RFI. NCIA welcomes industry feedback on this scoping boundary.

3. This RFI is issued for planning purposes only and is not a request for bids. It is part of NCIA’s effort to ensure a clear understanding of the marketplace, available capabilities, delivery models, implementation risks and potential acquisition strategies.

4. NCIA values your insight and invites you to share relevant corporate capabilities and experience by responding to the enclosed questions (Annex A), providing a Rough Order of Magnitude (ROM)(Annex B: Part 1), and commenting on the Epic-Outcome Matrix (Annex B: Part 2).

5. Submission instructions and additional details can be found in the enclosure to this RFI.

6. Only companies from a NATO member country can participate in and respond to this RFI

(https://www.nato.int/cps/en/natohq/nato_countries.htm).

7. We thank you in advance for your time and input, and we look forward to engaging with you as we shape this potential acquisition.

For the Chief of Acquisition:

James Miller

Contracting Officer

Enclosure:

Request for Information with Annexes A and B Distribution List

Distribution List

1. NATO Delegation (Attn: Infrastructure Adviser)

1. Albania 12. Greece 23. Poland

2. Belgium 13. Hungary 24. Portugal

3. Bulgaria 14. Iceland 25. Romania

4. Canada 15. Italy 26. Slovakia

5. Croatia 16. Latvia 27. Slovenia

6. Czechia 17. Lithuania 28. Spain

7. Denmark 18. Luxembourg 29. Sweden

8. Estonia 19. Montenegro 30. Türkiye

9. Finland 20. Netherlands 31. United Kingdom

10. France 21. North Macedonia 32. United States

11. Germany 22. Norway

2. All NATEXs

TTablee off Contentss

REQUEST FOR INFORMATION

A. Introduction B. Purpose C. Background D. Submission Instructions E. Industry Engagement (Optional) F. Disclaimer G. Use of Information Provided through Responses H. RFI Point of Contact Annex A – Requested Information Annex B – Part 1: ROM and Part 2: Epic-Outcome Matrix

REQUEST FOR INFORMATION

A. Introduction

1. The NCIA, in coordination with the NATO Digital Transformation programme and relevant NATO entities, is conducting market research to identify potential sources and gather information regarding industry capabilities to support the acquisition of an e-procurement solution for various NATO entities.

2. Responses to this RFI will assist in refining requirements, identifying capabilities, and shaping the strategy for any potential future solicitation.

B. Purpose

1. The purpose of this RFI is to gather industry input on how cloud-native COTS solutions, configurations, standard integrations and supporting services can best meet NATO’s needs.

2. Responses will assist in:

Identifying potential solutions that could deliver the target outcomes outlined in the Epic-Outcome Matrix (Annex B: Part 2) and their indicative costs;

Identifying solutions that are proven and deployed in public procurement settings;

Validating, challenging or refining the current planning assumptions and requirements;

Identifying security, hosting, data residency, supplier-access, records-management and accreditation considerations; and, Identifying key risks, constraints and alternative packaging, phasing or acquisition options that NCIA and relevant NATO stakeholders should consider in shaping any future solicitation.

C. Background

1. NATO is pursuing digital transformation. Within this context, the digital enablement of sourcing and procurement processes has become a critical focus. Objectives include expedited and streamlined source selection, stronger industry collaboration, improved timeliness of competitive evaluation activities, a user-centric approach from planning to delivery, and performance-based contracting with traceable obligations and outcomes.

2. The following information is provided to give respondents an indication of the scale of the procurement environment when preparing responses to this RFI:

a. The current aggregated annual procurement spend across the entities exceeds EUR 10 billion, including multinational-funded procurement opportunities;

b. Approximately 30,000 procurement transactions and 2,000 procurement opportunities are processed and published annually;

c. 6 NATO entities managing and publishing procurement opportunities with approximately 1,000 staff requiring access;

d. Approximately 5,000 suppliers are registered across the procurement environment.

3. The requirements baseline for this effort has been captured as a structured, persona-based catalogue across the domains of Source-to-Contract (S2C), Contract Lifecycle Management (CLM), Vendor Management (VM), and supporting cross-cutting platform capabilities (PLT). For this RFI, the catalogue has been translated into an Epic-Outcome Matrix (Annex B: Part 2) so that industry can respond at an outcome level that is comparable and traceable.

4. The current planning assumption is that the upstream procurement value chain, encompassing S2C, CLM, VM, and PLT, may be best addressed by a dedicated procurement suite, encompassing S2C, VM and CLM capability (or equivalent combination), integrated with an ERP/Finance backbone, containing downstream finance-facing P2P functions. This RFI seeks industry feedback to validate, challenge or refine that assumption.

5. This RFI is not limited to providers offering a complete end-to-end capability described above. Suppliers are encouraged to respond even if their solution addresses only individual functional areas (e.g. only S2C, CLM, or VM). Respondents should clearly describe the scope of their solution, the capabilities provided, and how their offering integrates with other platforms where relevant.

6. The epics corresponding to each domain are illustrated in the following table:

Domain Scope summary In-scope epics

S2C — Source-to- Contract

Identifying and planning procurement needs, engaging the market and running competitive or simplified procedures, up to contract award.

S2C-00 to S2C-06

VM — Vendor Management

Managing the supplier base: onboarding, qualification, master data, vetting, performance and external collaboration with suppliers and Nations.

VM-01, VM-02, VM-03

CLM — Contract Lifecycle Management

Creation, execution, change, dispute and close-out of contracts after award.

CLM-01 to CLM-05

PLT — Platform (cross-cutting)

Shared platform services that underpin S2C, CLM, VM and the procurement-facing components of P2P: documents and templates, collaboration, cross-cutting reporting, integrations, testing, governance, workflow configuration, and security & audit logging.

PLT-01 to PLT-07

*See the Epic-Outcome Matrix (Annex B: Part 2) for a full elaboration of the epics

D. Submission Instructions

1. Interested parties are invited to respond in accordance with the instructions below:

a. Submit responses via the email address RFI-CO-424390-PIVOT@ncia.nato.int no later than 12:00 hours Central European Time (CET) on 07 September 2026.

Responses should be submitted in PDF or Word format and must not exceed 12 pages for the main narrative response. The completed Annex B Excel file is excluded from this page limit. The main narrative response includes:

Responses to Annex A Any narrative response to Annex B excluding:

Cover page Company brochures or product literature (if included) Attachments such as past performance references Supporting security-assurance artefacts provided in response to Annex A.6

Use the following subject line for submission “Response to RFI-CO-424390-PIVOT – [Company Name]”

All responses should address the questions in Annex A and Annex B (Parts 1 and 2).

Industry Engagement (Optional)

1. As part of this market research effort, NCIA may invite selected respondents to participate in informational demonstrations (online) or solution overview sessions intended to improve NCIA’s and participating NATO entities’ understanding of current market capabilities and approaches.

F. Disclaimer

1. This RFI is for planning and informational purposes only and shall not be construed as a solicitation or obligation on the part of the NCIA. The NCIA does not intend to award a contract based on responses to this RFI. Respondents are solely responsible for all costs incurred in responding to this RFI. The NCIA will consider and analyse all information received from this RFI and may use these findings to develop a future solicitation. The NCIA will consider all responses as confidential commercial information and will protect it as such.

2. NCIA reserves the right, at any time, to cancel this informal market survey, partially or in its entirety. No legal liability on the part of NCIA for payment of any sort shall arise and in no event will a cause of action lie with any prospective participant for the recovery of any costs incurred in connection with the preparation of documentation or participation in response hereto. All effort initiated or undertaken by prospective informal market survey participants shall be done considering and accepting this fact.

G. Use of Information Provided through Responses

1. Confidentiality of Responses

NATO UNCLASSIFIED

The NCIA may incorporate industry comments and responses, in part or in whole, into a future release of a solicitation. Should respondents include proprietary data in their responses that they do not wish to be disclosed to the public for any purpose, or used by NCIA (except for internal evaluation purposes), they must:

a. Mark the title page with the following legend:

This document includes data that shall not be disclosed outside NATO and shall not be duplicated, used, or disclosed – in whole or in part – for any purpose other than for NATO internal evaluation purposes, unless otherwise expressly authorised by [insert company name]. This restriction does not limit the NATO’s right to use information contained in this data without restriction if it is obtained from another source. The data subject to this restriction are contained in sheets [insert numbers or other identification of sheets]

b. Mark each sheet of data it wishes to restrict with the following legend:

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this document.

H. RFI Point of Contact

RFI-CO-424390-PIVOT@ncia.nato.int

Annex A – Requested Information

1. Respondents are encouraged to provide the following information in their response:

A.1 Company Information

i. Legal Business Name

ii. Address

iii. Website

iv. Primary Point of Contact

v. Email address

vi. Company size and ownership structure (public/private/subsidiary)

vii. Relevant public-sector, defence, international organisation or regulated-environment references

A.2 Public Sector Procurement Experience

i. Where possible, identify deployments of your solution in an (inter)national public procurement context, with particular focus on NATO countries.

Please include:

1. Country and the exact agency name;

2. Go-live date and current status;

3. Modules deployed (e.g., S2C, CLM, etc.);

4. Scale of deployment (i.e., procurement volumes processed);

5. Quantified benefits achieved (e.g., % reduction in cycle time, cost savings, user experience satisfaction, etc.); and

6. Public sector challenges and lessons learned.

A.3 Pricing Model

i. Describe your pricing model, including the commercial metrics used to determine pricing (e.g., subscription, named users, concurrent users, sourcing events, contracts, suppliers, number of entities, procurement spend, modules, transactions, or other applicable measures), and define how these metrics are reflected in your solution;

ii. Where applicable, provide indicative pricing bands, unit costs or pricing ranges for each pricing metric, including any minimum platform or subscription fees;

iii. If your pricing varies by volume, please provide the volume bands or thresholds at which pricing changes and describe the assumptions used.

iv. Describe any implementation, configuration, integration, migration, training or other one-time professional services that are typically required and how these are commercially structured;

v. Describe any volume discounts or multi-year incentives you provide;

vi. Describe any overage charges incurred if volumes are exceeded;

vii. Describe any applicable exit and data portability costs, including any associated notice periods; and

viii. Provide any additional pricing information you think would be pertinent to understanding the solution and planning.

A.4 Technical Capability and Implementation

i. Provide a summary of relevant capabilities, solution modules, and deployment models;

ii. Provide a summary of the solution accessibility features, and mobile capabilities;

iii. Provide a list of key differentiators and recent customer awards or satisfaction metrics for the solution;

iv. Provide a 24–36-month high-level roadmap, with particular focus on enhancements relating to AI, automation, analytics, interoperability and user experience;

v. Describe the AI/ML capabilities provided by the proposed solution and the procurement processes they support (e.g., contract review, vendor risk scoring, demand forecasting, risk prediction, chatbots, contract term extraction, sourcing recommendations). Outline how AI capabilities are deployed and secured, including relevant controls over the use of customer data, model transparency, and human oversight. Identify any dependencies on public or third-party Large Language Models (LLM) services and describe whether the solution supports integration with customer-managed or on-premises AI/LLM platforms via standard APIs, including the ability to leverage organization-specific or security-accredited AI models;

vi. Describe the solution’s maintainability and release cadence, how configuration and extensions are kept “upgrade-safe”, and the customer control or advance notice provided for significant changes;

vii. Describe the solution’s standard availability, resilience, disaster-recovery, performance and scalability posture, include typical uptime/SLA levels, RTO/RPO, backup/restore, DR testing, scalability, and any sizing dependencies for a multi-entity, supplier-facing deployment;

viii. Provide a list of pre-built connectors and APIs, and describe identity-integration and secure-connectivity options, including SSO and, where available, dedicated site-to-site (S2S) VPNs or equivalent private connectivity;

ix. Describe the typical implementation timeline, key implementation assumptions and principal dependencies on customer-side resources, data, systems and governance decisions. Provide the typical buyer-side effort multiplier you observe in comparable deployments (e.g., buyer-side internal effort is typically 1.5-2.0x vendor effort over the programme lifetime);

x. Describe your training approach (e.g., in-person, online, etc.), user adoption and post-go-live support model (e.g., OEM-/affiliate-provided support, etc.); and,

xi. Provide any additional technical information you think would be pertinent to understanding your solution and planning.

A.5 Multi-Agency Support Framework

i. Describe how the solution supports multiple procurement entities operating under separate governance frameworks;

ii. Describe how the solution accommodates multiple procurement policies, approval workflows, thresholds, evaluation methodologies and compliance framework;

iii. Describe how the solution supports organizational segregation while also enabling collaboration across different participating entities;

iv. Describe how the solution supports information segregation and access control across multiple security domains, organizations, programmes and participating nations;

v. Describe how the integration of finance, logistics and procurement systems will operate across multiple organizations;

vi. Describe possible reporting and analytics capabilities that would offer oversight by multiple stakeholder groups with differing access rights and reporting requirements;

vii. Describe mechanisms supporting data ownership, data segregation and lifecycle management across participating organizations.

A.6 Security, Data Sovereignty and SaaS Assurance

i. Describe hosting, data sovereignty and tenancy - jurisdictions and locations where data is processed, stored and backed up, including primary, backup and disaster-recovery regions; whether data can be restricted to NATO member-country jurisdictions; relevant subprocessors;

the single- or shared-tenant model and tenancy-isolation mechanisms;

and how applicable data-protection requirements are met;

ii. Provide a summary of relevant security certifications (e.g., FEDRAMP/NIST, CSA CCM and CAIQ, OWASP ASVS, SOC 2 Type 2 and SOC 1, ISO/IEC 27001 and ISO 22301, etc.) and data-residency options;

iii. Describe the extent to which the solution has undergone independent testing and accreditation, including whether detailed reports can be shared with NATO during due diligence or accreditation, subject to confidentiality, and any limits on sharing; and,

iv. Describe your operational security arrangements, including security monitoring, logging, vulnerability and incident management.

A.7 Exit and Data Portability

i. Describe your approach to supporting customer exit and transition to another solution or service provider, including governance, planning, customer and supplier responsibilities, knowledge transfer and indicative timelines;

ii. Describe the data, documents, metadata, audit history, configurations and workflow definitions that can be exported at contract termination. Identify available export formats, APIs, tooling and any limitations or dependencies;

iii. Describe how integrations, reports, templates and custom configurations can be transferred, recreated or documented to support migration; and,

iv. Identify any technical constraints, proprietary components or dependencies that customers should consider when planning an exit.

A.8 Questions, Concerns and Mitigation Recommendations

i. Identify questions, concerns, barriers and mitigation recommendations, including suggestions for enhancing competition (e.g., modularisation, open standards, exit provisions, lotting strategy).

ii. If you believe alternative architectures or product combinations would better meet the objectives, describe them briefly and explain trade-offs.

iii. If you disagree with the proposed ERP/finance boundary or interface under consideration, please explain. Indicate how budget control, commitments, invoicing, payments, cost recovery and customer/nation billing should be split between the procurement platform and ERP/finance systems, and which capabilities should be procurement-facing, ERP-owned or jointly integrated in a multi-entity NATO context.

Annex B – Part 1: ROM and Part 2: Epic-Outcome Matrix

The responses to this annex are intended to be captured in the enclosed Excel file. The file contains two worksheets, one per part:

Part 1: Rough Order of Magnitude (ROM) Part 2: Epic-Outcome Matrix

Please refer to the top-left of each worksheet for associated instructions and disclaimers.