- The RFI covers four of the five work packages under the NICC urgent requirement project
- Responses are due Nov. 9, ahead of a workshop in Izmir
- NCIA will use a two-step down-select process, with all deliveries due by Q3 2030
The NATO Communications and Information Agency has launched pre-competitive market research to inform an upcoming acquisition supporting the technology pillar of the NATO Integrated Cyber Defence Centre, or NICC.
Through a request for information posted on SAM.gov, NCIA is seeking feedback on its draft problem statement and acquisition strategy.
The RFI is open only to companies based in NATO member countries.
What Is the NICC Urgent Requirement Project?
The Urgent Requirement project will deliver new communications and information services and upgrade existing capabilities through five independent work packages, all due by the third quarter of 2030.
The RFI covers four of them. The fifth, an upgrade to NATO’s red teaming and adversary emulation capability, was handled in an earlier RFI but will still be part of the final solicitation package.
NATO allies agreed in July 2024 to establish the NICC to better guard against increasingly sophisticated cyber threats.
What Will the NICC Platform Need to Deliver?
The first work package calls for a new resilient collaboration platform operating at the NATO Unclassified, NATO Restricted and NATO Secret levels. It will connect NATO Enterprise cyber entities, member nations and approved industry and academic partners. NCIA said the platform is intended for cyber collaboration, not a security operations center platform.
The platform must keep operating when enterprise infrastructure is degraded, providing backup connectivity such as 5G or high-speed satellite connectivity.
NCIA wants industry to compare on-premises, private cloud and hybrid deployment models and explain how it would limit dependence on any single vendor.
Which Other Cyber Capabilities Are in Scope?
The remaining work packages cover:
- Cyber Event Timeline and Analysis Capability, a new investigation tool that will combine security, threat intelligence and forensic data into interactive incident timelines. It will include artificial intelligence-assisted pattern and anomaly detection and must be deployable in disconnected environments.
- Rapid Reaction Team kits, with four new modular, vendor-neutral deployable kits planned: three for concurrent operations and one spare. The kits will include compute, encrypted storage, networking, power and AI-accelerated modules for forensics, malware analysis and threat hunting.
- Cyber Operations Management and Engagement Tool, or COMET, will replace NATO’s current cyber operations management system. NCIA sought migration approaches that preserve existing data and workflows and that avoid future vendor lock-in.
How Does NCIA Plan to Structure the Acquisition?
NCIA may group the work into two invitations for bid. The first would cover the platform and the timeline capability. The second would cover red teaming, the Rapid Reaction Team kits and COMET. Contracts would go to integrators able to deliver multiple work packages at the same time.
Evaluation would follow a phased down-select. Bidders would first submit a 10-page capability statement, and the highest-rated bidders would be invited to submit full proposals and participate in a challenge-based acquisition event. The agency also plans to use agile, iterative software delivery where technically feasible.
NCIA is also asking industry for feedback on the estimated value, the proposed timeline and whether companies would bid as prime contractors on the combined scope.
Written responses are due by 12:00 CET on Nov. 9.
NCIA will also hold a business workshop at NATO Edge in Izmir, Türkiye, from Nov. 17 to 19.
