Security Engineer

• Provide security accreditation advice and guidance to NCI Agency Project and System Managers across the full lifecycle of NATO CIS.
• Act as the focal point between NCI Agency and NATO Security Accreditation Authorities (SAAs).
• Build and sustain effective communications with Security Accreditation Boards, NATO SAAs, and NCI Agency organisational units supporting the accreditation process.
• Conduct Security Risk Assessments (SRA) in support of NATO CIS projects, including identification of threat levels and vulnerabilities for all assets comprising NATO CIS, derivation of residual risks, and provision of risk management recommendations.
• Identify, plan, request, and manage the development of all required accreditation documentation, including but not limited to the CIS Description, Security Accreditation Plan (SAP), Security Risk Assessment Report (SRAR), Security Requirement Statements (SRS), Security Operating Procedures (SecOPs), and Security Test and Verification Plan (STVP).
• Stay abreast of technological developments relevant to cybersecurity, network security, and cloud security.
• Provide subject-matter-related briefings and presentations to NCI Agency stakeholders and management.
• Coordinate and cooperate with activities across other Business Areas within NCI Agency.
• Perform any other related duties as directed by the section head.

Cyber Security Accreditation Support

Coach

• A senior Performance & Leadership coach that can help managers improve performance practices through observing, coaching, challenging and providing practical support.
• The resource will be part of a performance enablement team, working together with the Performance Management Lead and HR Excellence Lead.
• The mission of this team is to increase manager capability in performance management practices so that it becomes normal management practice.
• The coach would act as behavioural change agent, supporting this mission by:
• - Attending leadership and management meetings to strengthen accountability, and provide feedback and coaching;
• - Identifying patterns across teams and advising on capability gaps;
• - Helping managers prepare for difficult performance and development discussions;
• - Helping managers set clear results and expectations and provide meaningful feedback;
• - Reviewing performance cases and provide guidance on managing issues consistently and fairly;
• - Coaching managers to have regular, high-quality performance conversations;
• - Challenging leaders when performance is not being discussed;
• - Following up with managers to reinforce behaviours.

Senior Performance and Leadership Coach

Procurement

• **Duties & Role:**
• __Continuity management__
• - Contributes to the development of continuity management plans.
• - Identifies information and communication systems that support critical business processes.
• - Coordinates the business impact analysis and the assessment of risks.
• - Coordinates the planning, designing, and testing of contingency plans.
• __Business situation analysis__
• - Plans, manages and investigates business situation analysis where there is significant ambiguity and complexity.
• - Advises on the approach and techniques to be used for business situation analysis.
• - Ensures holistic view adopted to identify and analyse wide-ranging problems and opportunities.
• - Engages and collaborates with a wide range of stakeholders, including those at the management level.
• - Gains agreement from stakeholders to conclusions and recommendations.
• - Contributes to definition of organisational standards and guidelines for business situation analysis.
• - Develops the change management approach and a change management plan in collaboration with sponsors, users and project teams.
• - Creates and implements action plans to ensure everything is ready for the change before going live.
• - Acquires change management resources and develops their capabilities to deliver the required changes.
• - Gathers feedback to allow timely improvements to the change management plan and approach.
• - Assesses risks and takes preventative action.
• - Develops and communicates tailored change management plans for senior stakeholder groups.
• - Provides guidance and makes suggestions to support change sponsors.
• __Supplier management__
• - Develops organizational policies, standards, and guidelines to ensure effective supplier management across the integrated supply chain.
• - Defines the approach for commercial communications and the management of relationships with suppliers.
• - Establishes a positive and effective working environment with suppliers for mutual benefit.
• - Ensures that resources and tools are in place to conduct bench-marking.
• - Reviews supplier analysis and assesses effectiveness across the supply chain.
• - Manages risks and assures the quality of the services delivered by suppliers.
• - Leads the development of comprehensive stakeholder management strategies and plans.
• - Builds long-term, strategic relationships with senior stakeholders (internal and external).
• - Facilitates the engagement of stakeholders in support of the delivery of services and change projects.
• - Acts as a single point of contact for senior stakeholders, facilitating relationships between them.
• - Negotiates to ensure that stakeholders understand and agree on what will meet their needs, and that appropriate agreements are defined.
• - Oversees monitoring of relationships including lessons learned and appropriate feedback.
• - Leads actions to improve relations and open communications with and between stakeholders.
• - Trains others on evaluating products or services from multiple vendors.
• - Advises on appropriate solutions to complex multiple vendor problems.
• - Leads in the regulated use of materials and forms for the selection of products and vendors.
• - Evaluates overall considerations such as product and vendor risks, and provides recommendations.
• - Optimizes standard processes to maximize the efficiency of organizational products or services.
• - Designs and develops product and vendor selection criteria and requirements.
• __Vendor Management__
• - Builds and maintains partnerships with multiple and/or large vendors
• - Ensures the fulfilment of report and record-keeping requirements.
• - Evaluates issues and terminates vendor relationships as appropriate; works with legal departments.
• - Monitors supplier performance; works to resolve discrepancies between performance and agreements.
• - Develops quality standards and controls for vendor selection.
• - Facilitates supplier partnering arrangements that share risk.

Smartsourcing and Vendor Manager

Engineer

• The section where the duties will be performed is within the Chief Quality Office, Independent Assurance Branch, Product and Service Assurance Team.
• The Product and Service Assurance Team is responsible for the independent verification and validation of all Agency delivered projects, systems, services, processes and programmes, including independent status reporting at executive level.
• This includes in-service projects, systems, services, processes and programmes, which are supported by the Branch through the Agency enterprise change management processes.
• The role is to be a part of a team that deals with planning, execution and reporting on multiple different projects.
• The person will be integrated in a multinational team of assurance engineers with the knowledge of the specific domain(s) as requested for the profile.
• Plans, organizes and conducts formal reviews and assessments of complex domains areas, cross-functional areas, and across the supply chain.
• Evaluates, appraises and identifies non-compliances with organizational standards and determines the underlying reasons for non-compliance;
• Produces test documentation such as (Event) Test Plans, Test cases, Requirements Traceability Matrix, test reports, etc.
• Provides assurance to test artefacts such as the Requirements Traceability Matrix;
• Manages the design, planning and execution of the V&V events and its reporting;
• Provides support to projects where the execution is performed by an external contractor
• Provides support to the operational community in operational acceptance activities

Assurance Engineer – NS

Backend Engineer

• **5. EXECUTION**
• **5.1 Sprint Planning**
• **Objective: **Plan the objectives for the upcoming sprint, as a part of the overall plan.
• **Kick-off meeting: **The Contractor shall conduct a monthly meeting with the ITM-RC1 POC to plan the objectives of upcoming months and review the Contractor's manpower to meet the agreed deliverables.
• **Set sprint goals: **Define clear, achievable goals for the sprint and associated acceptance criteria, including specific delivery targets, quality standards as well as Key Performance Indicators (KPIs) for each task to be recorded in the monthly meeting minutes.
• **Agree resourcing: **Agree on the required level of effort for the various monthly tasks.
• **Backlog review: **Review and prioritise the backlog of tasks, issues, and improvements from previous months.
• **Payment assessment: **Assess each payment milestone cycle duration of one calendar month. State of completion and validation of each monthly status and sign off monthly to be submitted for payment as covered in Section 4.
• **5.2 Sprint Execution**
• **Objective: **Contractor to execute the agreed sprint plans with continuous monitoring and adjustments.
• **Weekly meetings: **Between ITM-RC1 POC and the Contractor to review sprint progress, address issues, and make necessary adjustments to the processes or production methodology. The meetings will be conducted physically in the office, or remotely with NCIA electronic means, as planned by the BCM.
• **Continuous improvement: **The Contractor shall establish a continuous feedback loop to gather input from stakeholders for ongoing improvements and their subsequent implementation depending on NCIA approval.
• **Progress tracking: **The Contractor shall use a shared dashboard or tool to track the status of the month deliveries and any issues.
• **Quality assurance / quality check: **The Contractor shall ensure that the quality standards agreed for the month deliverables are maintained throughout the month.
• **Quality control: **NCIA to perform the final quality control of the agreed deliverables and provide feedback on any issues.
• **5.3 Sprint Review**
• **Objective: **Review the monthly performance and identify areas for improvement.
• At the end of each month, there will be a meeting between the NCIA and the Contractor to review the outcomes against the acceptance criteria comprising monthly goals, agreed quality criteria and Key Performance Indicators (KPIs).
• Define specific actions to address issues and enhance the next sprint.
• **5.4 Sprint Payment**
• For each sprint to be considered as complete and payable, the Contractor must report the outcome of their work during the sprint, first verbally during the previous sprint review meeting and then in writing within five days after the month's end date. A report must be sent by email to the NCIA service manager, listing all the work achieved against the agreed tasking list set for the month.
• The Contractor's payment for each sprint will depend upon the achievement of agreed Acceptance Criteria for each task, defined at the month planning stage. This will include specific delivery targets, quality standards as well as Key Performance Indicators (KPIs) for each task/sprint.
• The payment shall be dependent upon successful acceptance as set in the above planning/review meetings. This will follow the payment milestones that shall include a completed Delivery Acceptance Sheet (DAS) - (Annex A) including the EBA Receipt number.
• Invoices shall be accompanied with a Delivery Acceptance Sheet (DAS) - (Annex A) signed by the Contractor and project authority.
• **5.5 Payment Schedule**
• The following are expected from this Statement of Work:
• Completion of the activities/tasks agreed in each sprint meeting as per Section 3 above, and associated deliverables.
• Produce sprint completion reports (format: e-mail update), which include details of activities performed and the list of the deliverables of the week.
• The Contractor will participate in the daily reporting and planning activities (daily stand-ups) as well as the required participation in workshops, meetings, events and conferences related to the supported services, as requested by the service delivery manager.
• Payment schedule will be according to payment milestones upon completion of each month, upon completion and validation of each sprint and at the end of the monthly milestone, following the acceptance of the sprint report.
• The NCIA team reserves the possibility to exercise options, during the same scrum deliverable timeframe, at a later time, depending on the project priorities and requirements.
• The payment shall be dependent upon successful acceptance of the month report and the Delivery Acceptance Sheet (DAS) - (Annex A).
• Invoices shall be accompanied with a Delivery Acceptance Sheet (Annex A) signed by the Contractor and the NCIA POC.
• 2026 Base: Period of Performance: 27 August 2026 to 31 December 2026
• **WP01: **Up to 4 sprints containing all deliverables in Section 5. Payment Milestone: Upon completion of each sprint acceptance. (Number of sprints will be adjusted based on actual starting date.)
• 2027 Option: Period of Performance: 1 January 2027 to 31 December 2027
• **Deliverable(s): **Up to 12 reports. Cost Ceiling: Price per report will be determined by applying the price adjustment formula as outlined in CO-115786-AAS+ Special Provisions article 6.5. Payment Milestones: Upon completion of each sprint acceptance.
• 2028 Option: Period of Performance: 1 January 2028 to 31 December 2028
• **Deliverable(s): **Up to 12 sprints. Cost Ceiling: Price per sprint will be determined by applying the price adjustment formula as outlined in CO-115786-AAS+ Special Provisions article 6.5. Payment Milestones: Upon completion of each sprint acceptance.
• **5.6 Coordination and Reporting**
• The Contractor shall participate in daily status update meetings, planning meetings, and other meetings, physically in the office, or in person via electronic means using Conference Call capabilities, according to the project manager's instructions.
• For each report to be considered as complete and payable, the Contractor must report the outcome of his/her work during the reporting period, first verbally during the specific meeting and then in writing within three (3) days after the reporting period's end date. The format of this report shall be a short email to the NCIA Point of Contact mentioning briefly the work held and the development achievements during the month.
• The Contractor shall organize and/or participate in Project meetings, or any other ITM meetings when asked by the PO, physically in the office or in person via an electronic means according to the project manager's instructions.
• The Contractor shall agree weekly with the PO a schedule of work, products and delivery dates, which will form the basis of the monthly deliverables report.
• The monthly deliverables report will support the monthly invoicing.
• **5.7 Purchaser Furnished Equipment**
• Purchaser will provide to the Contractor staff standard IT work position setup to allow access to the necessary networks, IT systems and tools.
• The Contractor staff shall follow Purchaser's policies and procedures and take due care of the Purchaser-furnished equipment.
• Access to relevant environments and licenses to commercial third-party libraries required to perform the contract will be provided by NCIA.
• At the end of the project, the Contractor shall provide a Project Closure Report summarizing the activities during the period of performance at high level.
• **6. SCHEDULE**
• It is expected the service starts as soon as possible but no later than 27 August 2026 and ending no later than 31 December 2026.
• If the 2027 option is exercised, the period of performance is 1 January 2027 to 31 December 2027.
• If the 2028 option is exercised, the period of performance is 1 January 2028 to 31 December 2028.
• **7. CONSTRAINTS**
• All the deliverables provided under this Statement of Work will be based on NCI Agency templates or agreed with the project point of contact.
• All code, scripts, documentation, etc. will be stored under configuration management and/or in the provided NCI Agency tools.
• **8. SECURITY**
• Delivering services under this SoW requires a valid NATO SECRET security clearance.
• Any resource proposed for this SOW requires a valid NATO SECRET security clearance prior to the start of the engagement.
• All the deliverables of this project will be considered NATO UNCLASSIFIED or NATO RESTRICTED, and access to the NCIA Business networks will be required.
• **9. PRACTICAL ARRANGEMENTS**
• The Contractor will be required to work at least 50% on site at NCI Agency The Hague.
• **NCIA Recognised Business Hours: **NCIA The Hague Operations: Monday to Thursday 0830-1700 and Friday 0830-1500 (CET).
• **Contractor Furnished Services: **The Contractor will be provided with a Reach Laptop and access to information required to perform the contract.
• Access to relevant environments and licenses to commercial third-party libraries required to perform the contract will be provided by NCIA.
• The work depicted in this SOW is expected to be carried out by a single resource.
• **10. TRAVEL**
• The Contractor will in principle not be required to travel often. Travel to the other main NCI Agency locations (Mons (BEL), Brussels (BEL), Braine l'Alleud (BEL)) and other sites within NATO will be required to complete these tasks. This travel is anticipated 10 times annually.
• This Task Order requires scheduled travel as detailed in this Section, consisting of up to 10 visits to Mons, Brussels and The Hague (1 per month) for a maximum of 3 working days each visit. The travel, lodging and associated expenses for travel are included in the price of the bid (NTE), such that the purchaser shall not be invoiced.
• Extraordinary Travel (Purchaser Directed Travel) may be required to other NATO or non-NATO locations as necessary. In the event of such unforeseen meetings being called, the cost of all travel and subsistence will be addressed through a contract amendment.
• Extraordinary Travel expenses will be reimbursed in accordance with Article 5.5 of the AAS+ Framework Contract. Such costs will be set as a separate PO line with a not-to-exceed value to cover and reimburse actual expenses upon submission of all receipts and invoices in line with NCIA processes.
• **11. CONTRACTOR'S PROFILE REQUIREMENTS**
• [See Requirements]

Technical Lead Architect – Support Services

• Plans, organizes and conducts formal reviews and assessments of complex domains areas, cross-functional areas, and across the supply chain.
• Evaluates, appraises and identifies non-compliances with organizational standards and determines the underlying reasons for non-compliance;
• Produces test documentation such as (Event) Test Plans, Test cases, Requirements Traceability Matrix, test reports, etc.
• Provides assurance to test artefacts such as the Requirements Traceability Matrix;
• Manages the design, planning and execution of the V&V events and its reporting;
• Provides support to projects where the execution is performed by an external contractor
• Provides support to the operational community in operational acceptance activities

Assurance Engineer

Graphics Designer

• **Duties & Role: **
• The IWC shall provide an experienced Multimedia Designer & (e)Learning Developer to support the design, development, modernization, and delivery of multimedia and learning solutions for the Procurement function and associated stakeholder groups.
• The IWC shall operate across the following work streams:
• - Multimedia Assets: The IWC shall create professional multimedia and visual assets to support learner understanding and adoption. This may include process roadmaps, procurement lifecycle diagrams, decision trees, infographics, explainer videos, motion graphics, learner guides, and quick reference materials. The IWC shall use appropriate multimedia tools to enhance engagement and simplify complex subject matter.
• - (e)Learning Materials: The IWC shall design, storyboard, build, test, and publish new SCORM-compliant eLearning modules using Articulate Storyline and other suitable authoring tools where appropriate. New content may include interactive scenarios, assessments, simulations, and role-based learning solutions for procurement staff, project managers, contracting officer representatives, and related stakeholder groups.
• **Expected Outcome**
• The IWC is expected to deliver the following outcomes:
• - Reusable multimedia assets and material for future internal use.
• - Availability of on-demand, scalable digital learning modules.
• - Improved consistency, compliance, and understanding of procurement policy processes.
• - Documentation of deliverables for maintenance and knowledge transfer.

Multimedia Designer, eLearning Developer

Communications

• Providing consultative support for industry to develop an NGN Comms Architecture Study.
• Drafting a 5G white paper in NCIA standard technical report format for one of the technical topics that are relevant to NATO.
• Updating the 5G readiness assessment that was previously conducted.
• Drafting a technical report to update the previous assessment of the use of 5G/6G technologies for military applications.
• Delivering a brief presentation for the MN5G Project Board to present the findings of the technical assessment.
• Performing a review of Network Management and Cyber Defense (NMCD).

Next Generation Networks and Secure Communications

• Oversight and support to Information Security and NATO CIS Security Accreditation activities. This includes provision of relevant expertise, direct support to specific projects and the conduct of security risk assessments. Specific duties include:
• Project Support: security design, CIS Security Risk Assessment, security requirements, security testing and validation, interoperability and security operating procedures;
• Information security: advise on security aspects to manage identified risks and ensure adoption and adherence to standards for complex ISR information systems. Develop security architectures that mitigate the risks;
• Information assurance: Interpret and apply information assurance and security policies to manage risks. Plan and conduct information assurance and security accreditation of complex cross- functional domains and areas, cross-functional areas;
• Risk management: Plan and implement complex security risk management activities within a specific function, technical area, project or programme. Implement consistent and reliable security risk management processes and reporting to key stakeholders.
• Vulnerability assessment/ Penetration Testing: Plan and manage vulnerability assessment and/or penetration testing activities

Senior Engineer – Cyber Security

Designer

• Design and validate the ADatP-36 and STANAG 5659 security & / DSIG improvements
• Collaborate with team members from NCIA, The Hague, The Netherlands
• Participate in the development and testing of security-enabled communication protocols
• Support the planning, preparation, execution, and assessment of validation and interoperability events
• Maintain and update the development backlog, including progress reporting, comments, risk identification, and issue tracking
• Produce agreed technical deliverables in accordance with defined acceptance criteria, quality standards, and timelines
• Ensure structured knowledge transfer to NCIA personnel and designated stakeholders throughout the contract execution

Secure Protocols Designer – ADatP-36, STANAG 5659

Software Engineer

• Support the preparation of a new release of the JChat Java Client.
• Support the preparation of a new release of the JChat Web Client.
• Support the preparation of a new release of the JChat Openfire Server.
• Support the preparation of a new release of the M-Link server for JChat.
• Represent the JChat team in test events.
• Maintain the development pipeline.

JChat Engineering Support – NS

Full-stack Engineer

• Bidders shall submit a proposal clearly providing required information.
• Evidence of successfully delivering one to three projects of similar scope to this statement of work within the last five years.
• CVs of the proposed contractor personnel for the project.
• Participate in kick-off meetings.
• Maintain and update the development backlog, including progress reporting, comments, risk identification, and issue tracking.
• Participate in development sprints, working on agreed JIRA tickets.
• Support FORACS Ranges in testing IDATS software either remotely or via on-site participation.
• Support formal knowledge handover sessions prior to contract completion.

EMW