2026-0049 Cyberspace Ops Specialized Computer Forensics Spprt (CTS) - TUE 28 Apr

Deadline Date: Tuesday 28 April 2026

Requirement: Cyberspace Operations Specialized Computer Forensics Support

Location: Mons, BE

Full Time On-Site: Yes

Time On-Site: 100%

Period of Performance: 2026 BASE: 02 JUN 2026 to 31 DEC 2026

2027 OPTION: 1 JAN 2027 to 30 MAY 2027

Required Security Clearance: NATO COSMIC TOP SECRET

1. BACKGROUND

The NCI Agency has been established with a view to meeting the collective requirements of some or all NATO nations in the fields of capability delivery and service provision related to Consultation, Command & Control as well as Communications, Information and Cyber Defence functions, thereby also facilitating the integration of Intelligence, Surveillance, Reconnaissance, Target Acquisition functions and their associated information exchange.

2. INTRODUCTION

The NATO Cyber Security Centre (NCSC) is a team of over 200 members working to monitor and protect NATO networks. In the NCSC's role to deliver robust security services to the NATO Enterprise and NATO Allied Operations and Missions (AOM), the centre executes a portfolio of programmes and projects around 219 MEUR euros per year, in order to uplift and enhance critical cyber security services.

The Portfolio ranges from Programme of Work (POW) activities funded via the NATO Military Budget (MB) to Critical / Urgent Requirements (CURs/URs) and NATO Security Investment Programme (NSIP) projects funded via the Investment Budget (IB). In some edge cases, projects are also funded via the Civilian Budget (CB). Projects can span multiple years and are governed by various frameworks, including the Common Funded Capability Development Governance Framework (CFCDGM).

In order to execute this work, the NCI Agency requires support with the work undertaken by the NATO Cyber Security Centre (NCSC) in the area of Communications and Information System (CIS) security, cyber defence and cyberspace operations. This Statement of Work (SoW) specifies the required skillset and experience.

3. PURPOSE

The NCSC is responsible to defend NATO networks on a 24/7 basis and as part of its cyber defence activities performs digital forensics analysis in case of suspicion or confirmed malicious activities. The Cyber Defence Analysis activities encompass digital forensics activities allowing to get understanding what has really happened during a cyber incident, or in case of suspicion of an incident, to confirm if the incident really happened.

The Specialized Computer Forensics (SCF) environment is a dedicated environment for forensics activities. Due to lack of clear ownership, it has fell in a state of inadequacy for the delivery of the service. The NCSC Cyber Security Analysis Service (SEC004) service is looking for help from the industry to bring it back in a good state.

The hardware is a mix of physical acquisition devices such as Atola, PC3000, Network Attached Storage (NAS) devices, powerful workstations and servers, but also various disks, cables, converters, write blockers, patch panels, switches and other accessories. The environment is replicated, although not in exactly the same way, on 2 different levels of classification. The work encompasses both environments. In total there are not more than 30 workstations and not more than 20 servers (both physical and virtual). The user base consists of less than 30 users (analysts and administrators).

4. OBJECTIVES

This Statement of Work (SoW) outlines the services to be provided by the Supplier to NCSC for providing support to Cyber Security Analysis Service (SEC004).

5. DELIVERABLES

The contractor shall deliver the following functions:

D1. Complete inventory of equipment, hardware, software and identities.

Create a complete inventory from scratch recording each and every element present in the SCF Lab, including but not limited to things like screwdrivers kits, specific hardware, disks, cables and adapters. Besides hardware, it will also contain the software and diagrams about the physical layout and interconnection. Identities will also be listed with the current access to each system for each identity.

D1 Scope of Work: Inventory of equipment in the SCF Lab located in SHAPE.

D1 Deliverables: The inventory is split between hardware and software and needs to be recorded in the dedicated space within Confluence with all details including, when available: serial number, brand, model (hardware) or software vendor, version (software), classification level, picture of the item (when applicable), the start (and end) timestamp of production use, a changelog, and purchase order number. When some details are not available, a free text description is expected which shall include all necessary details (e.g. non labelled 1.5m long cable USB A male to USB A female). Links are made between software and hardware components using the templates provided to the provider. Identities are linked to the assets they are assigned to. A physical layout representation needs to be produced in the form of a draw.io diagram which maps the different elements physically in the lab. An OSI layer 1, 2 and 3 diagram of the equipment linked to the network needs to be produced in the form of a draw.io diagram in the Confluence space.

D1 Acceptance Criteria: All of the data is added in the designated place within Confluence, using the templates provided and in an editable way to make it maintainable over time. The completeness of the inventory will be assessed by the NCSC team taking 10 items randomly and checking if they are indeed present in the inventory and in the diagrams.

D1 Schedules and Milestones: The earliest starting date is 2 June 2026, with a latest starting date of 1 July 2026. The first draft of the inventory should be completed by 30 June 2026 at the earliest, and 30 July 2026 at the latest. The final inventory taking comments into account should be delivered by 15 July 2026 at the earliest, and 15 August 2026 at the latest.

D2. New placement of network equipment.

At the moment the network equipment in the lab is placed on top of the shelves; it is not fixed or placed in any dedicated rack or shelf. With the information collected in D1, organize a few (up to 3) workshops with the NCSC team to brainstorm how to place the switches and patch panels in the forensics lab room. Taking into account their ideas, the reality of the lab (its size and layout), propose your own recommendation about how to place the network equipment in a professional, functional, economical and aesthetical way. If new equipment needs to be purchased (e.g. wall-mountable racks), propose the elements to be purchased.

D2 Scope of Work: Based on the inventory made in D1, propose the placement of the network equipment. Document the proposal in a report in Microsoft Word format. The proposal must take into account the following requirements from NATO regulations: minimal distance between NS and NR elements, and the new required elements must be purchased from companies from NATO member states.

D2 Deliverables: A report with the new setup of the network equipment in the form of an MS Word document. The report should contain: all items which need to be purchased, including URL links to the proposed products and their quantities and prices; a diagram showing the layout of the room indicating where the network equipment is going to be placed; and all changes in the lab room which would need to be done to implement the proposal.

D2 Acceptance Criteria: The final deliverable must follow the provided "deployment plan" template highlighting the final state as well as all the intermediate steps to reach that state. The proposed plan needs to take into account existing conditions of the lab: lab size and layout, the sizes of the existing network equipment, and the minimal distance between NS and NR elements.

D2 Schedules and Milestones: The earliest starting date is 1 July 2026, with a latest starting date of 1 September 2026. Workshops should be done and the solution presented to the team for approval by 15 July 2026 at the earliest, and 15 September 2026 at the latest. The final deployment plan taking into account the comments received should be delivered by 1 August 2026 at the earliest, and 1 October 2026 at the latest.

D3. Organize the lab's cables, adapters and accessories.

At the moment all the small size equipment in the lab (such as cables, converters, disks) is stored in the lab in an unorganized way. With the information collected in D1, organize a workshop with the NCSC team to brainstorm how to place the small size elements in the forensics lab room in a more organized way. Taking into account their ideas, the reality of the lab (its size and layout), propose your own recommendation about how to place it in a professional, functional, economical and aesthetical way. If new equipment needs to be purchased (e.g. drawers, cabinets, cases, labels), propose the elements to be purchased.

D3 Scope of Work: Based on the inventory made in D1, propose the placement of the digital forensic accessories equipment. Document the proposal in a dedicated Confluence page. If new required elements need to be purchased, provide the list of such items together with their quantity, price and links to the products on vendors' websites; the new required elements must be purchased from companies from NATO member states. As an option, if feasible, propose a more efficient storage location outside of the lab.

D3 Deliverables: A report with the new setup of the accessories in the form of Confluence pages. The report should contain: all items which need to be purchased, including URL links to the proposed products and their quantities and prices; a diagram in draw.io format showing the layout of the room indicating where the organised accessories are going to be placed; and all changes in the lab room which would need to be done to implement the proposal.

D3 Acceptance Criteria: The final deliverable must follow the provided "deployment plan" templat