2025-0243 IaaS and DevSecOps Support to Application Migration (CTS) - TUE 30 Sep at EMW

Deadline Date: Tuesday 30 September 2025

Requirement: Infrastructure as a Service and DevSecOps Support to Application Migration

Location: On-site, either in The Hague, Netherlands or in Braine L’Alleud, Belgium. Final location will be determined after award.

Full Time On-Site: Yes

Time On-Site: 100%

Period of Performance: 2026 BASE: 01 JAN 2026 to 31 DEC 2026, with possibility to exercise 2 (two) times 1 (one) year options (2027, 2028)

Required Security Clearance: NATO COSMIC TOP SECRET (See section 7 CONSTRAINTS)

1 INTRODUCTION

The NATO Communications and Information Agency (NCI Agency) is modernizing its hosting infrastructure and is in the process of implementing a custom DevSecOps delivery processes. As part of this work engineering support is needed to plan for and migrate existing workloads, support DevSecOps development in particular for Infrastructure as Code (IaC) and establish operation and maintenance (day 2) capabilities. The ITM RC1 Applications team is building a multi-year team of system engineers and DevSecOps engineers to support this work.

NCI Agency is looking for support with both containerized and legacy migrations to the new infrastructure.

2 OBJECTIVES

NCI Agency is undertaking a major infrastructure modernization project, enabling comprehensive infrastructure lifecycle management.

The main objective of this statement of work is to support the ITM RC1 team with planning, performing, testing, validating and documenting this body of work. Specifically, this comprises of:

- Implementing DevSecOps and automation capabilities (IaC, GitOps, Kubernetes, Terraform, Ansible)

- Planning and migrating legacy virtual machine payloads to a new virtual hosting infrastructure based on VMWare vCloud Foundation (vCF).

- Developing Day 2 operation for the new IaaS (Infrastructure as a Service) environment based on vCF.

3 SCOPE OF WORK

Under the direction / guidance of the NCIA Point of Contact or delegated staff, support will be required within the ITM RC1 Application Migration team, related to the following activities:

• Developing / maintaining infrastructure as code for deployment and configuration of infrastructure (ESXi vSphere, vSAN, SDDC, Aria Operations), virtual networking based on NSX-t, infrastructure support services (DNS, AD, NTP) and Cisco network devices (zero touch provisioning of Cisco switches)

• Contributing to design and implementation of infrastructure as code and container orchestration services

• Contributing to the design and implementation of an overall DevSecOps capability, comprising of vault, repository, GitLab, Jenkins, etc.

• Planing for and Migrate Virtual Machines legacy payloads to a new vCF Infrastructure

• Implementing hardening, compliancy and security scanning

• Creating pipelines and self-service solutions for deploying test environments using infrastructure as code

• Participateing in entire lifecycle activities – including design, testing, training and documentation (infrastructure day 2 operations)

It is estimated the ONE resource is required to provide services related to the activities above. The contractor’s personnel will be part of a team and will provide services using an Agile and iterative approach during multiple sprints. Each sprint is planned for a duration of 1 week. The content and scope of each sprint will be agreed during the sprint-planning meeting.

ue to the agile approach of this project, there is a need to define a set of specific arrangements between the NCIA and the contractor that specifically defines the deliverables to be provided for each sprint as well as their associated acceptance criteria. This includes sprint planning, execution and review processes, which are detailed below:

3.1 Sprint Planning:

Objective: Plan the objectives and deliverables for the upcoming sprint;

At the start of each sprint, a sprint planning meeting will be conducted with the contractor to discuss and plan the objectives and deliverables of the upcoming sprint;

Define clear, achievable objectives for the sprint and associated acceptance criteria, including specific delivery targets and quality standards for each task, to be recorded in the sprint planning meeting minutes.

Agree on the required level of effort for the various sprint tasks.

Backlog Review: Review and prioritize the backlog of tasks, issues, and improvements from previous sprints.

Assess and validate the status of completion of the previous sprint and sign off sprints to be submitted for payment.

3.2 Sprint Execution:

Objective: Contractor to execute the agreed “sprint plans” with continuous monitoring and adjustments.

Regular meetings: The contractor shall participate in status update meetings to review sprint progress, to address issues, and to make necessary adjustments to the processes or objectives. Those sprint meetings will be via electronic means using Conference Call capabilities. On rare occasions, there may be a requirement to attend a physical meeting in the office, or in person, as requested by the project manager.

Continuous improvement: The contractor will establish a continuous feedback loop to gather input from all stakeholders for ongoing improvements and their subsequent implementation depending on NCIA approval.

Progress Tracking: Contractor to track and share the status of the sprint deliveries and any risks / issues.

Quality Assurance / Quality Check: The contractor shall ensure that the quality standards agreed for the sprint deliverables are maintained throughout the sprint.

Quality Control: NCIA will perform the quality control of the agreed deliverables and provide feedback on any issues.

3.3 Sprint Review:

Objective: Review the sprint performance and identify areas for improvement.

At the end of each sprint, there will be a meeting to review the deliverables and outcomes against the acceptance criteria.

Define specific actions to address issues and enhance the next sprint.

3.4 Sprint Payment:

Progress on the above deliverables will be checked and approved on a per sprint basis.

For each sprint to be considered as complete and payable, the contractor must report the outcome of their work during the sprint, first verbally during the sprint review meeting and then in writing within three days after the sprint’s end date. The format of this report shall be an email to the NCIA Point of Contact mentioning briefly the work performed and the development achievements during the sprint against the agreed tasking list set for the sprint.

The payment of each sprint will be depending upon the achievement of agreed acceptance criteria for each task, defined at the sprint planning stage.

If the contractor fails to meet the agreed acceptance criteria for any task, the NCIA reserves the right to withhold (partial) payment for that sprint.

Invoices shall be accompanied by a Delivery Acceptance Sheet (DAS), signed by the contractor and the project manager, and shall follow the payment milestones.

4 DELIVERABLES AND PAYMENT MILESTONES

The following deliverables are expected in relation to this statement of work:

1) Complete the activities/tasks agreed in each sprint meeting as per section 3 above.

2) Produce sprint completion reports (format: e-mail update), which include details of activities performed and the list of the deliverables of the week.

3) The contractor will participate in the daily reporting and planning activities (daily stand-ups) as well as the required participation in workshops, events and conferences related to the supported services, as requested by the service delivery manager.

4) Payment schedule will be according to the payment milestones below. Upon completion and validation of each sprint and at the end of the monthly milestone, following the acceptance of the sprint report.

5) The Purchaser (NCIA) reserves the right to exercise a number of options of one or more sprints based on the same deliverables, at a later time, depending on the project priorities and requirements, at the following cost: for base year (2026) at the same cost, for following years (2027-2028) the Price Adjustment Formula will be applied in accordance with paragraph 6.5 of the Framework Contract Special Provisions.

6) The payment shall be dependent upon successful acceptance of the sprint report and the Delivery Acceptance Sheet (DAS) – (annex B).

7) Invoices shall be accompanied with a Delivery Acceptance Sheet (annex B) signed by the contractor and the NCIA POC.

2026 BASE period: 01 January 2026 to 31 December 2026

Deliverable: Max.44 sprints of design, planning, migration and software development.

Payment Milestones: Payment Schedule will be monthly for the completed and accepted sprints within the month.

OPTION YEAR 1: 01 January 2027 to 31 December 2027

Deliverable: 44 sprints of design, planning, migration and software development.

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.

Payment Milestones: Payment Schedule will be monthly for the completed and accepted sprints within the month.

OPTION YEAR 2: 01 January 2028 to 31 December 2028

Deliverable: 44 sprints of design, planning, migration and software development.

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.

Payment Milestones: Payment Schedule will be monthly for the completed and accepted sprints within the month.

5 COORDINATION AND REPORTING

The contractor shall participate in daily status update meetings, sprint planning, sprint retrospectives and other meetings, physically in the office, or in person via electronic means using Conference Call capabilities, according to project manager’s instructions.

For each sprint to be considered as complete and payable, the contractor must report the outcome of his/her work during the sprint, first verbally during the retrospective meeting and then in written within three (3) days after the sprint’s end date. The format of this report shall be a short email to the NCIA Point of Contact mentioning briefly the work held and the development achievements during the sprint.

Also a Certificate of Acceptance (Annex B) will be filled in and signed by the contractor and signed for acceptance by the Project Authority.

6 SCHEDULE

The 2025 BASE period of performance 01 January 2026 and will end no later than 31 December 2026.

If the 2027 and 2028 options are exercised, the period of performance is 01 January until 31 December of that respective year.

7 CONSTRAINTS

All the deliverables provided under this statement of work will be based on NCI Agency templates or agreed with the project point of contact.

All code, scripts, documentation, etc. will be stored under configuration management and/or in the provided NCI Agency tools.

All the deliverables of this project will be considered at most NATO RESTRICTED

Part of the work will involve handling classified networks with privileged access; therefore, a security clearance at NATO COSMIC TOP SECRET (CTS) level is expected for the contractor undertaking this project. If the contractor already possesses NATO Secret Clearance, they may start work prior to obtaining the appropriate clearance. In that case it should be obtained no longer than 6 months after the contract start date. Failure to have active CTS within 6 months after contract starting date, will lead to contract termination for the respective resource.

8 PRACTICAL ARRANGEMENTS

The contractor will be required to provide services on site, either in The Hague, Netherlands or in Braine L’Alleud, Belgium. Final location will be determined after contract award.

Access to the NCI Agency platforms will be provided in coordination with the NCIA Point of Contact or delegated staffs.

The contractor may be required to travel to NCI Agency, Mons BE, Braine L’Alleud BE, The Hague NL and other sites within NATO for completing these tasks. Travel expenses will be reimbursed under AAS+ framework contract provisions and in accordance with NCIAs Travel Directive.

9 QUALIFICATIONS

[See Requirements]

Requirements

• Part of the work will involve handling classified networks with privileged access; therefore, a security clearance at NATO COSMIC TOP SECRET (CTS) level is expected for the contractor undertaking this project.

9 QUALIFICATIONS

The consultancy support for the services requested under this SOW require the expertise of one resource having experience as an infrastructure engineer with the following qualifications:

• The candidate has relevant and recent experience in administrating complex applications or systems.
• The candidate has extensive (at least 3 years) and recent (in the past 1 year) experience in migration of applications on virtual infrastructures
• The candidate has a track record in DevSecOps and has strong problem solving skills.
• The candidate has extensive (at least 3 years) and recent (in the past 1 year) experience with and knowledge of Continuous integration and delivery, including the following tools and technologies and concepts: Windows Server and Linux Administration; VMWare vSphere infrastructure, vSAN storage, NSX-T, Aria Operations (vROPS); VDI environments; Git (mandatory); Ansible,  Terraform/OpenTofu; Designing and implementing build/deploy pipelines; Kubernetes, Helm (optional)
• The candidate has experience (at least 2 years) with designing and maintaining Sharepoint, SQL Server, Postgres, Active Directory and Exchange solutions
• The candidate has extensive experience (at least 3 years) in using Scrum methodology.
• The candidate has strong customer relationship skills, including negotiating complex and sensitive situations under pressure.
• The candidate is able to speak and write fluent English since the work is conducted in English.
• The candidate must have the nationality of one of the NATO nations.