UKRAINE · POLAND · EUROPEA publication by Mitchell Strategic Solutions Group
MSSG News

Defence. Technology. European security.

← Funding & opportunities
Analysis

NATO asks cyber suppliers for evidence before procurement. The NICC response deadline comes before NATO Edge.

NCIA’s market consultation closes on 9 November at 12:00 CET. Companies can address individual work packages without attending the later workshop; the planned integrated acquisition is a separate question.

Archive aerial photograph of NATO headquarters in Brussels, 27 October 2017. Institutional context, not a photograph of the NICC platform or its planned equipment. Swadim, CC BY-SA 4.0.
NATO asks cyber suppliers for evidence before procurement. The NICC response deadline comes before NATO Edge.
  • Deadline: 2026-11-09
Archive aerial photograph of NATO headquarters in Brussels, 27 October 2017. Institutional context, not a photograph of the NICC platform or its planned equipment. Swadim, CC BY-SA 4.0. Swadim / Wikimedia Commons, CC BY-SA 4.0 · Image source · Licence

Cybersecurity companies do not need to travel to NATO Edge to respond to NCIA’s new market consultation for the NATO Integrated Cyber Defence Centre. Written responses are due by 12:00 CET on 9 November, before the 17-19 November event in İzmir. The calling notice limits participation to companies from NATO member countries.

RFI-42630696-NICC, dated 16 October, seeks information for the centre’s technology pillar. It is market research, not a tender or a grant competition, and NCIA explicitly says it will not award a contract on the basis of these responses. The practical opening is to influence requirements and acquisition planning before a future competition.

The document separates four work packages open for comment from a possible later procurement that groups several packages. For a smaller specialist, that creates two distinct decisions: whether it can provide useful evidence now, and whether it could eventually deliver as an integrator, consortium member or subcontractor.

Four packages, one important exclusion

The consultation covers a collaboration platform, cyber-event timelines and analysis, rapid-reaction-team kits, and the Cyber Operations Management and Engagement Tool, COMET. The red-teaming package, WP3, is excluded because it was addressed by an earlier RFI. Respondents may cover one or several of the packages currently in scope.

The platform is described as supporting cyber collaboration rather than replacing a security operations centre. The timeline capability must retain connections to source evidence and distinguish observations, automated correlations and analyst hypotheses. For COMET, NCIA asks about preserving existing incident records, knowledge and workflows during migration, and about complete export in documented open formats.

Source-checked editorial explanation. Distinctions and limits are explained in the article.
Source-checked editorial explanation. Distinctions and limits are explained in the article.MSSG.news / original sourced editorial diagram · Source

Integration is part of the buying question

Annex B describes a possible split into two solicitations: WP1 with WP2, and WP3 with WP4 and WP5. It envisages integrators capable of multiple packages and asks industry whether bundling helps or hinders competition. The draft delivery horizon is no later than the third quarter of 2030. These are planning statements, not awarded contracts or a completed deployment timetable.

Our interpretation is that a strong specialist response should explain both its capability and its integration boundary. A tool may reconstruct an incident well yet depend on services unavailable in the intended operating environment. A migration product may move records but lose permissions, relationships or audit history. Those differences are directly relevant to the questions NCIA has published.

Respond to the actual consultation

The official instructions request PDF or Word responses, limited to ten pages per work package, with the exclusions specified on page 5. Annex A asks for company information, relevant capability and past performance, recommendations, risks and questions. The response address is RFI-42630696-NICC@ncia.nato.int; use the official document for the required subject line and treatment of proprietary information.

The NATO Edge workshop is optional and takes place after the written-response deadline. Attendance is therefore not a prerequisite for a valid contribution. Companies should use the current official RFI and any subsequent amendments, and distinguish this unpaid preparation effort from an entitlement to funding or a future order.

Sources & context

  1. NCIA official opportunity, RFI-42630696-NICC, checked 27 October 2026 ↗
  2. NCIA official RFI, 22 pages, especially pages 2, 5-8, 14-16 and 20-22 ↗

Published by Mitchell Strategic Solutions Group. See our editorial standards and corrections policy. Read more →

NATONCIACybersecurityMarket research