2025-0234 Level 3 Support For Web Application Security (NS) - WED 30 Jul

Deadline Date: Wednesday 30 July 2025

Requirement: Level 3 Support For Web Application Security

Location: The Hague, NL

Full Time On-Site: Yes

Time On-Site: 100%

Period of Performance: BASE period: As soon as possible but not later than 01 September 2025 (tentative) – 31st December 2025

2026 Option: 1st January 2026 until 31st December 2026

Required Security Clearance: NATO SECRET

1 INTRODUCTION

The NCIA is seeking Level 3 Support for Web Application Security – On Site, delivered in The Hague, Netherlands, for Internet Website Publishing and Protection Service.

NCIA – Internet Website Publishing and Protection Service.

The NCIA provides advanced technological solutions and support to NATO and its member nations. Its mission is to ensure effective and secure communication and information systems for the alliance, enabling operations and decision-making. The agency plays a critical role in maintaining NATO's technological edge and operational readiness through innovation, collaboration, and the implementation of cutting-edge technologies.

Internet Website Publishing and Protection service provides a suite of capabilities for web assets focused on security performance and reliability. These include a Web Application Firewall (WAF), Web Application and API Protection (WAAP), Content Delivery Network (CDN), Distributed Denial of Service (DDoS) protection, bot management, and SSL/TLS.

2 OBJECTIVE

The objective of this Statement of Work (SOW) is to describe Level 3 Support requirements for on-site Web Application Security for NATO websites.

3 SCOPE OF WORK

Level 1 support is user facing and is the first line of all technical support. At this level, all incidents and service requests will be logged, categorized, prioritized, diagnosed and managed. Incidents and service requests will be resolved within the boundaries of Level 1 support staff competence and administrator permissions limited to end-user devices. ESOC Centralized Service Desk (CSD) will provide Level 1 Support for Internet Website Publishing and Protection Service.

Level 2 support applies specialist skills to provide technical support, beyond that available at Level 1, to service requests and incident investigation, diagnosis and resolution. This level performs proactive end-to-end service monitoring and takes actions to resolve incidents and recover the services impacted. This level of support requires full administrator permissions to both end-user and back-end systems. Level 2 will be provided by NISC. Level 2 Support Staff is integrated in ESOC, SHAPE, Mons, Belgium.

Level 3 support provides the highest level of specialist skills available in the NCIA in order to support individual services and systems. This level will also, if applicable, liaise and work with external product and service suppliers as needed.

NISC Level 3 staff perform this level of support on-site, in The Hague, Netherlands.

This SOW covers Level 3 support for managing and optimizing Web Application Security services, including Web Application Firewall (WAF), Web Application and API Protection (WAAP), DDoS mitigation, Content Delivery Network (CDN), and Bot Management, as described in Annex C.

All services provided by NCIA, regardless of whether they are end-user services or supporting services, are under the responsibility of NCIA Service Delivery Managers (SDM).

Under the direction / guidance of the Internet Website Publishing and Protection Service, Service Delivery Manager, the following activities will be conducted by Level 3 support:

1) Operations:

a) Configure and maintain Cloudflare WAF rules and policies, in line with NATO Security Policy, to protect against OWASP Top 10 and other emerging threats.

b) Implement and manage WAAP features for securing APIs and applications, including schema validation, threat intelligence, and behavioural analysis.

c) Implement Rate Limiting Policies to protect APIs and web applications from abuse, brute force attacks, and scraping attempts. Design intelligent thresholds based on traffic patterns and application sensitivity.

d) Monitor and mitigate DDoS attacks, leveraging Cloudflare’s L3/L4/L7 protection capabilities.

e) Optimize CDN configurations to ensure high availability, low latency, and efficient caching strategies.

f) Deploy and fine-tune Bot Management policies to differentiate between good bots and malicious traffic.

g) Leverage Cloudflare Workers to deploy server less functions at the edge for custom logic, header rewriting, request inspection, or response manipulation.

h) Monitor and enforce Page Rules for URL-specific behaviours such as redirects, cache settings, and security controls.

i) Analyse traffic patterns, security logs, and incident data to proactively identify and remediate vulnerabilities.

j) Work closely with DevOps, Application Security, and Networking teams to enforce secure deployment practices.

k) Respond to security incidents and support troubleshooting efforts related to Cloudflare services.

l) Keep documentation up to date for security policies, procedures, and architecture diagrams.

m) Stay current with Cloudflare’s roadmap, industry trends, and evolving threat landscapes.

2) Inventory:

a) Maintain updates to the CMDB with the Configuration Items used by the services/systems listed in Annex C;

b) Perform all operation, support and maintenance activities on the platforms described in Annex C.

3) Incident Logging, Tracking, Dispatching:

a) Log and track incidents, work orders and change requests using the incident ticketing system (ITSM);

b) Investigate and resolve Application Security Service (WAF, WAAP, CDN, etc), Performance and Availability (CDN) and Threat Mitigation and Resilience (DDoS, Rate Limiting) related issues, directly assigned by end-users/requesters, or escalated from Level 2 support, within the staff competences and administrator permissions;

c) Maintain communication with end-users when needed;

d) Ensure all tickets are updated with accurate and detailed information and resolved (or assigned to appropriate stakeholders) within the agreed service levels;

4) Escalation:

a) Escalate complex issues to Level 4 support (vendor) or appropriate teams when necessary.

b) Follow up on escalated issues to ensure timely resolution and user satisfaction.

5) Knowledge Base Management:

a) Contribute to the creation/maintenance of a knowledge base, documenting common issues and solutions.

b) Share knowledge and best practices with team members to improve overall service quality.

6) Performance Monitoring:

a) Monitor support metrics and KPIs to ensure high-quality service delivery.

b) Participate in regular reviews to identify areas for improvement and implement corrective actions.

7) Automation and Efficiency:

a) Leverage Infrastructure as Code (IaC) tools (e.g., Terraform or Cloudflare’s native SDK/curl) to establish and maintain a scalable, repeatable, and auditable security posture through the deployment and management of Cloudflare WAF rules, firewall policies, custom configurations, and security settings.

b) Utilize automation to create workflows for repetitive tasks, improve service efficiency and proactively implement solutions.

8) Communication and Collaboration:

a) Communicate effectively with internal user community to understand their issues and provide clear instructions.

b) Collaborate with IT teams to resolve issues and improve service delivery.

9) Transition-In

The Contractor shall start the execution of the contract by implementing the transition-in on-boarding plan.

The on-boarding plan shall include at the minimum:

• Detailed schedule of the activities with GANTT chart.

• Resources and PFE required from the Purchaser for successful execution of on-boarding plan.

The on-boarding period will be divided in two parts; Shadowing and Reverse Shadowing.

• For the Transition-In on-boarding, Shadowing will be the monitoring of Purchaser’s activities by the Contractor for each product listed in Annex C. Reverse shadowing will the monitoring of the Contractor activities by the Purchaser for item listed in Annex C.

10) Transition-Out

Whatever the cause or the triggering event of the contract coming to an end, the Contractor shall end the execution of the contract by implementing the transition-out Handover-Takeover (HOTO) plan.

The transition-out Handover-Takeover plan to be executed for contract closure or contract termination shall include at the minimum:

• Detailed HOTO schedule with GANTT chart

• Transition to The Purchaser of any tools, procedures, training and documentation used by The Contractor to execute this SOW.

• Resources and PFE required from the Purchaser for successful execution of HOTO plan

Handover-takeover period will be divided two parts; Shadowing and Reverse Shadowing.

For the Transition-Out HOTO, Shadowing will be the monitoring of the Contractor activities by The Purchaser for each item listed in Annex C. Reverse shadowing will be the monitoring of the Purchaser activities by The Contractor for the second instance for each product listed in Annex C.

The services shall be carried out in sprints, each sprint is planned for a duration of one (1) week.

The content, scope of each sprint and their related acceptance criteria are to be peer reviewed within the sprint, and communicated to the contractor using NCIA tools (Jira, daily monitoring /reporting).

Input and guidance will be provided by NCIA in written form or/and during the targeted review meetings.

4 SPRINT PLANNING, EXECUTION, REVIEW AND PAYMENT

Due to the AGILE approach of this project, there is a need to define a set of specific arrangements between the NCIA and the contractor that specifically defines the deliverables to be provided for each sprint as well as their associated acceptance criteria. This includes sprint planning, execution and review processes, which are detailed below:

Sprint Planning:

Objective: Plan the objectives for the upcoming sprint.

Kick-off meeting: Conduct a bi-weekly (every two weeks) meeting with the contractor to plan the objectives of upcoming sprint and review contractor`s manpower to meet the agreed deliverables.

Set sprint goals: Define clear, achievable goals for the sprint and associated acceptance criteria, including specific delivery targets, Quality standards as well as Key Performance Indicators (KPIs) for each task to be recorded in the sprint meeting minutes.

Agree on the required level of effort for the various sprint tasks.

Backlog Review: Review and prioritise the backlog of tasks, issues, and improvements from previous sprints.

Assess each payment milestone cycle duration of 1 calendar month. State of completion and validation of each sprint status and sign off sprints to be submitted for payment as covered in Section 4.

There should be a sprint planning meeting every 4 sprints, that is 4 calendar weeks.

Sprint Execution

Objective: Contractor to execute the agreed “sprint plans” with continuous monitoring and adjustments.

Regular meetings between NCIA and the contractor to review sprint progress, address issues, and make necessary adjustments to the processes or production methodology. The Meetings will be physically in the office.

Continuous improvement: Contractor to establish a continuous feedback loop to gather input from all stakeholders for ongoing improvements and their subsequent implementation depending on NCIA approval.

Progress Tracking: Contractor to use a shared dashboard or tool to track the status of the sprint deliveries and any issues.

Quality Assurance/Quality Check: Contractor shall ensure that the quality standards agreed for the sprint deliverables are maintained throughout the sprint.

Quality Control: NCIA to perform the Final Quality Control of the agreed deliverables and provide feedback on any issues.

Sprint Review

Objective: Review the sprint performance and identify areas for improvement.

At the end of each sprint, there will be a meeting between the NCIA and the Contractor to review the outcomes against the acceptance criteria comprising sprint goals, agreed quality criteria and Key Performance Indicators (KPIs).

Define specific actions to address issues and enhance the next sprint.

Sprint Payment

For each sprint to be considered as complete and payable, the contractor must report the outcome of their service during the sprint, first verbally during the sprint review meeting and then in writing within five days after the sprint’s end date. A report must be sent by email to the NCIA service manager, listing all the achievements against the agreed tasking list set for the sprint.

The contractor's payment for each sprint will be depending upon the achievement of agreed Acceptance Criteria for each task, defined at the sprint planning stage. This will include specific delivery targets, quality standards as well as Key Performance Indicators (KPIs) for each task.

The payment shall be dependent upon successful acceptance as set in the above planning/review meetings. This will follow the payment milestones that shall include a completed Delivery Acceptance Sheet (DAS)

Invoices shall be accompanied with a Delivery Acceptance Sheet (DAS) signed by the Contractor and project authority.

If the contractor fails to meet the agreed Acceptance criteria for any task, the NCIA reserves the right to withhold payment for that task/sprint.

5 DELIVERABLES AND PAYMENT MILESTONES

5.1 Payment Schedule will be monthly for the completed and accepted sprints within the month.

5.2 The Purchaser (NCIA) reserves the right to exercise a number of options of one or more sprints based on the same deliverables, at a later time, depending on the project priorities and requirements, at the following cost: for base year (2025) at the same cost, for following year (2026) the Price Adjustment Formula will be applied in accordance with paragraph 6.5 of the Framework Contract Special Provisions.

5.3 The payment shall be dependent upon successful acceptance of the sprint report and the Delivery Acceptance Sheet (DAS) – (Annex B).

5.4 Invoices shall be accompanied with a Delivery Acceptance Sheet (Annex B) signed by the Contractor and the NCIA POC.

5.5 The following deliverables are expected for the all platforms that are explained in scop

of work (Section 3) on this statement of work:

2025 BASE: 4th of August 2025 to 31 December 2025

Deliverable: Up to 20 sprints to Level 3 Support For Web Application Security (Number of sprints is estimated and will be adjusted based on actual starting date.)

Payment Milestones: Monthly payment for the completed and accepted sprints within the month. Completion of each sprint shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor

2026 OPTION: 01 January 2026 to 31 December 2026

Deliverable: Up to 46 sprints to Level 3 Support For Web Application Security

Cost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.

Payment Milestones: Monthly payment for the completed and accepted sprints within the month. Completion of each sprint shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor

6 COORDINATION AND REPORTING

5.1 The contractor shall report to the assigned Service Delivery Manager.

5.2 The contractor shall participate in daily status update meetings, activity planning and other meetings as instructed, physically in the office, or in person via electronic means using Conference Call capabilities, according to the Service Delivery Manager instructions.

5.3 For each sprint to be considered as complete and payable, the contractor must report the outcome of their work during the sprint, first verbally during the review meeting and then in writing within three (3) days after the sprint’s end date. The format of this report shall be added into Delivery Acceptance Sheet (DAS) – (Annex A) mentioning briefly the work held and the development achievements during the sprint.

7 SCHEDULE

6.1 The base period of performance is 1 st of September 2025 (tentative) through 31st December 2025.

6.2 If the 2026 option is exercised, the period of performance is 1 January 2026 to 31 December 2026.

8 CONSTRAINTS

7.1 All the deliverables provided under this statement of work will be based on NCIA templates or agreed with the project point of contact.

7.2 All code, scripts, documentation, etc. will be stored under configuration management and/or in the provided NCIA tools.

9 SECURITY

8.1 The duties of the contractor require a valid NATO SECRET (NS) security clearance, for the entire duration of the contract.

10 PRACTICAL ARRANGEMENTS

9.1 This is a deliverables-based contract.

9.2 The Service depicted in this SOW is expected to be carried by a ONE contractor.

9.3 The contractor shall provide services 100% On-site NCIA Headquarters in The Hague, Netherlands. Exceptional off-site activities to support service delivery can be arranged with the line manager’s coordination and approval.

There may be requirements to travel to other sites within NATO for completing these tasks.

Travel will be the responsibility of the contractor and the expenses will be reimbursed in accordance with Article 5.5 of AAS Framework Contract and within the limits of the NCIA Travel Directive. They will be invoiced separately to the purchaser by the service provider, in accordance with the terms and conditions of the framework agreement.

9.4 The services depicted in this SOW are expected to be carried by a single contractor.

9.5 The service shall be delivered during core working hours (0830 – 1200 and 1300 - 1730). Incident resolution activities may be requested outside of business hours as part of deliverable-based sprints. Providing service out-side business hours is an exceptional situation (historically in the last years there were no such situations). If this occurs sprints price remains unchanged.

11 QUALIFICATIONS

[See Requirements]

ANNEX B: DESCRIPTION OF THE INTERNET WEBSITE

Publishing and Protection Service environment

1. The Internet Publishing and Protection Service environment operates at the following classification levels: NATO UNCLASSIFIED (NU).

2. The following Web Application Security products constitute the Internet Website Publishing and Protection Service environment:

a. Web Application Firewall (WAF)

b. API Gateway & API Shield

c. Bot Management

d. DDoS Protection

e. Rate Limiting

f. Page Shield

g. Firewall Rules

h. TLS & SSL Settings

i. Logpush

j. Workers

k. DNS

l. Caching

m. Page Rules

n. Turnstile

o. Zero Trust

p. Load Balancing

q. Health Checks

r. Automatic Notifications

3. The websites under Internet Website Publishing and Protection Service portfolio comprise a diverse mix of technologies and platforms, including content management systems (e.g., WordPress, Drupal), static websites, SharePoint portals, Learning Management Systems (e.g Moodle) web applications built with frameworks like ASP.NET and custom-built solutions hosted on cloud or on-prem infrastructure.

4. Currently there are around 50 websites subscribed to Internet Website Publishing and Protection Service and we expect to onboard more website in the future.

5. The response and resolution times for ITSM tickets are defined, in accordance with assigned priority, in NCIA Incident Management Standard Operating Procedure (SOP) 06.04.01.

6. The Contractor shall take the description above as an indication on the size and composition of the systems in scope. The actual environment composition under this contract may vary from the initially provided figures without any fixed margin and is subject to change as needed. Any changes to the number of websites will not entitle the Contractor to any price adjustments.

9 SECURITY

• 8.1 The duties of the contractor require a valid NATO SECRET (NS) security clearance, for the entire duration of the contract.

11 QUALIFICATIONS

10.1 Services to be provided under this SOW require ONE resource with the following qualifications and expertise:

1) Technical Proficiency:

The support for this work requires the following technical proficiencies, with minimum 3 years experiences in the following domains:

• 3 years experience in Cloudflare Security Stack
• 3 years experience in Web Application Firewall (WAF) Configuration
• 3 years experience in DDoS Mitigation & Rate Limiting
• 3 years experience in API Security & Schema Validation (Page Shield)
• 3 years experience in Bot Management
• 3 years experience in SSL/TLS Management
• 3 years experience in DNS & CDN Optimization
• 3 years experience in Security Analytics & Logging
• 3 years experience in Secure Coding & Vulnerability Assessment/Mitigation (WASP top 10)
• 3 years experience in Incident Response & Troubleshooting
• 3 years experience in DevOps & Automation - Use Terraform or APIs to automate Cloudflare configurations.
• 3 years experience in Cloudflare Workers and Zero Trust (Bonus)

2) Tasks:

• The support for this work requires expertise in performing the following tasks: Deploy, Configuration, Management, Security Operations; Monitoring, Upgrade, Version Control

3) Problem-Solving Skills:

• Analytical Thinking – Ability to analyse traffic patterns and identify anomalies or malicious behaviour using data-driven insights.
• Troubleshooting & Debugging – Skilled at diagnosing and resolving technical issues related to performance, security rules, and system errors.
• Security Incident Response – Capable of quickly responding to and mitigating active security threats without affecting legitimate traffic.
• Performance Optimization – Identifies and addresses performance bottlenecks while balancing security and speed.
• Automation & Configuration Consistency – Uses Infrastructure as Code to ensure consistent, reliable, and error-free deployments.
• Risk Assessment & Prioritization – Evaluates security risks and prioritizes remediation efforts based on impact and urgency.

4) Automation Skills:

• Experience with IaaC to automate routine support tasks.
• Proficiency in automation to create workflows and automate repetitive processes.
• Ability to identify and implement automation opportunities to enhance efficiency.

5) Communication and Interpersonal Skills:

• Excellent verbal and written communication skills.
• Full proficiency in English.
• Ability to communicate technical information to non-technical users in a clear and concise manner.

6) Customer Service Orientation:

• Strong customer service focus with a commitment to user satisfaction.
• Patience and empathy when dealing with user issues and concerns.

7) Organizational Skills:

• Ability to manage multiple support tickets and prioritize tasks effectively.
• Attention to detail in documenting support activities and maintaining accurate records.

8) Team Collaboration:

• Ability to work effectively as part of a team and share knowledge and resources.
• Willingness to collaborate with colleagues to solve complex issues.

9) Others:

• The candidate has strong customer relationship skills, including negotiating complex and sensitive situations under pressure.
• Full proficiency in the English language.
• The candidate must have the nationality of one of the NATO nations.