NATO International Competitive Bidding (ICB): Security Information and Event Management (SIEM) Infrastructure Refresh
The NATO Communications and Information Agency (NCI Agency) intends to issue a Request for Quotation (RFQ) for the acquisition and deployment of cyber security logging and Security Information and Event Management (SIEM) hardware and software as replacement for those that are at, or near, End-of-Life (EoL) within three environments at the NATO Computer Incident Response Centre (NCIRC) located in SHAPE, Mons.
Potential U.S. prime contractors must 1) maintain a professionally active facility (office, factory, laboratory, etc.) within the United States, 2) be pre-approved for participation in NATO International Competitive Bidding (ICB), 3) be nominated to the bidders list by the U.S. Government, and 4) hold an active facility security clearance at the level of SECRET.
SUMMARY OF REQUIREMENTS
Introduction
To address an urgent obsolescence management requirement and facilitate technology refresh, the NCI Agency is seeking the acquisition and deployment of cyber security logging and Security Information and Event Management (SIEM) systems that are at or near End-of-Life (EoL). These systems are part of the existing NATO Computer Incident Response Centre (NCIRC) which is operated centrally at SHAPE Mons.
The objective of this acquisition is to ensure continuity of service and support by refreshing the existing logging and SIEM components of the NCIRC capability that are nearing EoL, and to enable transition to an enterprise logging solution.
Project Scope
The intent is to award a single contract. Interested and eligible companies may provide quotations for the requirement as a whole as follows:
a) Partial refresh and transition of the currently deployed ArcSight Security Information and Event Management (SIEM) system to provide continuity of service until replacement of remaining ArcSight components in a future project. Activities include:
Upgrading and migrating existing ArcSight Enterprise Security Manager (ESM) to new hardware; Deployment and configuration of ArcSight Management Center (ArcMC) to manage the ArcSight infrastructure; Tuning of event management as necessary; Corresponding implementation services.
b) Deployment and configuration of Splunk Enterprise and Splunk Enterprise Security (ES), including corresponding hardware.
c) Migration of ArcSight SIEM back-end to Splunk, including: Migrating existing ESM use-cases and integrations to Splunk. Configuring event transit and ingestion from ArcSight Loggers to Splunk.
The scope items above will be deployed in independent architectures for NATO Restricted, NATO Secret, and a Test/Reference environment.
Geographical Implementation
The NCIRC SIEM and central logging capability is operated centrally from SHAPE Mons. All scope items are wholly deployed and operated from SHAPE Mons.
BECOMING ELIGIBLE TO BID
NATO ICB requires that the U.S. Government nominate U.S. prime contractors to the bidders list. Before the U.S. Government can nominate a U.S. prime contractor to the bidders list, however, the U.S. firm must be approved for participation in NATO ICB. Firms are approved for U.S. NATO ICB on a facility-by-facility basis.
The U.S. NATO ICB application is a one-time application. The application requires supporting documentation in the form of 1) a company resume indicating contracts completed as a prime contractor and 2) an annual report or set of financial documents indicating compilation, review, or audit by an independent CPA.
U.S. firms can download a copy of the U.S. NATO ICB application from the following website:
http://www.bis.doc.gov/index.php/other-areas/strategic-industries-and-economic-security-sies/nato-related-business-opportunities
The application and supporting documentation may be submitted as e-mail attachments. If, when submitting the application, your firm is interested in a specific NATO ICB project, please include the following in the text of your email:
- the title and/or solicitation number of the project
- the name/phone/email of the company employee who should receive the bid documents
After approval of your one-time NATO ICB application, the U.S. Department of Commerce (DOC) will then know to follow up by issuing a Declaration of Eligibility (DOE) for that project. NATO member governments use a DOE to nominate an approved firm to the bidders list for a particular NATO ICB project.
IMPORTANT DATES:
- Request from DOC that a DOE be issued (and, for firms new to NATO ICB, submit the completed one-time NATO ICB application): 18 November 2019
- NCI Agency issues RFQ (target): Early December 2019
- Bid Closing (target): TBD
- Contract Award (target): April 2020
Parya Fenton, Phone 2024828228, Email parya.fenton@bis.doc.gov
