NATO Request for Information: White Box Vulnerability Assessment (VA) Services

The NATO Communications and Information Agency (NCIA) is issuing a Request for Information (RFI) to identify the availability and technical capability of NATO Nation industry sources for White Box Vulnerability Assessment (VA) services. These services are required to support NATO networks through in-depth, credentialed assessments of enterprise systems, including configuration reviews, credentialed scans, Active Directory control path analysis, and threat reporting.

As part of this requirement, service providers must be capable of deploying to conduct on-site assessments at NATO locations across the 32 NATO Nations. We expect on-site deployment on average once per month with a team consisting of 2-4 staff depending on the complexity. While some testing may be performed remotely or from SHAPE (e.g., cloud environments), most services will require an on-site presence and flexible geographic support.

The RFI is intended to assess industry capabilities, geographic coverage, experience, and recommended contract structures to support this requirement under a future framework contract. A Questionnaire for responding to the RFI is provided in the attachment. Other supporting information and documentation (technical data sheets, marketing brochures, catalogue price lists, VA agreement sample of your company) are also desired.

You are responsible for adequately marking proprietary or competition sensitive information contained in your response. The NCIA reference for this RFI is MS-424262-VA and all correspondence and submissions concerning this matter should reference this number. This is an RFI only. It is NOT a solicitation for proposals nor a pre-solicitation notice. Do NOT submit your responses to the Department of Commerce. The NCIA Point of Contact for responding to the RFI is included in the attachment.

RFI responses are due to NCIA no later than COB 16 May 2025 Brussels time. The information resulting from this effort is for planning purposes only and for assisting NCIA in refining its requirement and related acquisition strategy. As a result, the NCI Agency will not pay for any costs incurred in responding to this RFI. Your participation in this RFI is greatly appreciated.