2025-0090 L2 Support for Trellix Endpoint Software Suite (NS) - THU 3 Apr

Time On-Site: 100%

2026 Option: 1st January 2026 until 31st December 20262027 Option: 1st January 2027 until 31st December 20272028 Option: 1st January 2028 until 31st December 2028

The NCIA is looking for Level 2 Support for Trellix Endpoint Software Suite – On Site, delivered in SHAPE, Mons, Belgium, for managed, protected, security-centric and reliable Infrastructure Endpoint Protection Service.NCIA – Infrastructure Endpoint Protection ServiceThe NCIA provides advanced technological solutions and support to NATO and its member nations.Its mission is to ensure effective and secure communication and information systems for the alliance, enabling operations and decision-making.

The agency plays a critical role in maintaining NATO's technological edge and operational readiness through innovation, collaboration, and the implementation of cutting-edge technologies.The Infrastructure Endpoint Protection Service within the NCIA provides a fully managed platform, based on Trellix ePolicy Orchestrator (EPO) and a comprehensive suite of Trellix endpoint protection products, for use as an integral part of a production, testing, and/or development environment.

The objective of this Statement of Work (SOW) is to provide Level 2 Support for Trellix Endpoint Software Suite, on Site, for NCIA managed networks.

Level 1 support is user-facing, and at this level, all incidents and service requests are logged, categorized, prioritized, diagnosed and managed. Level 1 support is user facing and is the first line of all technical support. At this level, all incidents and service requests will be logged, categorized, prioritized, diagnosed and managed. Incidents and service requests will be resolved within the boundaries of Level 1 support staff competence. Level 1 support for the Infrastructure Endpoint Protection Service is provided on-site, in SHAPE, Mons, Belgium.Level 2 support applies specialist skills to provide technical support, beyond that available at Level 1 to service requests and incident investigation, diagnosis and resolution.

This level requires communication with the end-user, it performs proactive end-to-end service monitoring and takes actions to resolve incidents and recover the services impacted. Level 2 support for the Infrastructure Endpoint Protection Service is provided on-site, in SHAPE, Mons, Belgium.This SOW covers Level 2 support for multiple instances of Trellix ePolicy Orchestrator (EPO) installations and managed suite of software products deployed on endpoints on NCIA-managed networks across multiple security domains, as described in Annex B.All services provided by NCIA, regardless of whether they are end-user services or supporting services, are under the responsibility of Service Delivery Managers (SDM).Each sprint is planned for a duration of one (1) week.The content, scope of each sprint and their related acceptance criteria are to be peer reviewed within the sprint cycle, and communicated in writing to the contractor, before beginning of each sprint. Input and guidance will be provided by NCI Agency in written from or/and during the targeted review meetingsUnder the direction / guidance of the Infrastructure Endpoint Protection Service Delivery Manager, the following activities will be conducted by Level 2 support:1) Operations:a) Ensure installation and configuration of Trellix software agents and the approved suite of endpoint protection products, is done in timely manner, as part of the physical or virtual endpoints deployment process;b) Identify the systems with incomplete endpoint protection, or unauthorized (“rogue”) endpoints, engage with the appropriate stakeholders and support the remediation of the deficiencies;c) Maintain an electronic register containing removable devices (RSM), users, timeframes, operational requirements and approvals’ status and relevant documents;d) Ensure the on premise Trellix software repositories are synchronized with vendor’s repositories from internet, and all EPO installations are updated daily; conduct troubleshooting and remediate deficiencies or apply mitigations to ensure the endpoint protection software (e.g. antimalware signature) are permanently updated;e) Support the requests for software installation/update activities by temporary reducing protection levels in the infrastructure endpoint protection configurations;f) Ensure only authorized configuration baselines are deployed on all EPO and managed systems, with specific, authorized, deviations applied in a systemic manner, using configuration rules per categories of software applications;g) Monitor continuously all EPO dashboards, logs and alerts, identify misconfigurations and implement configurations and updates, in coordination with Level 3 support Subject Matter Experts.2) Inventory:a) Maintain the CMDB updated with the Configuration Items used by the services/systems listed in Annex B;b) Perform all operation, support and maintenance activities on the platforms described in Annex B.3) Incident Logging, Tracking, Dispatching:a) Log and track incidents, work orders and change requests using the incident ticketing system (ITSM);b) Investigate and resolve endpoint security related issues, directly assigned by end- users/requesters, or escalated from Level 1 support, within the staff competences and administrator permissions;c) Maintain communication with end-users when needed;d) Ensure all tickets are updated with accurate and detailed information and resolved (or assigned to appropriate stakeholders) within the agreed service levels;4) Escalation:a) Escalate complex issues to Level 3 support or appropriate teams when necessary.b) Follow up on escalated issues to ensure timely resolution and user satisfaction.5) Knowledge Base Management:a) Contribute to the creation and maintenance of a knowledge base, documenting common issues and solutions.b) Share knowledge and best practices with team members to improve overall service quality.6) Performance Monitoring:a) Monitor support metrics and KPIs to ensure high-quality service delivery.b) Participate in regular reviews to identify areas for improvement and implement corrective actions.7) Automation and Efficiency:a) Develop and implement automation scripts to streamline routine support tasks such as software installations, updates, system checks and notifications.b) Utilize automation to create workflows for repetitive tasks, improve service efficiency and proactively implement solutions.8) Communication and Collaboration:a) Communicate effectively with internal user community to understand their issues and provide clear instructions.b) Collaborate with IT teams to resolve issues and improve service delivery.9) Transition-InThe Contractor shall start the execution of the contract by implementing the transition-in Handover-Takeover (HOTO) plan.The Transition-in Handover-Takeover (HOTO) plan shall include at the minimum:

For the Transition-In HOTO, Shadowing will be the monitoring of Purchaser’s activities by the Contractor for each product listed in Annex B. Reverse shadowing will the monitoring of the Contractor activities by the Purchaser for item listed in Annex B.10) Transition-OutWhatever the cause or the triggering event of the contract coming to an end, the Contractor shall end the execution of the contract by implementing the transition-out Handover-Takeover (HOTO) plan.The transition-out Handover-Takeover plan to be executed for contract closure or contract termination shall include at the minimum:

For the Transition-Out HOTO, Shadowing will be the monitoring of the Contractor activities by The Purchaser for each item listed in Annex B. Reverse shadowing will be the monitoring of the Purchaser activities by The Contractor for the second instance for each product listed in Annex B.

4.1 Payment Schedule will be at the end of each 4 sprints, following the acceptance of the sprint report.4.2 The NCIA team reserves the possibility to exercise a number of options, based on the same scrum deliverable timeframe, at a later time, depending on the project priorities and requirements.4.3 The payment shall be dependent upon successful acceptance of the sprint report and the Delivery Acceptance Sheet (DAS) – (Annex A).4.4 Invoices shall be accompanied with a Delivery Acceptance Sheet (DAS) (Annex A) signed by the Contractor and the NCIA POC.4.5 The following deliverables are expected for the all platforms that are explained in scope of Service (Section 3) on this statement of work:2025 BASE: 19th May 2025 to 31 December 2025Deliverable: Up to 29 sprints to Support Level 2 For Trellix Endpoint Software Suite (Number of sprints is calculated considering a starting date 19th May 2025.

This will be adjusted based on actual starting date)Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor2026 OPTION: 01 January 2026 to 31 December 2026Deliverable: Up to 46 sprints to Support Level 2 For Trellix Endpoint Software SuiteCost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor2027 OPTION: 01 January 2027 to 31 December 2027Deliverable: Up to 46 sprints to Support Level 2 For Trellix Endpoint Software SuiteCost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor2028 OPTION: 01 January 2028 to 31 December 2028Deliverable: Up to 46 sprints to Support Level 2 For Trellix Endpoint Software SuiteCost Ceiling: Price will be determined by applying the price adjustment formula as outlined in CO‐115786‐ AAS+ Special Provisions article 6.5.Payment Milestones: Upon completion of each fourth sprint and at the end of the service. Completion of each milestone shall be accompanied documented in Delivery Acceptance Sheet (DAS) – (Annex A), signed for acceptance by the Purchaser’s authorized point of contact and the Contractor

5.1 The contractor shall report to the assigned service delivery manager.5.2 The contractor shall participate in daily status update meetings, activity planning and other meetings as instructed, physically in the office, or in person via electronic means using Conference Call capabilities, according to the Service Delivery Manager instructions.5.3 For each sprint to be considered as complete and payable, the contractor must report the outcome of their service during the sprint, first verbally during the retrospective meeting and then in writing within three (3) days after the sprint’s end date.

The format of this report shall be added into Delivery Acceptance Sheet (DAS) – (Annex A) mentioning briefly the Service held and the development achievements during the sprint.

6.1 The base period of performance is 12th May 2025 through 31st December 2025.6.2 If the 2026 option is exercised, the period of performance is 1 January 2026 to 31 December2026.6.3 If the 2027 option is exercised, the period of performance is 1 January 2027 to 31 December2027.6.4 If the 2028 option is exercised, the period of performance is 1 January 2028 to 31 December2028.

7.1 All the deliverables provided under this statement of work will be based on NCIA templates or agreed with the project point of contact.7.2 All code, scripts, documentation, etc. will be stored under configuration management and/or in the provided NCIA tools.

8.1 The duties of the contractor require a valid NATO SECRET (NS) security clearance, for the entire duration of the contract.

9.1 This is a deliverables-based contract.9.2 The contractor shall provide services 100% On-site NCIA Headquarters in SHAPE, Mons, Belgium. Exceptional off-site activities (in a NATO country) to support service delivery can also be arranged with the line manager’s coordination and approval.9.3 There may be requirements to travel to other sites within NATO for completing these tasks.9.4 The expenses will be reimbursed in accordance with Article 5.5 of AAS Framework Contract and within the limits of the NCIA Travel Directive.9.5 The services under this SOW are expected to be carried by a ONE contractor for the entire performance period.9.6 The service shall be delivered during core working hours (0830 – 1200 and 1300 - 1730).

Incident resolution activities may be requested during the out of business hours as part of deliverable-based sprints.9.7 The contractor will be required to obtain working permission for provide on-site service in Belgium.

[See Requirements]

1. The Infrastructure Endpoint Protection environment operates at the following classification levels: NATO UNCLASSIFIED (NU), NATO RESTRICTED (NR), NATO SECRET (NS) and MISSION SECRET (MS).2. The following Trellix software products constitute the Infrastructure Endpoint Protection environment:a. Trellix ePolicy Orchestrator (EPO);b. Trellix Agent;c. Trellix Endpoint Security (ENS);d. Trellix Data Loss Prevention – Endpoint, Network, Discover (DLP);e. Trellix Rogue System Detection (RSD);f. Trellix Data Exchange Layer (DXL);g.

Trellix Threat Intelligence Exchange (TIE);h. Trellix Application and Change Control (TACC);i. Trellix Data Encryption – including Drive Encryption, File and Removable Media Protection (FRP).3. The managed environment contains predominantly Microsoft Windows Server and Linux Operating systems, running on physical and virtual servers.4. The physical and virtual servers host software applications (database platforms, web hosting components, and other NATO specific applications).5. The environment contains 22 EPO installations, with a total number of 8000 managed endpoints.6. The response and resolution times for ITSM tickets are defined, in accordance with assigned priority, in NCIA Incident Management Standard Operating Procedure (SOP) 06.04.01.7. The Contractor shall take the description above as an indication on the size and composition of the systems in scope. The actual CIS environment composition in the scope of this contract will stay within a margin of +/- 25% of the provided numbers. Any changes to the number of instances while staying within the above margin will not entitle the Contractor to any price adjustments. However should the numbers move outside this margin, upwards or downwards, this could be ground for an equitable price adjustment to be applied at the next turn of the year

10.1 The following qualifications and expertise are required:1) Technical Proficiency:The support for this service requires the following technical proficiencies.

2) Tasks:The support for this service requires expertise in performing the following tasks:

3) Problem-Solving Skills:

4) Automation Skills:

5) Communication and Interpersonal Skills:

6) Customer Service Orientation:

7) Organizational Skills:

8) Team Collaboration:

9) Others: