OCIO-0025 Cryptographic Modernization Risk Assessment Officer (NS) - TUE 6 Jun

Deadline Date: Tuesday 6 June 2023

Requirement: Cryptographic Modernization Risk Assessment Officer

Location: Brussels, BE

Full time on-site: Yes

Time On-Site: 100%

NATO Grade: A3/G17/88

Total Scope of the request (hours): 988

Required Start Date: No Later Than 10 July 2023

End Contract Date: 31 December 2023

Required Security Clearance: NATO SECRET

Note: For all Level-of-Effort and Completion-Type requests processed outside of the IWC Value Stream, and for which the contractor will not be reimbursed directly by OCIO for travel expenses, additional travel funding shall be allocated on a Not-to-exceed basis when the yearly Option is exercised.

Annex A – Special Terms and Conditions

The contractor will be responsible for complying with the respective national requirements for working permits, visas, taxes, social security etc. whilst working on site at NATO HQ Brussels, Belgium.

No special status is either conferred or implied by the host organisation, NATO HQ Brussels, Belgium to the contractor whilst working on site.

The contractor will be responsible for complying with all the respective National Health COVID-19 regulations in Belgium before taking up the position.

1. INTRODUCTION

The NATO Chief Information Officer (CIO) function brings Information and Communications Technology (ICT) coherence across NATO Enterprise’s civil and military bodies. The NATO CIO is empowered to realize the Allies’ vision for the NATO Enterprise is accountable to the Secretary General and is responsible for the development of Enterprise directives and advice on the acquisition and use of information technologies and services. The NATO CIO provides Enterprise oversight on cybersecurity issues, and, in close coordination with all relevant NATO civil and military bodies, works towards the continual improvement of the cyber hygiene and cybersecurity posture in the NATO Enterprise.

This Statement of Work (SoW) describes the contractual work in support the Office of the NATO Chief Information Officer (OCIO) at the NHQ in Brussels in the ongoing cryptographic modernization process for the whole Alliance and the position to be fill by FTE. The individual will be located within the OCIO Enterprise Security Branch – Enterprise Risk Management Section. The individual will be in charge of the development, execution and overview of multiple cryptographic-related projects in support of NATO Operations and Missions, including the Procurement of cryptographic related devices and capabilities and will oversee the status and the process of cryptographic modernisation for the Enterprise. He/she will also assess the threats and risks for the Enterprise Cryptographic initiatives and COMSEC while interacting with multiple, different NATO and National Stakeholders.

2. TASKS

The contractor will effectively and efficiently, provide the following services:

2.1 Ensure that the role of the OCIO in the NATO Cryptographic Governance Model is clearly defined, consistent and recognized by NATO Policy, fully integrated in the Cryptographic Ecosystem and well understood by the Community of Interest (CoI);

Measurement: To the NATO CIO’s satisfaction, identify the OCIO role in the Cryptographic Governance Model, ensuring its presence into all levels of the relevant cryptographic fora. In collaboration with a C3S develop a food for thought paper describing in detail the OCIO’s area of activity within the Crypto’ Governance Model, clearly describing the workflows and interactions. Support the joint MC/C3B approval of OCIO’s role in the Crypto’ Governance model, leading to the update of the main Policy.

2.2 Establish an effective NATO Enterprise Risk Management framework, considering and incorporating the Cryptographic Risks Analysis, in support of the CISOA informed decision making;

o Measurement: To the NATO CIO’s satisfaction, gather a full situational awareness of NATO Enterprise Cyber Security, encompassing cryptographic obsolescence, replacement plans, capability gaps, decertification and any other related shortfalls. Establish a coordinated and efficient risk management framework through the Enterprise, covering and integrating NATO Cryptography and the prioritisation of Crypto’ Modernisation and Transformation strands.

2.3 S/He is to support Cryptographic Coherence and Interoperability and help develop and improve a reliable and comprehensive cryptographic situational awareness including key management. Assist with the development or updating of cryptographic Policies, Directives and Guidance Paper to reflect the NATO Enterprise perspective on Interoperabil