2026-0043 Senior Full Stack Software Development Services - TUE 12 May

Deadline Date: Tuesday 12 May 2026

Requirement: Senior Full Stack Software Development Services

Location of Performance: Off-site

Note: Please refer to your Subcontract Agreement, article 6.4.1.a, which states “Off-Site Discount: 5% (this discount is applicable to all requirements, and applies when the assigned personnel are permitted to work Off-Site, such as at- home)". Please be sure to price this discount in your overall price proposal when submitting bids against off-site RFQs

Period of Performance: 2026 BASE: Starting as soon as possible but not later than 01 June 2026 to 31 December 2026, with the possibility to exercise following options:

2026 option: 01 October 2026 to 31 December 2026

2027 option: 01 January 2027 to 31 December 2027

Required Security Clearance: No Security Clearance Required

1. Introduction

NATO Communications and Information Agency (NCIA), as the main ICT service provider in NATO, is the main technical entity providing subject matter expertise to support NATO Cyber and Digital Transformation (CDT) Branch's Innovation Programmes of Work (PoW) and relevant activities in 2026. NCIA Chief Technology Office (CTO) is looking for a Contractor who will provide full-stack software development support to the PoW projects.

2. Objectives

The Contractor shall provide Senior Full Stack Software Development Services to architect, develop, implement, integrate, and deploy Full Stack application meant for analytical capabilities for the Toolbox platform that is being developed by NCIA. The Contractor will be responsible to provide technical expertise in the area of software development and coordinate activities with the various NCIA teams.

The Contractor will develop tailored tools to enable and facilitate demonstration of the results, maintain dashboards and information management artefacts and furthermore, the Contractor shall be able to provide on-site support to the workshops that will be organized within the scope of PoW projects.

3. Scope of Work

Under the direction / guidance of the NCIA Point of Contact or delegated staff, the Contractor shall perform the following activities:

Support NCIA in the NATO Programmes of Work with CDT in the area of software development for digital innovation and technology applications.

Develop advanced application capabilities for analysts, enabling the exploration, analysis, and synthesis of strategic foresight analysis data through complex, multi-step user experience workflows, including cross-article reasoning, topic engineering, source intelligence, and relevance assessment.

Develop full-stack integrations with AI-enabled backend services, including the exposure of AI-driven analytical functions, retrieval mechanisms, and automated synthesis capabilities in a controlled and user-transparent manner.

Apply sound software design principles to ensure transparent, auditable, and controllable analytical workflows, including clear traceability between inputs, sources, AI-assisted reasoning steps, and generated outputs, suitable for high-trust analytical and policy environments.

Deliver deployment-ready solutions that are compatible with restricted and secure environments, including solutions subject to accreditation for NATO UNCLASSIFIED (NU) deployment, and capable of operating under governance, security, and operational constraints beyond standard commercial systems.

The services are delivered through monthly milestones and delivery increments. The deliverables will be required by various dates, as identified in Section 4, throughout the contract execution.

4. Deliverables and Payment Milestones

This section thoroughly describes the deliverables and payment milestones. All deliverables are to be peer reviewed within their delivery cycle. Input and guidance will be provided by NCIA in written form or/and during the targeted review meetings.

During the period of performance, a Delivery Acceptance Sheet (DAS) shall be provided to the Purchaser for each scheduled delivery, as identified in Section 4.1. The Purchaser will confirm the acceptance by signing the DAS.

The expected classification level of the deliverables is NATO UNCLASSIFIED.

The contract will have optional scope extension work-packages to be executed in 2027 should NCIA choose to exercise them.

The following deliverables are expected from the services described in this statement of work:

4.1 Schedule of Deliverables

The contractor shall undertake the necessary research and evaluation necessary to provide the following deliverables by their respective due dates:

Deliverable 1: Project Kick-off and Requirements Analysis

Kick-off meeting minutes including the analysis of the Toolbox Development work that will be performed during the period of performance, an initial roadmap and review of milestones.

Due Date: June 01, 2026

KPIs: Kick-off Completion Rate (%) → Meeting conducted + minutes approved → Target: 100%; Requirements Coverage (%) → (Captured requirements / Identified requirements) × 100 → Target: ≥ 95%; Stakeholder Alignment Score (%) (survey/approval) → Target: ≥ 90%; Roadmap Accuracy (%) (milestones accepted without major revision) → Target: ≥ 90%; Milestone Definition Completeness (%) → Target: 100%

Payment Milestone: M1 – 15% of total value

Deliverable 2: Backend Development Phase 1

Establishment of core backend services and APIs; Initial data ingestion, storage, and retrieval foundations; Availability of backend services required for analytical UI consumption.

Due Date: July 01, 2026

KPIs: API Availability (%) → Target: ≥ 99%; Core Service Implementation Coverage (%) → Target: 100%; Data Ingestion Success Rate (%) → Target: ≥ 99%; Data Retrieval Latency (ms) → Target: within SLA (e.g., < 300 ms); Backend–Frontend Readiness (%) → Services usable by UI → Target: 100%

Payment Milestone: M2 – 10% of total value

Deliverable 3: Frontend Integration Phase 1

Frontend framework setup and baseline UI and Backend architecture; Initial analyst-facing views and navigation structure; Basic integration between frontend and backend services.

Due Date: August 03, 2026

KPIs: UI Framework Setup Completion (%) → Target: 100%; Frontend–Backend Integration Success Rate (%) → Target: ≥ 98%; Initial View Load Time (seconds) → Target: ≤ 2 seconds; Navigation Task Success Rate (%) → Target: ≥ 95%; UI Defect Density (# per feature) → Target: low / within threshold

Payment Milestone: M3 – 10% of total value

Deliverable 4: AI Integration Phase 1

Initial AI-enabled analytical components exposed through the UI and integrated in the backend; Cross-article analysis and comparison capabilities; Early traceability and transparency indicators linking outputs to sources.

Due Date: September 01, 2026

KPIs: AI Feature Availability (%) → Target: 100%; Cross-Article Analysis Accuracy (%) → Target: ≥ 85–90%; Traceability Coverage (%) → Outputs linked to sources → Target: ≥ 95%; AI Response Time (seconds) → Target: ≤ 3 seconds; User Trust/Explainability Score (%) → Target: ≥ 85%

Payment Milestone: M4 – 20% of total value

Deliverable 5: Backend Development Phase 2

Extension and stabilisation of backend services; Advanced retrieval, relevance, and topic-related logic; Backend support for iterative topic engineering and source intelligence.

Due Date: October 01, 2026

KPIs: Service Stability (Error Rate %) → Target: < 1%; Advanced Query Accuracy (%) → Target: ≥ 95%; Relevance Precision/Recall (%) → Target: ≥ 90%; Topic Engineering Support Coverage (%) → Target: 100%; System Throughput (req/sec) → Meets agreed benchmark

Payment Milestone: M5 – 10% of total value

Deliverable 6: Frontend and AI Integration Phase 2

Advanced frontend workflows for analyst control and refinement; Topic engineering, source intelligence, and relevance interaction patterns; Cross-view consistency, usability refinement, and workflow optimisation; Advanced AI-enabled reasoning and explanation capabilities; Adaptive reporting, synthesis, and content generation; Automatic newsletter creation and template-based analytical outputs.

Due Date: November 11, 2026

KPIs: Workflow Completion Rate (%) → Target: ≥ 95%; User Interaction Efficiency (time/task) → Improvement vs Phase 1 baseline; Cross-View Consistency Score (%) → Target: ≥ 95%; UI Performance (load time) → Target: ≤ 1.5 seconds; User Satisfaction Score (%) → Target: ≥ 90%; AI Output Quality Score (%) → Accuracy + relevance → Target: ≥ 90%; Automated Report Generation Success Rate (%) → Target: ≥ 95%; Newsletter Automation Accuracy (%) → Target: ≥ 90%; Content Generation Latency (seconds) → Target: ≤ 5 seconds

Payment Milestone: M6 – 15% of total value

Deliverable 7: Deployment & Environment Integration

Frontend and backend alignment for target environments; Deployment readiness for restricted, secure, and accredited environments; Final system integration, handover preparation, and operational readiness.

Due Date: December 31, 2026

KPIs: Deployment Success Rate (%) → Target: ≥ 98%; Environment Compatibility (%) → Target: 100%; System Uptime (%) → Target: ≥ 99.9%; Security/Compliance Pass Rate (%) → Target: 100%; Operational Readiness Score (%) → (runbooks, monitoring, support readiness) → Target: ≥ 95%

Payment Milestone: M7 – 20% of total value

4.2 2026 – Options (if Exercised)

The following activities are included as options, separate from core development milestones:

Deliverable 1 (if 2026 OPTION is exercised): Quality Assurance & Testing

Perform functional and integration testing; Perform UI validation and workflow verification; Provide acceptance support and defect resolution.

Due Date: October 30, 2026

KPIs: Quality Assurance Tests Success Rate (%) → Target: ≥ 98%; Latency/Response Time (%) → Target: 99% of users experience response time under 200ms; Requirements Traceability (%) → Target: ≥ 95%, feature has a corresponding test case; Crash-Free Session Rate (%) → Target: ≥ 98%, SW remains stable during stakeholder testing

Payment Milestone: OPTION M1 – 50% of 2026 OPTION value

Deliverable 2 (if 2026 OPTION is exercised): Maintenance & Troubleshooting

Provide post-deployment stabilisation; Provide bug fixing and minor adjustments; Support during initial operational use.

Due Date: December 31, 2026

KPIs: Bug fixing Success Rate (%) → Target: ≥ 98%; Documentation Update Accuracy (%) → Target: 100%; Resolution Success Rate (%) → Target: ≥ 99%; Security/Compliance Pass Rate (%) → Target: 100%

Payment Milestone: OPTION M2 – 50% of 2026 OPTION value

4.3 2027 – Options (if Exercised)

Deliverable 1 (if 2027 OPTION is exercised): Software Requirements Specifications 2027

Define the Software Requirements Specifications (SRS) and development plan for the phases that will be performed during the period of performance. Provide a roadmap and define the development phases.

Due Date: January 29, 2027

KPIs: 2027 Requirements Coverage (%) → (Captured requirements / Identified requirements) × 100 → Target: ≥ 95%; Stakeholder Alignment Score (%) (survey/approval) → Target: ≥ 90%; Roadmap Accuracy (%) (milestones accepted without major revision) → Target: ≥ 90%; Milestone Definition Completeness (%) → Target: 100%

Payment Milestone: M1 – 8% of total value

Deliverable 2 (if 2027 OPTION is exercised): Backend Development Phase 3

Backend development activities will be defined in the SRS document. This deliverable will deliver the Phase 3 activities.

Due Date: February 26, 2027

KPIs: Service Stability (Error Rate %) → Target: < 1%; Advanced Query Accuracy (%) → Target: ≥ 95%; Relevance Precision/Recall (%) → Target: ≥ 90%; Topic Engineering Support Coverage (%) → Target: 100%; System Throughput (req/sec) → Meets agreed benchmark

Payment Milestone: M2 – 8% of total value

Deliverable 3 (if 2027 OPTION is exercised): Frontend Integration Phase 3

Frontend development activities will be defined in the SRS document. This deliverable will deliver the Phase 3 activities.

Due Date: March 31, 2027

KPIs: Workflow Completion Rate (%) → Target: ≥ 95%; User Interaction Efficiency (time/task) → Improvement vs Phase 1 baseline; Cross-View Consistency Score (%) → Target: ≥ 95%; UI Performance (load time) → Target: ≤ 1.5 seconds; User Satisfaction Score (%) → Target: ≥ 90%

Payment Milestone: M3 – 8% of total value

Deliverable 4 (if 2027 OPTION is exercised): Deployment & Environment Integration Phase 3

Frontend and backend alignment for target environments; Final system integration, handover preparation, and operational readiness.

Due Date: April 30, 2027

KPIs: Deployment Success Rate (%) → Target: ≥ 98%; Environment Compatibility (%) → Target: 100%; System Uptime (%) → Target: ≥ 99.9%; Security/Compliance Pass Rate (%) → Target: 100%; Operational Readiness Score (%) → (runbooks, monitoring, support readiness) → Target: ≥ 95%

Payment Milestone: M4 – 8% of total value

Deliverable 5 (if 2027 OPTION is exercised): Backend Development Phase 4

Backend development activities will be defined in the SRS document. This deliverable will deliver the Phase 4 activities.

Due Date: May 31, 2027

KPIs: Service Stability (Error Rate %) → Target: < 1%; Advanced Query Accuracy (%) → Target: ≥ 95%; Relevance Precision/Recall (%) → Target: ≥ 90%; Topic Engineering Support Coverage (%) → Target: 100%; System Throughput (req/sec) → Meets agreed benchmark

Payment Milestone: M5 – 8% of total value

Deliverable 6 (if 2027 OPTION is exercised): Frontend Integration Phase 4

Frontend development activities will be defined in the SRS document. This deliverable will deliver the Phase 4 activities.

Due Date: June 30, 2027

KPIs: Workflow Completion Rate (%) → Target: ≥ 95%; User Interaction Efficiency (time/task) → Improvement vs Phase 1 baseline; Cross-View Consistency Score (%) → Target: ≥ 95%; UI Performance (load time) → Target: ≤ 1.5 seconds; User Satisfaction Score (%) → Target: ≥ 90%

Payment Milestone: M6 – 8% of total value

Deliverable 7 (if 2027 OPTION is exercised): Deployment & Environment Integration Phase 4

Frontend and backend alignment for target environments; Final system integration, handover preparation, and operational readiness.

Due Date: July 30, 2027

KPIs: Deployment Success Rate (%) → Target: ≥ 98%; Environment Compatibility (%) → Target: 100%; System Uptime (%) → Target: ≥ 99.9%; Security/Compliance Pass Rate (%) → Target: 100%; Operational Readiness Score (%) → (runbooks, monitoring, support readiness) → Target: ≥ 95%

Payment Milestone: M7 – 8% of total value

Deliverable 8 (if 2027 OPTION is exercised): Backend Development Phase 5

Backend development activities will be defined in the SRS document. This deliverable will deliver the Phase 5 activities.

Due Date: August 31, 2027

KPIs: Service Stability (Error Rate %) → Target: < 1%; Advanced Query Accuracy (%) → Target: ≥ 95%; Relevance Precision/Recall (%) → Target: ≥ 90%; Topic Engineering Support Coverage (%) → Target: 100%; System Throughput (req/sec) → Meets agreed benchmark

Payment Milestone: M8 – 8% of total value

Deliverable 9 (if 2027 OPTION is exercised): Frontend Integration Phase 5

Frontend development activities will be defined in the SRS document. This deliverable will deliver the Phase 5 activities.

Due Date: September 30, 2027

KPIs: Workflow Completion Rate (%) → Target: ≥ 95%; User Interaction Efficiency (time/task) → Improvement vs Phase 1 baseline; Cross-View Consistency Score (%) → Target: ≥ 95%; UI Performance (load time) → Target: ≤ 1.5 seconds; User Satisfaction Score (%) → Target: ≥ 90%

Payment Milestone: M9 – 8% of total value

Deliverable 10 (if 2027 OPTION is exercised): Deployment & Environment Integration Phase 5

Frontend and backend alignment for target environments; Final system integration, handover preparation, and operational readiness.

Due Date: October 29, 2027

KPIs: Deployment Success Rate (%) → Target: ≥ 98%; Environment Compatibility (%) → Target: 100%; System Uptime (%) → Target: ≥ 99.9%; Security/Compliance Pass Rate (%) → Target: 100%; Operational Readiness Score (%) → (runbooks, monitoring, support readiness) → Target: ≥ 95%

Payment Milestone: M10 – 8% of total value

Deliverable 11 (if 2027 OPTION is exercised): Quality Assurance & Testing

Perform functional and integration testing for the improvement of the software; Provide acceptance support and defect resolution; Provide a report about the test results and log of improvements.

Due Date: November 30, 2027

KPIs: Quality Assurance Tests Success Rate (%) → Target: ≥ 98%; Latency/Response Time (%) → Target: 99% of users experience response time under 200ms; Requirements Traceability (%) → Target: ≥ 95%, feature has a corresponding test case; Crash-Free Session Rate (%) → Target: ≥ 98%, SW remains stable during stakeholder testing

Payment Milestone: M11 – 8% of total value

Deliverable 12 (if 2027 OPTION is exercised): Maintenance & Troubleshooting

Post-deployment stabilisation; Bug fixing and minor adjustments; Support during initial operational use.

Due Date: December 31, 2027

KPIs: Bug fixing Success Rate (%) → Target: ≥ 98%; Documentation Update Accuracy (%) → Target: 100%; Resolution Success Rate (%) → Target: ≥ 99%; Security/Compliance Pass Rate (%) → Target: 100%

Payment Milestone: M12 – 12% of total value

The payment shall be dependent upon successful acceptance of the Delivery Acceptance Sheet (DAS). Payment will be provided based on these deliveries as indicated in the table. Invoices shall be accompanied with a Delivery Acceptance Sheet signed by the Contractor and project authority.

5. Acceptance Criteria

The deliverables that are delivered to NCIA must be compliant with the following success criteria:

1: All deliverables must demonstrably meet the specific functional requirements outlined in the SOW.

2: All deliverables must satisfy the KPIs that are defined in the Section 4.1 Schedule of Deliverables.

3: The solution must follow professional software design practices e.g. ISO 90003 - Software Engineering Guidelines, IEEE 12207 Systems and Software Engineering – Software Life Cycle Processes, to provide a modular, maintainable and scalable system for future expansion.

4: All ingested data must display its source, methodology as defined in the guidelines that will be provided by NCIA Technical Lead.

5: Every phase increment must provide updated documentation, architecture diagrams and deployment instructions, if applicable.

6: All workflows must prioritize user-defined inputs and configurations to ensure that user can adjust the processes to achieve a better user experience.

7: Code must be deployed to the designated NATO Software Factory (NSF) development environment and shall be subject to pass a security scan.

8: Architectural integrity shall be provided, for instance, all frontend and backend components must utilize type-safe interfaces with clearly defined data contracts and schema validation.

9: All new User Interface (UI) components (sidebar, prompts, widgets) must be fully responsive, adhere to the agreed design system, and allow for new configurations.

10: All integrations between the frontend and backend must use clearly defined and stable data interfaces.

11: If the solution encounters issues during accreditation process, the developer is required to implement all necessary improvements and bug fixes.

6. Coordination and Reporting

The Contractor shall participate in milestone review meetings after the delivery of each milestone defined in Section 4.1 Schedule of Deliverables, and if necessary other technical progress meetings, according to project manager's instructions.

For each milestone, the contractor must report the outcome of his/her work during the period of performance. The format of this report shall be a short email to the NCIA Point of Contact mentioning briefly the work held and the development achievements.

Acceptance of each delivery completion will be documented in the Delivery Acceptance Sheet.

Cross-Phase KPIs (Apply to All Phases)

Test Pass Rate (%) → ≥ 98%

Defect Density → Within agreed threshold

Critical Defects (#) → 0

Documentation Coverage (%) → 100%

Traceability (%) → ≥ 95%

7. Schedule

This task order will be active immediately after signing of the contract by both parties but not before required starting date of 1st June 2026.

If the 2026 option is exercised, the period of performance is 1st September 2026 to 31st December 2026.

If the 2027 option is exercised, the period of performance is 01st January 2027 to 31st December 2027.

8. Constraints

All the deliverables provided under this statement of work will be based on NCIA templates or agreed with the project point of contact.

All code, scripts, documentation, etc. will be stored under configuration management and/or in the provided NCIA tools.

All the deliverables of this project will be considered NATO UNCLASSIFIED.

9. Security

The security classification of the service will be up to NATO UNCLASSIFIED.

10. Practical Arrangements

The Contractor shall provide the services offsite. Access to the NCIA's NATO Software Factory platform will be provided in coordination with the NCIA Point of Contact or delegated staff.

This service must be accomplished by ONE contractor.

11. Travel

This Task Order requires travel, consisting of up to 3 visits to NCIA Brussels (one per quarter) for a maximum of one working day each visit. Travel dates will be planned during the Project Kick-off Meeting with NCIA Project Manager. The travel, lodging and associated expenses for travel are included in the price of the bid (NTE), such that the purchaser shall not be invoiced.

Extraordinary Travel (Purchaser Directed Travel) may be required to other NATO or non-NATO locations as necessary. In the event of such unforeseen meetings being called, the cost of all travel and subsistence will be addressed through a contract amendment.

Extraordinary Travel expenses will be reimbursed in accordance with Article 5.5 of AAS+ Framework Contract. Such costs will be set as a separate PO line with a not to exceed value to cover and reimburse of actual expenses upon submissions of all receipts and invoices in line with NCIA processes.

12. Qualifications

[See Requirements]

Requirements

12. Qualifications

The support services under this SOW requires a Senior Full Stack Developer with the following qualifications:

Required Qualifications

• Senior-level full stack development experience with at least 8 years of experience, covering: frontend and backend development, system architecture, integration, implementation and end-to-end ownership from design through deployment.
• Extensive knowledge in frontend (Vue.js, React, Astro) and backend frameworks (Python, FastAPI), including: frontend application architecture and state management, backend API design, schema validation, and service orchestration.
• Proven experience integrating frontend applications with backend APIs and data services, including: high-volume data ingestion and querying, search, retrieval, and analytics-oriented backends, performance-aware UI–backend interaction patterns. The bidder must provide at least two project examples demonstrating the experience.
• Practical experience integrating AI and LLM-based services, including: LLM-powered analysis, synthesis, and content generation, retrieval-Augmented Generation (RAG) or hybrid retrieval approaches and deterministic, traceable, and auditable AI outputs suitable for policy and analytical use.
• Experience with designing and implementing analyst-facing workflows, with emphasis on: transparency of analytical results, traceability of sources, reasoning, and outputs, user control over inputs, filters, and relevance criteria.
• Experience working in analytical decision-support contexts or strategic foresight, including: topic engineering and thematic analysis, source intelligence and relevance assessment, multi-source analytical synthesis.
• Ability to work independently at senior level, including: structuring complex systems from high-level requirements, translating abstract objectives into concrete technical deliverables and delivery constraints.
• Experience with analytical platforms, such as strategic foresight analysis, emerging and disruptive technologies assessment, or decision-support tooling.
• Experience deploying solutions in restricted, controlled, or secure environments, including: separation of environments, controlled AI service integration, deployment constraints beyond standard commercial cloud setups.
• Candidate must have the nationality of one of the NATO nations.
• Excellent command of spoken and written English.

Preferred Qualifications

• Relevant experience with NATO and/or international organizations is highly desired.
• Experience in multi-stakeholder and high-accountability environments, including: auditability and traceability requirements, governance, review, and acceptance processes, coordination between technical, policy, and operational stakeholders.