Cybersecurity Scorecard Assessment and Coordination Support

Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.

Who we are supporting

The NATO Communication and Information Agency (NCIA) is responsible for providing secure and effective communications and information technology (IT) services to NATO's member countries and its partners. The agency was established in 2012 and is headquartered in Brussels, Belgium.

The NCIA provides a wide range of services, including:

• Cyber Security: The NCIA provides advanced cybersecurity solutions to protect NATO's communication networks and information systems against cyber threats.
• Command and Control Systems: The NCIA develops and maintains the systems used by NATO's military commanders to plan and execute operations.
• Satellite Communications: The NCIA provides satellite communications services to enable secure and reliable communications between NATO forces.
• Electronic Warfare: The NCIA provides electronic warfare services to support NATO's mission to detect, deny, and defeat threats to its communication networks.
• Information Management: The NCIA manages NATO's information technology infrastructure, including its databases, applications, and servers.

Overall, the NCIA plays a critical role in ensuring the security and effectiveness of NATO's communication and information technology capabilities.

The program

Assistance and Advisory Service (AAS)

The NATO Communications and Information Agency (NCI Agency) is NATO’s principal C3 capability deliverer and CIS service provider. It provides, maintains and defends the NATO enterprise-wide information technology infrastructure to enable Allies to consult together under Article IV, and, when required, stand together in the face of attack under Article V.

To provide these critical services, in the modern evolving dynamic environment the NCI Agency needs to build and maintain high performance-engaged workforce. The NCI Agency workforce strategically consists of three major categorise's: NATO International Civilians (NIC)'s, Military (Mil), and Interim Workforce Consultants (IWC)'s. The IWCs are a critical part of the overall NCI Agency workforce and make up approximately 15 percent of the total workforce.

Role ID – 2026-0089

Role Background

The objective of this engagement is to provide assessment and coordination support for enterprise cybersecurity governance activities, specifically supporting the NATO Enterprise Cybersecurity Scorecard (The Scorecard) process.

The contractor will assist CDT in performing assessments, coordinating stakeholders, supporting analytical and reporting activities and ensuring that Scorecard process is executed in a structured, consistent and traceable manner.

Role Duties and Responsibilities

• Supporting preparation of the annual Scorecard execution approach and planning documentation
• Preparing assessment materials, including questionnaires, interview guidance and data collection templates
• Coordinating and conducting cybersecurity assessments of the identified entities through remote sessions and on-site engagements
• Engaging with relevant stakeholders to collect assessment inputs and supporting information
• Documenting assessment results and maintaining structured records of assessment outputs
• Maintaining tracking documentation for the Scorecard, including assessment progress and identified issues.
• Maintaining oversight documentation such as tracking dashboards, issue logs and status summaries
• Consolidating assessment inputs and maintaining structured datasets supporting Scorecard scoring and analysis
• Supporting preparation of Scorecard reports and presentation materials
• Proposing improvements to Scorecard methodology, KPIs, survey questions or scoring logic for CDT’s consideration.

Deliverables:

• WP1- D1- Scorecard Execution Plan

A structured plan describing the execution approach for the annual Scorecard cycle.

• Assessment timeline and milestones
• Roles and responsibilities (RACI)
• Coordination approach with the entities
• Tracking structure

• WP1- D2- Scorecard Coordination and Tracking Dashboard

Operational dashboard used to track progress of Scorecard assessments

• List of participating entities
• Entity participation tracking
• Survey distribution and completion tracking
• Maturity assessment completion tracking
• Overview of progress of assessment activities

• WP1- D3- Data Collection Package

Preparation of the documentation and tools required for collecting the Scorecard survey inputs from entities

• Survey / data collection template
• Instructions and guidance for completion
• Supporting explanatory material
• Distribution list of participating entities

• WP1- D4- Scorecard Introduction Workshops

Workshops introducing the Scorecard methodology and explaining the survey completion process to participating entities

• Presentation material explaining the Scorecard methodology and survey process
• Overview of data collection templates
• Workshop summary notes

• WP2- D1- Completed Survey / Data Collection Files

Survey responses completed by participating entities as part of the Scorecard process.

• Periodic engagement with each entity to obtain a completed survey
• Completed survey templates submitted by entities
• Supporting notes where clarification was provided

• WP2-D2- Survey Support and Clarification Log

Structured log documenting questions, clarifications and guidance provided to entities during the survey completion period.

• Record of questions received from entities
• Clarifications provided
• Status of resolved issues

• WP2- D3- On-site Maturity Assessment Reports

Reports documenting the maturity assessment sessions conducted during on-site Scorecard assessments

• Overview of the assessed entity
• Summary of maturity assessment discussions
• Key observations and identified gaps
• Supporting assessment notes

• WP3- D1- Scorecard Summary Data Spreadsheets

Structured spreadsheets containing aggregated results derived from the survey responses and maturity assessment inputs.

These spreadsheets will serve as the data source for the Scorecard analytical dashboard and reporting activities

• Aggregated assessment results
• Summary results structured by Strategic Pillars and Key Objectives
• Summary indicators supporting Scorecard analysis

• WP3- D2- Scorecard Analytical Dashboard

Analytical dashboard used to visualize the aggregated results of the Scorecard assessments.

The dashboard will display summary results derived from specific Scorecard summary spreadsheets

The dashboard will be developed and maintained using the Sponsor- provided technical environment, including access to the PowerBI Server and associated resources such as laptops and etc.

• Visualization of results by Strategic Pillars, Key Objectives and relevant KPIs
• Graphical summaries supporting analysis of the Scorecard results

• WP3- D3- Scorecard Analytical Summary

Analytical documentation identifying key observations and trends derived from the Scorecard results

• Observations across participating entities
• Analysis of results by pillar and key objective
• Identification of trends or pattern

• WP3- D4- Scorecard Final Report

The final Scorecard report summarizing the results and key findings of the Scorecard cycle.

• Overview of the scorecard process
• Summary of key results
• Conclusions and observations

• WP3- D5- Executive Briefing Package

Presentation material summarizing the key findings of the Scorecard process for governance stakeholders.

• Summary of key observations
• Graphical presentation of results
• Supporting charts or visuals

Essential Skills, Experience and Certifications

• Expertise in Cyber Security:
  • Contractor personnel must have a minimum 5 years of professional experience in cyber security with a focus on analytical assessment, scorecard development and performance metrics. Personnel must demonstrate a strong understanding of the cybersecurity processes such as Cyber Incident Management, Defensive Cyberspace Operations, Enterprise Risk Management and Cyber Threat Intelligence Analysis and Sharing.
• Experience in Metrics and Measures Development:
  • Contractor personnel must have a minimum 3 years of experience in developing meaningful and actionable cybersecurity metrics and measures.
• Methodology Development Skills:
  • Contractor personnel must have a minimum 3 years of experience in developing, refining and updating methodologies for assessing cybersecurity maturity and performance.
• Data Analysis and Visualization Proficiency:
  • Contractor’s personnel must have strong skills in data analysis and the ability to create insightful visualizations for complex data sets. Familiarity with modern data visualization tools is essential – particularly PowerBI.
• Communication Skills:
  • Contractor personnel must demonstrate strong written and verbal communication skills for engaging with various stakeholders and facilitating Enterprise-wide assessments.
• Autonomous Working Capability:
  • The contracted individual must be capable of performing effectively and efficiently with minimal supervision.

Working Location

• Brussels Belgium

Working Policy

• Offsite

Travel

• Some travel to other NATO sites may be required

Security Clearance

• Valid National or NATO Secret personal security clearance