Engagement of Cybersecurity & GRC Consultant for Information Security Audit and Pakistan CERT Readiness

Power Information Technology Company (PITC), a state-owned enterprise under the Ministry of Energy (Power Division), Government of Pakistan, invites qualified and experienced consultants for the engagement of a Cybersecurity & GRC Consultant in Lahore, Punjab. This consultancy aims to conduct a comprehensive Information Security Audit, Gap Assessment, and Pakistan CERT / nCERT Readiness engagement across PITC's digital ecosystem and allied IT/OT infrastructure. Items being procured: - Consultancy Services as Cybersecurity & GRC Consultant for Information Security Audit - Gap Assessment of IT/OT architecture, networks, endpoints, cloud environments, and perimeter security - Pakistan CERT and Regulatory Audit Readiness including policy alignment and incident response workflows - Policy formulation and control optimization including drafting SOPs and governance artifacts - Pre-audit dry run, mock assessment, and certification support The assignment is structured in three phases over eight weeks: Phase 1 focuses on discovery and gap assessment; Phase 2 on remediation and policy alignment; Phase 3 on mock audit and certification support. Deliverables include detailed reports, risk registers, compliance matrices, remediation plans, and audit evidence packs. Eligible bidders must have a minimum of 12 years of professional experience in Information Security, Governance, Risk and Compliance (GRC), and Cyber Defense architecture. Experience with Tier-1 consulting/audit firms and Pakistan CERT / nCERT compliance initiatives is mandatory. Professional certifications such as CISSP, CISA, CISM, CRISC, ISO 27001 Lead Auditor/Implementer are preferred. Bidders must be active taxpayers and not blacklisted by PPRA or any government entity. Proposals must be submitted through the e-Pak Acquisition and Disposal System (EPADS) v2.0 by **Monday, October 19, 2026, 11:00 AM**. A physical copy of the bid security must also be submitted to Room # 405, WAPDA House, Lahore. Technical proposals will be evaluated on relevant experience, certifications, and proposed methodology with a minimum passing score of 70 out of 100. The contract will be awarded to the technically qualified lowest financial bidder. Bidders are advised to carefully review the detailed RFP documents available on EPADS and ensure compliance with all submission requirements. One practical tip for bidders is to ensure timely registration and submission on EPADS v2.0 to avoid disqualification due to late or manual submissions. For further information, contact the Director General at Power Information Technology Company (PITC), Room # 405, WAPDA House, Lahore. Phone: +92-335-444-5133, Email: adnan@pitc.com.pk.