Hiring of Cybersecurity Consultant for NEPRA

The National Electric Power Regulatory Authority (NEPRA) invites qualified individual consultants to submit proposals for the hiring of a Cybersecurity Consultant to enhance cybersecurity governance and implementation across Pakistan's power sector. This consultancy is based in Islamabad and aims to support NEPRA in overseeing licensee compliance with cybersecurity regulations and advisories, including those issued by NCERT and NTISB. The consultant will be responsible for evaluating cybersecurity compliance submissions, implementing security operations technology, ensuring IT and OT system architectures comply with industry standards such as Zero-Trust Architecture, and designing secure-by-design principles for information systems. The scope includes preparing quarterly compliance reports, reviewing audit reports, proposing amendments to NEPRA's IT/OT Security Regulations, developing standardized compliance processes and digital tools, and delivering tailored capacity-building training for technical staff. The consultant will also provide advisory services on emerging threats, support NEPRA's internal cybersecurity posture, and discharge advisory functions equivalent to a Chief Information Security Officer (CISO) without holding a sanctioned post. The assignment duration is two years with possible extension based on performance. Key eligibility criteria include a minimum of a BS/BE or higher degree in relevant fields, at least ten years of post-bachelor experience in cybersecurity with specific experience in industrial control systems or operational technology environments, and possession of internationally recognized professional certifications related to ICS/OT cybersecurity. The procurement follows a Quality and Cost Based Selection (QCBS) method under a Single Stage Two Envelope procedure. Proposals must be submitted electronically via EPADS v2.0 by November 16, 2026, 02:00 PM, with financial proposals opened subsequently. Manual submissions are not accepted. Bid security in the form of Pay Order, Banker's Cheque, or Call Deposit is required. Interested bidders must be registered on EPADS v2.0. The consultant will report to the Director (IT) or designated officer and must maintain confidentiality and comply with NEPRA's data security requirements. This is a consultancy services procurement by NEPRA in Islamabad Capital Territory. Items being procured: - Cybersecurity consultancy services including compliance evaluation, security operations implementation, regulatory advisory, training, and internal cybersecurity enhancement for NEPRA over two years. The consultant must have strong expertise in cybersecurity frameworks, regulatory compliance, and operational technology security. The contract includes detailed deliverables such as inception reports, standardized compliance frameworks, quarterly reports, audit reviews, regulatory amendments, training plans, internal cybersecurity reviews, critical infrastructure prioritization, and liaison with national cybersecurity institutions. The consultant will be paid a lump sum professional fee inclusive of all taxes, with payments linked to deliverables and subject to satisfactory performance. Bidders should ensure timely submission of proposals on EPADS and adhere to all eligibility and submission requirements. A practical tip for bidders: Register early on EPADS v2.0 and carefully prepare both technical and financial proposals as per the detailed RFP documents to avoid disqualification. Ensure all required certifications and experience documents are verifiable and included in the submission.