IT Cybersecurity Audit and NEPRA Compliance for LESCO Primary and Disaster Recovery Data Centers

The Lahore Electric Supply Company (Material Management) in Lahore is procuring consultancy services for a comprehensive IT Cybersecurity Audit and NEPRA Compliance assessment for its Primary Data Center (PR) and Disaster Recovery Data Center (DR). This procurement is under Tender No 4424 and aims to ensure compliance with NEPRA regulations and the Pakistan Information Security Framework (PISF) 2025. Items being procured: - IT Cybersecurity Audit & NEPRA Compliance for LESCO Primary Data Center (PR) - IT Cybersecurity Audit & NEPRA Compliance for Disaster Recovery Data Center (DR) The scope includes a detailed evidence-based audit covering document review, stakeholder interviews, configuration reviews, control testing, vulnerability assessments, and validation of actual practices. Key areas include governance and cybersecurity management controls, asset management, risk assessment, security awareness, system and communication protection, identity and access management, threat monitoring, incident response, infrastructure security, application security, vulnerability management, and third-party risk controls. The audit will cover network devices, servers, databases, backup and restoration processes, physical and environmental controls, and compliance mapping against NEPRA and PISF standards. Eligibility criteria require bidders to be Category-1 PKCERT/NCERT accredited firms with ISO-17021 certification, registered with FBR and PRA, and have at least five years of relevant experience in cybersecurity risk assessments and IT audits. Financial health and client references must be provided. JV or subcontracting is not allowed unless explicitly permitted. The consultancy must ensure non-disruptive audit activities and data confidentiality. The tender is open for submission through EPADS v2.0 until Monday, August 3, 2026, at 10:30 AM, with bid opening at 11:00 AM the same day. Bidders must submit a bid security and comply with all documentation requirements. The contract duration is 90 days from award. A practical tip for bidders: Ensure your proposal includes a detailed project methodology, compliance approach, and named certified experts with relevant credentials such as ISO 27001 LA/LI, CISA, CISM, CISSP, CEH, OSCP, or CHFI to maximize technical evaluation scores. Early registration on EPADS v2.0 and thorough compliance with bid submission instructions will avoid disqualification.