OT Related VAPT and Security Review Engagement for Automation at Faisalabad, Keamari, and Machike

Pakistan State Oil Company Limited (PSO) invites qualified firms to submit quotations for a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) and security review engagement focused on Operational Technology (OT) automation environments at Faisalabad, Keamari (KTA), and Machike locations. This engagement aims to enhance cybersecurity posture by assessing OT-connected PCs, servers, network infrastructure, and applications in line with global standards and industry best practices. Items being procured: - Internal Audit Services for OT Audit - VAPT of OT-connected PCs/Servers using OT-safe methodologies - Application security review of TAS (SCADA, Token Generator), PLC, SAP#OT integration middleware - Evaluation of OT network architecture and IT/OT segregation - Physical and environmental security review of OT systems - Assessment across four layers: Field & Control Devices, OT-Hosted PCs/Servers, Applications, Network Infrastructure - Security baseline review including password/authentication mechanisms, antivirus status, patch management, endpoint hardening, audit logging The scope covers Layer 1 (Engineering & Operator Workstations, OT Hosted Servers) and Layer 2 (Layer 2/3 Switches, Firewalls, Routers, Wireless infrastructure including RFID transmission network) at all specified locations. The selected firm will provide prioritized categorized findings, remediation roadmap, baseline configuration standard review, and closing presentation to PSO management. The contract tenure is 5 months with draft reports due within 3 months and final reports within 1 month after responses. Payment is milestone-based, divided into draft reports for Faisalabad and other locations, baseline document review, final report issuance, and management presentation. Eligibility requires demonstration of experience in IT/OT Review & VAPT per global standards, submission of an activity schedule, detailed work breakdown, and objective communication of findings. Bidding follows a Single Stage, Two Envelope procedure. Interested bidders should ensure compliance with PSO's technical evaluation criteria and submit bids by the deadline. Earnest Money and other bid security requirements apply as per instructions. A practical tip for bidders: Carefully review the detailed methodology annexure and ensure your technical proposal addresses all layers and locations comprehensively to meet PSO's stringent cybersecurity requirements. Early submission and clear documentation of experience will enhance your bid's competitiveness.