OT Related VAPT and Security Review Engagement for Automation at Faisalabad, Keamari, and Machike

Pakistan State Oil Company Limited (PSO) invites qualified firms to submit quotations for a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) and security review engagement focused on Operational Technology (OT) automation systems at its Faisalabad, Keamari (KTA), and Machike locations. This engagement aims to enhance cybersecurity posture by assessing OT-connected PCs, servers, network infrastructure, and applications in line with industry best practices. Items being procured: - Internal Audit Services for OT Audit - VAPT of OT-connected PCs/Servers using OT-safe methodologies - Application security review of TAS (SCADA and related screens, Token Generator, PLC, SAP#OT integration middleware) - Evaluation of OT network architecture and IT/OT segregation - Physical and environmental security review of OT systems - Assessment across four layers: Field & Control Devices, OT-Hosted PCs/Servers, Applications, and Network Infrastructure - Security baseline review including password/authentication mechanisms, antivirus status, patch management, endpoint hardening, and audit logging The scope covers Layer 1 (Engineering & Operator Workstations, OT Hosted Servers) and Layer 2 (Layer 2/3 Switches, Firewalls, Routers, Wireless infrastructure including RFID transmission network) at all specified locations. The selected firm will provide prioritized categorized findings, a remediation roadmap, baseline configuration standard review, and a closing presentation to PSO management. The contract tenure is 5 months with draft reports due within 3 months and final reports within 1 month after responses. Payment will be milestone-based across draft reports, baseline document review, final report, and management presentation. Bidding follows a Single Stage, Two Envelope procedure. Eligibility requires demonstration of experience in IT/OT Review & VAPT per global standards, submission of an activity schedule, detailed work breakdown, and objective communication of findings. Firms must comply with the attached Technical Evaluation Criteria. Interested bidders should prepare their technical and financial bids carefully, ensuring compliance with PSO's requirements and timelines. Submission deadline is **04 November 2026**. Bidders are advised to review the detailed scope and evaluation criteria thoroughly to maximize their scoring potential. This opportunity is ideal for cybersecurity firms with proven expertise in OT environments and industrial control systems. Attention to detail and adherence to global best practices will be critical for success.