Procurement of 3rd Party Services for Security Assessments

The National Bank of Pakistan (NBP) invites eligible bidders to participate in the procurement of 3rd party consultancy services for comprehensive security assessments of applications and critical infrastructure in Karachi, Sindh. This procurement covers security assessments of 25-30 applications including internet, intranet, and desktop based applications with vulnerability assessment and penetration testing (VAPT) using both automated tools and manual testing, including secure SDLC checklist and white/grey/black box testing. Additionally, the scope includes security assessments of critical infrastructure comprising 500-525 servers and 100 network devices such as switches, routers, firewalls, and storage systems, with configuration reviews and vulnerability assessments. A compromise assessment to identify indicators of compromise (IOCs) within the network infrastructure is also required. Items being procured: - Security Assessments of Applications (25-30 applications) - Security Assessments of Critical Infrastructure including 500-525 servers and 100 network devices - Compromise Assessment for network infrastructure The successful bidder will provide detailed reports covering threats and vulnerabilities with CVSS categorization, recommended controls, and corrective actions. Reports must include methodologies such as OWASP, OSSTMM, PTES, and include both automated and manual testing results. The bidder must have at least 3 years of experience in IT security risk assessment, vulnerability assessment, and penetration testing, with a team of at least 3 certified personnel including a team lead with OSCP or equivalent certification. The bidder must have experience serving at least 10 reputed Pakistani organizations including leading banks, and demonstrate financial capacity with audited revenue of at least PKR 30 million over the last 3 years. Bids must be submitted electronically via EPADS v2.0 by 30 September 2026 at 11:00 AM. Manual bids will not be accepted. Bid security of PKR 1,000,000 in the form of Pay Order or Bank Guarantee is required. Technical bids will be evaluated first and only technically compliant bids will have their financial proposals opened. The contract period is one year starting within 45 days of award. Payment will be milestone based with mobilization advance and payments upon submission of various assessment reports and successful project closure. Bidders are advised to carefully review the detailed bidding documents available on EPADS and ensure compliance with all eligibility, technical, and financial requirements. A practical tip for bidders is to ensure timely submission of original bid security to the Procurement Division at NBP Head Office, Karachi, before the bid submission deadline to avoid disqualification. This procurement offers a significant opportunity for qualified IT security firms to provide critical security assessment services to one of Pakistan's largest banks in Karachi.