Procurement of Professional Services for Continuous VAPT

The National Bank of Pakistan (NBP) invites bids for the procurement of professional services for Continuous Vulnerability Assessment and Penetration Testing (VAPT) in Karachi, Sindh. This procurement is for a three-year contract commencing within 45 days after contract award. The scope includes continuous VAPT and security assessments of applications, APIs, and IT infrastructure assets across the bank's heterogeneous IT environment. The consultancy services encompass periodic security assessments and VAPT as per the bank's Vulnerability Assessment and Management Program. Items being procured: - Professional services for continuous VAPT including application and infrastructure security assessments - Use of expert resources and tools such as Burpsuite, NMAP, Metasploit, SQLMap, Nessus, and others - Delivery of detailed VAPT reports including successful and unsuccessful exploits - Re-validation and closure of VAPT issues - Code reviews and guidance on remediation - Management of vulnerability assessments and follow-ups The technical scope requires bidders to have at least 10 years of experience in IT security risk assessment, vulnerability assessment, and penetration testing services, with relevant certifications such as Ethical Hacking, OSCP, CISSP, CISM, ISO 27001, CCNP, or CCIE. Bidders must demonstrate experience with at least 10 reputed Pakistani organizations including leading banks and provide current references for continuous VAPT services in the banking industry. The bidder must provide all software, tools, hardware, and licenses necessary for the services without additional cost to NBP. Bids must be submitted electronically via EPADS v2.0 by 30 September 2026 at 11:00 AM. Manual bids will not be accepted. Bid security of PKR 1,000,000 in the form of Pay Order or Bank Guarantee is required. Technical bids will be evaluated first, and only technically accepted bids will have their financial proposals opened. The contract will be awarded on Least Cost Based Selection (LCBS) basis. A practical tip for bidders: Ensure your technical proposal is complete with all required documentation and references properly indexed and paginated to avoid disqualification. Also, register early on EPADS v2.0 and submit your bid well before the deadline to avoid last-minute issues. Contact Person: Wing Head Departmental Head Tender-LCMG Phone: +92-213-890-2267 Email: teemar@nbp.com.pk Website: https://epads.gov.pk/opportunities/federal/procurements/113089 Submission Method: Online submission through EPADS v2.0 only. Hard copy of bid security must be submitted to the Departmental Head Tender-LCMG, 3rd Floor Right Wing, NBP Head Office, Building I.I Chundrigar Road Karachi. Source URL: https://epads.gov.pk/opportunities/federal/procurements/113089 Source File Name: tender_ppra2_1788953278373.pdf Source Name: PPRA