Procurement of Consultancy Services for Vulnerability Assessment and Penetration Testing (VAPT) for Network Infrastructure and Web Applications of National Grid Company

The National Grid Company (Formerly NTDC) Lahore invites qualified and experienced cybersecurity consulting firms to submit proposals for Vulnerability Assessment and Penetration Testing (VAPT) services covering its network infrastructure and web applications. This procurement aims to enhance the cybersecurity posture of NGC by identifying vulnerabilities, assessing risks, and validating security controls across its extensive network and systems. Items being procured: - Comprehensive Security Architecture Assessment - Dynamic and Static Application Security Testing (DAST/SAST) on 12 web applications - External and Internal Penetration Testing of 8 public-facing IPs, 5 network devices (SDWAN Hub, Firewalls, Switches), 13 servers and 126 virtual machines - Security controls review of cloud and virtualized/containerized environments - Active Directory and Group Policy Object (GPO) audit - Post-exploitation and business impact assessment including privilege escalation and lateral movement - Evaluation of existing security controls - Detailed vulnerability reporting with CVSS ratings and remediation recommendations - Up to three rounds of retesting and validation following remediation The scope includes grey-box testing for web applications and black-box testing for network devices and servers. The consultant will provide a detailed implementation schedule, interface document, draft and final VAPT reports, technical documentation of methodologies and tools, a three-day stakeholder workshop, and a revalidation and closure report. Eligibility criteria include a minimum of 10 years consulting experience in IT infrastructure and cybersecurity assessments, proven track record of at least 10 similar VAPT projects in the last five years, sound financial standing, and no blacklisting by government or donor agencies. Key experts must meet specified qualifications and experience levels. The contract duration is 30 calendar days from signing. Proposals must be submitted electronically via e-PADS by 13 November 2026 at 11:00 AM. Technical proposals will be opened publicly on the same day at 11:30 AM at NGC Lahore office with an online attendance option. Bidders should ensure compliance with all submission requirements including proposal security declaration, and attend the pre-proposal conference on 4 November 2026 at 10:30 AM at NGC Lahore. Earnest money and PEC registration requirements apply as per PPRA rules. A practical tip for bidders: Carefully prepare the technical proposal addressing all TOR requirements and ensure key experts' CVs demonstrate relevant experience and qualifications to meet the minimum technical score of 80. Early submission and thorough compliance with e-PADS portal instructions will avoid disqualification due to technical errors or late bids.