Procurement of Vulnerability Assessment and Penetration Testing Services

The Securities and Exchange Commission of Pakistan (SECP), located in Islamabad, is procuring Vulnerability Assessment and Penetration Testing (VA/PT) services for a period of one year starting May/June 2026. This procurement is specifically for cybersecurity services to be provided on-site at SECP's Head Office by two qualified Resident Engineers who will be on the bidder's regular payroll and work under SECP supervision. The scope includes conducting VA/PT activities using industry-standard tools and methodologies such as OWASP Top 10 and CIS Benchmarks, delivering detailed reports, evidence screenshots, and post-remediation validations. The selected firm must have at least 10 years of experience in VA/PT services, a local office in Islamabad, and provide references of similar work. The Resident Engineers must hold relevant degrees, have 3-4 years of experience, and at least one global VA/PT certification. Bidders must be registered with valid NTN, appear on the Active Taxpayers List, and comply with security declarations excluding tools linked to Israel or India. The procurement follows the Single Stage Two Envelope method with a bid security of PKR 100,000 in the form of a pay order. Bids must be submitted exclusively through the EPADS system by 14:30 on May 11, 2026, with technical bids evaluated first and only those scoring 70% or above considered for financial evaluation. The contract includes quarterly payments upon submission and approval of deliverables. A practical tip for bidders is to ensure all required documents, including compliance sheets and payroll evidence, are complete and uploaded on EPADS before the deadline to avoid disqualification. The SECP emphasizes strict adherence to the bidding instructions and timely submission to maximize chances of success.