7. In terms of Rules 48 of Public Procurement Rules, 2004 Grievance Redressal Committee (GRC) is notified for the subject procurement and notification copy is available on the procuring agency’s website and also available on EPADS v2.0 as well as Authority’s website at (www.ppra.org.pk).
Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director
Constitution Avenue, Sector G-5., Islamabad Capital Territory
+92-347-725-9108
adgs.sykb@mofa.gov.pk
The following specific data for the procurement of Non-Consultancy Services to be procured shall complement, supplement, or amend the provisions in the Instructions to Bidders (ITB). Whenever there is a conflict, the provisions herein shall prevail over those in ITB.
BDS Clause Number
ITB Number
Amendments of, and Supplements to, Clauses in the Instruction to Bidders
BDS Clause Number 1
Name of Procuring Agency: Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA))
The subject of procurement is: Cyber Security Services
Expected commencement date: Friday, October 30, 2026
BDS Clause Number 2
Financial year for the operations of the Procuring Agency: 2026-27
Name and identification number of the Contract: P119398
BDS Clause Number 3
JV/Consortium or Association Allowed: No
Number of JV/Consortium Members: Nil
BDS Clause Number 4
The Bidders may seek clarifications through EPADS v2.0: Clarification Date: Monday, September 28, 2026
BDS Clause Number 5
Any addendum, in case issued, shall be published on Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)) website and on EPADS v2.0.
BDS Clause Number 6
List of documents required along with the bid: No
BDS Clause Number 7
The qualification criteria to establish the supply / production capability of the bidder.
see Eligibility Criteria
BDS Clause Number 8
Services and Their related documents:
See section Required Services and Scope of Work
BDS Clause Number 9
Price schedule will be provided according to the format defined and acquired.
see section price schedule.
BDS Clause Number 10
Specifications:
see section of specifications.
BDS Clause Number 11
The price shall be Fixed.
BDS Clause Number 12
Currency of the Bids shall be : PKR
BDS Clause Number 13
The Bids/Bid Validity period shall be: 90 Days
BDS Clause Number 14
The amount of Bid Security shall be as defined in Bid Security Section for items and lots given in BDS 6
The Bid Security shall be in the form of: Pay Order, Banker's Cheque, Call at Deposit, Demand Draft
BDS Clause Number 15
The Bids security shall be valid for twenty-eight (28) days beyond the expiry of the Bids validity period specified in the bidding documents, for example the bid validity is 90 days so the bid security shall be valid for 90+28 = 118 days.
BDS Clause Number 16
Alternative Bids to the requirements of the bidding documents will not be permitted.
BDS Clause Number 17
Bid shall be submitted online on EPADS v2.0 whereas hard copy of the bid security should be submitted to the following;
Constitution Avenue, Sector G-5., Islamabad Capital Territory
Bids that are not submitted on EPADS v2.0 shall be disqualified.
The deadline for Bids submission is: Monday, October 5, 2026 11:30 AM
BDS Clause Number 18
The Bids opening shall take place on EPADS v2.0.
Day : Monday
Date: Monday, October 5, 2026
Time : 12:00 PM
BDS Clause Number 19
Selection technique adopted will be: Quality and Cost Based Selection (QCBS)
see Evaluation Criteria
BDS Clause Number 20
The Performance guarantee shall: 0%.
The Performance Guarantee shall be acceptable in the form of: Nil
21.
51.1
Arbitrator shall be appointed by mutual consent of the both parties.
BDS Clause Number 22
Grievence against this procurement shall be submitted online on EPADS v2.0.
| Bidder's Type | Required Registration |
|---|---|
|
Sole Proprietorship Partnership Firm Company (Private Limited) Company (Public Limited) Company (Holding Company) Company (Limited by Guarantee) State Owned Enterprise (Private Limited) State Owned Enterprise (Public Limited) |
NADRA CITIZENSHIP (CNIC/NICOP) FBR (NTN) FBR (GSTN) SECP |
| Eligibility Criteria | Document |
|---|---|
| Pakistan-registered legal entity with active NTN and sales tax registration | Yes |
| Minimum 5 years of operations in cyber security or GRC services. (Incorporation certificate; client reference list) | Yes |
| Demonstrated information security experience in fields like GRC, Risk assessments, security/ compliance audits, vulnerability assessments/penetration testing experience with at least 3 clients. (Client reference letters or engagement summaries with scope descriptions) | Yes |
| Organization certified under ISO 27001. (Valid ISO 27001 certification copies) | Yes |
| Accredited by nCERT (Firms holding CAT (A) status). (nCERT accreditation certificate; CAT (A) status certificate) | Yes |
| No conflict of interest with Ministry or its key vendors. (Signed conflict of interest declaration) | Yes |
Quality and Cost Based Selection (QCBS)
Weightage
| Technical Evaluation % | Financial Evaluation % |
|---|---|
| 80 | 20 |
| Technical Marks | 100 | |
|---|---|---|
| Passing Marks | 60 | |
| Technical Evaluation Criteria | ||
| Company experience and past performance in Cyber Security.
Firms must attach verifiable certificates of good/satisfactory performance from clients in projects. (Relevant documents attached) (Qualitative)(Doc Required) 15 Years or more with 15 good performance certificates (25) 10 to 14 Years with 10 to 14 good performance certificates (18) 5 to 9 Years with 5 to 9 good performance certificates (12) | 25 | |
| Technical approach and methodology for GRC & Internal Audit. (Relevant documents attached) (Qualitative)(Doc Required) | 10 | |
| Proposed resource qualifications and experience (GRC and Internal Audit) (Qualitative)(Doc Required) 2 Years plus experience as per the criteria given at section 2 (20) As per Criteria given at Section 2 (12) | 20 | |
| SLA/KPI framework and reporting capability. (Relevant documents attached). As per ISO framework (Qualitative)(Doc Required) | 10 | |
| Technical Evaluation Criteria | ||
| CAT (A) Auditor with nCERT and ISO 27001 and 27701 (Assurance for security and privacy) (Qualitative)(Doc Required) All Three Certifications (20) Any 2 Certifications (12) Any 1 Certification (8) | 20 | |
| Technical Evaluation Criteria | ||
| Experience of GRC with ministries and national organizations. (Relevant documents attached) (Qualitative)(Doc Required) 5 or more (15) 3 to 4 (10) 1 to 2 (5) | 15 | |
Positions Without Lots :
| Position | Delivery Schedule | Quantity | Bid Security |
|---|---|---|---|
| Cyber Security Services | Address: Constitution Avenue, Sector G-5., Islamabad Capital Territory Schedule: 27 Days Quantity: 1/Qty |
1/Qty | 1143500 PKR |
No
Positions Without Lots :
Position: Cyber Security Services
Specifications / Requirements:
The engagement requires Managed Cyber Security Services comprising an On-Site Governance, Risk and Compliance (GRC) Team to be embedded at Ministry premises as the primary delivery mechanism for the Ministry’s Cyber Security programmed.The Vendor shall deliver Managed Cyber Security Services under two integrated service pillars as detailed below. All services shall be delivered through resources deployed on-site at Ministry premises, except where expressly noted otherwise.
Â
On-Site Governance, Risk and Compliance (GRC) Team and Internal Auditor
Â
The Vendor shall deploy a dedicated GRC team and internal Auditor at Ministry premises on a full-time basis for the duration of the contract. This team shall serve as the primary delivery mechanism for the Ministry's governance, risk management, and compliance programme, including but not limited to: development and implementation of cybersecurity policies and procedures aligned with Pakistan Information Security Framework (PISF); enterprise risk assessment and risk register management; SOP drafting and implementation; regulatory compliance monitoring; third-party risk management (TPRM); and asset inventory and classification.
Â
|
Role |
 Qty |
Min. Experience |
Min. Qualification / Certification |
Primary Focus |
|
GRC Lead |
1 |
12 years of total IT and information security experience. Out of this, a minimum of 6 years should specifically be in cyber security and at least 3 years must involve  AND  Must Possess an experience of at least 10 Audits or Compliance preparedness engagement, gap assessments, risk assessments.  |
BS/BE in CS, Information/Cybersecurity, or related field  Core Certifications The GRC Lead must hold at least two certifications, one Certifications like: CISSP, CISM, CRISC, CISA, ISO 27001 LA/ LI or equivalent  And one certification based on domain expertise: For IT: CISSP, CISM, CRISC, CISA, ISO 27001 LA/ LI, ISO 27701 or equivalent. For Cloud: ISO/IEC 27017, CCSP or equivalent. For OT: ISA/IEC 62443 or equivalent  |
Policy development and implementation, risk framework oversight, compliance coordination, TPRM programme management, executive reporting, implementation and any other relevant task assigned by the Ministry. Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â |
|
GRC Analyst/Pentester |
2 |
4 years of total IT and information security experience. Out of this, a minimum of 2 years should specifically be in fields like GRC, Risk assessments, security/  And  Must Possess an experience of at least 5 Audits or Compliance preparedness engagement, gap assessments, risk assessments, VA or PT.  |
BS/BE in CS, Information/Cybersecurity, or related field                  Core Certifications  GRC Analyst must hold at least one certification like ISO 27001 LA/LI, CEH, OSCP, Security+, GIAC or equivalent.    |
Policy drafting and review, risk register upkeep, SOP development, asset inventory management, compliance documentation, TPRM vendor assessments, security awareness programme delivery, compliance tracking, audit support, implementation and any other relevant task assigned by the Ministry. |
|
Internal Auditor |
1 |
8 years of total IT and information security experience. Out of this, a minimum of 5 years should specifically be in cyber security and at least 3 years must involve   AND  Must Possess an experience of at least 7 Audits or Compliance preparedness engagement, gap assessments, risk assessments. |
BS/BE in CS, Information/Cybersecurity, or related field  Core Certifications The GRC Lead must hold at least two certifications, one Certifications like: CISSP, CISM, CRISC, CISA, ISO 27001 LA/ LI or equivalent  And one certification based on domain expertise: For IT: CISSP, CISM, CRISC, CISA, ISO 27001 LA/ LI, ISO 27701 or equivalent. For Cloud: ISO/IEC 27017, CCSP or equivalent. For OT: ISA/IEC 62443 or equivalent  |
Independent from the team of implementation (GRC). Will do internal audit on the imp-implementation of policies by GRC team and any other relevant task assigned by the Ministry. |
Â
Â
GRC Team & Internal Auditor Deliverables:
Â
|
Task |
Deliverable |
Owner |
Target Timeline |
|
Phase 1: Asset inventory/Risk assessment/Gap assessment with reference to Pakistan Information Security Framework (PISF) |
 |
GRC Team |
Within 90 days |
|
Phase 2: Implementation of security solutions and development of policies and Procedures with reference to Pakistan Information Security Framework (PISF) Â |
 |
GRC Team |
Within 270 days after completion of phase 1. |
|
Phase 3: Internal Audit, Vulnerability assessment with reference to Pakistan Information Security Framework (PISF) Â |
 |
Internal Auditor |
Within 60 days after completion of phase 2. |
Â
All GRC resources must be physically present at Ministry premises during contracted working hours. The Internal Auditor will be physically present at Ministry premises during phase 3. Â Resource substitution requires Ministry approval at least 15 working days in advance.
Â
The Vendor's on-site GRC shall conduct on-the-job mentoring and knowledge transfer as a continuous activity alongside their primary duties. Ministry IT staff shall be embedded with the GRC teams on a rotational basis to gain practical exposure. The Vendor shall produce a Knowledge Transfer Report at the end of each contract year documenting skills transferred, competency assessments, and recommendations for further development.
Â
Â
For Individual Positions
| # | Position Title | Quantity | Unit Price (PKR) | Total Price (PKR) | Delivery Location | Delivery Period / Year | Country of Origin |
|---|---|---|---|---|---|---|---|
| 1 | |||||||
| 2 |
| # | Lot Title | Total Lot Price (PKR) | Country of Origin |
|---|---|---|---|
| 1 | [Lot 1 Title] |
The following Special Conditions of Contract shall supplement the General Conditions of Contract. Whenever there is a conflict, the provisions herein shall prevail over those in the Conditions of Contract. The corresponding clause number of the GCC is indicated in parentheses.
Number of GC Clause
Amendments of, and Supplements to, Clauses in the General Conditions of Contract
Definitions
The Procuring Agency is: Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director Constitution Avenue, Sector G-5., Islamabad Capital Territory
The Supplier is:
The title of the subject procurement is:Cyber Security Services
Number of GC Clause 2
Applicable/Governing Law:
The Contract shall be interpreted in accordance with the laws of Islamic Republic of Pakistan
Number of GC Clause 3
Language:
The language of the Contract, all correspondence and communications to be given, and all other documentation to be prepared and supplied under the Contract shall be in English.
Number of GC Clause 4
Notices:
The addresses for the notices are:
Procuring Agency:
Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director
Constitution Avenue, Sector G-5., Islamabad Capital Territory
+92-347-725-9108
adgs.sykb@mofa.gov.pk
Contractor/ Bidder:
[Name, address and telephone number].
The Contractor/ Bidder’s Representative(s)
[Name, address, telephone number and e-mail address]
Number of GC Clause 6.1
The Authorized Representatives are:
For the Procuring Agency:
Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director
Constitution Avenue, Sector G-5., Islamabad Capital Territory
+92-347-725-9108
adgs.sykb@mofa.gov.pk
For the Bidder:
Name: ………………………
Designation: ……………..
Address: ……………………………..
Number of GC Clause 7
Effectiveness of the contract
The Contractor/Bidder shall be effective within ….. days from the date of signature of the Contract by both parties
Number of GC Clause 8
Commencement of Contract:
The Contractor/ Bidder shall provide Non-Consultancy Services from the effective date of contract.
Number of GC Clause 10.2
Expiration of Contract:
The time period shall be ………………….
Number of GC Clause 14
Termination
In the event of termination of the contract due to any reason as already defined in the General Conditions of Contract, the Bidder shall be responsible for providing to the Authority the Services till the time of alternate arrangements.
Number of GC Clause 16
Conflict of Interest:
The Procuring Agency reserves the right to determine on a case-by-case basis whether the Bidder should be disqualified from providing services due to a conflict of a nature described in Clause GCC C2.
Number of GC Clause 20
Liquidated Damages
If the Bidder fails to provide services as required under the contract or in case of any data loss/data breach or any incident compromising the data security or other such failures related to any services, the Bidder shall pay to the Procuring Agency as Liquidated Damages at a rate of 0.05% to 15.00% of the Contract value, in accordance with the extent of performance failure & the cost of investigating such incidents as judged by the Authority.
Number of GC Clause 21
Performance Guarantee:
The amount of performance guarantee shall be 0% of the contract price in acceptable form of Nil
Number of GC Clause 27
Currency of Payment:
All the payment to be released to the contractor/Bidder shall be in Pakistani Rupees.
Number of GC Clause F
Payment terms:
Payment will be made to the Bidder against the procured Goods and services according to the actual invoice or running bills submitted by the Bidder against the services provided within the time given in the conditions of the contract.
Number of GC Clause F
Identifying Defects:
The Authority reserves the right at any time to inspect the premises of the provider to inspect the goods and monitor the goods being provided.
For being Brand New, bearing relevant reference numbers of the equipment (Certificate from supplier)
For Physical Fitness having No Damages (Certificate from supplier)
For the Country of Origin as quoted by the Supplier (Certificate from manufacturer)
For conformance to specifications and performance parameters, through Prior to delivery inspection (Inspection Report by Procurement Committee / Inspection Team)
For successful operation at site after complete installation, testing and commissioning of the equipment (Installation, Testing and Commissioning Report by Procurement Committee / Inspection Team)
Copies of the Supplier’s invoice showing Goods’ description, quantity, unit price, and total amount;
Original and two copies of the usual transport document (for example, a negotiable bill of lading, a non-negotiable sea waybill, an inland waterway document, an air waybill, a railway consignment note, a road consignment note, or a multimodal transport document) which the buyer may require to take the goods;
Copies of the packing list identifying contents of each package;
Insurance Certificate;
Manufacturer’s or Supplier’s Valid Warranty Certificate;
Inspection Certificate issued by the Nominated Inspection Agency (if any), and the Supplier’s Factory Inspection Report;
Certificate of Origin.
The above documents would be required even if the equipment has already been imported and is available with the supplier ex-stock
Number of GC Clause F 5 & 6
Following is the guidance for Dispute Resolution
Notwithstanding any reference to the arbitration herein, the parties shall continue to perform their respective obligations under the Contract unless they otherwise agree that the Authority shall pay the Bidder any monies due to the Bidder.
Arbitrator’s fee:
The fee shall be specified in Pak Rupees, as determined by the Arbitrator, which shall be shared equally by both parties.
Appointing Authority for Arbitrator:
By the Mutual Consent or in accordance with the provisions of Arbitration Act, 1940, in case the parties fail to reach a consensus on the name of sole arbitrator, any party may submit an application to the Chief Justice Islamabad High Court for appointment of sole arbitrator. The Chief Justice IHC may appoint a former judge of any High Court or Supreme Court as the sole arbitrator to resolve the dispute between the parties.
Rules of procedure for arbitration proceedings:
Any dispute between the Authority and a Bidder who is a national of the Islamic Republic of Pakistan arising in connection with the present Contract shall be referred to adjudication or arbitration in accordance with the laws of the Islamic Republic of Pakistan including Arbitration Act 1940, however above provision shall prevail in referring the case to the Arbitrator.
Place of Arbitration and Award:
The arbitration shall be conducted in English language and place of arbitration shall be at Islamabad. The award of the arbitrator shall be final and shall be binding on the parties.
Date: [insert date (as day, month and year)]
Bid No.:P119398
To: Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director Constitution Avenue, Sector G-5., Islamabad Capital Territory
We, the undersigned, declare that:
We understand that, according to your conditions, Bids must be supported by a Bid Securing Declaration.
We accept that we will be blacklisted and henceforth cross debarred for participating in respective category of public procurement proceedings for a period of (not more than) six months, if fail to abide with a bid securing declaration, however without indulging in corrupt and fraudulent practices, if we are in breach of our obligation(s) under the Bid conditions, because we:
We understand this Bid Securing Declaration shall expire if we are not the successful
Bidder, upon the earlier of (i) our receipt of your notification to us of the name of the successful Bidder; or (ii) twenty-eight (28) days after the expiration of our Bid.
THIS AGREEMENT made the _____ day of __________ 20_____ between Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director Constitution Avenue, Sector G-5., Islamabad Capital Territory
(hereinafter called “the Procuring Agency”) of the one part and [name of Bidder] of [city and country of Bidder] (hereinafter called “the Bidder”) of the other part:
WHEREAS the Procuring Agency invited Bids for provision of goods, viz., Cyber Security Services (P119398) and has accepted a Bids by the Bidder for the provision of Goods in the sum of [contract price in words and figures] (hereinafter called “the Contract Price”).
NOW THIS CONTRACT WITNESSETH AS FOLLOWS:
1. In this Contract words and expressions shall have the same meanings as are respectively assigned to them in the Conditions of Contract referred to.
2. The following documents shall be deemed to form and be read and construed as part of this Contract, In the event of any ambiguity or conflict between the Contract Documents listed below, the order of precedence shall be the order in which the Contract Documents are listed below:-
3. In consideration of the payments to be made by the Procuring Agency to the Bidder as hereinafter mentioned, the Bidder hereby covenants with the Procuring Agency to provide the Goods related services and to remedy defects therein in conformity in all respects with the provisions of the Contract.
4. The Procuring Agency hereby covenants to pay the Bidder in consideration of the provision of Goods and the remedying of defects therein, the Contract Price or such other sum as may become payable under the provisions of the contract at the times and in the manner prescribed by the contract.
IN WITNESS whereof the parties hereto have caused this Contract to be executed in accordance with their respective laws the day and year first above written.
Signed, sealed, delivered by __________________the ________________ (for the Procuring Agency)
Witness to the signatures of the Procuring Agency:
………………………………………………
Signed, sealed, delivered by __________________the ________________ (for the Procuring Agency)
Witness to the signatures of the Bidder: …………………………………………………
Contract Number: Contract Value: Contract Title:
Dated:
[Name of Supplier] hereby declares that it has not obtained or induced the procurement of any contract, right, interest, privilege or other obligation or benefit from Government of Pakistan or any administrative subdivision or agency thereof or any other entity owned or controlled by it (GoP) through any corrupt business practice.
Without limiting the generality of the foregoing [Name of Supplier] represents and warrants that it has fully declared the brokerage, commission, fee etc. paid or payable to anyone and not given or agreed to give and shall not give or agree to give to anyone within or outside Pakistan either directly or indirectly through any natural or juridical person, including its affiliate, agent, associate, broker, consultant, director, promoter, shareholder, sponsor or subsidiary, any commission, gratification, bribe, finder's fee or kickback, whether described as consultations fee or otherwise, with the object of obtaining or inducing the procurement of a contract, right, interest, privilege or other obligation or benefit in whatsoever form from GoP, except that which has been expressly declared pursuant hereto.
[Name of Supplier] certifies that it has made and will make full disclosure of all agreements and arrangements with all persons in respect of or related to the transaction with GoP and has not taken any action or will not take any action to circumvent the above declaration, representative or warranty.
[Name of Supplier] accepts full responsibility and strict liability for making and false declaration, not making full disclosure, misrepresenting fact or taking any action likely to defeat the purpose of this declaration, representation and warranty. It agrees that any contract, right interest, privilege or other obligation or benefit obtained or procured as aforesaid shall, without prejudice to any other right and remedies available to GoP under any law, contract or other instrument, be voidable at the option of GoP.
Notwithstanding any rights and remedies exercised by GoP in this regard, [Name of Supplier] agrees to indemnify GoP for any loss or damage incurred by it on account of its corrupt business practices and further pay compensation to GoP in an amount equivalent to ten time the sum of any commission, gratification, bribe, finder's fee or kickback given by [Name of Supplier] as aforesaid for the purpose of obtaining or inducing the procurement of any contract, right, interest, privilege or other obligation or benefit in whatsoever form from GoP.
To: Ministry of Foreign Affairs (Ministry of Foreign Affairs (MOFA)), Deputy Director Constitution Avenue, Sector G-5., Islamabad Capital Territory
WHEREAS [name of Bidder] (hereinafter called “the Bidder”) has undertaken, in pursuance of Contract No. [reference number of the contract] dated [insert date] for provision of Goods(hereinafter called “the Contract”).
AND WHEREAS it has been stipulated by you in the said Contract that the Bidder shall furnish you with a Bank Guarantee by a reputable bank for the sum specified therein as security for compliance with the Bidder’s performance obligations in accordance with the Contract.
AND WHEREAS we have agreed to give the Bidders guarantee:
THEREFORE, WE hereby affirm that we are Guarantors and responsible to you, on behalf of the Bidder, up to a total of [amount of the guarantee in words and figures], and we undertake to pay you, upon your first written demand declaring the Bidder to be in default under the Contract and without cavil or argument, any sum or sums within the limits of [amount of guarantee] as aforesaid, without your needing to prove or to show grounds or reasons for your demand or the sum specified therein.
This guarantee is valid until the: [insert date]
Signature and seal of the Guarantors
_____________________________________________________________________
[name of bank or financial institution]
_____________________________________________________________________
[address]
_____________________________________________________________________
[date}
Â