Â
7. In terms of Rules 48 of Public Procurement Rules, 2004 Grievance Redressal Committee (GRC) is notified for the subject procurement and notification copy is available on the procuring agency’s website and also available on EPADS v2.0 as well as Authority’s website at (www.ppra.org.pk).
Â
National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager
5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
+92-321-400-4044
muhammad.asif@ndrmf.pk
The following specific data for the procurement of Goods to be procured shall complement, supplement, or amend the provisions in the Instructions to Bidders (ITB). Whenever there is a conflict, the provisions herein shall prevail over those in ITB.
BDS Clause Number
ITB Number
Amendments of, and Supplements to, Clauses in the Instruction to Bidders
BDS Clause Number 1
ITB Number 1.1
Name of Procuring Agency:Â National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF))
The subject of procurement is:Â Hiring of Services for Vulnerability Assessment & Penetration Testing (VAPT) Services
Expected commencement date: Monday, June 8, 2026
BDS Clause Number 2
ITB Number 2.1
Financial year for the operations of the Procuring Agency:Â 2025-26
Name and identification number of the Contract: P24350Â
BDS Clause Number 3
ITB Number 4.6
JV/Consortium or Association Allowed: No
Number of JV/Consortium Members: Nil
BDS Clause Number 4
ITB Number 7.1
The Bidders may seek clarifications through EPADS v2.0: Clarification Date: Monday, May 18, 2026
BDS Clause Number 5
ITB Number 8.1
Any addendum, in case issued, shall be published on National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)) website and on EPADS v2.0.
BDS Clause Number 6
ITB Number 9.1
List of documents required along with the bid:
BDS Clause Number 7
ITB Number 11.1
The qualification criteria to establish the supply / production capability of the bidder.
see Eligibility Criteria
BDS Clause Number 8
ITB Number 7.6
Services and Their related documents:
See section Required Services and Scope of Work
BDS Clause Number 9
ITB Number 13.1 & 13.2
Price schedule will be provided according to the format defined and acquired.
see section price schedule.
BDS Clause Number 10
ITB Number 7.6.2
 Specifications:
see section of specifications.
BDS Clause Number 11
ITB Number 13.5
The price shall be Fixed.
BDS Clause Number 12
ITB Number 15.1
Currency of the Bids shall be : PKR
BDS Clause Number 13
ITB Number 16.1
The Bids/Bid Validity period shall be: 90 Days
BDS Clause Number 14
ITB Number 17.1
The amount of Bid Security shall be as defined in Bid Security Section for items and lots given in BDS 6
The Bid Security shall be in the form of: Others Â
BDS Clause Number 15
ITB Number 17.3
The Bids security shall be valid for twenty-eight (28) days beyond the expiry of the Bids validity period specified in the bidding documents,  for example the bid validity is 180 days so the bid security shall be valid for  180+28 = 208 days.
BDS Clause Number 16
ITB Number 18.1
Alternative Bids to the requirements of the bidding documents will not be permitted.
BDS Clause Number 17
ITB Number 21.1
Bid shall be submitted online on EPADS v2.0 whereas hard copy of the bid security should be submitted to the following;
5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
Bids that are not submitted on EPADS v2.0 shall be disqualified.
The deadline for Bids submission is: Thursday, May 21, 2026 10:00 AM
BDS Clause Number 18
ITB Number 26.1
The Bids opening shall take place on EPADS v2.0.
Day : Thursday
Date:Â Thursday, May 21, 2026
Time : 10:30 AM
BDS Clause Number 19
ITB Number 32.1
Selection technique adopted will be: Least Cost Based Selection (LCBS)
see Evaluation Criteria
BDS Clause Number 20
ITB Number 49.1
The Performance guarantee shall: 5.00%.
The Performance Guarantee shall be acceptable in the form of:Â Banker's Cheque, Call at Deposit, Bank Guarantee, Demand Draft
21.
51.1
Arbitrator shall be appointed by mutual consent of the both parties.
BDS Clause Number 22
ITB Number 53.1
Grievence against this procurement shall be submitted online on EPADS v2.0.
| Bidder's Type | Required Registration |
|---|---|
|
Any |
FBR (NTN) FBR (GSTN) |
| Eligibility Criteria | Document |
|---|---|
| a) Bidder must be registered with Income & sales Tax Departments and on ATL status, [Documentary proof shall be attached with proposal], | Yes |
| b) Bidder must have proper Business Location/setup and telephone facility, [Documentary proof shall be attached with proposal], | Yes |
| c) Bidder has not been blacklisted by any of Provincial or Federal Government Department, Agency, Organization or Autonomous body or Private Sector Organization anywhere in Pakistan (submission of undertaking), | Yes |
| d) Bidders must have at least three (03) successful completion of similar IT Services in last five years. The bidder(s) must provide copies of supply orders/contracts, completion certificate(s) to establish the required experience. | Yes |
| e) Bidder must have minimum 3 x certified professionals with anyone of the certifications (OSCP, CEH, OSWE, CISSP, GPEN, ISO 27001 or any other equivalent certification). [Documentary proof in form CVs and Certification credentials to attached with proposal.] | Yes |
| f) Bidder must be ISO 27001 certified [Documentary proof shall be attached with proposal]. | Yes |
| g) Bidder must submit Work plan and methodology for this VAPT assignment [Documents shall be attached with proposal]. | Yes |
Least Cost Based Selection (LCBS)
Positions Without Lots :
| Position | Delivery Schedule | Quantity | Bid Security |
|---|---|---|---|
| Vulnerability Assessment & Penetration Testing (VAPT) Services, complete in all respect as per scope of work/service |
Address: 5th Floor, EOBI House, G-10/4., Islamabad Capital Territory Schedule: within 90 days following signing of contract agreement Quantity: 1 |
1 | 0 |
No
Positions Without Lots :
Position: Vulnerability Assessment & Penetration Testing (VAPT) Services, complete in all respect as per scope of work/service
Specifications / Requirements:
As per Scope of Work/Service of the Bidding DocumentThe National Disaster Risk Management Fund (NDRMF) invites qualified and experienced cybersecurity service providers to submit proposals for conducting comprehensive Vulnerability Assessment and Penetration Testing (VAPT) across its IT infrastructure, applications, and systems.
The objective of this engagement is to identify security weaknesses, evaluate the current security posture, and recommend mitigation strategies to safeguard NDRMF's digital assets and sensitive information.
NDRMF has two data centers (Primary and Secondary), based in Islamabad. Addresses are as under: -
Primary Data Center Address: 1st Floor SINES Building, H-12 Campus, NUST
Secondary Data Center Address: 5th Floor EOBI house G-10/4, Islamabad.
Â
The Service Provider will conduct VAPT on the following components:
| S.No. | Scope Item | Quantity | Details |
|---|---|---|---|
| 1 | Web/Mobile Applications | 1 |
natcat.ndrmf.pk, careers.ndrmf.pk, sap.ndrmf.pk, v2-natcat.ndrmf.pk, dashboards.ndrmf.pk |
| 2 | Network Devices (Routers, Switches, Firewalls etc | 12 |
WLC (2) and APs (10) |
| Â | Â | 14 |
Switches |
| Â | Â | 3 | Routers |
| Â | Â | 3 | Firewalls |
| Â | Â | 10 | Miscellaneous Devices |
| 3 | Servers (Linux/Windows) | 15 |
High Critical Server Machines |
| Â | Â | 5 | Web Servers |
| Â | Â | 1 |
Email Server (MS Office 365) |
| Â | Â | 5 | Application Servers |
| Â | Â | 5 | DB Servers |
| Â | Â | 1 | Active Directory |
| 4 | Host (End Users) | 35 | End users Laptops |
The Service Provider must follow structured methodologies:
The Service Provider must:
The Service Provider shall provide the following:
6.1 Pre-Engagement Documents
6.2 VAPT Reports
6.3 Post-Testing Deliverables
7. Timeline
Assignment shall be completed within 3 months following signing of contract agreement.
8. Payment
Hundred (100) percent payment against the services delivered, received and accepted, shall be made within Thirty (30) days of submission of claim supported by a copy of the General Sales Tax (GST) invoice showing the amount of sales tax have been submitted along with the invoice, supplemented by deliverables reports & certificates. Incase GST is not applicable on the Services to be procured, the supplier shall provide documentary evidence to the said effect.
For Individual Positions
| # | Position Title | Quantity | Unit Price (PKR) | Total Price (PKR) | Delivery Location | Delivery Period / Year | Country of Origin |
|---|---|---|---|---|---|---|---|
| 1 | |||||||
| 2 |
| # | Lot Title | Total Lot Price (PKR) | Country of Origin |
|---|---|---|---|
| 1 | [Lot 1 Title] |
The following Special Conditions of Contract shall supplement the General Conditions of Contract. Whenever there is a conflict, the provisions herein shall prevail over those in the Conditions of Contract. The corresponding clause number of the GCC is indicated in parentheses.
Number of GC Clause
Amendments of, and Supplements to, Clauses in the General Conditions of Contract
Definitions
The Procuring Agency is: National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager 5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
The Supplier is:
The title of the subject procurement is:Hiring of Services for Vulnerability Assessment & Penetration Testing (VAPT) Services
Number of GC Clause 2
Applicable/Governing Law:
The Contract shall be interpreted in accordance with the laws of Islamic Republic of Pakistan
Number of GC Clause 3
Language:
The language of the Contract, all correspondence and communications to be given, and all other documentation to be prepared and supplied under the Contract shall be in English.
Number of GC Clause 4
Notices:
The addresses for the notices are:
Procuring Agency:Â
National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager
5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
+92-321-400-4044
muhammad.asif@ndrmf.pk
Contractor/ Bidder:Â
 [Name, address and telephone number].
The Contractor/ Bidder’s Representative(s)
[Name, address, telephone number and e-mail address]
Number of GC Clause 6.1
The Authorized Representatives are:
For the Procuring Agency:
National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager
5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
+92-321-400-4044
muhammad.asif@ndrmf.pk
For the Bidder:
Name: ………………………
Designation: ……………..
Address: ……………………………..
Number of GC Clause 7
Effectiveness of the contract
The Contractor/Bidder shall be effective within ….. days from the date of signature of the Contract by both parties
Number of GC Clause 8
Commencement of Contract:
The Contractor/ Bidder shall provide Non-Consultancy Services from the effective date of contract.
Number of GC Clause 10.2
Expiration of Contract:
The time period shall be ………………….
Number of GC Clause 14
Termination
In the event of termination of the contract due to any reason as already defined in the General Conditions of Contract, the Bidder shall be responsible for providing to the Authority the Goods till the time of alternate arrangements.
Number of GC Clause 16
Conflict of Interest:
The Procuring Agency reserves the right to determine on a case-by-case basis whether the Bidder should be disqualified from providing goods or services due to a conflict of a nature described in Clause GCC 17.
Number of GC Clause 20
Liquidated Damages
If the Bidder fails to provide services as required under the contract or in case of any data loss/data breach or any incident compromising the data security or other such failures related to any services, the Bidder shall pay to the Procuring Agency as Liquidated Damages at a rate of 0.10% to 5.00%Â of the Contract value, in accordance with the extent of performance failure & the cost of investigating such incidents as judged by the Authority.
Number of GC Clause 21
Performance Guarantee:
The amount of performance guarantee shall be 5.00%Â of the contract price in acceptable form of Banker's Cheque, Call at Deposit, Bank Guarantee, Demand Draft
Number of GC Clause 27
Currency of Payment:
All the payment to be released to the contractor/Bidder shall be in Pakistani Rupees.
Number of GC Clause 28
Payment terms:
Payment will be made to the Bidder against the procured Goods and services according to the actual invoice or running bills submitted by the Bidder against the services provided within the time given in the conditions of the contract.
Number of GC Clause 29
Identifying Defects:
The Authority reserves the right at any time to inspect the premises of the provider to inspect the goods and monitor the goods being provided.
As per Scope of Work/Service corresponding section
Copies of the Supplier’s invoice showing Goods’ description, quantity, unit price, and total amount;
Documents as per Scope of Work/Service Section
Number of GC Clause 31
Following is the guidance for Dispute Resolution
Notwithstanding any reference to the arbitration herein, the parties shall continue to perform their respective obligations under the Contract unless they otherwise agree that the Authority shall pay the Bidder any monies due to the Bidder.
Arbitrator’s fee:
The fee shall be specified in Pak Rupees, as determined by the Arbitrator, which shall be shared equally by both parties.
Appointing Authority for Arbitrator:
By the Mutual Consent or in accordance with the provisions of Arbitration Act, 1940, in case the parties fail to reach a consensus on the name of sole arbitrator, any party may submit an application to the Chief Justice Islamabad High Court for appointment of sole arbitrator. The Chief Justice IHC may appoint a former judge of any High Court or Supreme Court as the sole arbitrator to resolve the dispute between the parties.
Rules of procedure for arbitration proceedings:Â
Any dispute between the Authority and a Bidder who is a national of the Islamic Republic of Pakistan arising in connection with the present Contract shall be referred to adjudication or arbitration in accordance with the laws of the Islamic Republic of Pakistan including Arbitration Act 1940, however above provision shall prevail in referring the case to the Arbitrator.
Place of Arbitration and Award:
The arbitration shall be conducted in English language and place of arbitration shall be at Islamabad. The award of the arbitrator shall be final and shall be binding on the parties.
Date: [insert date (as day, month and year)]
Bid No.:P24350
To: National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager 5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
Â
Â
We, the undersigned, declare that:
We understand that, according to your conditions, Bids must be supported by a Bid Securing Declaration.
We accept that we will be blacklisted and henceforth cross debarred  for participating in respective category of public procurement proceedings for a period of (not more than) six months, if fail to abide with a bid securing declaration, however without indulging in corrupt and fraudulent practices, if we are in breach of our obligation(s) under the Bid conditions, because we:
We understand this Bid Securing Declaration shall expire if we are not the successful
Bidder, upon the earlier of (i) our receipt of your notification to us of the name of the successful Bidder; or (ii) twenty-eight (28) days after the expiration of our Bid.
Â
THIS AGREEMENT made the _____ day of __________ 20_____ between National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager 5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
 (hereinafter called “the Procuring Agency”) of the one part and [name of Bidder] of [city and country of Bidder] (hereinafter called “the Bidder”) of the other part:
Â
WHEREAS the Procuring Agency invited Bids for provision of goods, viz., Hiring of Services for Vulnerability Assessment & Penetration Testing (VAPT) Services (P24350) and has accepted a Bids by the Bidder for the provision of Goods in the sum of [contract price in words and figures] (hereinafter called “the Contract Price”).
Â
NOW THIS CONTRACT WITNESSETH AS FOLLOWS:
1.  In this Contract words and expressions shall have the same meanings as are respectively assigned to them in the Conditions of Contract referred to.
2.  The following documents shall be deemed to form and be read and construed as part of this Contract, In the event of any ambiguity or conflict between the Contract Documents listed below, the order of precedence shall be the order in which the Contract Documents are listed below:-
3.  In consideration of the payments to be made by the Procuring Agency to the Bidder as hereinafter mentioned, the Bidder hereby covenants with the Procuring Agency to provide the Goods related services and to remedy defects therein in conformity in all respects with the provisions of the Contract.
4.  The Procuring Agency hereby covenants to pay the Bidder in consideration of the provision of Goods and the remedying of defects therein, the Contract Price or such other sum as may become payable under the provisions of the contract at the times and in the manner prescribed by the contract.
Â
IN WITNESS whereof the parties hereto have caused this Contract to be executed in accordance with their respective laws the day and year first above written.
Â
Signed, sealed, delivered by __________________the ________________ (for the Procuring Agency)
Â
Witness to the signatures of the Procuring Agency:
………………………………………………
Signed, sealed, delivered by __________________the ________________ (for the Procuring Agency)
Â
Witness to the signatures of the Bidder: …………………………………………………
Â
Â
Â
Contract                          Number:  Contract                              Value:  Contract Title:
Dated:
Â
[Name of Supplier] hereby declares that it has not obtained or induced the procurement of any contract, right, interest, privilege or other obligation or benefit from Government of Pakistan or any administrative subdivision or agency thereof or any other entity owned or controlled by it (GoP) through any corrupt business practice.
Without limiting the generality of the foregoing [Name of Supplier] represents and warrants that it has fully declared the brokerage, commission, fee etc. paid  or payable to anyone and not given or agreed to give and shall not give or agree to give to anyone within or outside Pakistan either directly or indirectly through any natural or juridical person, including its affiliate, agent, associate, broker, consultant, director, promoter, shareholder, sponsor or subsidiary, any commission, gratification, bribe, finder's fee or kickback, whether described as consultations fee or otherwise, with the object of obtaining or inducing the procurement of a contract, right, interest, privilege or other obligation or benefit in whatsoever form from GoP, except that which has been expressly declared pursuant hereto.
[Name of Supplier] certifies that it has made and will make full disclosure of all agreements and arrangements with all persons in respect of or related to the transaction with GoP and has not taken any action or will not take any action to circumvent the above declaration, representative or warranty.
[Name of Supplier] accepts full responsibility and strict liability for making and false declaration, not making full disclosure, misrepresenting fact or taking any action likely to defeat the purpose of this declaration, representation and warranty. It agrees that any contract, right interest, privilege or other obligation or benefit obtained or procured as aforesaid shall, without prejudice to any other right and remedies available to GoP under any law, contract or other instrument, be voidable at the option of GoP.
Notwithstanding any rights and remedies exercised by GoP in this regard, [Name of Supplier] agrees to indemnify GoP for any loss or damage incurred by it on account of its corrupt business practices and further pay compensation to GoP in an amount equivalent to ten time the sum of any commission, gratification, bribe, finder's fee or kickback given by [Name of Supplier] as aforesaid for the purpose of obtaining or inducing the procurement of any contract, right, interest, privilege or other obligation or benefit in whatsoever form from GoP.
Â
To:     National Disaster Risk Management Fund (National Disaster Risk Management Fund (NDRMF)), Manager 5th Floor, EOBI House, G-10/4., Islamabad Capital Territory
Â
WHEREAS [name of Bidder] (hereinafter called “the Bidder”) has undertaken, in pursuance of Contract No. [reference number of the contract] dated [insert date] for provision of Goods(hereinafter called “the Contract”).
Â
AND WHEREAS it has been stipulated by you in the said Contract that the Bidder shall furnish you with a Bank Guarantee by a reputable bank for the sum specified therein as security for compliance with the Bidder’s performance obligations in accordance with the Contract.
Â
AND WHEREAS we have agreed to give the Bidders guarantee:
Â
THEREFORE, WE hereby affirm that we are Guarantors and responsible to you, on behalf of the Bidder, up to a total of [amount of the guarantee in words and figures], and we undertake to pay you, upon your first written demand declaring the Bidder to be in default under the Contract and without cavil or argument, any sum or sums within the limits of [amount of guarÂantee] as aforesaid, without your needing to prove or to show grounds or reasons for your demand or the sum specified therein.
Â
This guarantee is valid until the: [insert date]
Â
Â
Signature and seal of the Guarantors
Â
Â
_____________________________________________________________________
[name of bank or financial institution]
Â
Â
_____________________________________________________________________
[address]
Â
Â
_____________________________________________________________________
[date}
Non-Disclosure & Information Security Agreement (VAPT Services) following Clauses construe manadatory part of the Conditions of Contract.
1. Definition of Confidential Information
“Confidential Information” means all non-public information disclosed by the Procuring Agency to the Service Provider, whether in written, electronic, visual, or oral form, including but not limited to:
2. Purpose Limitation
The Service Provider shall use Confidential Information solely for the purpose of performing VAPT services under the Contract and for no other purpose whatsoever.
3. Non-Disclosure Obligation
The Service Provider shall:
4. Information Security Measures
The Service Provider shall implement industry-standard security controls, including:
5. Handling of Credentials & Access
6. Data Retention & Destruction
7. Vulnerability Disclosure Protocol
8. Incident/Breach Notification
The Service Provider shall immediately (within 24 hours) notify the Procuring Agency of:
9. Compliance with Laws & Standards
The Service Provider shall comply with:
10. Subcontracting Restrictions
11. Intellectual Property Rights
12. Term & Survival
13. Indemnity & Liability
The Service Provider shall indemnify and hold harmless the Procuring Agency against:
14. Remedies
Breach of this Agreement shall entitle the Procuring Agency to:
15. Governing Law & Jurisdiction
This Agreement shall be governed by the laws of Pakistan, and courts at [Islamabad/Relevant Jurisdiction] shall have exclusive jurisdiction.