Department Of Public Enterprises Vulnerability & Penetration Testing Tender 2026 in India - OWASP Top 10 Web Audit & Security Review
Progress
Key Highlights
- • CERT-IN empaneled agency requirement for bid eligibility
- • Security testing scope across OWASP Top 10 and malware analysis
- • No BOQ items; broad capability-driven engagement
- • 25% quantity/duration flex allowed by Buyer
- • Estimated value ₹50,000 indicating localized, specialized services
- • No explicit delivery timeline; confirm post-award expectations
- • No brand-specific mandates; focus on compliance and technical capability
Tender Overview
- Organization: Department Of Public Enterprises; Product/Service: Vulnerability and Penetration Testing, Web Application Security Audit (OWASP Top 10), Security Infrastructure Review, Data Communications and Network Control Review, Secure Configuration Review (Devices/OS), Malware Analysis.
- Estimated Value: ₹50,000; Location: Not specified; Category: Security testing and audit services.
- Tender scope centers on comprehensive cyber security assessments across web apps, networks and devices, with emphasis on OWASP Top 10 mitigation and incident readiness.
- Notable clause: bidders must be CERT-IN empaneled agencies; 25% contract quantity/duration flexibility is allowed before and after contract issuance.
- Unique point: BOQ is currently empty, signaling a broad, capability-driven engagement rather than fixed-item procurement.
- This tender requires precise security expertise and adherence to CERT-IN credentialing, ensuring audited providers meet government vetting standards.
Technical Specifications & Requirements
- Service category: Vulnerability and Penetration Testing; Key deliverables: Web application security assessment, OWASP Top 10 remediation review, security infrastructure evaluation, data communications and network control assessment, malware analysis, secure configuration reviews.
- Delivery expectations: Not specified; Standards/Certification: Not explicitly listed; however, bidder must be CERT-IN empaneled.
- Value signals: Estimated value ₹50,000; no itemized BOQ; no explicit hardware or software brand mandates.
- Scope indicators: Emphasis on cross-domain security auditing and policy alignment across IT infrastructure.
- Quality focus: Outcome-oriented security findings, risk mitigation recommendations and executive summary deliverables.
Terms, Conditions & Eligibility
- EMD: Not stated; bidders should verify payment terms at bid submission.
- Experience/Turnover: Not specified; CERT-IN empaneled status is mandatory per ATC.
- Delivery: No explicit delivery timeline published; contingency for scope adjustment exists via 25% clause.
- Payment: Not detailed in data; verify with terms during procurement.
- Documents: Submit CERT-IN empanelment proof, technical bid, GSTIN, PAN, and prior security testing certificates.
- Warranty/Penalties: Not specified; review post-award for service-level expectations.
- This procurement targets specialized security testing firms with government credentials and vetted capabilities.
Key Specifications
-
Security testing category: Vulnerability and Penetration Testing for web applications
-
Audit scope includes: OWASP Top 10, Security Infrastructure Review, Data Communications and Network Control Review
-
Additional reviews: Secure Configuration Review (Devices/OS) and Malware Analysis
-
Engagement must be performed by a CERT-IN empaneled agency
-
No fixed BOQ items; flexible, capability-driven deliverables
Terms & Conditions
-
CERT-IN empanelment is mandatory for bid submission
-
contract quantity/duration may be adjusted by 25% before issuance
-
BOQ is not provided; bidders must demonstrate capability to cover broad security audit scope
Important Clauses
Payment Terms
Details on payment timing and milestones to be clarified in final contract; no explicit terms in data.
Delivery Schedule
No explicit deadline; flexibility exists with 25% scope/duration adjustment prior to contract issuance.
Penalties/Liquidated Damages
Not disclosed in available data; verify post-award and include SLA penalties if applicable.
Bidder Eligibility
-
Must be CERT-IN empaneled agency
-
Proven experience in web application security testing
-
Demonstrated capability for OWASP Top 10 remediation reporting
Tender Data
Bid Details
Quantity
1
Bid Type
Two Packet Bid
Bid Validity
180 (Days)
Bid Type
Service
Evaluation
Total value wise evaluation
Tech Clarification Time
3 Days
Preference & Exemptions
EMD Required
No
MII Compliance
Yes
MSE Purchase Preference
Yes
MSE Preference Band
L1+15%
MSE Exemption/Relaxation
Yes
Startup Exemption/Relaxation
No
Bid Splitting Applied
No
Requirements
Experience Required
3 Year (s)
Arbitration Clause
No
Mediation Clause
No
Additional Tender Data
Commercial Details
Tender Category
Service
Bid To RA
No
Bid To RA Enabled
No
Item Category
Vulnerability and Penetration Testing - Web Application; Application Security Audit (OWASP Top 10), Security Infrastructure Review, Data Communications and Network Control Review, Secure Configuration Review (Devices/OS), Malware Analysis, Security C..
Advisory Bank
State Bank of India
ePBG Percentage
3%
ePBG Duration (Months)
6
Delivery Details
Delivery Locations
1
Delivery Cities
Lodhi Road
Delivery Locations
| Consignee | Address | City | State | Pincode | Quantity | Delivery Days | Additional Requirement |
|---|---|---|---|---|---|---|---|
| Nitin Kumar | Enterprises Bhawan, Block No. 14, CGO Complex, Lodhi Road | Lodhi Road | - | - | Lumpsum Based | - | - |
Authority Records
BID & GeM Expert Consultancy
End-to-end support — bid preparation, GeM registration, document filing & compliance by industry experts.
Free consultation · 24h response
Documents 5
GeM-Bidding-10021372.pdf
Main Document
Other Documents
OTHER
Other Documents
OTHER
GEM General Terms and Conditions Document
GEM_GENERAL_TERMS_AND_CONDITIONS
GEM General Terms and Conditions Document
GEM_GENERAL_TERMS_AND_CONDITIONS
Categories
5
🤖 AI-Powered Bidder Prediction
Discover companies most likely to bid on this tender
Required Documents
GST registration certificate
Permanent Account Number (PAN) card
CERT-IN empanelment proof (as uploaded in bid documents)
Experience certificates for similar security testing projects
Financial statements or solvency certificate (as required)
Technical bid detailing methodology for OWASP Top 10 assessments
OEM authorizations or security tool licenses (if applicable)
Any prior audit reports or security compliance certificates
Frequently Asked Questions
Key insights about DELHI tender market
How to bid in the vulnerability testing tender in India 2026?
Bidders must be CERT-IN empaneled agencies and submit technical bids with OWASP Top 10 methodology, proof of empanelment, GSTIN, PAN, and experience certificates. The engagement covers web app audits, malware analysis, and network reviews; confirm any additional documents at bid submission.
What documents are required for the security testing bid in India?
Submit GST registration, PAN, CERT-IN empanelment proof, experience certificates for security testing, financial statements, technical bid detailing testing methodology, and OEM authorizations or tool licenses if applicable. Ensure certificates are current and match the bid scope.
What are the technical specifications for the OWASP Top 10 audit?
The bidder must perform comprehensiveOWASP Top 10 assessments across web applications, including risk ratings, remediation guidance, and evidence-based reporting. Deliverables should include executive summaries, remediation plans, and validated test results aligned with industry best practices.
When is the bid submission deadline for this tender in 2026?
The available data does not specify a deadline; verify the procurement portal listing for the latest submission date and ensure all CERT-IN documentation, technical methodology, and financials are ready before the stated closing time.
What are the payment terms for the security procurement contract?
Payment terms are not listed in the provided data; bidders should await the final contract for milestone-based payments, typical government norms may include milestone payments upon acceptance of deliverables and final payment after successful certification.
What is the scope of services in this vulnerability testing bid?
Scope includes web application vulnerability testing, OWASP Top 10 security audit, security infrastructure review, data communications and network control review, secure configuration review for devices/OS, and malware analysis; BOQ is not provided, so deliverables should cover all listed areas.
What qualifies as CERT-IN empanelment proof for submission?
Provide official CERT-IN empanelment certificate or listing, validity dates, and scope of authorization. Upload scanned copies in bid documents and ensure the empanelment matches the service domain of security testing and audit.
Which organization is procuring the security testing services in 2026?
The Department Of Public Enterprises is seeking vulnerability testing and security auditing services, including OWASP Top 10 and malware analysis, with an estimated value of ₹50,000; the bid requires CERT-IN empaneled agencies and capability-based proposals.