Indian Army VAPT & Security Audit Tender 2026 - CERT-I Based Assessment, Security Infrastructure Review, OWASP Top 10 - 224200 2026

Tender Overview

The Indian Army, Department Of Military Affairs, invites bids for Vulnerability and Penetration Testing (VAPT) of Certifying Authority systems, security infrastructure review, data communications and network control review, secure configuration review (devices/OS), and application security audit (OWASP Top 10) with malware analysis. The project carries an estimated value of ₹224,200. Bidders must have a local service presence in the consignee state and demonstrate prior VAPT experience in armed forces CERT-I guidelines. A dedicated service desk is required, along with an escalation matrix and documented evidence of nearest office location. The scope emphasizes certified security assessments, incident readiness, and adherence to CERT-I protocols.

Technical Specifications & Requirements

• Organization: Indian Army (Department Of Military Affairs). Product category focuses on VAPT and security assessments incl. Certifying Authority reviews, network and application security, malware analysis.
• Experience requirements: At least one VAPT engagement conducted for armed forces CERT-I guidelines; local office in consignee state; service support availability via toll-free/dedicated lines.
• Documentation & certificates: Submission of Malicious Code Certificate asserting no embedded malicious code; explicit attestations on software/hardware integrity and IP rights compliance.
• Delivery & support: Dedicated support line, escalation matrix, and evidence of an on-ground service provider within the buyer’s state; adherence to security and privacy norms during testing.
• Value & scope: Estimated contract value ₹224,200; no BOQ items listed; emphasis on compliance with CERT-I standards and secure configuration reviews.

Terms, Conditions & Eligibility

• EMD/financial standing: Bidder must not be under liquidation or bankrupt; must upload an undertaking.
• Malicious code certificate: Required certificate confirming absence of embedded malicious code and IP rights breach avoidance.
• Service & support: Toll-free dedicated service number and escalation matrix mandatory.
• Geographic condition: Service provider must be located in the buyer’s state; documentary evidence required.
• Compliance: Prior VAPT at armed forces certification authority per CERT-I guidelines; adherence to security protocols during testing.