Mod Sectt Establishment Vulnerability & Penetration Testing Tender in Defence Sector, Web App Security (OWASP Top 10) 2026

Tender Overview

Mod Sectt Establishment of the Department Of Defence invites bids for Vulnerability and Penetration Testing - Web Application services, including application security audit (OWASP Top 10), Malware Analysis, and Pre-hosting assessment of applications. The scope covers ethical hacking, vulnerability addressing, and a plug-in solution recommendation. The contract contemplates service provision with on-site support, and a potential quantity/duration adjustment up to 25% at the time of issue and post-issue. The bidder must demonstrate the ability to operate within the consignee’s state through an accredited service presence. No BOQ items are listed, indicating a broad security testing framework rather than commodity goods.

Technical Specifications & Requirements

• Scope: Web application security testing and risk assessment aligned to OWASP Top 10.
• Services: Vulnerability assessment, penetration testing, malware analysis, and pre-hosting evaluation of applications prior to deployment.
• Deliverables: Plug-in solution recommendation for existing infra and mitigation plan addressing identified findings.
• Compliance: On-site service capability with a dedicated escalation matrix; service provider office must be located in the state of the consignee.
• Documentation: Required to provide technical compliance and escalation details; no itemized BOQ present.
• Additional controls: Joint liability with assignee/sub-contractor for contract performance; contractor shall not assign or subcontract without prior written consent.

Terms, Conditions & Eligibility

• Quantitative flexibility: Up to 25% variation in contract quantity or duration, with acceptance of revised terms.
• Procurement sensitivity: No assignment or subcontracting without prior consent; ultimate liability remains with the bidder.
• Financial health: Bidder must declare absence of liquidation/bankruptcy; upload undertaking with bid.
• Certifications: Upload all certificates/documents requested in the Bid document/ATC/Corrigendum; ensure presence of OEM authorizations if applicable.
• Local presence: Office of service provider must be in the state of the consignee; escalation matrix required for service support.