Controller General Of Defence Accounts Vulnerability Testing Tender 2025 in India - Mobile/Web/IoT Security Audit with CERT-In Empanelment

Tender Overview

Controller General Of Defence Accounts invites bids for comprehensive vulnerability and security testing across mobile applications, web applications, network, and IoT devices with services including security code review, malware analysis, and OWASP Top 10 oriented audits. The opportunity includes an EMD of ₹20,000 and a flexible contract window allowing up to 25% changes in quantity or duration before and after contract award. Bidders must be CERT-In empanelled for the required goods/services, and the bid process enforces submission of specific certificates and past-experience proof. The absence of BOQ items implies a service-grade assessment rather than a fixed-item purchase, emphasizing capability and compliance over unitized quantities. This tender targets security service firms capable of cross-domain testing and incident analysis for defence-related software and devices. Knowledge of service delivery and payroll compliance in a defence procurement context will be advantageous.

Technical Specifications & Requirements

• Focus areas include: Vulnerability and Penetration Testing for Mobile apps, Web apps, Network, and IoT devices; Security Code Review; Malware Analysis; Application Security Audit (OWASP Top 10); Secure Configuration Review for devices/OS; and Data Communications security.
• As no explicit technical specs are published, emphasis is on demonstrable capability in multi-domain security testing, risk assessment, and reporting aligned to defence standards.
• Emphasize: mandatory CERT-In empanelment; experience proof via contracts, execution certificates, or client attestations; flexible invoicing with excess settlement provisions.

Terms, Conditions & Eligibility

• EMD: ₹20,000.
• Eligibility entails CERT-In empanelment on bid opening date.
• Contractors must provide past-project proof via contract-invoice self-certification, client execution certificates, or third-party notes.
• Payment terms align with defence procurement norms; salaries of personnel deployed at the buyer site must be paid by the service provider, with subsequent reimbursement.
• Contractual flexibility allows up to 25% changes in quantity/duration pre- and post-award.
• Non-submission of required certificates/documents can lead to rejection; adherence to buyer-added terms is mandatory.