Web Hosting, Email Services, Disaster Recovery and Security Solutions by Pakistan Ordnance Factories

Pakistan Ordnance Factories invites pre-qualification proposals from eligible and experienced vendors for the provision of dedicated web hosting, email services, disaster recovery, web application security, email protection and anti-spam solutions. The scope encompasses secure, scalable web hosting with 99.9% uptime SLA, support for PHP and MySQL-based applications on Linux Ubuntu servers, full-featured control panels, secure FTP and SSH access, dedicated resources or VPS hosting, reliable IMAP/POP3/SMTP email hosting with spam and malware protection, centralized email administration dashboards, Web Application Firewall deployment against OWASP Top 10 vulnerabilities, comprehensive DDoS protection and bot management with integrated CDN support, intelligent load balancing with real-time monitoring, automated SSL certificate management, email anti-spam and anti-virus filtering with domain-based authentication, regular automated and manual backups with version control and snapshot recovery, disaster recovery mechanisms with geo-redundant failover capabilities, centralized security monitoring and alerting systems, and LogRhythm SIEM solution for security threat detection and compliance reporting. This procurement is based in Punjab, Pakistan.

Eligible vendors must demonstrate a minimum of three years experience with at least three firms in providing web hosting, email services and cybersecurity solutions. Applicants must present a proven track record with at least five similar projects, preferably in the public sector, evidence of qualified technical staff and established support infrastructure, demonstrated financial capability with annual turnover details for the last three years, and full compliance with GDPR and relevant local data protection regulations. Vendors must possess valid ISO/IEC 27001:2022 Information Security Management, ISO/IEC 27017:2015 Security Controls for Cloud Services, and ISO/IEC 27018:2019 Protection of Personal Data in Cloud Computing certifications. Robust data backup, redundancy and disaster recovery capabilities are mandatory. Pakistan-based data center infrastructure ensuring local data residency is mandatory; firms hosting servers or data centers outside Pakistan will be disqualified. Vendors must provide 24/7 technical support via multiple channels with clearly defined SLAs, dedicated account management and on-demand consultancy. Security clearance by POF Security Agencies is required, based on owner complete profile, CNIC copies, owner bio data and assets details, Police Verification on firm and owner, and valid PTC Punjab, ATL and NTN certificates.

Bid documents and submission instructions have not been specified in this pre-qualification notice. The first year price will be as per financial bid, while second and third year prices will be adjusted based on official USD/PKR exchange rates notified by Government of Pakistan at the time of annual review. Service providers must ensure minimum 99.9% monthly uptime for web hosting and corporate email services with 24/7 technical support. Financial penalties and service credits may be imposed for failure to meet agreed service levels, excluding scheduled maintenance with advance notice, force majeure events, or disruptions beyond the service provider's reasonable control.

POFs seeks qualified vendors for comprehensive IT infrastructure services spanning web hosting, email, disaster recovery and security across a three-year contract. This is a pre-qualification phase; successful vendors proceed to formal tendering. The scope is substantial and technical, requiring ISO 27001/27017/27018 certifications and Pakistan-based data centers—a significant constraint eliminating international-only providers. The 99.9% uptime SLA and 24/7 support requirements indicate mission-critical services. No bid security or financial scale mentioned at this stage; pricing is indexed to PKR/USD rates in years two and three.

Who can bid: Typically, IT service providers must be registered with SECP (as private limited or equivalent), hold valid NTN and PTC certificates, and demonstrate financial stability. This notice explicitly requires ISO 27001:2022, ISO 27017:2015, and ISO 27018:2019 certifications, three years experience with three firms, five similar public-sector projects, and Pakistan-based data center infrastructure. Security clearance by POF agencies with Police Verification is mandatory. Non-Pakistani data center hosting results in automatic disqualification.