Tender Details
Description / Scope of Work
Pakistan State Oil Company Limited (PSO) is requesting quotations for engagement of a third-party cybersecurity firm to conduct Vulnerability Assessment and Penetration Testing (VAPT) and comprehensive security review across the company's operational technology (OT) environment. The scope covers three primary locations: Faisalabad, Keamari (KTA), and Machike, in Sindh province. The engagement encompasses VAPT of all OT-connected PCs and servers using OT-safe methodologies, application security review of SCADA systems, TAS, PLC, SAP OT integration middleware, and Fuel FACs, evaluation of OT network architecture and IT/OT segregation, physical and environmental security review of OT systems, and assessment across four layers including field and control devices, OT-hosted PCs and servers, applications, and network infrastructure. The VAPT scope is structured across two layers: Layer 1 covering OT-hosted PCs, servers, engineering and operator workstations, and Layer 2 covering network infrastructure including Layer 2/3 switches, firewalls for OT/IT segmentation, routers, and wireless RFID transmission networks.
Vendors must demonstrate proven experience performing IT/OT reviews and VAPT in accordance with globally recognized standards and industry best practices. Eligible vendors should possess relevant cybersecurity certifications, established track record in OT security assessments, and capability to develop comprehensive activity schedules. Typical requirements include vendor registration with relevant authorities, compliance with Pakistani procurement regulations, and submission of technical qualifications alongside financial proposals. The notice specifies earnest money and PO/DD requirements, though exact amounts are to be filled by bidders.
Quotations are required by 02.10.2026. Bid documents should include detailed methodology aligned with the provided annexure, activity schedule for testing and review, and evidence of relevant experience. Deliverables specified include prioritized reports categorized by criticality, remediation roadmap with actionable recommendations, baseline configuration standard review, and closing presentation to PSO management. Interested firms should contact PSO House, Khayaban-e-Iqbal, Clifton, Karachi for complete tender documents and clarifications.
For Bidders: Our Analysis PAKISTANTENDER INSIGHT
Independent analysis by PakistanTender — not part of the official notice. Always confirm details against the original tender document.
PSO seeks a specialized cybersecurity vendor for multi-location OT security assessment covering VAPT and baseline reviews at Faisalabad, Keamari, and Machike facilities.
The engagement is substantial in scope, spanning PCs, servers, SCADA systems, network infrastructure, and physical security across four assessment layers. This is a one-time engagement with tight deadline (16 September to 2 October 2026). Vendors need demonstrated OT security expertise, capability for simultaneous or sequential assessments at three sites, and familiarity with industrial control systems operating in oil and gas context. The technical depth required—particularly OT-safe VAPT methodologies and SCADA-specific security review—narrows the eligible bidder pool to specialized firms rather than general IT consultants.
Who can bid: Vendors must be registered cybersecurity firms with demonstrable experience in OT/ICS security assessments and VAPT. Typically required: company registration (SECP), valid NTN, relevant security certifications (OSCP, CEH, or equivalent), proof of prior OT engagements, and professional liability insurance. The notice does not specify sector restrictions but implies need for vendors with industrial control systems expertise and ability to work within operational technology environments.