Comprehensive Information and Cyber Security Assurance Audit

Publication / RFP date

Tender/RFP published on 07 August 2026 (GeM bid dated 07-08-2026; RFP Date 07/08/2026).

• Reference: GEM/2026/B/7890556; RFP Tender No. 000100/HO IT/RFP/554/2025-2026.

Pre-bid queries deadline

Last date for submitting pre-bid queries is 14th August, 2026, by email only to [email protected] in the Annexure-11 Excel format.

• No query is entertained after the pre-bid meeting.
• Authorization letter for pre-bid attendance must be emailed at least two days prior to the meeting.

Pre-bid meeting

Pre-bid meeting is scheduled on 18th August, 2026; UIIC may conduct it virtually by video conference.

• Authorized representatives must carry/send proper authorization.
• Any resulting change will be only by Addendum/Corrigendum, not via pre-bid minutes.

Bid submission deadline

Last date/time for online bid submission on GeM is 28-08-2026 21:00:00 (RFP: 28th August, 2026 till 09:00 p.m.).

• Mode of submission: Online through Government e-Marketplace (GeM) Portal only.
• Auto-extension on GeM: if fewer than 3 bids, extend by 3 days, maximum 2 auto-extensions.

Bid / technical opening

GeM Bid Opening Date/Time is 28-08-2026 21:30:00; RFP separately states Opening of Technical Bid on 31st August, 2026 @ 12:00 p.m.

• RFP: Opening of Commercial Bid and Declaration of Appointed Bidder will be communicated later.
• Bids open online through GeM Portal on the scheduled date & time.
• Conflict between GeM opening (28-08-2026 21:30) and RFP technical opening (31-08-2026 12:00 p.m.) is recorded under contradictions; follow GeM portal schedule unless UIIC issues a corrigendum.

Bid validity

Bid offer validity is 180 days from the bid end/last date of submission.

• GeM: Bid Offer Validity (From End Date) 180 (Days).
• RFP: Bids shall remain valid for 180 days from the last date of submission; shorter validity may be rejected as non-responsive.
• Self-declaration 12C also requires 180-day validity.

Contract period / related post-award timelines

Contract/appointment is for Three years / 36 months; LOA acceptance within 15 days; Performance Security within 20 days of Notification of Appointment, valid 39 months from LOA.

• GeM Contract Period: 3 Year(s); ePBG duration 39 months.
• Calendar Plan for Red Team, Training, Table Top and Phishing due within 7 working days of PO.

Estimated / tender value

No numeric estimated bid value/tender value is printed in the available GeM bid fields or RFP; GeM only states that any Estimated Bid Value is for EMD/eligibility guidance and not for pricing reasonableness.

• Commercial evaluation is on Total bid price / TCO from Annexure-15 line items (exclusive of GST).

EMD / bid security

EMD is Rs.8,00,000 (Rupees Eight Lakhs only); preferred mode Bank Guarantee (Annexure 7) or NEFT; GeM also allows surety bond; BG validity 6 months from bid submission cut-off; EMD carries no interest.

• BG in favour of “United India Insurance Company Limited” payable at Chennai; GeM Beneficiary: Chief Manager (Suresh Kumar M K), UNITED INDIA INSURANCE COMPANY LTD; Advisory Bank: Indusind bank.
• NEFT account: Beneficiary United India Insurance Company Ltd.; IFSC INDB0000007; Account No 200999095210000100ITAUDIT; IndusInd Bank; Remarks EMD_ITAUDIT<Depositor Name>. First 18 characters of account number are digits, rest alphabets.
• EMD should be effected at least two days prior to tender submission date; bidder must provide payment details.
• MSE units exempt from EMD (with CA certificate Annexure 10 / valid supporting docs per GeM GTC); traders excluded from MSE EMD exemption on GeM.
• Forfeiture if withdraw after LOA, fail PBG after signing, withdraw before validity expiry, violate tender terms, or fail PBG within 20 days of LOA.
• Refund: successful bidder after PBG and contract signing; unsuccessful after final bid validity expiry and upon completion of 30th day after award.
• Bid Security Declaration (Annexure 8) also required on bidder letterhead.

Tender document fee

No tender fee is applicable.

Performance security / ePBG

Performance security / ePBG is 3% of total contract value, to be furnished within 20 days of Notification of Appointment as irrevocable BG/DD from Nationalized/Scheduled Bank; validity 39 months from LOA (GeM ePBG duration 39 months).

• UIIC provides PBG proforma to successful bidder.
• Failure to furnish PBG is ground to annul award and blacklist for 2 years from future tenders.
• GeM Advisory Bank for ePBG: Indusind bank; EMD & Performance security in favour of Beneficiary.

Payment terms

Payments are activity-linked per RFP 4.27 (mostly 100% on final signed report; VAPT/External VA&PT 50% initial + 50% revalidation); GeM requires payment within 45 days of SDAC and online bill submission; currency INR; prices exclusive of GST.

• Annual Comprehensive VAPT: initial testing within 45 days; revalidation within 30 days; 50%/50% on signed initial and revalidation reports.
• IRDAI Compliance Audit and IS Assurance Audit: within 45 days; 100% on final signed report.
• External Application VA & PT: same 45/30 day testing split and 50%/50% payment as comprehensive VAPT.
• Red Team, Table Top, Phishing: within 30 days; 100% on final signed report.
• Training & Awareness: within 30 days; 100% on completion of each training.
• Ad-hoc VAPT man-day: timeline defined per assignment by UIIC; 100% on final signed report; separate PO as needed.
• Invalid CERT-In certificate at report signing: report rejected at no extra cost and payment withheld until resolved.
• No out-of-pocket expenses; bidder factors travel/boarding/lodging/food; prices firm 36 months; GST paid extra on actuals with GSTIN bills.
• TReDS is preferred payment mode on GeM for eligible MSME sellers.
• ITC available to buyer: Yes.

Legal entity, age and registrations

Bidder must be a Company / Partnership Firm / LLP registered in India for more than 5 years as on RFP date (other modes not acceptable), with registered office in India, valid GST and PAN, and statutory tax registrations; in operation last five years per definitions.

• Proofs: Certificate of Incorporation, MoA/AoA or Partnership Deed, commencement certificate, CIN, and letterhead declaration of years of service in India.

Financial capacity (turnover, net worth, profit)

Average annual turnover from India cyber security services operations not less than 4 Crores in each of FY 2023-24, 2024-25, 2025-26 (Start-ups/MSEs: minimum average annual turnover 2 crores for that period); positive net worth in all 3 FYs; profit in at least 2 of last 3 FYs.

• GeM restates Minimum Average Annual Turnover 400 Lakh(s) for 3 years, with MSE/Startup partial relaxation to 200 lakhs.
• GeM also requires 3 years past experience of similar services to Central/State Govt/PSU (ending March prior to bid opening) with contract/order copies.
• Documentary evidence: audited annual reports / CA certificates including P&L and balance sheet for the three FYs.

CERT-In empanelment

Bidder must be empaneled with CERT-In for Information Security Audit services as on RFP publication date; certificate must remain valid when signing Initial/Final reports for specified audits.

• If empanelment expires before contract end, submit renewal application proof and renewed certificate ASAP.
• Valid CERT-In certificate required on date of signing Final Report for Sections 2.1, 2.2, 2.3, 2.4, 2.5 and 2.7.

Individual bid only; no consortium; Chennai project office

Bidder must bid individually and not as a consortium, and must have a project office in Chennai (self-declarations 12D and 12E).

• No sub-contracting is permitted under the agreement.

Blacklisting, land-border, forensics conflict and IRDAI auditor eligibility

Bidder must not be blacklisted by Govt/PSU/etc. as on RFP date; not from a land-border sharing country unless registered with Competent Authority; must not be providing Information & Cyber Forensic services to UIIC as on RFP date; must meet IRDAI Annexure-IV audit firm eligibility; and must comply with CVC tender guidelines.

• Companies blacklisted or terminated by UIIC cannot participate.
• Per IRDAI, any company providing Cyber Forensic Related Services to UIIC cannot participate; successful bidder cannot take other UIIC Cyber Forensic tenders during contract.
• Integrity Pact signing is a preliminary eligibility/qualification criterion; refusal disqualifies.
• GeM GTC clause 26 land-border restriction also applies.

Technical qualification threshold and QCBS

Technical bid scored on Annexure-14 (100 marks max); minimum 60 marks to open commercial bid; evaluation is QCBS with Technical:Financial weightage 70:30.

• Annexure-14 categories (max marks): 14A IS Audit VA&PT infrastructure experience 15; 14B VA&PT applications/APIs 15; 14C IRDAI Compliance Audit 10; 14D Red Team/Phishing experience 10; 14E Training/Table Top 10; 14F certifications skillset 20; 14G experience years skillset 20.
• Experience windows generally last 3 FY 2023-24 to 2025-26 in Govt/Regulatory/PSU/BFSI as specified.
• 14F/14G: submit min 5 and max 10 deployable resource profiles; scoring by certifications (CISA/CISSP/DISA/CEH/CISM) and years of experience.
• Non-compliance/non-submission of Annexures 1–13 eligibility is outright rejection.
• GeM QCBS parameters: As per the RFP Terms, Max 100, Cutoff 60, weightage 70:30.

Resource and deployment conditions (pass/fail operational)

Deployed resources must be permanent employees (not part-time/outsourced), drawn from Annexure-14 profiles (or equivalent), qualified with relevant certifications, and use only authorized licensed tools.

• Onsite auditors must bring original employer ID card; conveyance/accommodation/food is bidder’s responsibility.
• Vendor must be reachable 24/7 by telephone and email.

Procurement objective

Appointment of an independent CERT-In empaneled IS Auditor for Comprehensive Information and Cyber Security Assurance Audit for UIIC for three years, aligned to IRDAI guidelines dated 06th April, 2026 and amendments.

• Buyer: United India Insurance Company Limited, Head Office, Chennai.
• GeM item category: Cyber Security Audit - 1; Team Deployment Hybrid; standards include ISO 27001 and ISO 20000 (and value '1' as printed).

Locations and indicative IT landscape

In-scope offices/centres: Head Office, Data Centre, DR Site and NDR Site; indicative inventory includes internal apps 40±10, external apps/APIs 40±10, servers 200±30, auth servers 4, proxy 1, network devices 20, desktops 1000±200, laptops 150±30.

• Final inventory will be shared with successful bidder.
• IS Assurance Audit requires physical inspection of DC, DR, NDR and Head Office.

Workstreams, frequency and quantities (BOM)

Nine commercial line items over the contract: annual Comprehensive VAPT (3), IRDAI Compliance Audit (3), IS Assurance Audit (3), External Application VA&PT (3), Red Team (3), Training (6 = 4 online + 2 offline), Table Top (3), Phishing (6), and Ad-hoc VAPT man-day unit (1 quoted unit; PO on need).

• Comprehensive VAPT: annual cycle (process/implementation audit, draft/final); deliverables include reports, trackers, presentations, certificate.
• IRDAI Compliance Audit: one cycle/year against IRDAI CS Guidelines April 2026 Annexure III controls.
• External Application Grey/White Box VA&PT: annually, exclusively after six months from completion of Annual Comprehensive VAPT or as convenient to UIIC; revalidation after fixes.
• Red Team: annual; Training: 4 virtual + 2 on-site as required; Table Top: annual; Phishing: bi-annual or as convenient.
• Ad-hoc VAPT before go-live of apps/APIs/web services on man-day basis; unit = 8 hours = 1 Day; bidder also to quote unit price per API and Web service/URL in scope text.
• Calendar Plan for items 2.5–2.8 within 7 working days of PO.
• UIIC may drop/implement listed projects and may increase scope/value up to 25% under GeM option clause (with consent for lumpsum value increase).

Standards and notable conditions

Testing/standards reference OWASP Top 10, OWASP ASVS, NIST CSF, SANS controls, OWASP Testing Guide, MITRE ATT&CK; only authorized licensed tools; reports in DOC/PDF/XLS/PPTX/hard copy as required.

• Scope is indicative not exhaustive; bidder must perform all required activities and any additional regulatory-driven audits via separate PO.
• Focus includes emerging AI threats (generative AI phishing, deepfakes, prompt injection, etc.).

Submission portal and mode

Single-stage online submission on GeM Portal only (two-stage opening: Technical then Commercial); no other mode accepted; hard copies only if demanded or clarification sought.

• Commercial Excel breakup upload required on GeM: Commercial Bid Document - 1786095301.xlsx.
• Buyer ATC/RFP PDF is the uploaded ATC document on GeM.
• RFP also available on https://www.uiic.co.in/web/tenders-rfp.

Bid structure and signing

Technical packet: Annexures 1–14 and 16; Commercial packet: Annexure-15 BOM/TCO (unmasked) plus masked BOM replica in technical bid with ‘XX’ for prices; documents page-numbered; signed by authorized signatory under Power of Attorney.

• Prices must not be revealed in technical bid.
• Self-evaluation sheet for Annexure-14 required with supporting proofs.
• Two Packet Bid on GeM; financial document indicating price breakup required: Yes.

Integrity Pact physical form

Pre-Contract Integrity Pact must be submitted in 2 (Two) copies on ₹100 stamp paper (Annexure 9); signing is preliminary eligibility—refusal disqualifies.

• No separate physical-submission deadline/address beyond online GeM upload and ‘hard copy if demanded’ is stated for other documents.
• IEMs named: Shri Dharam Chand Jain, IPS (Retd.) and Shri Vijay Sharma, IRSE (Retd.).

No corrigendum / addendum issued in the workspace

No corrigendum or addendum documents are present in the tender pack; original GeM bid (07-08-2026) and RFP dated 07/08/2026 values currently apply.

• Identical RFP PDFs appear thrice as buyer additional documents; no amendment chain to collapse.
• Bidders should still monitor GeM and https://www.uiic.co.in/web/tenders-rfp for any later Addendum/Corrigendum after pre-bid.

Values that finally apply (no amendments)

Final operative timeline/financials as published: bid end 28-08-2026 21:00; GeM opening 28-08-2026 21:30 (RFP technical opening text 31-08-2026 12:00 p.m.—see contradictions); validity 180 days; EMD ₹8,00,000; ePBG/PBG 3% for 39 months; contract 3 years; QCBS 70:30 with technical cutoff 60.

Technical bid opening date: GeM vs RFP

GeM Bid Opening is 28-08-2026 21:30:00, while RFP Schedule states Opening of Technical Bid on 31st August, 2026 @ 12:00 p.m.

• RFP also says bids will be opened online through GeM on the scheduled date & time.
• Absent a corrigendum, bidders should treat the GeM portal clock as operative for opening and seek written clarification from UIIC on the 31 Aug RFP date.

Evaluation method label on GeM vs QCBS in same bid/RFP

GeM Bid Details field shows “Evaluation Method: Total value wise evaluation”, but the same GeM document and RFP mandate QCBS 70:30 with technical cutoff 60.

• RFP clause 3.7(l)–(o): two-stage QCBS; commercial compared on total bid price among technically qualified bidders.
• Operative method for award is QCBS 70:30 as expressly stated in RFP and GeM QCBS section; the “Total value wise evaluation” label is inconsistent boilerplate.

Training frequency: summary ‘Quarterly’ vs 4 online + 2 offline / BOM qty 6

Scope summary table lists Regular Training frequency as “Quarterly”, but Section 2.6 requires only 4 virtual + 2 on-site trainings and BOM/Excel quantities are 6 units for the contract.

• Quarterly over 3 years would imply ~12 sessions, which conflicts with fixed 6-unit commercial quantity.
• Pricing should follow BOM quantities (6) and Section 2.6 delivery mix unless clarified.

EMD acceptable instruments: RFP vs GeM

RFP specifies Bank Guarantee (preferred) or NEFT only, while GeM also states EMD shall be accepted as a surety bond.

• Both require beneficiary favour of UIIC / Chief Manager beneficiary details on GeM.
• To avoid rejection risk, prefer RFP modes (BG/NEFT) unless buyer confirms surety bond acceptance in writing.

Payment timing: GeM 45-day SDAC vs RFP milestone triggers

GeM sets seller payment within 45 days of SDAC and online bills, while RFP 4.27 ties payment percentages to submission of signed initial/final/revalidation reports per activity.

• GeM note says this supersedes 10-day GTC clause 12 timeline.
• In practice, milestone acceptance/SDAC on GeM will likely gate the 45-day clock after RFP deliverable submission; confirm process with buyer.

Confirm operative technical opening date

Please confirm whether technical bids open on GeM at 28-08-2026 21:30 or on 31-08-2026 12:00 p.m. as in RFP 1.5, and publish a corrigendum aligning both.

• Material for bid logistics and authorized representative planning.

Confirm QCBS scoring formula and GeM ‘total value wise’ label

Please confirm the exact QCBS composite formula (normalization of commercial score) and that award is not pure L1 despite GeM “Total value wise evaluation” wording.

• Affects bid/no-bid pricing strategy and whether technical marks can offset price.

Training quantity vs ‘Quarterly’ frequency

Please clarify whether Regular Training is quarterly each year or limited to 6 sessions (4 online + 2 offline) over the 3-year contract as per Section 2.6 and BOM quantity 6.

• Directly changes commercial volume and delivery planning.

Ad-hoc VAPT commercial unit basis

Section 2.9 asks for man-day rate and also unit price per API and Web service/URL, but Annexure-15/Excel has only one man-day line with quantity 1—please confirm what must be quoted and how call-offs will be ordered/paid.

• Ambiguity can cause commercial non-responsiveness or under-recovery on ad-hoc work.

Physical Integrity Pact delivery

Annexure 9 requires 2 stamp-paper copies of Integrity Pact, while bid submission is GeM-only—please confirm whether originals must be couriered, to which address, and by what deadline relative to bid end.

• Failure mode is eligibility disqualification under clause 4.28.

Turnover test: ‘each year’ 4 Cr vs average 4 Cr / GeM 400 Lakh

Please confirm whether cyber-security turnover must be ≥ ₹4 Cr in each of FY23-24/24-25/25-26 (RFP 13C wording) or as a three-year average (GeM average turnover phrasing), and whether FY 2025-26 audited figures are mandatory if bid is in Aug 2026 before audit finalization.

• Pass/fail eligibility and MSE/Startup 2 Cr relaxation hinge on this.

Site locations for DC/DR/NDR and onsite expectations

Please share city/addresses (or at least cities) of Data Centre, DR and NDR and expected onsite duration per exercise, since commercials must include all travel/stay with no reimbursables.

• Material for pricing risk because out-of-pocket expenses are disallowed.

Liquidated damages and CERT-In payment hold

LD of 1% of each SOW/year PO amount per week (or part) of delay, capped at 5%, then UIIC may terminate; invalid CERT-In at report signing attracts additional 5% LD and payment withholding/report rejection at bidder cost.

• Bidder must prove delays attributable to UIIC/Force Majeure with authenticated proof to avoid LD.
• LD applies over and above other penalties and before various termination clauses.

Tight activity SLAs and fixed-price all-inclusive commercials

Many exercises must finish within 30–45 days of UIIC intimation, with revalidation in 30 days, while prices are firm for 36 months with no out-of-pocket reimbursement and bidder bears travel/stay.

• UIIC may change/drop scope items and use 25% quantity/duration option clause.
• Additional regulatory audits may be ordered via separate PO—pricing rights limited to quoted units/man-days.

One-sided termination, blacklist and security risks

UIIC may terminate for default/unsatisfactory progress (30-day cure), insolvency without compensation, convenience, or cancel and recover damages; failure to furnish PBG can annul award and blacklist for 2 years.

• EMD forfeiture triggers are broad (including any tender term violation).
• No subcontracting; discovery allows termination and cost recovery.
• Limitation of liability is one-time total contract value for direct damages, but does not cap fraud/gross negligence/willful misconduct or indemnity/IPR third-party claims.
• Exclusive jurisdiction Courts at Chennai.

Eligibility / conflict traps and resource lock-in

Forensic-service conflict with UIIC is an absolute bar; successful auditor is barred from UIIC cyber-forensic tenders during contract; resources must be permanent employees from submitted profiles.

• Chennai project office and individual (non-consortium) bidding narrow participation.
• Customer reference verification may lead to rejection for misrepresentation.

Payment and cash-flow risk

No advance; payments are back-ended to signed reports/training completion and GeM 45-day post-SDAC cycle; CERT-In issues can freeze payment entirely for the activity.

• Ad-hoc work depends on separate POs and utilization.

Inviting authority / buyer organization

United India Insurance Company Limited (UIIC), IT Department, Head Office — United India Bhavan, No. 24, Whites Road, Royapettah, Chennai – 600 014; Ministry of Finance / Department of Financial Services; GeM office name North.

• CIN: U93090TN1938GOI000108.
• RFP correspondence address block used on annexures: The Chief Manager, IT Department, Head Office, 7th Floor, 24, Whites Rd, Chennai, Tamil Nadu 600014.

RFP communication email and pre-bid contact path

Primary RFP email for communication/queries/clarifications: [email protected]; pre-bid authorization details also to this email at least two days before meeting.

• Tender copy also on https://www.uiic.co.in/web/tenders-rfp.
• No telephone queries accepted for pre-bid.

GeM buyer / grievance contacts and EMD beneficiary

GeM Buyer Email: [email protected]; HOD grievance email: [email protected]; EMD/PBG Beneficiary Chief Manager Suresh Kumar M K, UNITED INDIA INSURANCE COMPANY LTD.

• Advisory Bank for EMD/ePBG: Indusind bank.

Independent External Monitors (Integrity Pact)

IEMs for this tender: Shri Dharam Chand Jain, IPS (Retd.), 4F, Type-VII, Tower-6, East Kidwai Nagar, New Delhi – 110023; and Shri Vijay Sharma, IRSE (Retd.), Flat no.9112, Parx Laureate, Sector 108, Noida, Uttar Pradesh, 201304.

• UIIC may change/name another IEM later.

Physical submission address (if originals demanded)

No standing physical bid-submission desk/deadline is prescribed beyond GeM upload; if hard copies are demanded, the RFP address for the Chief Manager, IT Department, HO 7th Floor, 24 Whites Road, Chennai 600014 is the documented authority address.

• Integrity Pact stamp-paper originals may need to be delivered to this authority—confirm by pre-bid query.