Publication / RFP issue date
GeM Bid GEM/2026/B/7792329 and RFP BOI:HO:IT(G&E):SBOM:0262 are both dated 15-07-2026.
- GeM Bid Document header: Dated 15-07-2026.
- RFP cover: Ref BOI:HO:IT(G&E):SBOM:0262 Dated 15.07.2026.
Loading
Loading…
Loading…
Hiring of Agency for IT Projects- Milestone basis
Bank Of India9612788
Written by TenderKart AI from the documents published when it was generated. Check the tender for later corrigenda before you bid.
15 Jul 2026
22 Sept 2026
₹2.3 Cr
₹4 L
All important dates as they stand after corrigenda: publication, pre-bid/clarification deadline, bid submission deadline, bid opening, and bid validity period.
GeM Bid GEM/2026/B/7792329 and RFP BOI:HO:IT(G&E):SBOM:0262 are both dated 15-07-2026.
Pre-bid date/time on GeM Bid Document is 20-07-2026 15:00:00 at BOI IT (G&E), Star House-3, BKC Mumbai; RFP also allows online conference and requires pre-bid queries by 2 PM on that scheduled date to [email protected].
The only bid end date/time printed in the available bid PDF is 05-08-2026 18:00:00; later Date corrigenda and Corrigendum 1 (25-08-2026) exist after that date, but the corrigendum PDFs do not restate a new end date—bidders must verify the live GeM deadline.
Printed GeM Bid Opening Date/Time is 05-08-2026 18:30:00; RFP says technical/price opening is as per GeM portal. Final opening after date extensions is not restated in available corrigendum PDFs.
Bid Offer Validity is 180 days from Bid End Date (GeM); RFP requires minimum 180 days validity from bid opening, with shorter validity treated as non-responsive.
Contract period is 5 Year(s) on GeM/RFP; overall delivery/installation/integration/go-live of the SBOM+CBOM solution is within 12 weeks from PO acceptance (or 13 weeks from PO issue).
Tender value or estimated cost, EMD/bid security (amount, acceptable forms, validity), tender document fees, performance security, and key payment terms.
Estimated Bid Value is INR 2,30,00,000 (inclusive of all taxes), declared for EMD/eligibility guidance only and not binding on quoted price.
EMD is INR 4,00,000; acceptable as RTGS/NEFT, Demand Draft, Bank Guarantee/e-BG (Format 6.4(a)) from scheduled commercial banks other than BOI, or surety bond; BG valid one year with three months claim period; MSE may submit Bid Security Declaration (Format 6.4(b)) with valid MSE certificate instead.
No tender/bid participation fee is stated; GeM disclaimer prohibits asking for tender fee.
Performance security is 5% of price quoted (GeM ePBG Percentage 5.00% for 66 months); PBG from a Public Sector Bank in India other than Bank of India in Format 6.6; submit within 21 days of PO (Format 6.6 text also says within 30 days of PO in the BG form heading—see contradictions).
No advance against PO; invoices paid after Bank sign-off. GeM Bid Detail sets payment within 45 days of SDAC/online bills; RFP Annexure-7 still says payment within 30 days of invoice receipt—report both (see contradictions). Commercial structure and milestones were revised in Corrigendum 1 Annexures 1/2/6.
QCBS 70:30 (Technical:Financial), technical cutoff 70/100; H1 on 5-year TCO. Buyer may vary quantity/duration up to 25% at contract issue (increase only up to 25% after issue); for lumpsum services scope/value up to 25% with service provider consent.
Every pass/fail eligibility and qualification requirement: experience and past performance, turnover/net worth, registrations and certifications, consortium/JV rules, and debarment or blacklisting conditions.
Bidder must be a legally registered Indian partnership/LLP/company/proprietorship; Class-I or Class-II local supplier under Make in India order dated 19/07/2024; sign Pre-Contract Integrity Pact; confirm no related entity also bidding; OEM alone or OEM+SI cannot both bid (OEM-alone preferred if both bid).
Bidder must be OEM/OSO/OSD of the solution, or an authorized dealer/distributor with OEM authorization valid for the entire contract period from bid submission.
Average annual turnover of Rs.6 Crores from Indian operations during FY 2022-23, 2023-24 and 2024-25 (individual company, not group); Net Worth not negative as on 31/03/2025 and not eroded more than 30% in last three FYs ending 31/03/2025; CA certificates with UDIN required.
After Corrigendum 1: (i) Bidder/OEM supplied, implemented and maintaining similar Comprehensive SBOM Solution in any one SCB/PSU/Govt Dept/PSE/BFSI in India during last 2 years as on RFP submission; (ii) similar for CBOM in SCB/PSU/Govt/PSE/BFSI in India / Global exposure as on submission; (iii) SBOMs for at least 50 Software Applications via similar SBOM solution in those Indian entities during last 2 years. Mumbai 24x7 support-office eligibility criterion deleted.
Land-border country bidders (incl. OEM/OSD/OSO) eligible only if registered with Competent Authority; must not be debarred/blacklisted by SCB/PSU/State/Central Govt or agencies as on bid submission; Bidder and parent must not be NPA/defaulter/in CIRP/liquidation/bankruptcy as on tender date; bid authenticated via Board Resolution and notarized PoA/LoA with KYC of authorized signatory.
Bidding in consortium is not permitted; any consortium bid will be summarily rejected.
What is being procured: the work, supplies or services, deliverables and quantities, locations, phases, completion or delivery timelines, applicable standards, and notable exclusions.
End-to-end Supply, Installation, Implementation, Integration and 5-year Maintenance of a Comprehensive Software Bill of Materials (SBOM) and Cryptographic Bill of Materials (CBOM) solution for Bank of India (CERT-In SBOM guidelines Oct 2024 / July 2025 compliant), despite GeM category label 'Hiring of Agency for IT Projects- Milestone basis'.
Commercial Day-1 mandatory SBOM coverage priced for 250 Applications (indicative); Bank pays only for applications actually onboarded with validated SBOM; subscription is per-Application (not per-SBOM), covering ancillary/dependent modules of that application. CBOM is a separate enterprise subscription line. Pre-bid clarified scope narrative of 200 applications Day-1 excludes underlying infra.
Corrigendum 1 replaces mandatory host-based agent continuous discovery with 'agent based or agentless discovery'. Solution must support HA DC-DR (Active-Active clusters), 24x7x365 support, and full technical/functional specs in Annexure-8.
FMS at Mumbai/other designated location with at least 2 skilled resources (amended from at least 3); dedicated onsite 10:00–19:00 on Bank working days for SBOM and CBOM; at least one resource onsite at all such times; C1 specifies 2× L2 resources (graduate/engineering etc., min 2 years similar solution experience; solution certification within 3 months of deputing).
Complete delivery, installation, integration, implementation and Go-Live within 12 weeks of PO acceptance (or 13 weeks of PO issue), including features, existing-application integration and Bank acceptance/sign-off; comply with CERT-In SBOM guidelines and future regulatory advisories.
The complete checklist of documents to submit — mandatory vs conditional, with any prescribed formats, proformas or annexures — plus how to submit: portal and mode, envelope/cover structure, digital signature requirements, signing and attestation rules, and physical originals with their deadline.
Online two-packet bid on GeM only (Qualifying & Technical Bid Part A + Price Bid Part B); no manual bids; bidder needs GeM registration and compatible DSC; upload BOM Excel; do not alter downloaded document contents except filling required information.
Scanned EMD (or MSE Bid Security Declaration + MSE certificate), Integrity Pact and NDA must be uploaded on GeM at bid time; originals in sealed envelope must reach The General Manager, BOI IT (G&E), Star House-3, 10th Floor, BKC Mumbai 400051 within 5 working days of final bid submission deadline (excluding bid submission date) or bid is disqualified.
Integrity Pact on non-judicial stamp/e-stamp Rs.500/- or more (state Stamp Act higher); NDA on Rs.1000/- or more; MSE Bid Security Declaration on Rs.500/- or more; formats signed by authorized signatory with seal as specified in each proforma.
Every corrigendum/addendum in order — what changed (original vs amended value), its impact, and the action for the bidder — ending with the values that finally apply.
Original printed Bid End/Opening were 05-08-2026 18:00 / 18:30. GeM Date corrigenda 4462253 (published 2026-08-05) and 4498190 (2026-08-17) have no files in this pack. Corrigendum 1 dated 25-08-2026 post-dates the original deadline and points extension seekers to Corrigendum-1, but does not itself print a revised end/opening clock—verify live GeM dates.
Splits SBOM vs CBOM experience; allows BFSI and global CBOM exposure; lowers application threshold from 100 SBOM/CBOM apps to 50 SBOM apps; deletes Mumbai 24x7 support-office eligibility requirement.
Host-based agent mandatory continuous discovery replaced by agent-based or agentless discovery.
Replaces Format 6.3(a)/(b) with Annexures 1–2: SBOM subscription for 250 Day-1 applications (pay actual onboarded), separate CBOM enterprise license, revised HW/SW and implementation milestones, FMS resource rate card, training, and 5-year TCO Table G; H1 on 5-year TCO with initial 3-year order.
FMS annexure cut minimum resources from 3 to 2 (2×L2 detailed); QCBS marking methodology replaced (Annexure-4); uptime clarified for SBOM and CBOM at 99.95% with new false-negative vulnerability/crypto penalties (Annexure-5); payment schedule replaced (Annexure-6) including implementation 40/50/10 via UAT sign-off.
Large pre-bid Q&A set is attached in Corrigendum 1 PDF; many material items answered 'Refer Corrigendum-1' or with clarifications (e.g., 200 apps Day-1 exclude infra; agentless acceptable; estimated value stays 2.3 Cr).
Finally apply: RFP BOI:HO:IT(G&E):SBOM:0262 + GeM GEM/2026/B/7792329 as amended by Corrigendum 1 (25-08-2026) eligibility/tech/commercial/SLA/FMS/QCBS changes; live GeM clock for submission/opening (not reprinted in C1 PDF); EMD ₹4 Lakh; ePBG 5%/66 months; QCBS 70:30 cutoff 70; contract 5 years; Day-1 SBOM commercial basis 250 apps (pay actual); CBOM separate enterprise license; FMS ≥2 L2 onsite; discovery agent-based or agentless; 99.95% uptime SBOM+CBOM; 12-week implementation.
Genuine conflicts within and across the documents (original vs corrigenda, clause vs annexure, tender document vs BOQ): both sides with citations, and which value prevails.
GeM Item Category is 'Hiring of Agency for IT Projects- Milestone basis', while the ATC/RFP is for SBOM+CBOM solution supply/implementation/maintenance. Scope of Work field points to the RFP PDF—RFP scope prevails for work definition.
Dominant framing is 5 years (title, GeM Contract Period, PBG, TCO). Invitation para also says 'for a period of 6 years'. Separately, Bank may extend another 2 years at discretion / take years 4–5 after initial 3-year order. Treat base contract as 5 years unless Bank issues further amendment; flag the 6-year sentence as drafting inconsistency.
GeM Bid Details Payment Timelines: within 45 days of SDAC and online bills (expressly superseding GeM GTC 10 days). RFP Annexure-7: payment within 30 days of invoice receipt after sign-off. GeM disclaimer also invalidates ATC clauses contravening bid-detail payment terms unless GTC allows. Report both; GeM bid-detail 45-day clause is on the face of the bid, while RFP ATC states 30 days—seek written clarification if material to working capital.
Original Format 6.3 Table A Day-1 quantity 200 SBOM+CBOM units; Corrigendum 1 prices 250 Applications for SBOM Day-1; pre-bid reply still explains '200 applications deployed... doesn’t include underlying infra.' Commercial quoting must follow Corrigendum 1 (250) while operational onboarding narrative may still reference 200 apps—clarify with Bank if volumes drive sizing/cost.
Original Annexure-2 required at least 3 FMS resources; Corrigendum 1 Annexure-3 requires at least 2 and details 2×L2; GeM BOM Excel Sheet5 still shows 1 L2 × 60 months. Latest corrigendum FMS text (2 resources / 2 L2) prevails over original annexure and possibly stale Excel—reconcile Excel upload to C1.
GeM states 180 days from Bid End Date; RFP cl.3.14 states minimum 180 days from date of opening of the bid. Practically keep validity covering both anchors (from end date through opening + 180 days).
Clause 4.4 narrative requires PBG within 21 days from PO date; Format 6.6 heading states BG should be furnished within 30 days from PO. Use the stricter 21-day operational target unless Bank confirms otherwise.
Original Annexure-7 paid One Time Implementation 100% of Table C on successful end-to-end implementation; Corrigendum 1 Annexure-6 splits implementation cost 40% delivery / 50% UAT sign-off / 10% Go-Live. Corrigendum 1 prevails.
Uploaded GeM Excel still reflects pre-corrigendum table structure (single SBOM subscription TCO line; 1 L2 resource; no separate CBOM enterprise table as in C1). Corrigendum 1 revised Format 6.3 is controlling for RFP commercials—bidders should ensure GeM Excel/price bid aligns with C1 or seek Bank/GeM guidance if portal template cannot be changed.
Only critical, tender-specific pre-bid queries that could materially change bid/no-bid, pricing, eligibility or contractual risk. Skip generic or obvious questions the documents already answer clearly.
Available PDFs never print the post-extension submission/opening timestamps; Corrigendum 1 is dated after the original 05-08-2026 end. Critical to lock the exact current GeM deadline and whether auto-extension still applies.
Licensing, sizing, and TCO hinge on whether mandatory Day-1 commercial quantity is 250 applications (C1 Table A) while pre-bid still describes 200 applications excluding infra—and how SBOM vs CBOM coverage is counted when populations differ.
Working-capital risk from conflicting payment timelines and from subscription paid annually only after SLA monitoring / tiered Year-1 releases versus delivery-heavy cost front-loading.
New Corrigendum 1 false-negative penalties (₹500–₹2,500/vuln/day plus remediation and loss/damage) can dominate risk if detection SLAs, vulnerability databases in scope, and concurrent uptime/LD caps are not clarified.
Need firm billable headcount (Excel 1 vs C1 2 L2), whether both must be onsite simultaneously, Noida vs Mumbai base, and how optional extra resources are ordered.
Corrigendum allows CBOM 'India / Global exposure' without the same 'last 2 years' phrasing used for SBOM—confirm acceptable evidence. Also confirm treatment if multiple Indian SIs of same OEM bid.
Commercial, legal and execution risks a bidder should weigh: liquidated damages and penalties, unusual or one-sided clauses, tight timelines, and payment or security risks.
Full delivery/install/integration/go-live including existing application integration within ~12 weeks of PO, with LD 0.5% of total project cost per week delay up to 5%, then possible termination.
Uptime 99.95% monthly for SBOM and CBOM; penalties escalate by availability band as % of total license cost per hour; penalties not mutually exclusive; recoverable from invoices and PBG.
Daily per-vulnerability penalties plus bidder bears remediation costs and any loss/damage/penalty/breach cost from non-detection—open-ended consequential exposure beyond ordinary LD caps.
No advance; subscription largely annual after SLA; Bank pays only onboarded apps not shelf licenses; penalties netted from Year-1 license, FMS, later licenses and PBG; 5% PBG for ~66 months; 25% quantity/duration option binding on bidder at award.
Missing online or physical EMD/IP/NDA, consortium bid, incomplete eligibility pack at submission, false statements, or failure to accept PO/sign contract/furnish BG can disqualify and forfeit EMD; conflict of interest can forfeit bid and performance security.
Bidder sizes infra; if sizing fails performance, upgrades at bidder cost; unlimited-ish regulatory change compliance for CERT-In/future advisories; RBI IT outsourcing covenants, data localization, audit/exit/transition obligations, and broad indemnity/confidentiality regimes apply.
The inviting authority and relevant contacts: office, person, designation, address, phone and email — and which address receives physical submissions, if any.
Bank of India, Head Office — Information Technology Department (Governance & Excellence), under Department of Financial Services, Ministry of Finance (GeM hierarchy).
The General Manager, Bank of India, IT Department (Governance & Excellence), Head Office, Star House-3, 10th Floor, C29, G Block, PNB-BOI Tower, Bandra Kurla Complex, Bandra (E), Mumbai, Maharashtra 400051; Telephone 022-69179300 (also listed 022-69179300/9394 on GeM).
Coordinators: 1) Anamica Mishra, Chief Manager, 022-69179311; 2) Subhashish Biswas, Senior Manager, 022-69179314; 3) JANEEKA R., Officer, 022-69179394. Pre-bid link/queries email: [email protected].
Bid on GeM https://gem.gov.in; RFP also under Bank website Tenders https://bankofindia.bank.in/ (RFP text) / https://www.bankofindia.bank.in (invitation).