Cyber Security Audit of Application and Server

Bid publication date

GeM Bid Document GEM/2026/B/8012011 is dated 12-09-2026.

• No separate corrigendum revises this date; metadata also lists no corrigenda.

Bid submission end date/time

Bid End Date/Time is 03-10-2026 12:00:00.

• If fewer than 3 bids are received, GeM auto-extends the bid end by 5 days, maximum 1 auto-extension.

Bid opening date/time

Bid Opening Date/Time is 04-10-2026 12:00:00.

Bid offer validity

Bid Offer Validity is 180 days from the bid end date.

• GeM GTC: Bid Security/EMD should be valid for 45 days beyond bid validity; bid validity can be extended with mutual consent.

Technical clarification window during evaluation

Time allowed for Technical Clarifications during technical evaluation is 2 Days.

• No pre-bid meeting date or pre-bid query submission deadline is stated in the bid or ATC documents.

Contract period

Contract Period on GeM is 3 Year(s) 1 Day(s); ATC states three (03) years for the VAPT engagement.

• ePBG duration is 38 months, aligning with ~3-year contract plus post-completion cover.

Estimated bid value

Estimated Bid Value is INR 70,00,000 (inclusive of all taxes).

• Declared for guidance on EMD and eligibility (turnover/past experience); not a binding bid price.
• Evaluation method: Total value wise evaluation; L1 on ATC notes is Total 3-Year Cost (including GST).

EMD / Bid Security

EMD Amount is INR 2,10,000; Advisory Bank State Bank of India; beneficiary AIIMS, Main Grant.

• GeM GTC forms of Bid Security: Insurance Surety Bond, Account Payee DD, FDR, Banker's Cheque, Bank Guarantee (including e-BG), or online payment in acceptable form.
• Bid also states EMD shall be accepted as a surety bond.
• Scanned EMD with online bid; hard copy to Buyer within 5 working days of bid opening or bid may be rejected.
• EMD validity under GTC: 45 days beyond bid validity; no interest payable.
• MSE Service Providers (valid Udyam), DPIIT Startups and other GTC-exempt categories may claim exemption with supporting documents; traders not eligible under MSE.
• Unsuccessful bidders' EMD returned within 15 days of technical evaluation result (two-packet) / award or validity expiry; successful bidder's EMD within 15 days after receipt of Performance Security/e-PBG.

Performance security / ePBG

ePBG is 5.00% of contract value for 38 months; Advisory Bank SBI; in favour of beneficiary AIIMS, Main Grant.

• GTC: Performance Security forms are Insurance Surety Bonds, Account Payee DD, FDR, BG (including e-BG), or online payment; submit within 15 days of GeM award; payments due only after receipt and genuineness verification.
• GTC validity: 2 months beyond completion of all contractual obligations including warranty; no interest; refund within 30 days of full completion.
• 5% is at the top of the GFR 3–5% band referenced in GTC.

Tender / bid document fee

No tender fee or bid participation fee is charged in this GeM bid.

• GeM disclaimer prohibits buyers from asking for tender/bid participation fee.

Payment terms

Quarterly payments against GST invoice after satisfactory completion; no advance; penalties deducted from invoice; GST as per norms.

• Quarterly release subject to: scheduled audits completed; L1 Report accepted by AIIMS; re-testing and L2/subsequent reports if applicable; certified onsite attendance.
• Onsite resource pay also quarterly on certified attendance and performance; payments only after verifying Junior Auditor attendance, payslip and PF details (ATC eligibility note).
• Rates inclusive of all costs except GST; firm for three years; quote in INR; no additional charges beyond quoted amount; VAPT cost includes tools, manpower, travel, reporting, compliance; onsite cost includes salary, allowances, admin expenses.

CERT-In empanelment (ATC)

Bidder must be currently CERT-In empanelled; valid empanelment certificate mandatory at bid submission.

• ATC invites proposals only from CERT-In empanelled Information Security Auditing Agencies.

Experience and past performance

GeM requires 3 years similar service experience plus 40%/50%/80% similar-service value thresholds; ATC separately requires 3 years cybersecurity audit experience and 3 similar VAPT projects for Govt/PSU/Healthcare in last 3 FYs.

• GeM years of experience: ending month of March prior to bid opening; similar services to any Central/State Govt Organisation/PSU; upload contracts/orders for each Financial year.
• GeM past experience of similar services over current FY + last three FYs (ending March prior to opening): (1) three works ≥40% of estimated cost; or (2) two ≥50%; or (3) one ≥80% of estimated cost (estimated cost INR 70 lakh).
• ATC: Minimum three (03) years experience in cybersecurity audits; Minimum three (03) similar VAPT projects for Govt/PSU/Healthcare in last three financial years with documentary evidence.
• MSE and DPIIT Startup relaxation from GeM Experience Criteria and Turnover is available if quality/technical specs met and supporting exemption docs uploaded; ATC does not expressly relax CERT-In or the three VAPT-project rule.

Turnover

Minimum average annual turnover INR 50 Lakh for last 3 years (ending 31 March of previous FY).

• Evidence: certified audited balance sheets or CA/Cost Accountant certificate; if entity <3 years old, average of completed FYs after constitution.
• Turnover eligibility criteria to be verified by buyer at technical evaluation.
• MSE/Startup turnover relaxation available on GeM with supporting documents.

Office location and blacklisting

Operational office in Delhi/NCR required; vendor must not be blacklisted by any Central/State Govt/PSU/Autonomous Body.

Onsite Junior Security Auditor qualifications

One Junior Auditor onsite for 3 years must meet education, certification, experience and skill thresholds in ATC 7.1.

• Education: B.Tech/B.E. in CS/IT or MCA from recognized university.
• At least one mandatory certification: CEH, CompTIA Security+, OSCP, or ISO 27001 Internal Auditor (BSI/IRCA).
• Minimum 2 years hands-on IT security auditing/VA/PT; Govt/healthcare/PSU preferred.
• Must be onsite during AIIMS working hours for full contract; vendor surety to retain junior auditors minimum 1 year.
• Tools/software for audit to be provided by the Junior auditor (ATC scope).

MSE / Startup preference and MII

MSE purchase preference Yes with L1+15% band and 100% quantity to matching MSE service provider; MII Compliance Yes.

• Bid splitting not applied.
• MSE benefits only if seller validated online on GeM and approved by Buyer after document evaluation.

Land-border bidder restriction

Bidders from countries sharing a land border with India are eligible only if registered with the Competent Authority (GeM GTC clause 26); false declaration grounds immediate termination and legal action.

Consortium / JV

No consortium or JV rules are stated in the bid document or ATC.

Procurement summary

3-year CERT-In empanelled agency engagement for continuous VA/PT of AIIMS applications, physical servers and VMs, with one onsite Junior Auditor at AIIMS New Delhi.

• Buyer: AIIMS New Delhi, Computer Facility; category Cyber Security Audit - Security Audit of Application and Server; quantity Project/Lumpsum Based (1).
• Approx assets: Applications ~70; Physical servers ~50; VMs ~200; AIIMS may increase or decrease numbers to be audited.

Technical assessment scope

Application, server/VM and database security assessments covering OWASP, external black-box, OS hardening (CIS L1/L2), hypervisor and multi-DB platforms.

• Applications: .NET/ASP.NET, Java/J2EE, Python, PHP, Node.js, legacy/custom, web apps and REST/SOAP APIs; also predictive/generative AI solutions.
• OS examples: RHEL 7/8/9, Ubuntu LTS variants, Windows Server 2012–2022, CentOS, Rocky/AlmaLinux.
• App tests include injection, XSS/CSRF, auth/session, access control, business logic, API OWASP Top 10, file upload, SSL/TLS, third-party libs; automated tools (Burp/Nessus/Acunetix or equivalent) plus manual exploitation.
• Server/VM: patching, privileges, malware/rootkit, network exposure, logging, VM snapshot/backup, ESXi/Hyper-V review.
• DB: MSSQL, MySQL, PostgreSQL, MongoDB etc.; DLP and DAM configuration review.

Audit periodicity

Applications: VA monthly, auth/access quarterly, PT half-yearly, re-test as required; Servers/VMs: vuln scan monthly, hardening and privilege review quarterly, PT and compliance yearly, re-test as required.

Standards and compliance framework

ATC requires CERT-In directions (incl. 2022), MeitY advisories, ISO/IEC 27001:2022, OWASP Top 10 and Testing Guide v4.2, CVSS v3.1, DPDPA 2023, NABH IT Standards, MoHFW Cybersecurity Guidelines 2023.

• GeM technical specifications also list ISO 27001 ISMS and ISO 20000 IT Service Management as compliance standards.
• Findings documented Critical/High/Medium/Low via CVSS v3.1.

Deliverables and SLAs

L1 VA reports, remediation/re-test till certificate, executive summary, dashboards, annual report, Safe-to-Host certificate; tight SLA timelines and 24-hour critical vulnerability intimation.

• SLA: Audit Plan within 2 WD; L1 draft within 5 WD of audit completion; Final within 3 WD of AIIMS feedback; re-test within 7 WD of remediation confirmation; L2/L3 etc. within 5 WD after re-test.
• Critical vulns: email within 24 hours; escalate to AIIMS CISO/IT Head in 24h; Nodal Officer by phone in 4h if actively exploitable; CERT-In if national-level implications.
• Reports soft copy PDF/DOCX plus signed hard copies stamped/signed by authorized signatory; PPT for top management.
• GeM Buyer Added SLA: comply with all tender terms and submit required supporting documents/certificates.

Submission mode and portal

Online two-packet bid on GeM (GEM/2026/B/8012011); Bid to RA enabled with H1-Highest Priced Bid Elimination.

• Technical and commercial bids submitted before bid closure on GeM; after technical evaluation, RA among qualified bidders except H1 (with stated exceptions).
• Documents uploaded by bidders are visible to all participating bidders after login.
• Time for technical clarifications during evaluation: 2 days.
• GeM e-sign via Aadhaar is at par with digital signatures under IT Act Amendment 2008.

Physical originals

Hard-copy EMD/Bid Security must reach the Buyer within 5 working days of bid opening; other physical pre-qualification document mandates (except EMD and Integrity Pact) are prohibited on GeM.

• No Integrity Pact requirement is expressly stated in this bid document.
• Physical delivery address not separately specified beyond consignee/buyer location at AIIMS Ansari Nagar Store Section (CN Centre).

Signing / attestation of service deliverables

Security audit reports must be stamped and signed by the authorized signatory (soft + hard copies); NDA to be executed before commencement.

No corrigenda issued

No corrigendum or addendum is present in the tender document set; all dates, amounts and conditions stand as in the original GeM bid dated 12-09-2026 and attached ATC/proposal.

• Final applying values: Bid end 03-10-2026 12:00:00; opening 04-10-2026 12:00:00; validity 180 days; estimated value INR 70,00,000; EMD INR 2,10,000; ePBG 5% for 38 months; contract ~3 years.

Four differently labelled GeM attachments are identical files

Bid page 5 labels four separate files as Scope of Work, NDA format, Network Infrastructure/data-flow diagram, and price-breakup format, but all four PDFs are byte-identical copies of the same TSEC minutes + VAPT proposal.

• Impact: promised NDA format, network diagram and price-component breakup are missing from the pack; only the VA/PT proposal/ATC content is available.
• Action: seek buyer clarification/corrigendum for the correct attachments before finalizing technical approach and commercial structure.

Past-experience rules differ between GeM bid clauses and ATC

GeM clause 10 uses value-based similar-service thresholds (3×40% / 2×50% / 1×80% of estimated cost), while ATC section 7 requires three similar VAPT projects for Govt/PSU/Healthcare in last three FYs without stating those value percentages.

• Both also state 3 years experience, but scope of 'similar' differs (GeM: similar services to Govt/PSU; ATC: cybersecurity audits / VAPT including healthcare).
• Action: assume both GeM and ATC bars apply unless buyer clarifies; MSE/Startup relaxation on GeM may not automatically waive ATC CERT-In or VAPT-project requirements.

Compliance standards: ISO 20000 on GeM specs vs ATC standards list

GeM technical specifications require compliance against ISO 27001 and ISO 20000; ATC section 5 lists CERT-In, MeitY, ISO/IEC 27001:2022, OWASP, CVSS, DPDPA, NABH and MoHFW guidelines but does not mention ISO 20000.

• Action: clarify whether ISO 20000 certification/compliance evidence is mandatory for technical qualification.

Contract duration wording

GeM Bid Details state Contract Period 3 Year(s) 1 Day(s); ATC repeatedly states three (03) years.

• ePBG duration 38 months suggests ~3 years plus about 2 months cover, closer to GTC performance-security practice than a material 1-day dispute.
• Action: confirm exact contract end date at award.

Who supplies audit tools

ATC scope says all tools/software needed for security audit will be provided by the Junior auditor, while general conditions require all tools/software/licenses used to be genuine/properly licensed (vendor responsibility) and VAPT cost to include all tools.

• Action: clarify ownership of commercial tool licences (Burp/Nessus etc.), transfer to onsite junior auditor, and cost allocation.

Missing NDA format, network diagram and price-breakup attachments

Please re-upload the actual NDA proforma, network/data-flow diagram and commercial breakup format; current GeM attachments 1788866392/398/409 are duplicates of the Scope PDF.

• Material to bid structure, scoping of infrastructure and pricing model.

Variable asset counts without rate variation

If AIIMS increases applications/servers/VMs above the indicative 70/50/200 during the firm 3-year price, will unit rates or change-order pricing apply, or is all variation absorbed in the lump-sum?

• Directly affects commercial risk and bid/no-bid on capacity.

Which experience criteria control technical qualification

Confirm whether bidders must satisfy both GeM 40/50/80% similar-service value criteria and ATC's three VAPT projects for Govt/PSU/Healthcare, and whether MSE/Startup experience relaxation waives any ATC bars (especially CERT-In and VAPT project count).

ISO 20000 compliance evidence

Is ISO 20000 certification or demonstrated ITSM compliance mandatory for technical acceptance, given it appears only in GeM core specifications and not in ATC section 5?

Onsite junior auditor employment and tool licensing model

Clarify expected employment model (vendor payroll only?), PF/payslip verification process, replacement SLA if resource exits before 1-year surety, and who must own commercial VA/PT tool licences used onsite.

• Payments tied to attendance, payslip and PF; tools said to be provided by junior auditor yet must be genuine/licensed and priced into VAPT.

External black-box testing authorization and window

Please confirm authorization process, allowed testing windows, production vs staging, and liability allocation for external black-box PT against live healthcare systems.

• High operational/clinical risk for AIIMS HMIS/clinical systems; affects methodology and insurance.

Financial penalties and SLA pressure

Cash penalties for missed audits, late reports and repeated failures, capped at 10% of quarterly invoice; poor reports trigger re-audit at vendor cost; persistent non-compliance can lead to immediate termination.

• Missed scheduled audit: Rs. 1,000/instance; report delay >7 days: Rs. 1,000/instance; repeated failure >3 times/quarter: Rs. 10,000.
• Critical vulnerability must be notified within 24 hours with multi-level escalation including possible CERT-In reporting.
• Dispute window only 7 working days after penalty notification.

Open-ended scope with firm lump-sum price

Indicative asset counts can be increased/decreased by AIIMS while prices remain firm for 3 years with no additional charges beyond quoted amount.

• Monthly VA across ~70 apps and ~250 hosts/VMs plus half-yearly/yearly PT and continuous onsite resource is capacity-intensive.
• Re-testing continues till certificate is generated—open-ended rework risk.

Payment and security cash-flow risk

No advance; quarterly pay only after reports, retests and certified attendance/PF checks; 5% ePBG for 38 months; EMD 2.1 lakh locked through evaluation.

• Payments due only after Performance Security receipt/verification under GTC.
• Penalties deducted before payment.

One-sided termination, liability and dispute settings

AIIMS may terminate for SLA breach, security incident from vendor negligence, misrepresentation, non-performance or resource failure; may recover losses; arbitration/mediation clauses are No; Delhi jurisdiction only.

• On termination, pay only for satisfactorily performed services up to termination date.
• Use of cracked/unlicensed tools = immediate contract termination.
• Land-border false declaration = immediate termination plus legal action.

Confidentiality and document-visibility risk

NDA and long confidentiality obligations apply, yet GeM setting shows bidder-uploaded documents to all participating bidders—sensitive proposal content may be visible to competitors.

• Confidentiality continues after contract end; third-party disclosure needs prior written AIIMS consent.

Onsite resource retention and healthcare operational risk

Full-time onsite junior auditor for 3 years with 1-year retention surety; external black-box testing of live clinical/HMIS systems creates high operational and liability exposure.

• Failure to deploy/maintain onsite resources is an express termination ground.

Inviting authority

Buyer organisation is AIIMS, New Delhi under Department of Health and Family Welfare, Ministry of Health and Family Welfare; Computer Facility issues the VAPT proposal.

• Office name on GeM: Aiims, New Delhi.
• ATC letterhead: Computer Facility, All India Institute of Medical Sciences, Ansari Nagar, New Delhi-29.
• File reference: CF-15/2/2023-Computer Facility (Computer No. 3210985).

GeM grievance / buyer emails

HOD Email: [email protected]; Buyer Email: [email protected].

• ATC lists Mr. Shyamal Barua, System Analyst, CF as Special Invitee; Mr. Sumit Kuhar, Store Keeper, CF as Special Invitee (did not attend TSEC).

Consignee / reporting officer and physical address

Consignee/Reporting Officer: Sumit; address 1st Floor, New Pvt. Ward, Store Section (CN Centre), AIIMS, Ansari Nagar, New Delhi, PIN 110029.

• Likely address for physical EMD delivery to Buyer (GTC requires hard copy to Buyer within 5 working days of opening); no separate EMD submission desk is named.
• EMD/PBG beneficiary style: AIIMS, Main Grant, All India Institute of Medical Sciences (AIIMS), Ansari Nagar, New Delhi.

TSEC / technical stakeholders named in minutes

TSEC chair Dr. Punit Kaur, Prof & HOD Biophysics; other members include Dr. Angel R. Singh, Dr. Vivek Gupta, Mr. Nalin Kaushik (NIC), Dr. Manish Bhardwaj (CSIR); end users Tripta, Sanjeev Kumar, Harish (Computer Facility).

• No phone numbers for these persons are printed in the documents.