Vulnerability Assessment of IT and OT System, ISO 27001

Tender download window

Tender document download starts 20.08.2026 at 11:00 AM and ends 02.09.2026 at 12:00 PM (NIT schedule).

• TN5577.pdf tender-event table prints last download time as 12:00 AM on 02.09.2026, while the multi-NIT notice for TN-5576/5577/5579 prints 12:00 PM; bid submission end is consistently 02.09.2026 12:00 PM.
• No corrigendum changes these dates.

Online bid submission window

Online submission starts 20.08.2026 (12:00 PM per NIT; 12:00 AM per TN5577) and closes 02.09.2026 at 12:00 PM.

• Bids are to be submitted online on http://eproc.rajasthan.gov.in.
• Price bid opening date is to be intimated later to techno-commercially qualified bidders.

UTR / fee intimation deadline

UTR details for tender cost + processing fee + EMD, with Tender Application Form, must be intimated by 02.09.2026 12:00 PM.

• Mode: email / in-person / by post.
• NIT lists O/o SE (Contracts), KSTPS, Kota with email [email protected] (CC [email protected]); TN5577.pdf repeatedly says office of SE (MM), KSTPS, Kota (see contradictions).

Technical bid opening

Online opening of technical bid: 03.09.2026 at 03:00 PM.

Bid validity

Bid remains valid for 180 days from the date and time on which tenders are opened.

• Bidder may not withdraw/amend/impair the offer or withdraw EMD within this 180-day period.

Pre-bid / clarification deadline

No pre-bid meeting date is scheduled; clarifications must be sought before technical bid opening.

• After technical bid opening on e-portal, no correspondence on clarifications will be entertained.

Publication / NIT issue

Fresh NIT covering letter is dated 07/08/26; download/submission window opens 20.08.2026.

• NIT letter No. RVUN/CE(KSTPS)/D. 486 dated 07/08/26 directs newspaper publication of the tender notice.

Estimated / BoQ value

Estimated cost Rs. 51.02 Lacs (ex-GST BoQ base Rs. 51,01,694.92); G-Schedule states Rs. 60.20 Lakhs including GST @18%.

• Percentage BoQ; bidder quotes Excess(+)/Less(-)/At Par on estimated rate.
• Goods and Service Tax payable extra as per prevailing rates (ITB); G-Schedule amount is stated incl. GST @18%.
• Quantities/value are tentative; payment for actual work done; Nigam does not guarantee payment of entire BSR amount.

EMD / bid security

EMD Rs. 1,02,040 (~2% of estimated value), preferably via single NEFT/RTGS with tender cost and processing fee; successful bidder's EMD converts to security deposit.

• Total single-transaction deposit (Tender Cost + Processing Fee + EMD) = Rs. 1,04,720.
• Account: RVUN Ltd. CC Collection, SBI Kota Thermal Power Sakatpura, A/c 10001320016, IFSC SBIN0031793.
• Registered RRVUNL contractors: A-class full EMD exemption; B-class exemption up to Rs. 50 Lac estimated value; C-class up to Rs. 25 Lac; excess above slab at 2%. Registration certificate to be scanned in technical bid and sent for exemption.
• Unsuccessful EMD refundable after finalization; no interest; no adjustment of other deposits; forfeiture rights if bidder not interested in executing order.
• Bank guarantee form is not prescribed; digital NEFT/RTGS is the stated mode.

Tender document fee and processing fee

Tender cost Rs. 1,180 (incl. GST) and e-procurement processing fee Rs. 1,500; both non-refundable.

• To be paid with EMD in one preferred digital transaction; tender cost and processing fee will not be refunded.

Security deposit / performance security

Security Deposit @10% deducted from running bills; EMD adjusted into SD; refund after 3 months of satisfactory completion subject to PF/ESI clearances.

• Additional Performance Security for unbalanced bid: if L-1 is more than 15% below estimated bid value, additional PS = 50% of unbalanced bid amount (positive difference of 85% of estimated bid value minus quoted bid amount); refunded only after satisfactory completion; forfeited if work not completed in time.
• No interest on security deposits.
• Separate stand-alone performance bank guarantee percentage is not prescribed beyond SD and unbalanced-bid APS.

Payment terms

No advance; payments against satisfactory work on milestone percentages in Annexure-I (ISO 30%, IT VA/PT 15%, OT VA/PT 7.5%, capacity building 22.5%, training 15%, each surveillance audit 5%); GST extra/as applicable; delayed-payment interest not payable.

• Section B also states 100% payment after deductions on monthly basis against satisfactory performance — conflicts with milestone schedule (see contradictions).
• Bills in triplicate to XEN/EIC, KSTPS; verified and forwarded via SE to Sr.AO/AO (O&M), KSTPS.
• Taxes deductible as applicable; remittance charges borne by bidder; penalties/LD deductible from payments.
• Price fall / short closure per RTPP Rules 2013 clause 29(2)(h).

Agreement stamp duty

Contract agreement on non-judicial stamp: Rs. 1,000 up to Rs. 50 Lac contract value; above that 0.15% limited to Rs. 25 Lac, or as per Rajasthan stamp duty; return executed agreement within 15 days of order.

• Acceptance of order to be conveyed within 7 days of receipt of order.

Legal status and basic registrations

Bidder must be an Indian company (Companies Act 1956/2013), proprietary firm, partnership firm, or Govt-owned entity, with PAN, GST (latest 3 months GST return), and last-three-FY ITRs.

• Documents: MoA/registration certificate as applicable; ITR copies; PAN; GST registration/returns.

CERT-In empanelment

Bidder must possess a valid CERT-In certificate or be CERT-In empanelled at the time of bidding.

• Document: copy of valid CERT-IN certificate.

Financial capacity — turnover and net worth

Minimum average annual turnover INR 60.20 Lakh over last 3 completed FYs; net worth positive in each of last 3 completed FYs; both evidenced by CA certificate with registration number/seal and address.

Technical experience — similar cyber security audit of IT and OT

In last 7 years ending last day of month previous to invitation: one similar WO ≥ Rs. 48.16 Lakh (incl. GST) OR two ≥ Rs. 30.10 Lakh each OR three ≥ Rs. 24.08 Lakh each for cyber security audit of IT and OT infrastructure.

• Acceptable clients: Central/State Govt. Department / PSUs / power sector / process industry / Enterprise / Private Sector.
• Documents: copy of PO and completion certificate.

Mandatory certifications and certified professionals

At bidding: valid ISO 27001:2013 or latest and ISO 9001:2008 or latest; minimum three certified professionals from any two of CCIE (valid), CIPPE, CISM, CISA, CISSP, IEC 62443, ISO 27001:2022 Lead Auditor/Lead Implementer.

• Employee proof: certificate from the bidder for number of technically qualified professionals employed.

Blacklisting / insolvency / conflict of interest declaration

Bidder must not be insolvent, in receivership, bankrupt, wound up, suspended, blacklisted/debarred by any utility/Govt agency, or have conflict of interest — self-declaration on Rs. 100/- Rajasthan non-judicial stamp paper.

• Wrong information may lead to rejection at any stage.
• Not more than one tender for a work by one contractor/firm.
• Breach of code of integrity may attract action under RTPP Act Sections 11(3) and 46.
• No JV/consortium eligibility pathway is stated; bidder status is single firm/company/entity.

Overall engagement

3-year works contract for Vulnerability Assessment of IT & OT systems and maintaining ISO 27001 across RVUN thermal, hydro and HQ locations.

• Four broad pillars: (1) ISO 27001:2022 implementation/maintenance and re-certification/surveillance support; (2) VAPT of IT & OT; (3) cyber security assessment and capacity building; (4) information security training & LI/LA certification of 5 RVUN employees.
• Also covers risk assessment/preparedness against AI-driven attacks and CCTV/VSS vulnerabilities (G-Schedule).

ISO 27001:2022 implementation, re-certification and surveillance

Gap assessment, control implementation, risk assessment, internal audit support, engage external certifying body for re-certification, and complete Surveillance Audits 1 and 2 to keep certificate valid three years.

• Deliverables include gap assessment report & mitigation plan (IT-OT), SOA assessment, updated asset inventory/control library/residual risk acceptance, detailed RA report, internal audit report & CAPA, and external audit handholding.
• Any ISO 27001:2022 changes/new standards to be incorporated without additional cost.
• Payment weight: implementation/maintenance/certification support 30%; each surveillance audit 5%.

VAPT of IT and OT, CCTV and AI-assisted attack preparedness

IT VAPT every six months (6 cycles); OT VAPT yearly (3 cycles); plus CCTV/VSS audit per MeitY 22.03.2026 guidelines and AI-assisted vulnerability preparedness per CERT-In 25.06.2026.

• Standards alignment: CEA Cyber Security Guidelines 2021 / Regulations-2025, CERT-In/MeitY practices, ISO 22301 BCMS, and other CERT-In/NCIIPC/CERT-Th/CERT-Hydro advisories.
• OT special rule: prefer passive VA / physical verification / planned outages; no exploitation if OT access found; exclude components that cannot tolerate downtime.
• Bidder supplies hardware/software for VA/PT.
• Deliverables: VAPT report with mitigations; CCTV audit report; AI gap analysis & remedial measures.

Cyber security assessment, CCMP/CII and trainings

Yearly cyber assessment & capacity building (network architecture, malware defence, sample config reviews, OT controls, policies, CCMP with 2 mock drills/year, CII review) plus structured trainings and ISO 27001 LI/LA certification for 5 RVUN staff in year-1.

• End-user awareness: 2 sessions yearly; dedicated trainings: top management, procurement, personnel (1 each/year) and IT/ISD (2/year).
• Also assist drafting cyber-secure procurement T&Cs and DPR for AI-aware C-SOC.
• Project team minimum profiles: Project Manager (Engg/MBA, 5 yrs, dual certs among CISA/CISM/CEH/ISO27001 LA/LI, 3 yrs IT security, 2 ISO27001 projects) and Team Members (Engg/MBA/MCA/BCA, 3 yrs, CEH or ISO27001 LA, 2 yrs IT security, 1 ISO27001 project).

Locations, asset volumes and timelines

Scope covers all listed RVUN thermal plants, hydro plants/circle offices and Jaipur HQ; work schedule from WO (T) through T+34 months for final OT VAPT/training.

• Thermal: KSTPS, DCCPP, KaTPP, CTPP-O&M, CTPP-SC, STPS-O&M, STPS-SC, RGTPP; Hydro: Mahi Ph-I/II, Rana Pratap Sagar, Jawahar Sagar, Gen circle Banswara & Kota; HQ: Vidyut Bhawan and LIC Investment Building, Lalkothi, Jaipur.
• Tentative IT assets: 10 firewalls, 1500 laptops/desktops, 300 switches, 1150 CCTV; OT: DCS/PLC/SCADA 50/69/18, servers/OWS/EWS 721, switches 307; quantities may vary ±10%.
• Key milestones: ISO impl/cert support T+5; IT VAPT T+4/10/16/22/28/34; OT VAPT T+10/22/34; capacity building T+4/16/28; training T+10/22/34; surveillance-1 T+17; surveillance-2 T+29.
• Generic GCC Clause 18 says contract period one year — conflicts with 03-year title/scope/schedule (see contradictions).

Submission mode and portal

E-procurement only on http://eproc.rajasthan.gov.in; two covers uploaded together; offline-only bids not contemplated.

• Bidders must enrol on eproc; Digital Signature Certificate Type-II or Type-III required to sign electronic bids.
• Upload stamped, signed and digitally signed specified sections; do not upload remaining tender sections/irrelevant papers.
• All tenders/accompanying documents addressed to CE (KTPS), RVUNL KSTPS, Kota.

Cover structure

Cover-I techno-commercial (fees proof, acceptance letter, Sections E/F/I/J/K, QR docs); Cover-II price bid/BOQ only.

• Price bid opened only for techno-commercially responsive qualified bidders; date intimated later.
• Missing/insufficient QR supporting documents → price bid not opened; generally no correspondence seeking missing documents.

Physical / email originals for fees

Filled, sealed and signed Tender Application Form + UTR/payment advice must reach by email/in-person/post before 02.09.2026 12:00 PM; also upload UTR in Cover-I.

• Emails: [email protected] and CC [email protected] (TN notice also lists [email protected]).
• Office named as SE (MM) in TN5577.pdf / SE (Contracts) in multi-NIT notice.
• EMD exemption registration certificate likewise to be emailed/sent before deadline.
• Allow 4–24 hrs for NEFT/RTGS confirmation — transact early.

Signing and attestation

Bid forms and acceptance letter must be filled, sealed, signed and digitally signed; self-declaration on Rs.100 Rajasthan NJ stamp; QR copies as specified.

• Deviations only via Section F (sealed & signed); otherwise deemed full compliance.
• Annexures A–D (SPP) form part of accepted tender conditions per acceptance letter.

No corrigendum issued in the available tender pack

Only Tendernotice_1.pdf, TN5577.pdf and BOQ_1046921.xls are present; no corrigendum/addendum/pre-bid reply document is included, so original document values stand.

• Finally applicable key values remain those in the NIT/techno-commercial documents: bid submission end 02.09.2026 12:00 PM; technical opening 03.09.2026 03:00 PM; estimated cost Rs. 51.02 Lacs; EMD Rs. 1,02,040; tender cost Rs. 1,180; processing fee Rs. 1,500; bid validity 180 days.

Contract period: 1 year (GCC) vs 3 years (title/scope/schedule)

Generic GCC Clause 18 states one-year O&M contract period, while the tender title, G-Schedule, ISO three-year validity and work schedule to T+34 months require a 3-year engagement — the specific 3-year scope/schedule should govern for this TN.

• Bidder should seek written confirmation that Clause 18's “12 months” is template text and does not cut short the 03-year ISO/VAPT programme.

Payment basis: monthly running bills vs milestone percentages

Section B Clause 10.01 provides monthly 100% payment against work done, while Section C Annexure-I fixes deliverable-wise % payments (ISO 30%, VAPT cycles, trainings, surveillance audits).

• Section C payment terms also say 100% after deductions against satisfactory performance without saying “monthly”.
• For pricing/cash-flow, the Annexure-I milestone table is the more specific commercial schedule for this cyber scope.

UTR receiving office: SE (Contracts) vs SE (MM)

Multi-NIT notice directs UTR intimation to O/o SE (Contracts), KSTPS; TN5577.pdf tender notice and ITB say office of SE (MM), KSTPS — same emails ([email protected] / cashier).

• Practical action: email both listed IDs and, if delivering hard copy, confirm receiving seat with KSTPS before deadline.

Start/last-download clock times: 12:00 PM vs 12:00 AM

Tendernotice prints online submission start and last download as 12:00 PM; TN5577.pdf prints 12:00 AM for those two rows, while both agree bid submission end is 02.09.2026 12:00 PM and opening 03.09.2026 03:00 PM.

• 12:00 AM on start day would be midnight (before 11:00 AM download start) — likely a typographical AM/PM error in TN5577.pdf; rely on portal clock and NIT 12:00 PM wording, and do not cut submission close to deadline.

Estimated value presentation: Rs. 51.02 Lacs vs G-Schedule Rs. 60.20 Lakhs

NIT/BOQ base is ~Rs. 51.02 Lacs without GST; G-Schedule states Rs. 60.20 Lakhs incl. GST @18% (mathematically 51,01,694.92 × 1.18).

• EMD Rs. 1,02,040 aligns with ~2% of Rs. 51.02 Lacs base.
• Turnover QR of INR 60.20 Lakh matches the GST-inclusive G-Schedule figure, not the ex-GST BoQ base.

Confirm governing contract duration (1 year vs 3 years)

Ask RVUN to delete/override GCC Clause 18's 12-month period and confirm the contract term is 36 months aligned to Annexure-I through T+34 and ISO certificate validity.

• Material to staffing, pricing and LD exposure.

Which payment regime applies — monthly or milestone %?

Seek written confirmation that Annexure-I percentages govern invoicing (and when each % becomes due), and that Section B “monthly basis” is only a residual generic clause.

• Also ask whether ISO 30% is payable only after external re-certification certificate is issued or after T+5 activities alone.

Who bears external ISO certification body fees?

Bidder must “appoint” the certifying authority for re-certification and surveillance — confirm whether certification-body fees are inside the quoted lump sum or reimbursable extra.

• Material cost risk on a Rs. ~51 L base contract.

OT live-system testing windows and liability for plant trips

Request site-wise list of testable OT assets, approved maintenance windows, passive-only assets, and written liability cap if testing coincides with generation loss.

• Clause requires stop on access without exploitation, but operational risk remains high across 8 thermal + hydro plants.

Definition of “similar work” for IT and OT experience

Clarify whether a single order covering only IT (or only OT), or ISO27001-only without VAPT, counts, and whether multi-year AMC values can be annualised to meet 48.16/30.10/24.08 Lakh thresholds.

• PQR requires “cyber security audit of IT and OT infrastructure” — conjunction may be read as both domains mandatory in each cited order.

Correct office/time for UTR submission and portal cut-offs

Confirm receiving authority (SE Contracts vs SE MM), mandatory email list, and whether 12:00 AM entries in TN5577.pdf are errors versus NIT 12:00 PM.

Liquidated damages up to 10% of contract value

Delay LD steps 2.5%/5%/7.5%/10% of contract price by delay band vs agreed timeline; max 10%; GST on LD extra.

• Agreed timelines are deliverable-specific (Annexure-I), so multiple concurrent LD exposures are possible.
• Additional generic workmanship penalties under Section B 21 (T&P/manpower/supervisor shortfalls, breakdown delays, incomplete daily work at 100% item value).

Security deposit cash lock and unbalanced-bid APS

10% SD from running bills plus possible 50%-of-unbalance additional performance security if bid is >15% below estimate; APS forfeitable for delay.

• SD refund only after 3 months post completion and PF/ESI annual returns/challans — long cash cycle on a 3-year job.
• No interest on EMD/SD.

One-sided termination / risk-and-cost and force majeure

Repeated lapses allow termination after 7 days' notice with risk-and-cost execution; force majeure notice within 24 hours and RVUN may still get work done at contractor's cost/risk for prolonged strike.

• Order acceptance deemed if not conveyed in 7 days.
• Price fall / short closure under RTPP Rule 29(2)(h).
• Quantity may vary ± and repeat order up to 50% under Annexure D.

Execution breadth vs low estimated value

Statewide multi-plant IT/OT/CCTV VAPT, ISO re-certification (including appointing CB), trainings and C-SOC DPR support for ~Rs. 51 L ex-GST over ~3 years is commercially tight.

• Asset counts may vary ±10%; no guarantee of full BSR payment.
• Bidder tools/hardware for VA/PT included; electricity/water free at one point only.
• No advance; no interest on delayed payments; certification and travel across Kota/Dholpur/Jhalawar/Chhabra/Suratgarh/Jaisalmer/hydro/Jaipur on bidder cost unless clarified.
• New ISO/standard changes must be absorbed without extra cost.

Blacklisting and integrity exposure

Theft incidents can trigger FIR, Rs. 1,000 token penalty per case and blacklisting for 3 years after >3 incidents; integrity breaches attract RTPP debarment actions.

• False bid information rejectable at any stage; EMD forfeiture if bidder not interested after award path.

Tight bid timeline and single-packet fee mechanics

From 20.08.2026 start to 02.09.2026 close (~13 days) with mandatory single NEFT of Rs. 1,04,720 and dual online+email/physical UTR path — high procedural rejection risk.

• Missing UTR scan makes tender liable for rejection; portal hanging is bidder's risk — no extension on that account.

Inviting / accepting authority

Chief Engineer, Kota Super Thermal Power Station (KSTPS), RRVUNL, Kota — tender inviting and bid-acceptance authority.

• Office: Administrative Building, Sakatpura, Kota-324 008.
• Regd. Office & H.O.: Vidyut Bhawan, Janpath, Jyoti Nagar, Jaipur-302005.
• Phone: 0744-2271134; Email: [email protected] / [email protected]; website www.energy.rajasthan.gov.in/rvunl.
• Tender No. RRVUNL/KSTPS/TN-5577/(CISO)/CE (KSTPS); technical sections signed by CISO, RVUN / XEN (CISO) / XEN (Contracts).

Fee UTR / Tender Application Form receiving contacts

Send TAF + UTR by email to [email protected] (and [email protected] per tender notice) with CC [email protected], or in-person/by post to SE (Contracts)/SE (MM) office, KSTPS, Kota.

• Physical submissions of fee intimation: O/o SE (Contracts) or SE (MM), KSTPS, Kota (documents conflict on designation).
• EMD exemption registration copies to same email set including [email protected].

Post-award correspondence and payment offices

Work-order clarifications to concerned Dy. Chief Engineer / Superintending Engineer, KSTPS, Kota; bills to XEN/EIC then Sr. AO/AO (O&M), KSTPS; RTGS form addressed to Sr. Accounts Officer (Thermal), KSTPS.

• Engineer-in-charge: KSTPS, RVUN, Kota and authorised AEN/JEN.
• Jurisdiction of courts: Kota.

e-Procurement helpdesk

e-Procurement Cell, RISL, Yojana Bhawan, Tilak Marg, C-Scheme, Jaipur; Helpdesk 0141-4022688 (10:00 am–6:00 pm working days); [email protected].

• Portal: http://eproc.rajasthan.gov.in

Appellate authorities (grievance)

First Appellate Authority: Purchase Committee-I; Second Appellate Authority: The Secretary (Energy), Govt. of Rajasthan.