Objectives

The primary objective of this tender is to procure a service provider capable of supplying licenses, installing, configuring, and supporting a vulnerability assessment tool (such as Nessus or an equivalent industry-recognized solution) for a period of 24 months. The tool will enable the QCTO to conduct monthly internal vulnerability assessments and penetration testing, proactively identifying and managing security weaknesses within its IT environment to enhance cybersecurity posture and reduce reliance on external testing services.

Scope

The scope of the project includes:

• Provision of licenses for the vulnerability assessment tool (Nessus or equivalent).
• Installation and configuration of the tool on designated servers or workstations, ensuring compatibility with existing IT infrastructure (Windows Server, Windows 10/11 endpoints, network devices, firewalls, web applications).
• Implementation of the tool to perform unauthenticated vulnerability scans across the QCTO network, covering up to 500 IP addresses or assets.
• Configuration of the tool to generate detailed vulnerability reports, including scan results and critical findings.
• Provision of advanced support for the duration of 24 months.
• Training of five ICT technicians on the use, policies, troubleshooting, and remediation planning related to the tool.
• Delivery of a draft remediation plan post-installation and configuration.

Technical Requirements

The technical specifications for the solution include:

• Industry-recognized vulnerability assessment tool (Nessus Professional or equivalent).
• Compatibility with existing IT environment components such as Windows Server, Windows 10/11 endpoints, network devices, firewalls, and web applications.
• Capability to perform unauthenticated scans on up to 500 network assets or IP addresses.
• Ability to generate comprehensive vulnerability reports, including detailed findings and critical issues.
• Support for user roles and controls (e.g., Administrator, Scanner, Reader).
• Provision of end-user training for five ICT technicians, covering installation, usage policies, troubleshooting, and remediation strategies.
• Support and maintenance services for the entire 24-month period.

Skills Requirements

The tenderer must demonstrate the following skills and qualifications:

• Key personnel with industry-recognized technical certifications such as OSCP (Offensive Security Certified Professional) and either CEH (Certified Ethical Hacker) or CompTIA PenTestPlus(+).
• At least three (3) reference letters from similar projects completed within the last three years.
• Proven experience in deploying and supporting vulnerability assessment tools in similar organizational environments.
• Ability to provide comprehensive training to ICT staff on the use and management of the vulnerability assessment tool.
• Technical expertise in network security, vulnerability management, and remediation planning.