EB-ITCB-11-2026

EmpowerBank wants a vulnerability assessment and penetration test of its systems within 14 days with a bid security of 300 and no scope published. Bids close 2 November 2026 at 13:00 CAT.

EmpowerBank is buying a vulnerability assessment and penetration test, at its Harare offices, over 14 days on Regular Agency Fund. The requirement is a single line repeating the title. For security testing that is the one thing that cannot be left out, because the scope is the price: no number of IP addresses or hosts, no application count, no distinction between external and internal testing, nothing on whether web applications, mobile apps, wireless or social engineering are included, and no mention of the core banking system. No methodology or standard is cited either — OWASP, PTES or similar — and nothing about whether a retest after remediation is expected, which is normal practice and a material part of the cost. A bid security of 300 is payable. The full tender document was not available to us, so download it from the source.

Moderate effort to bid.

Written from the published notice — the full tender document was not available to us. Download it from the source before bidding: eligibility rules, fees and specifications may only appear there.

• A bid security of 300 is required — the notice does not state the currency
• No tender document fee — the bid form fee is listed as 0
• Bids must stay valid for 60 days

• No scope is published — no host or IP count, no application count, and no split between external and internal testing
• No testing methodology or standard is cited, so proposals will not be comparable
• Nothing says whether a retest after remediation is included, which is normal practice and a real cost
• Fourteen days covers testing and reporting, which is tight if the estate turns out to be large
• The line is coded against an unrelated pharmaceutical product code

• 1 Oct 2026, 13:00 — Published by EMPOWERBANK