Service Contract - Implement a Venerability Assessment and Penetration test

1. Reference
EU/WAPP-3/2025/01

2. Procedure 
simplified

3. Title program
EU Support to WAPP-3

4. Financing
ACT 61-029 Financing: Contract-NDICI AFRICA/2025/484-478

5. Contracting authority
Official Name: West African Power Pool Secretariat General (WAPP)
Legal form: Specialized institution of ECOWAS

CONTRACT SPECIFICATION

6. Nature of contract
Overall price

7. Contract description

The West African Power Pool (WAPP) has received financial support from the European Union (EU) under the ACT 61-029 Financing Agreement to enhance operational efficiency, market readiness, and digital transformation across the regional electricity market. Within this framework, a dedicated budget line has been allocated to strengthen cybersecurity capabilities and safeguard WAPP’s digital assets, information systems, and critical market infrastructure.

As part of this initiative, the WAPP Secretariat intends to engage a qualified consulting firm to undertake a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) exercise. The assessment will cover the Information and Coordination Center (ICC), ICT infrastructure, regional system for monitoring and control as well as the inter-utility digital exchange platforms supporting the WAPP Regional Electricity Market.

The primary objective of the assignment is to systematically identify and evaluate potential weaknesses within WAPP’s Information Technology (IT) and Operational Technology (OT) environments, assess the robustness of existing defense mechanisms, and recommend practical, prioritized mitigation measures. The consultant will be expected to perform both automated and manual testing, simulate realistic cyberattack scenarios, and benchmark WAPP’s cybersecurity posture against international best practices and standards.

This exercise will contribute directly to improving WAPP’s cyber-resilience, protecting critical assets from emerging threats, and ensuring the confidentiality, integrity, and availability of regional market data exchanges. The results will also serve as the foundation for a long-term Cybersecurity Improvement Plan and capacity-building roadmap aligned with WAPP’s digital modernization strategy. Additionally, the consultant will be expected to develop a roadmap for implementation of a Regional Security Operations Center for the WAPP.

8. Number and titles of lots
One lot only

9. Maximum budget
Value excluding VAT: N/A

CONDITIONS OF PARTICIPATION
10. Legal basis, eligibility and rules of origin

The legal basis of this procedure is Regulation (EU) No. 2021/947 establishing the Neighborhood, Development and International Cooperation Instrument – ​​Global Europe (NDICI). See Annex A2 of the practical guide.

For this contract award procedure, financed by NDICI geographic programmes, participation is open to all natural persons who are nationals of and legal persons (participating either individually or in a grouping – consortium – of candidates/tenderers) which are effectively established in a Member State of the European Union or in an eligible country or territory as defined under Article 28 of Regulation (EU) N° 2021/947.

11. Number of tenders
No more than one tender can be submitted by a natural or legal person whatever the form of participation (as an individual legal entity or as leader or member of a consortium submitting a tender). In the event that a natural or legal person submits more than one tender, all tenders in which that person has participated will be excluded.

Interested candidates can obtain the Request for Proposal (RFP) by sending an email request to the following address: cpm@ecowapp.org

12. Grounds for exclusion

As part of the tender, tenderers must submit a signed declaration, included in the tender form, to the effect that they are not in any of the exclusion situations listed in Section 2.6.10.1. of the practical guide.

Tenderer included in the lists of EU restrictive measures (see Section 2.4. of the PRAG) at the moment of the award decision cannot be awarded the contract.

13. Sub-contracting
Subcontracting is allowed.

PROVISIONAL TIMETABLE
14. Provisional commencement date of the contract
< February 2026 > (indicative)

15. Implementation period of the tasks
<From February 2026 to May 2026> (forecast)

SELECTION AND AWARD CRITERIA

16. Selection criteria
Capacity-providing entities

An economic operator (i.e. candidate or tenderer) may, where appropriate and for a particular contract, rely on the capacities of other entities, regardless of the legal nature of the links it has with them. If the economic operator relies on other entities, it must in that case prove to the contracting authority that it will have at its disposal the resources necessary for the performance of the contract by producing a commitment by those entities to place those resources at its disposal. Such entities, for instance the parent company of the economic operator, must respect the same rules of eligibility and notably that of nationality as the economic operator relying on them and must comply with the selection criteria for which the economic operator relies on them. Furthermore, the data for this third entity for the relevant selection criterion should be included in a separate document. Proof of the capacity will also have to be provided when requested by the contracting authority.

With regard to technical and professional criteria, an economic operator may only rely on the capacities of other entities where the latter will perform the tasks for which these capacities are required.

With regard to economic and financial criteria, the entities upon whose capacity the economic operator relates, become jointly and severally liable for the performance of the contract.

The following selection criteria will be applied to the tenderers. In the case of tenders submitted by a consortium, these selection criteria will be applied to the consortium as a whole if not specified otherwise. The selection criteria will not be applied to natural persons and single-member companies when they are sub-contractors.

The tenderer shall not use previous experience which caused breach of contract and termination by a contracting authority as a reference for selection criteria.

The selection criteria for each tenderer are as follows:
1) Economic and financial capacity (based on item 3 of the request to participate form, or on item 3 of supply tender form). In case of candidate being a public body, equivalent information should be provided. The reference period which will be taken into account will be the last three years for which accounts have been closed.
o Criterion No. 1. The average annual turnover of the candidate or tenderer for the years (2022, 2023 and 2024) must exceed EUR 90,000; and
o Criterion No. 2. Current ratio (current assets/current liabilities) in the last year for which accounts have been closed (2024) must be at least 1. In case of a consortium this criterion must be fulfilled by each member.

2) Professional capacity of the tenderer (based on items 4 of the tender form).
The reference period which will be taken into account will be the last three years preceding the submission deadline.
o Criterion No. 1. In the current year and the two previous years (2023, 2024, 2025), the candidate or tenderer has, on average, at least: 5 staff members directly employed or otherwise legally engaged, on a permanent or non-permanent basis, in areas of expertise relevant to this contract;
o Criterion No. 2. The candidate or tenderer is not in a situation of conflicting professional interests which could affect the performance of the contract. The presence of conflicting professional interests is examined on the basis of the declarations made in the declarations of honor and, where applicable, the declarations and other documents submitted.

2) Technical capacity of tenderer (based on items 5 and 6 of the tender form). The reference period which will be taken into account will be the last (2023, 2024, 2025) preceding the submission deadline.

o Criterion
The candidate or tenderer has provided services under at least 2 contracts performed at any time in the last 3 years before the submission deadline (between 01/01/2022, and the date of submission). For each contract, the amount of the services provided shall not be less than EUR 70,000.
The services provided fall under the following areas: conduct a comprehensive Vulnerability Assessment and Penetration Testing (VAPT) to identify and mitigate risks across WAPP’s digital and operational systems, enhancing the security, reliability, and resilience of its regional electricity market infrastructure.

This means that the service contract the tenderer refers to could have been started at any time during the indicated period but it does not necessarily have to be completed during that period, nor implemented during the entire period. Tenderers are allowed to refer either to service contracts completed within the reference period (although started earlier) or to service contracts not yet completed. Only the portion satisfactorily completed during the reference period will be taken into consideration. This portion will have to be supported by documentary evidence (-statement or certificate from the entity which awarded the contract, proof of payment) also detailing its value. If a tenderer has implemented the service contract in a consortium, the percentage that the tenderer has successfully completed must be clear from the documentary evidence, together with a description of the nature of the services provided if the selection criteria relating to the relevance of the experience have been used.

17. Award criteria
Best price-quality ratio.

Award Criteria
Criterion: Best value for money
Type: Quality
Description: Please refer to the procurement documents
Weight: 80%
Type: Price
Description: Please refer to the procurement documents
Weight:20%

18. The Consultants will submit their Proposals electronically:
YES

Time limit for submission of tenders or requests to participate
o Technical and financial proposals in PDF format, each protected by its own password, must be sent by email only. Proposals must be sent no later than December 15, 2025, at 10:00 am Benin local time to the secure email address procurement @ecowapp.org

Financial Proposal: The Consultant shall send the financial proposal at the same time as the technical proposal, but in separate, clearly identified files and at the date and time indicated above, i.e. on December 15, 2025, at 10:30 am Benin local time.

o The financial proposal will be protected by its own password, different from that of the technical proposal.

Application emails must clearly state “Proposals - Implement a venerability Assessment and Penetration test”.

Minimum time frame during which the tenderer must maintain the tender
Duration in months: 3 months (from the date stated for receipt of tender)

TENDERING
19. Deadline for submission of tenders
The deadline for submission of tenders is specified in point 8 of the instruction to tenderers.

20. Tender format and details to be provided
Tenders must be submitted using the standard tender form for simplified procedures, the format and instructions of which must be strictly observed. The tender form is available from the following internet address:
https://wikis.ec.europa.eu/display/ExactExternalWiki/Annex#Annex-AnnexB(Ch.3):Servicecontracts, under the zip file called Simplified Tender dossier.

The tender must be accompanied by a declaration on honor on exclusion and selection criteria using the template available from the following Internet address:
https://wikis.ec.europa.eu/display/ExactExternalWiki/Annexes#Annexes-Ann...(Ch.2):General

Any additional documentation (brochure, letter, etc.) sent with a tender will not be taken into consideration.

20. How tenders may be submitted
Tenders must be submitted in English exclusively to the contracting authority, using the means specified in point 8 of the instructions to tenderers.

Tenders submitted by any other means will not be considered.

By submitting a tender, tenderers accept to receive notification of the outcome of the procedure by electronic means.

21. Alteration or withdrawal of tenders
After submitting a tender, but before the deadline for receipt of tenders, a tenderer may definitively withdraw its tender or withdraw it and replace it with a new one.
Tenderers may alter or withdraw their tenders by written notification prior to the deadline for submission of tenders. No tender may be altered after this deadline.

22. Operational language
All written communications for this tender procedure and contract must be in English.

23. Additional information
Financial data to be provided by the candidate in the standard application form must be expressed in EUR or XOF. If applicable, where a candidate refers to amounts originally expressed in a different currency, the conversion to EUR shall be made in accordance with the following BCEAO exchange rate 1 EUR = 655.957 XOF.