What is a request for proposal?
A request for proposal (RFP) is a formal document an organization sends to potential vendors describing a need and asking each one to propose a solution: how it would meet the requirements, how it would deliver and support the solution, and what it would cost. It is used for purchases where vendors may solve the problem in different ways, such as a managed detection and response service, an identity platform or a SIEM replacement, and where price alone can't decide the winner.
What an RFP contains
- Background on the organization and the problem to be solved
- Functional, technical and security requirements, each marked mandatory or desired
- Instructions for the response format, so proposals can be compared side by side
- Evaluation criteria and their weights
- A timeline: question deadline, submission date, demos and the planned award date
- Proposed contract terms, often a draft MSA, that bidders must accept or mark up
Writing security into the RFP
The RFP is the cheapest point to make security part of the purchase. Every vendor prices its bid against the stated requirements, so a control added after the award becomes a paid change request. Security teams typically contribute requirements such as single sign-on through SAML or OpenID Connect, encryption of data at rest and in transit, a current SOC 2 Type II report or ISO/IEC 27001 certificate, a breach notification deadline, limits on where data may be stored and a full list of subprocessors. Mandatory requirements act as pass-or-fail gates before scoring begins. Because the vendor's written answers can be incorporated into the contract, they also leave a record of what was promised.
Example: weighted scoring
An RFP for a managed detection and response service weights functionality at 35 percent, security at 25 percent, cost at 25 percent and support at 15 percent, and evaluators score each proposal from 1 to 10.
| Criterion (weight) | Vendor A | Vendor B |
|---|---|---|
| Functionality (35%) | 9 | 8 |
| Security (25%) | 5 | 9 |
| Cost (25%) | 8 | 6 |
| Support (15%) | 7 | 8 |
| Weighted total | 7.45 | 7.75 |
Vendor A is cheaper and has more features, but Vendor B wins on the weighted total because of its security score. A third bidder, cheaper than both, was dropped before scoring because it could not meet the mandatory SSO requirement.
RFP vs. RFI vs. RFQ
- Request for information (RFI): early research that asks what solutions exist and what vendors can do, with no commitment to buy.
- Request for proposal (RFP): asks vendors how they would meet defined requirements, and at what price, then scores the answers.
- Request for quotation (RFQ): asks only for price and terms on something already fully specified.
Large purchases often run in that order: an RFI to learn the market, an RFP to choose an approach and a vendor, and sometimes an RFQ for follow-on hardware or licenses. Some buyers also ask for expressions of interest first to build a shortlist of qualified bidders.
Request for proposal on the CompTIA Security+ exam
RFPs, RFIs and RFQs are new to the Security+ objectives in SY0-801, which lists them under objective 5.3 as part of choosing vendors in third-party risk management. Wording such as "invite vendors to propose a solution," "scored against requirements" or "compare competing approaches" points to an RFP. If the organization is still researching what exists, the answer is an RFI; if the product is already chosen and only pricing is needed, the answer is an RFQ. A SOW is a distractor too, but it comes after selection, when the chosen vendor's specific work is defined.