What is a request for quotation?
A request for quotation (RFQ), often called a request for quote, is a document that asks suppliers to state their price and terms for a product or service the buyer has already defined in full. Vendors are not invited to propose alternatives or designs; they quote on exactly what is described. Because the requirement is fixed, bids are compared mostly on price, delivery time, warranty and payment terms, and the lowest bid that meets every term usually wins.
What an RFQ includes
- An exact specification, such as model numbers or minimum hardware and software requirements
- Quantities, delivery locations and required delivery dates
- Warranty, support and maintenance terms
- Requirements the supplier itself must meet, such as being an authorized reseller
- How long the quoted price must remain valid, and when quotes are due
Security belongs in the specification
In an RFQ, a requirement that isn't written down won't be priced or delivered, because suppliers compete on cost and have every reason to quote the cheapest thing that matches the words. Security needs therefore go into the specification itself. For hardware that can mean a TPM 2.0 chip, firmware that supports Secure Boot, a minimum number of years of vendor security updates, and purchase through the manufacturer's authorized channel so that devices are genuine and their warranties and updates are valid. For software renewals it can mean a supported version and the same SSO and logging features the organization already relies on.
Example
A school district has already standardized on one model of managed network switch after testing it. It needs 40 more of that model, with five years of support and firmware updates, delivered to two sites before the summer break. The district sends an RFQ to four authorized resellers listing the exact model and support package, the quantity, the delivery dates and a requirement to register serial numbers to the district. Three quotes come back, and the lowest one that meets every term wins. No proposal or scoring panel is needed, because nothing about the solution is open.
RFQ vs. RFP vs. RFI
| Document | The buyer asks | Used when |
|---|---|---|
| RFI | Which options are out there? | The need is not yet defined |
| RFP | Which approach would you take, and for how much? | Vendors may solve the problem differently |
| RFQ | What will this exact specification cost? | The product or service is fully specified |
Request for quotation on the CompTIA Security+ exam
SY0-801 adds the RFQ, along with the RFP and RFI, to objective 5.3 as part of choosing vendors. Scenario wording such as "obtain pricing," "the product has already been selected" or "compare costs for a defined configuration" points to an RFQ. The RFP is the most tempting distractor: choose it only when vendors are asked to design or propose a solution. Choose the RFI when the organization is still learning what the market offers, and the SOW when a vendor has been selected and the specific work must be defined.