An RFP for outside-threat services should ask the same core questions of every vendor, then add questions for the area bought. This list gives a common section and four area sections: threat intelligence, digital risk protection, external attack surface management and third-party risk. Copy the lines you need and score answers consistently.
- Use a common section plus an area section, and score every vendor the same way.
- Ask for evidence and a trial on your own data.
- Ask each vendor what it cannot do, and read the zero scores.
- Check legal and compliance claims against official texts.
How Should You Structure The RFP?
A request for proposal for outside-threat services works best when it is short enough for vendors to answer fully and strict enough to compare them fairly. Keep a common section for every vendor, add one section for the area you buy, ask for evidence rather than promises and score every answer on the same scale, so the result is easy to defend.
- Define scopeWhat you need found and who acts
- Send the listCommon plus area sections
- Score answersSame scale for all
- TrialShortlist, use your own data
- DecideReference calls and contract
Each area has a matching buyer’s guide: digital risk protection, threat intelligence and attack surface management.
What Are The Common Questions For Every Vendor?
- CompanyOwnership, years of operation, customer reference calls.
- Data handlingWhere data is stored, who can access it, retention and deletion.
- Security of the serviceIndependent security assessments and certifications, stated by the vendor with proof, such as ISO/IEC 27001.
- SubprocessorsWhich other companies touch our data.
- ExitCan we export all data and evidence at the end?
- SupportHours, language, response targets and escalation.
- PricingWhat drives cost, and what is excluded.
Which Questions Fit Threat Intelligence?
- Which source types feed the service and how is each checked?
- Is the intelligence tailored to our sector, region and assets?
- How is confidence shown for each item?
- Which formats and APIs are available?
- Can analysts ask the vendor questions, and how quickly are they answered?
- How do you handle false positives we report?
For scoring, use the threat intelligence evaluation checklist.
Which Questions Fit Digital Risk Protection And Attack Surface Management?
| Topic | Digital risk protection | External attack surface |
|---|---|---|
| Scope | Which channels are monitored and which are not? | Which asset types and clouds are discovered? |
| Evidence | What proof comes with each case? | How is ownership of an asset confirmed? |
| Action | Who files takedown requests and where? | How are findings sent to the owner? |
| Freshness | How soon is new abuse reported? | How often is the inventory refreshed? |
| Reporting | What do monthly reports show? | How is progress shown over time? |
The takedown checklist adds more questions if removal is part of the purchase.
Which Questions Fit Third-Party Risk?
- How are our suppliers added and kept up to date?
- Which external signals feed the supplier rating?
- Can we see the evidence behind a rating, and can the supplier respond?
- How are fourth parties handled?
- Does the service map to our rules, such as NIS2 or DORA? Ask for the vendor’s explanation, not a promise of compliance.
Public guidance on supplier security includes ISO/IEC 27036 and the NIST Cybersecurity Framework. Cite the parts you rely on. Risk and compliance owners can read the third-party risk and legal, risk and compliance pages.
What Mistakes Make An RFP Less Useful?
- Asking too many questions. Vendors answer with copied text when the list is too long.
- Asking yes or no questions only. Ask how, with evidence.
- Leaving out the trial. Documents can look alike while products do not.
- Weighting everything equally. Decide beforehand which sections matter most.
- Not involving legal and procurement early. Contract terms can decide the outcome.
Send the questions in a form that is easy to score, such as a table with one row per question, and ask vendors not to change the numbering.
How Do You Compare The Answers?
Put every answer in one sheet. Score each from 0 to 2 as described in the scoring section below, then add weights for your priorities. Read the evidence links and ask for a call on any answer that scores partial. Keep a list of claims you could not verify, since they should become contract terms or trial checks.
Bring in the people who will use the service for a short review of the finalists. Analysts, fraud staff and IT owners often notice usability problems that a document does not show. Reference calls with customers of similar size and sector are valuable too; ask what was harder than expected and what they would do differently.
Finally, keep the file. At renewal the same list tells you whether the vendor delivered what it described.
What Do The Main Terms In This Guide Mean?
Short definitions of the words used above, so that everyone in the buying team reads them the same way.
- RFP. A request for proposal: a document in which you set out needs and ask vendors to answer.
- Proof of concept. A short trial on your own data to check a vendor’s claims.
- Subprocessor. A company a vendor uses that may handle your data.
- Fourth party. A supplier of your supplier.
- Weighting. Giving more points to sections that matter most to you.
- Reference call. A conversation with an existing customer of the vendor.
- Exit clause. A contract term that sets how you get your data back when you leave.
What Should You Prepare Before Sending The List?
Write down the outcomes you want in plain words, the budget range you can discuss and the date by which you must decide. Name the people who will score answers. Agree how long vendors have to answer and how questions from vendors will be shared with all of them, so no one has an advantage.
How Do You Score The Answers?
Give each question 0 (no answer), 1 (partial) or 2 (full, with proof), and weight sections by importance to you. Compare totals, but also read the zeros: they show where a vendor cannot help.
Brandefense can be part of your shortlist with its platform covering the four areas. Request a demo and send the same list.
Sources And Further Reading.
These public bodies are the references behind the criteria in this guide. Open them and cite the exact page you rely on in your own paper.
- NIST Cybersecurity Framework: the six functions and the outcomes under each.
- ENISA: European threat landscape reports and guidance.
- CISA: advisories and the catalog of known exploited vulnerabilities.
- ISO/IEC 27001: the information security management standard that vendors often cite. Ask for the scope of any certificate shown.
Questions.
-
What questions should be in a threat intelligence RFP?
Ask about sources, tailoring to your sector, confidence, formats and APIs, analyst access and how false positives are handled.
-
How do you write an RFP for a cybersecurity service?
Define scope, send a common plus area question list, score answers on one scale and test shortlisted vendors on your own data.
-
What should a third-party risk RFP ask?
Ask how suppliers are added, what signals feed the rating, whether evidence is visible and how fourth parties are handled.
-
How to choose the right digital risk protection service?
Use the buyer's guide for scope, owner and model, then compare vendors with the digital risk protection questions here.
In Our Research
- 1 Your Security Vendors Are Your Highest-Privilege Third Parties, and Your TPRM Program Scores Them Low September 2026
- 2 Why Vendor Security Questionnaires Don’t Work (And What Actually Does) May 2026
- 3 CIO and IT director Role
- 4 CISO Role
- 5 Legal, risk and compliance Role
- 6 Procurement and finance buyer Role