INFORMATION SECURITY ASSESSMENT
RFP CHEAT SHEET

What milestones and timeline (dates for starting,ending, performing testing, etc.) do you require?

Define vendor selection criteria and assign weighs toeach factor based on its importance to you.

What reports and other deliverables do you expect toreceive? (For reports, outline desired table of contents.)

Consider what information about the vendor’s
companies you require (e.g., revenue, locations, etc.).

Planning the Security Assessment RFP

What type of a security assessment do you need(vulnerability assessment, penetration testing, etc.)?

Ask clarifying questions from RFP responses before
making your selection.

Consider whether you’ll benefit from issuing the RFP orwhether a less formal process is better for you.

What is a “must have” and what is a “nice to have” forthe desired assessment?

Inquire about the vendors’ references for the type of
project you’re looking to conduct.

If you’re not familiar with the services you need,consider issuing an RFI, rather than an RFP.

Describe the size of the environment in scope for theassessment (number of systems, applications, etc.).

Review the vendor’s sample assessment reports.

Consider requiring an NDA if an RFP responder asks forsensitive details for preparing a response.

•About Your Organization: Outline the nature ofyour business, workforce size, location details, etc.

Distributing the RFP•

RFP Process: Clarify selection criteria, RFP timeline,submission guidelines, vendor qualifications, etc.

•Assessment Requirements: Discuss assessment
objectives, scope, your infrastructure details, etc.

•Assessment Deliverables: Explain the expected
deliverables, including reports and discussions.

•Terms and Conditions: Include the text provided byyour organization’s legal and procurement teams.

Tips for issuing and reviewing Request for Proposal(RFP) documents for information security assessments.

Understand what’s driving your need for the security
assessment, so you can be specific in the RFP.
Identify the individuals who should participate in thedevelopment of the RFP and in the review of responses.
Consider whether your environment is ready to beassessed, or whether it’s best to wait.
Understand and confirm your staff’s availability during
the assessment to support the project.
Identify and avoid conflicts with other projects during
the assessment (e.g., rollout of a new application).
In the RFP, describe the benefits of working with yourorganization to entice more vendors to respond.

Supporting the RFP Process
Consider various teams’ perspectives (legal, IT, audit,etc.) to ensure support for the RFP and the assessment.
Decide on a realistic timeline for the RFP process,allocating sufficient time for a responses and review.

Decide whether you’ll benefit from a large pool of RFP
responders or whether you prefer hand-picking thevendors whom you’ll invite to respond.
Consider finding potential RFP responders byresearching speakers and authors who’ve
demonstrated security assessment expertise.
If you maintain a list of firms interested in your RFPs,contact them; if you don’t, consider creating such a list.
To meet promising RFP responder, participate insecurity events (SANS, Infragard, ISSA, OWASP, etc.).
Request a commitment to respond by a specific date, soyou know whether to expect a sufficient number of RFP
responses; if necessary, invite additional responders.

Typical Elements of an RFP DocumentDefinitions
Request for Proposal (RFP): A structured documentused to solicit proposals for services or products
Request for Information (RFI): A document, often lessformal than an RFP, used to assess available offerings

Consider sharing the RFP with the vendors with whom
you already have a good working relationship.

Non-Disclosure Agreement (NDA): A contract requiring
the parties to protect sensitive data they exchange

Define a process for handling the RFP responders’questions fairly and comprehensively.

Security assessment: A structured test of IT
infrastructure, usually used to assess security posture

Selecting the Security Assessment Vendor

Additional RFP References

Request itemized pricing from the RFP responders, tosimplify the comparison of proposed services and costs.

Assess the expertise of the individuals the vendor willassign to your security assessment.

Beyond the Template: Writing an RFP That Works
http://sourcingmag.com/content/c070228a.asp

Define the process for receiving timely answers to thequestions you may have after reviewing RFP responses.

Confirm the availability of the vendor’s staff inaccordance to your timeline and location requirements.

Sample RFP for Security Risk Assessment … Project
https://iapsc.org/...RiskAssessment.pdf

Defining the Assessment’s Details

Consider inquiring about the background checks thevendor performed on the staff assigned to the project.

Truths and Tips on the Flawed RFP Process
http://cio.com/article/193501

Confirm a realistic budget for the assessment,accounting for your requirements and market prices.
Clarify how the RFP responses should be submitted(email, fax, paper mail, etc.) and who will receive them.

What business and IT objectives, including compliancerequirements, should the assessment support?

Examine the vendor’s project management capabilities.

Authored by Lenny Zeltser, a seasoned business and technology leader with extensive information security experience. Special thanks for feedback to Hana Park and Jefferey Saiger. This cheat sheet is
distributed according to the Creative Commons v3 “Attribution” License. File version 1.5. If you liked this reference, take a look at Lenny’s other cheat sheets for IT and information security professionals.