CIOPages

RFP Question Bank

What to ask a software vendor before you sign

2,644 questions on security, privacy, compliance, contracts, AI and support. Each comes with the reason to ask it, what a good answer looks like and the red flags. Read a free sample of any module below.

Whether the vendor can protect your data, prove it, and keep running: security controls, privacy and data protection, certifications and audits, sub-processors and the software supply chain, and business continuity.

Whether you can contract with the vendor and leave it: who the company is, references, pricing and commercial terms, contract and IP terms, insurance and financial risk, and exit.

For any product with AI in it: model governance, safety, bias and data provenance, human oversight, agent autonomy, performance evaluation, and AI cost.

Whether the product will work in your environment and keep working: hosting, integration, implementation, training, support, accessibility, localization, roadmap, and sustainability.

The complete library

All 27 modules in one workbook, for teams that run several selections a year and consultancies that run them for clients.

$1,999 Enterprise · $4,999 Consultancy

How the questions were checked

A language model drafted them and a second model critiqued them. Each module then went through three audit passes against the text of the laws and standards it cites. Every module page shows examples of what the audit changed.

Questions about the question bank

What is the difference between the RFI, RFP and deep-dive questions?

RFI questions go to every vendor on the long list and decide who is worth a proposal. RFP questions go to the shortlist with the RFP document. Deep-dive questions are for the last one or two vendors, usually in a workshop or with documents attached.

How do I score the answers?

Each question has a weight and a 0–5 score column. The workbook multiplies them and totals the results by depth and by section on a scorecard sheet. Every question lists what a good answer looks like, the red flags and the follow-ups to ask.

Who wrote the questions?

A language model drafted them and a second model critiqued them. Each module was then audited in three passes for wrong citations, outdated standards, invented thresholds and unsupported claims. The workbook lists every change with the old and new text. No named subject-matter expert wrote them.

Can a consultancy use them with clients?

Yes, with the Consultancy License, for any number of clients. The Enterprise License covers any number of evaluations inside one organization. Neither license allows reselling or republishing the question set.