Compliance & certifications RFP Questions

Questions on the certifications and audit reports the vendor holds, such as SOC 2, ISO/IEC 27001, HITRUST, FedRAMP and PCI DSS, and on whether their scope covers the product you are buying.

90 questions to put to a software vendor, each with the reason to ask it, what a good answer looks like, the red flags and the follow-ups. Delivered as an Excel workbook that scores the answers for you.

Inside the Workbook

• 22 RFI questions for the long list
• 34 RFP questions for the shortlist
• 34 deep-dive questions for the finalists
• An evaluator guide on every question: why it matters, good-answer signals, red flags and follow-ups
• A weighted scorecard that totals each depth and each section from your 0–5 scores
• An RFP cover template in Word, to send with the questions

Sections

• Attestation reports & gap remediation (42)
• Scope of certification vs purchased product (14)
• Customer audit rights & artifact access (21)
• Compliance roadmap & in-flight certifications (13)

How the Questions Were Checked

A language model drafted the questions and a second model critiqued them. They were then audited in three passes for wrong citations, outdated standards, invented thresholds and unsupported claims. The audit made 196 changes, and the workbook lists every one with the old and new text.

Built For

IT, security and procurement teams running a software selection, and consultancies running one for a client. The Consultancy License covers use with any number of clients.