RFP Template for Vendors

Start with the job in plain words, agreed with the people who will use what you buy. Then list every requirement in a sheet, one row each, before anyone drafts the RFP.

Give each row a type. A gate is a pass/fail minimum, such as an insurance level or a security audit report. Everything else is scored, with weights that add up to 100%. Keep rows distinct, so nothing counts twice.

Keep gates few. The UK government's guidance for its own buyers points out that a mandatory threshold means excluding any bidder that doesn't meet it¹, however strong the rest of the bid. But never hide a true minimum in the scored list at a small weight, where a bid that fails it can still win.

Then fill in the column that makes scoring possible: what a complete answer must state. "Describe your security practices" invites prose that fits any vendor. "Send your own current SOC 2 Type II report and name your subprocessors" can be checked.

For each scored row, write what earns a 5, a 3 and a 1. In the template's example, a 5 on inventory accuracy needs a production rate of 99.5% or better, with its method and sample period. A production rate of 98% to 99.5% earns a 3.

Decide now how price will count and what happens to a missing answer. Then test the model. The UK guidance recommends trying it on a number of dummy bids (including low bids)¹ to check the results come out as expected. If a cheap, weak bid wins on paper, fix the weights.

Write rules that spread the bids apart. If most bids land on the same quality score, the guidance warns, price can still decide the contract even when quality carries more weight.

The RFP is the matrix turned into questions. Copy each row's wording into a numbered question, so what you send can't drift from what you score. A good RFP covers:

• Background and scope: what you're buying, for whom and for how long
• Every requirement as a numbered question, gates marked pass/fail
• The weights, and how price will be evaluated
• The response format: answers in your numbering, prices in your sheet
• Key dates: last day for questions, due date with time zone, decision date
• How you'll answer bidders' questions: in writing, to every bidder
• What happens to a missing or unclear answer

Publish the weights. US federal agencies must state the factors that will affect the award and their relative importance², though not the detailed rating method. Private buyers aren't bound by that, but published weights show vendors where to spend their effort. The detailed scoring rules can stay internal.

Proposals arrive in each vendor's own order and words. Map each one onto your matrix, row by row, and note the page every score rests on. A heading called "Security" doesn't mean the security row is answered.

The UK guidance calls for at least two evaluators to score each bid independently¹, then a meeting that agrees one score per answer, not an average. Have the same evaluators score every bidder's answer to a given question, and score price separately.

An answer about a nearby topic isn't a low score; it's a gap. Mark it "no answer," send that bidder a dated written question, and hold the total until it's resolved. Ask only for what the matrix asks: in the guidance's words, clarification is not an opportunity for bidders to improve their bids.

A blank cell lets the formula decide what the gap means. Excel's AVERAGE ignores empty cells but counts zeros³, so the gap drops out and the bidder is judged only on what it answered. A weighted total built with SUMPRODUCT treats non-numeric entries as if they were zeros⁴, so the same gap scores below the lowest possible mark.

A host's report stops at the host. In Amazon Web Services' shared responsibility model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud⁵. Customers secure what they run on it.

This template uses price per point, which the UK guidance describes as dividing the bid price by the quality score¹, with the lowest result winning. Since a cheap, weak bid can match a strong, expensive one, pair it with a published minimum score.

Paying more for a stronger bid is fine if you can say why. US federal buyers may accept a higher price when the perceived benefits of the higher priced proposal merit the additional cost⁶, with the reasoning documented. Hold yourself to the same test.

Hold the award while any gate on the leading bid is open, however far ahead it ranks. If the gate fails, go to the next eligible bidder by the method you published. The award letter gives the price and term, why the bid won, and dated next steps.

Send every regret letter the same day, with feedback sufficient to let each bidder understand why they received the score they did¹, as the UK guidance puts it. Never pass on what another bidder gave you in confidence. US federal rules, for example, forbid disclosing an offeror's cost breakdown, profit, overhead rates, trade secrets⁷ or other confidential business information to another offeror.

Before the RFP, a build vs buy analysis settles whether to buy at all. Before the winner gets your data, test its security report with the vendor risk assessment template. Then log the signed contract's deadlines in a contract summary. To start faster, open this template with Edit with AI: River builds your requirement matrix from what you tell it.