Penetration Testing RFP Template: What to Include

A formal Request for Proposal (RFP) is critical when selecting a penetration testing vendor. Instead of getting vague quotes or making a decision based on price alone, a well-structured RFP ensures you compare vendors on consistent criteria, clarify expectations upfront, and build a documented procurement process that satisfies compliance requirements.

In this guide, I'll walk through the essential sections of a penetration testing RFP, provide sample questions to ask vendors, highlight red flags in their responses, and give you a framework for evaluating and comparing proposals.

Why a Formal RFP Matters for Penetration Testing

Penetration testing is a high-stakes security service. A formal RFP helps you:

• Get comparable proposals: When all vendors respond to the same detailed requirements, you can compare apples to apples instead of piecing together fragmented quotes.
• Define scope clearly: Ambiguous scope is one of the top sources of conflict between clients and vendors. An RFP eliminates guesswork on what's included and what isn't.
• Reduce scope creep: By documenting the testing methodology, timeline, and deliverables upfront, you avoid surprise costs mid-engagement.
• Evaluate qualifications: You can ask vendors to provide certifications, case studies, and references specific to your industry or compliance needs.
• Meet compliance requirements: Many compliance frameworks (SOC 2, HIPAA, PCI DSS, NIST) expect documented vendor evaluation processes. An RFP provides that paper trail.
• Negotiate better terms: When multiple vendors are competing on the same RFP, you have leverage on pricing, timeline, and deliverables.

Key Sections to Include in Your RFP

1. Executive Summary & Business Context

Start with a brief overview of your organization, industry, and the business driver for the pentest. This helps vendors understand your risk profile and tailor their response. Example:

"We are a mid-market SaaS company in the healthcare data analytics space. We serve 200+ healthcare organizations and handle PHI/PII. Our compliance requirements include HIPAA, HITRUST, and SOC 2 Type II. We're conducting this pentest to meet our annual HITRUST assessment requirement."

2. Scope & Testing Objectives

Define what systems, applications, and infrastructure will be tested:

• In-scope systems: cloud applications, on-premises infrastructure, APIs, web apps, mobile apps, etc.
• Out-of-scope systems (third-party products you won't test, production databases, etc.)
• Testing types: external network pentesting, internal network pentesting, web application testing, API testing, social engineering, physical security, wireless, etc.
• Environment: development, staging, production, or a mix
• Evasion techniques: specify if you want the vendor to attempt stealth/evasion or if standard techniques are fine
• Known vulnerabilities: clarify if the vendor should focus on unknown vulnerabilities or also validate previously identified issues

3. Testing Methodology & Standards

Specify which methodology and standards the vendor should follow. Options include:

• OWASP Testing Guide (for web apps)
• NIST SP 800-115 (Technical Security Testing)
• OSSTMM (Open Source Security Testing Methodology Manual)
• PTES (Penetration Testing Execution Standard)
• Vendor's proprietary methodology (provided it's documented)

4. Timeline & Milestones

Specify when you need the pentest to occur and when deliverables are due. Include:

• Kickoff date and testing window (e.g., 2-week engagement starting June 1)
• Interim report or debrief meeting date
• Final report delivery date (typically 1-2 weeks after testing ends)
• Remediation timeline and follow-up testing window (if applicable)

5. Required Deliverables

Be explicit about what the vendor must deliver:

• Executive summary (C-suite friendly, high-level findings)
• Detailed technical report with findings, evidence, and remediation recommendations
• Vulnerability severity ratings (CVSS scores, business impact, etc.)
• Proof of concept (PoC) code or screenshots
• Prioritized remediation roadmap
• Remediation validation testing (re-testing after fixes)
• Compliance mapping (if needed, map findings to relevant standards)

6. Budget & Pricing Model

Specify your budget range and how you expect pricing to be structured:

• Fixed-price vs. time-and-materials
• Budget ceiling and what's included
• Any expenses beyond the main quote (travel, additional testing, rush delivery, etc.)

7. Vendor Qualifications & Certifications

Specify required certifications and experience:

• Certifications: OSCP, GPEN, GWAPT, GXPN, ECPPT, etc.
• Team size and composition (number of testers, lead tester experience level)
• Industry experience (healthcare, fintech, etc.)
• Company size and stability
• References (at least 3 recent references from similar-sized companies in your industry)

8. Compliance & Regulatory Requirements

If compliance drives the pentest, spell it out:

• Required compliance frameworks: SOC 2, HIPAA, PCI DSS, ISO 27001, NIST, CMMC, etc.
• Report acceptance by auditors or compliance bodies
• Subprocessor requirements (if your vendor must meet your subprocessor policy)
• Data handling and confidentiality agreements

9. Rules of Engagement & Responsible Disclosure

This section protects both you and the vendor:

• Type of testing allowed: live network testing, code analysis, documentation review, etc.
• Denial of service rules: is DoS testing allowed, and under what conditions?
• Social engineering scope: is phishing, vishing, or pretexting in scope?
• Responsible disclosure timeline: how long does the vendor have to report findings before they're made public?
• Liability and insurance: what liability coverage does the vendor carry?
• Remediation assistance: does the vendor help you fix issues after the pentest?

Sample RFP Questions for Penetration Testing Vendors

Beyond the sections above, ask these specific questions to get a sense of vendor capability and alignment:

1. Describe your penetration testing methodology, including recon, scanning, exploitation, and post-exploitation phases. How do you prioritize findings?
2. How many certified penetration testers will be assigned to this project, and what are their primary certifications?
3. How do you approach testing cloud infrastructure (AWS, Azure, GCP)? Can you test infrastructure-as-code and configuration security?
4. Do you have experience with [your specific tech stack]? Can you provide a case study or reference?
5. What compliance frameworks are you familiar with? Have you conducted pentests that satisfy [your framework]?
6. What is your responsible disclosure policy? How long do I have to patch findings before you disclose them?
7. Do you carry professional liability insurance? If so, what is the coverage limit?
8. Will you provide remediation guidance after the pentest? Is that included in the price, or is it additional?
9. How do you handle findings that are already known or not exploitable in our environment?
10. Can you provide references from [3] organizations in [your industry] that you've conducted pentests for in the past 12 months?
11. What happens if we discover a critical vulnerability mid-engagement? Can you pivot testing to focus on that issue?
12. Do you offer re-testing or validation testing after we've remediated findings?

Red Flags in Vendor Responses

Watch out for these warning signs when evaluating RFP responses:

• Vague methodology: If a vendor describes their approach as "industry-standard testing" without specifics, that's a red flag. Good vendors explain their process step-by-step.
• Unwillingness to discuss scope limitations: Every pentest has boundaries. A vendor that won't clearly define what's in and out of scope is setting up for conflict.
• No mention of rules of engagement: Professional vendors always clarify what they will and won't do (DoS, social engineering, etc.). If it's absent, ask.
• Weak or missing certifications: Testers should have at least OSCP, GPEN, GWAPT, or equivalent. If the lead tester has none of these, be skeptical.
• No insurance or liability coverage: A reputable vendor carries professional liability insurance. If they don't, that's a risk.
• Unrealistic pricing: A 2-week comprehensive pentest at $5,000 is likely to be underwhelming. Budget $25,000-$50,000+ for serious testing of mid-market organizations.
• Generic response: If the RFP response looks like a template that could apply to any customer, the vendor didn't do their homework.
• Poor references or unavailable references: If a vendor can't provide references or they won't return calls, that's telling.
• No mention of a report timeline: Good vendors commit to a report delivery date. Vague timelines are a red flag.

How to Evaluate and Compare Proposals

Create a scoring matrix to evaluate proposals objectively. Here's a template:

Criteria	Weight	Vendor A	Vendor B	Vendor C
Methodology alignment	20%	9/10	8/10	7/10
Team certifications & experience	25%	9/10	9/10	6/10
Industry experience	20%	9/10	7/10	8/10
Deliverable quality	15%	9/10	8/10	7/10
Pricing competitiveness	15%	7/10	8/10	9/10
Weighted Score	100%	8.85	8.05	7.55

Key steps:

1. Define weighted criteria: Weight factors based on what matters most to you (methodology, team quality, pricing, etc.).
2. Score each vendor: Score 1-10 on each criterion based on their RFP response, references, and interviews.
3. Calculate weighted score: Multiply each score by its weight and sum.
4. Conduct interviews or deep dives: Before finalizing, interview the lead testers from your top 2-3 candidates.
5. Check references: Call references and ask about the vendor's thoroughness, professionalism, and deliverable quality.
6. Negotiate final terms: Use the scoring to negotiate timeline, price, or deliverables with your top choice.

Best Practices for RFP Success

• Give vendors adequate time to respond. A 2-3 week RFP window is standard. Rushing vendors often leads to low-quality responses.
• Ask for references and call them. This is the most important validation step. Don't skip it.
• Be transparent about your budget. If you have a budget range, share it. It helps vendors scope appropriately and avoids surprises later.
• Include a technical discussion phase. After shortlisting vendors, schedule a 1-hour call to discuss approach, ask technical questions, and gauge communication style.
• Document everything. Keep copies of all RFP responses, scoring, and communications for your compliance records.
• Negotiate remediation testing upfront. Clarify if re-testing after fixes is included or additional. Factor this into pricing.
• Define your escalation point. Specify who on your team owns the vendor relationship and how critical issues will be escalated during testing.

Related Resources

For more on selecting and working with penetration testing vendors, check out:

• Questions to Ask a Penetration Testing Vendor
• How to Choose a Penetration Testing Vendor
• Penetration Testing Cost: What to Budget

Conclusion

A formal RFP process elevates your penetration testing vendor selection from a coin flip to a data-driven decision. By defining your scope clearly, asking the right questions, and scoring vendors objectively, you'll get better proposals, better pricing, and ultimately better testing. Use this template as your starting point, customize it to your organization's needs, and watch your vendor evaluation process become a competitive advantage.

Ready to request proposals from top pentesting vendors? Start with your RFP and use the evaluation matrix to compare. If you'd like to discuss your specific needs or want recommendations on vendors for your industry, get in touch.