A workable RFP checklist moves a procurement through five phases in order: groundwork decisions before anything is drafted, the RFP document itself, submission and evaluation rules, award and negotiation, and post-award obligations. Each phase has specific items that have to be settled before the next one starts. Skip one and the problems surface later as change orders, bid protests, or a contract that doesn’t fit the need.
Before You Draft the RFP
Most procurement failures trace back to decisions that were never made before the solicitation went out. Settle these first.
- Define the scope. Write down exactly what the vendor will deliver, what stays in-house, and where the line sits between them. Scope creep is the single biggest driver of change orders, and locking scope early gives vendors a fair basis for pricing.
- Set a budget range. Base it on market research. A range lets the evaluation team weigh cost against quality. You don’t have to publish the range in the RFP, but you do have to have one internally.
- Run a make-or-buy analysis. Compare the cost of hiring a vendor against doing the work internally. This protects you later from questions about why competitive bidding was necessary at all.
- Assemble the evaluation team. Include subject-matter experts, not only procurement staff. Every member discloses potential conflicts of interest before seeing any proposals. Federal procurement rules bar evaluators from participating in any acquisition that could affect their personal financial interests, and most organizations apply the same standard.
- Build the timeline backward from your project completion date. A full RFP cycle from issuance through vendor selection generally runs three to four months: about a month for vendor responses, a month for evaluation, and several weeks for demonstrations and final negotiations. Add time on the front for internal approvals and on the back for contract finalization.
When an RFP Isn’t Required
Not every purchase needs full competitive bidding. Federal grant recipients can use noncompetitive procurement when the total cost falls below the micro-purchase threshold, the item is available from only one source, or an emergency doesn’t allow time for competition. Most state and local procurement codes carry similar exceptions. If your situation fits one, you’ll need a written sole-source justification explaining why competition was impractical, but you won’t need the full RFP apparatus.
What to Put Inside the RFP Document
Every section of the RFP has to give bidders enough information to price their work accurately. Vague requirements produce vague proposals, and vague proposals produce expensive surprises after signing.
Technical Requirements and Deliverables
This is where most of the drafting effort belongs. List every specification the solution must meet, organized so vendors can respond point by point. Be concrete about deliverables. “Weekly progress reports” and “a finalized software build delivered to a staging environment by a specific date” are actionable. “Regular updates” and “a working product” are not. Once work starts, leverage shifts toward the vendor, so getting technical requirements right upfront is the single highest-value activity in the entire RFP.
Performance Metrics
Define how you’ll measure success before the vendor starts work. For technology services, that might mean uptime guarantees or response-time thresholds. For manufactured goods, defect rates or compliance with specific quality standards. Spelling these out in the RFP lets vendors factor quality assurance costs into their initial pricing instead of treating them as add-ons later.
Insurance, Bonds, and Liability
Specify every policy the winning vendor must carry. Most organizations require general liability coverage, commonly $1 million per occurrence, along with workers’ compensation and professional liability (errors and omissions) coverage sized to the scope of work.
For projects involving sensitive data, consider requiring a dedicated cyber liability policy. If the vendor handles protected health information, a Business Associate Agreement is required under federal law, and the cyber policy should reflect the additional exposure. Organizations often require that the vendor’s policy name the client as an additional insured and stay in force for a defined period after the contract ends.
Construction and large service contracts often require performance bonds. In federal procurement, performance bonds on contracts exceeding $150,000 must equal 100 percent of the contract price, with additional bonding required if the price increases during execution. Payment bonds follow the same structure. Even outside federal procurement, a performance bond protects against vendor default: the surety company steps in to complete the work or compensate the organization.
Data Security
Any RFP involving technology, data processing, or access to organizational systems needs explicit data security clauses. Define which categories of data the vendor will handle (personally identifiable information, financial records, health information, intellectual property) and mandate specific technical safeguards: encryption for data in transit and at rest, role-based access controls, multi-factor authentication, and regular vulnerability assessments.
Referencing an established framework gives vendors a clear compliance target. Common choices are the NIST Cybersecurity Framework, SOC 2, and ISO 27001. For healthcare data, HIPAA compliance is non-negotiable. Requiring compliance to be shown through audits or third-party certifications is more reliable than accepting self-attestation.
Accessibility Under Section 508
If your organization is a federal agency, or the end product will be used by one, Section 508 of the Rehabilitation Act requires that all information and communication technology be accessible to people with disabilities. That covers websites, software, mobile applications, electronic documents, and hardware. Compliance is measured against the Revised 508 Standards, which incorporate WCAG 2.0 Level A and AA success criteria for both web and non-web electronic content. Federal agencies must evaluate Section 508 conformance during procurement planning, and testing is required whether the product is commercial off-the-shelf, open source, or custom-built. If no fully conformant product exists, the agency selects the option that best meets the standards and documents a “best meets” exception.
Vendors typically document compliance through a Voluntary Product Accessibility Template, which maps their product’s features against the applicable standards. Requiring a completed VPAT as part of the proposal submission is the most efficient way to evaluate accessibility during scoring. Private-sector organizations increasingly include accessibility requirements in their RFPs as well.
Submission Rules and the Scoring Rubric
Clear submission rules are the foundation of a defensible procurement. Every vendor plays by the same rules, and the organization has documentation to justify its decisions if anyone challenges the outcome.
Submission Requirements
Specify the format (PDF, online portal, hard copy), the exact deadline down to the minute and time zone, and where to submit. Under federal procurement rules, any proposal received after the deadline is late and will not be considered, with very narrow exceptions like government system failures. Most organizations follow the same hard-cutoff approach. Say so in the RFP itself.
List every document a proposal must include to be responsive: financial disclosures, proof of insurance, tax identification numbers, reference contacts, and any required certifications. Missing a mandatory element is grounds for disqualification in most procurement frameworks. Providing templates for financial disclosures and reference forms reduces errors and makes evaluation easier.
The Weighted Scoring Rubric
A weighted scoring rubric is the primary tool for objective vendor selection. Federal procurement regulations require agencies to evaluate proposals solely on the factors stated in the solicitation, and the principle applies broadly to any organization that wants its selection to hold up under scrutiny. Assign a specific point value to each evaluation factor (for example, 40 points for price, 30 for technical approach, 30 for past performance) and publish the rubric in the RFP so vendors know exactly how proposals will be judged.
Federal rules require that price and past performance be evaluated in every competitive acquisition above the simplified acquisition threshold. The source selection decision must be documented and must reflect the decision-maker’s independent judgment, including the rationale for any tradeoffs between cost and non-cost factors. A documented, criteria-based decision is far harder to challenge than one that looks subjective.
Require vendors to provide contact information for previous clients who can speak to their work. Three references is a common minimum, and the verification step often reveals issues that wouldn’t surface from the written response alone.
Running the Q&A and Protecting the Evaluation
Once the document clears internal review, distribute it through a procurement portal or verified distribution list. The distribution method matters less than consistency: every potential bidder receives the same document at the same time.
The Question Window
Open a formal Q&A period so vendors can seek clarification. Two weeks is common for complex solicitations, with answers posted at least ten days before the submission deadline so vendors can adjust their proposals. One rule governs the window: every answer goes to every bidder at the same time. Anonymized Q&A logs on the procurement portal are the standard approach.
Amendments
If you need to change requirements after the RFP is live, issue a formal amendment to all parties. Under federal rules, amendments issued before the submission deadline go to everyone who received the solicitation; amendments issued after go to all offerors still in the competition. If a change is substantial enough that additional vendors would have bid had they known, cancel the solicitation and reissue it rather than patching it.
Communication Blackout
Once proposals come in, limit contact with vendors to what is strictly necessary. Federal procurement integrity rules prohibit evaluators from discussing the acquisition with offerors outside of formally documented exchanges, and they bar evaluators from seeking employment with any company whose proposal they’re reviewing. In private-sector procurement, a blackout period that routes all vendor communication through a single point of contact prevents the appearance of favoritism and protects the evaluation.
Negotiation, Final Offers, and Award
Evaluation doesn’t always end with the first round of scoring. For complex procurements, the organization may enter a negotiation phase with top-ranked vendors.
In federal procurement, the contracting officer establishes a “competitive range” of the most highly rated proposals. Only vendors in that range participate in discussions, which address ambiguities, perceived weaknesses, or cost concerns. Discussions can’t be used to coach a vendor into fixing fundamental deficiencies. The goal is refinement.
At the end of discussions, each vendor still in the competitive range gets one chance to submit a final proposal revision, sometimes called a best and final offer. The organization sets a single cutoff for all revisions and advises vendors it intends to award without further rounds. That pressures vendors to put their strongest terms forward.
The source selection authority then makes the final decision based on a comparative assessment of proposals against every evaluation criterion in the solicitation. The decision must be documented, including the rationale for any tradeoffs: why a higher-priced proposal was chosen over a lower one, or why a vendor’s past performance concerns were outweighed by their technical approach. This documentation is the organization’s primary defense if the award is challenged.
After the Award: Notifications, Debriefings, and Protests
Notify unsuccessful vendors promptly. Under federal procurement rules, the contracting officer must provide written notification within three days of contract award to every offeror that was in the competitive range but not selected. The notice includes the number of offerors solicited, the number of proposals received, the name of the winning vendor, and, in general terms, the reasons the unsuccessful proposal wasn’t accepted. Confidential business information like cost breakdowns, profit margins, and trade secrets stays out of the notice.
Unsuccessful vendors have a right to request a debriefing. Cover only that vendor’s own proposal: how it scored, where it fell short, and the relative advantages of the winning bid. Stick to the reasoning used during evaluation. Introducing new rationale that wasn’t part of the original scoring creates vulnerability to a protest. Keep a written record of every debriefing.
Bid Protests and the Automatic Stay
A bid protest is a formal challenge to the award decision, and the possibility of one should inform every earlier step. At the federal level, a protest filed with the Government Accountability Office must be submitted within ten days after the protester knew or should have known the basis for the challenge. If a required debriefing was requested, the deadline runs from the date the debriefing is held rather than from the award notice.
Filing a protest triggers an automatic stay: the agency can’t award the contract, or if the contract has already been awarded, can’t allow performance to proceed, while the protest is pending. The GAO must receive a complete agency report within 30 days and generally decides the protest within 100 days. The stay can be overridden only if an agency head makes a written finding that urgent and compelling circumstances affecting U.S. interests won’t permit waiting for the decision.
The best defense against a protest is a clean process. Document every evaluation decision, follow the published criteria without deviation, treat all vendors identically, and keep the administrative record complete. Most successful protests don’t hinge on a substantive disagreement about who should have won; they hinge on a procedural mistake the agency could have avoided.
Tax Paperwork Once Payments Start
Once vendor payments begin, reporting obligations are easy to overlook. For payments made on or after January 1, 2026, file Form 1099-NEC for any non-employee vendor who receives $2,000 or more in aggregate payments during the calendar year. This threshold increased from the longtime $600 floor and will adjust annually for inflation starting in 2027. Backup withholding obligations kick in at the same $2,000 threshold if the vendor hasn’t provided a valid taxpayer identification number.
Collect a completed W-9 from every vendor before the first payment. Chasing tax documentation after the fact compounds as the year goes on, and failing to file required 1099s can result in IRS penalties. Build the W-9 into the contract onboarding checklist rather than treating it as an afterthought.