VAPT RFP Template and Vendor Scorecard
A clear request for proposal (RFP) makes quotes comparable, and a scorecard makes the choice easier to explain to your management and your auditor. This guide lists what a VAPT RFP should contain and how to score the replies. A fill-in version of both is on the resources page.
Buying guides · By Thimmagurudu Bathini · Published · 3 min read
What the RFP Should Say
| Section | What to write |
|---|---|
| Purpose | Why you need the test: launch, customer request, audit, a regulator's rule, a recent change or an incident. |
| Scope | Each application, API, app, network range or cloud account, with names, addresses, versions, number of user roles and number of environments. |
| Test type | Black, gray or white box; internal or external; whether source code or red team work is included. |
| Environment and rules | Staging or production, testing windows, systems that must not be touched, notice to hosting providers. |
| Standards | The methods and lists you expect, such as the OWASP Top 10, OWASP API Security Top 10 and OWASP MASVS. |
| Compliance needs | Whether a regulator or standard requires a particular kind of auditor. If an empanelled auditor is required, say so. |
| Deliverables | A report for management and one for engineers, evidence for each finding, a walkthrough call, and a retest. |
| Timeline | Start date, report date, retest window. |
| Team | Who will test, their experience, and who is the contact. |
| Confidentiality | How findings and credentials are stored, who may see them, and when they are deleted. |
| Price format | A fixed price for the scope, what is excluded, how changes are priced and how GST is shown. |
What to Ask Every Vendor to Show
- A sample report, so you can judge the evidence and the fix advice.
- The method for each type of test, in writing.
- How false positives are removed before the report.
- What the price includes, including the retest terms.
- Who you will speak to during the test.
- Whether any of the work is done by subcontractors.
A Weighted Scorecard
Score each vendor from 1 to 5 on each line, multiply by the weight and add up. The weights below are a starting point. Change them to fit your case, and agree them before you read the replies.
| Criterion | Weight | Vendor A | Vendor B |
|---|---|---|---|
| Method and coverage fit the scope | 25 | 4 | 3 |
| Report quality: evidence and fixes | 20 | 5 | 3 |
| Team experience on this kind of system | 15 | 3 | 4 |
| Meets compliance or auditor requirement | 15 | 2 | 5 |
| Retest and support terms | 10 | 4 | 3 |
| Price clarity and value | 10 | 4 | 4 |
| Timeline and communication | 5 | 4 | 3 |
| Weighted total (out of 500) | 100 | 375 | 355 |
The scores here are invented to show the arithmetic. Add a pass or fail line for any must-have, such as a required empanelment, because a vendor that fails it should not win on points.
Mistakes to Avoid
- Comparing prices when scopes are different. Give every vendor the same scope document.
- Choosing on the lowest price alone. Ask what is left out.
- Skipping the sample report.
- Not asking who will do the work.
- Leaving out retest terms.
For the questions behind each line, read how to choose a VAPT company in India, and see what a test costs. A sample report shows what ours looks like, with invented data.
To plan a test for your own systems, request a scoping call, or download the pre-test checklist and scoping questionnaire.
Sources
Links checked on 5 November 2026.
- NIST SP 800-115, the security testing guide, planning and reporting a test
- OWASP Web Security Testing Guide, what a web test should cover
- CERT-In, the CERT-In panel of auditing organizations
Next Step
When you are ready to compare vendors, use the RFP template and vendor scorecard, read how to choose a VAPT company, and see what a test costs.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan Your Next Security Test
Tell us what needs Penetration Testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana