Download the template
First published Nov 27, 2023. Updated and expanded May 29, 2024.
Looking for the right MSSP (managed security services provider)?
Unfortunately, not all MSSPs are created equal. Some specialize in certain cybersecurity controls while outsourcing other controls to a third party.
Some only handle cybersecurity. They don’t cover the related IT managed services.
If you’re going to choose the right MSSP, you need to perform a rigorous evaluation of any vendor you’re considering.
Use our FREE Cybersecurity RFP Template to put every vendor through their paces. Our template covers:
- Your current IT/cybersecurity landscape
- Your company details
- Vendor details
- Required cybersecurity services
- Roles and responsibilities
- Required SLA/SLO(s)
- Service guarantees
- Legal requirements
Download our FREE RFP Template now to start evaluating MSSPs.
Why use an RFP template for cyber security?
If you’ve never gone through a proposal process for cybersecurity services, it’s tough to know if you’ve covered everything. Cybersecurity touches every part of the organization and every system, which means your RFP must be incredibly thorough.
A template from a top-rated MSSP (like Corsica Technologies) brings together everything we’ve learned in 30+ years in business. We understand the essential core that must be present in every cybersecurity proposal, and our template covers every aspect of these essential core services.
Of course, every organization is unique. Some common requirements may not apply to you–or you may have unique needs that aren’t covered in the template. Because the document is a simple Excel spreadsheet, you can edit as needed to fit your scenario. But even if you need to make changes, you’ll save time and manpower by starting with a template that’s 90% ready for you to use. That’s the intent behind our cybersecurity proposal template.
Using the RFP process to be your own advocate
The first thing is to understand your own needs. If you’re not sure what the scope of the MSSP RFP should be, this template helps you put your needs first–so you don’t get sucked in by MSSPs who want to control your destiny.
Filling out the template will also encourage you to get internal information from across your organization to ensure you cover all your bases.
Once you have your own needs fully scoped, you want to evaluate potential partners rigorously. Not all MSSPs are created equal, and you want to flush out anything that won’t work for your company. For example, some MSSPs may outsource the cyber security portion of their services. Others may specialize in certain security disciplines without offering comprehensive coverage.
While there are no right answers, you should use the RFP process to get a transparent view into the strengths and weaknesses of each MSSP.
Download our FREE template now to start your RFP process.
RFP template details
The key with any RFP is to cover all your bases–and that’s especially true of cybersecurity. You want to get a clear picture of what each MSSP can do, how they operate, and how well they align with your needs and your organizational culture.
That’s why our template covers everything you need to know:
About your organization
- Industry
- Vision and mission
- Ownership and funding
- Applicable regulations (if known)
- Current compliance with regulation (if known)
- Time since last cybersecurity risk assessment
- Outcome of last cybersecurity risk assessment
- Purpose of RFP
- RFP process and timeline
Your IT/cybersecurity landscape
- Current IT services delivery model
- Current cybersecurity services delivery model
- Email and collaboration suite used
- User workstations
- Network specifications
- Cloud environments (if any)
About the vendor
- Vision and mission
- Ownership and funding
- Capabilities and specializations
- Relevant certifications and partnerships
- Demonstrated success assisting companies in the same industry to achieve regulatory compliance
- Differentiation from other MSSPs
Required cybersecurity services
For each discrete service in the RFP template, the vendor will indicate whether they have in-house competency in that service. You can remove any services that aren’t relevant to your environment before sending out the RFP.
- Managed Detection and Response (MDR)
- Information Security Policy Library
- Infrastructure and Server Monitoring (SIEM)
- Microsoft 365 Monitoring (SIEM)
- Security Alerting and Containment
- Secure Internet Gateway
- Dark Web Monitoring
- Phish Testing and Security Awareness Training
- Email Protection
Roles and responsibilities
- What roles and responsibilities does the vendor cover?
- What roles and responsibilities remain with the client?
Cybersecurity incident response warranty
- Does the vendor offer a Service Guarantee covering the cost of their services to remediate a cybersecurity incident?
- How many incidents are covered per 12-month term?
- What are the coverage limits for various incident types?
Download the template