$ rfp --template

Twelve questions to send to every shortlisted vendor. Every quote-only vendor in this index should answer all twelve in writing before you sign.

$ answer --question="What should a pen-test RFP cover?"

Day-rate and day-count, retest, attestation letter, out-of-hours premium, change-order rate, consultant substitution, data handling, redacted-report format, executive readout, escalation triggers, and year-two pricing. Twelve questions in total. The template below covers each.

Last verified June 2026

$ stat --slot=1

Questions in the template

Every one is a real cost driver

$ stat --slot=2

Vendors who route to a quote

Send the template to each of them

$ stat --slot=3

2-3 wk

Typical RFP turnaround

Vendor-dependent

$ stat --slot=4

100%

Should answer in writing

Not on the call

$ questions --list

What is the day-rate for the senior consultant who will lead this engagement?
why ask Surfaces the underlying unit cost behind the headline quote.
How many days are estimated, and what changes the count up or down?
why ask Lets you sanity-check the quote against day-count rather than total dollars only.
Is one full retest included in the price, or charged separately?
why ask Retest is the most common hidden cost line.
Is the auditor attestation letter included in the price?
why ask Some vendors bundle, some charge separately.
What is your out-of-hours premium and when does it apply?
why ask Production-sensitive testing typically lives outside business hours.
What is your change-order rate, capped at what percent of original SOW?
why ask Caps mid-engagement scope-creep cost.
Will the named consultant change mid-engagement, and what is the substitution process?
why ask Senior-led quotes that ship junior delivery are a known pattern.
How is data handled, and what is the data-retention window after report delivery?
why ask Information-security and legal teams will ask before signing.
Is the technical report editable for our redacted-for-customers version?
why ask Customer-facing redacted reports are increasingly common for B2B vendors.
What format and depth of executive readout is included?
why ask Live readout vs PDF-only varies by vendor.
Which findings categories trigger immediate escalation to us mid-test?
why ask Critical-finding escalation should be defined before testing begins.
What does year-two pricing look like if we renew on the same scope?
why ask Most vendors quote the introductory year aggressively.

$ cat --quote

“A vendor that cannot answer the twelve questions in writing is a vendor who can renegotiate the headline number after you sign.”

Editorial framing from pentestcost.com, June 2026