RFP questions for a QA vendor
Questions to send two or three shortlisted vendors, each asking for a case, a reference or a document rather than a description.
Research desk, cybersecurityqavendors.com. Published 2026-11-11.
Short answer
Ask for one case per product class you need, the test types run on it, team size and engagement length, an ISO 27001 certificate number and SOC 2 report details, where builds and test data are stored, and how test code is handed over at exit. Score answers that cite a document above answers that describe.
How to use these questions
Send them after the shortlist step in how to choose a QA vendor.
Each group below maps to a dimension of the methodology. Ask the vendor to cite a case study, a reference call or a document for every answer. Score each answer 0 for a description only, 1 for a document or case, 2 for a reference call.
Questions by dimension
- Evidence depth (dimension 1). Name two security-product engagements in the last five years. For each: product type, test types, team size, duration and a reference contact.
- Product-class coverage (dimension 2). Which of these classes have you tested: endpoint, detection platform, identity, network, email, data protection? Give one case per class.
- Test-type depth (dimension 3). For your closest case to our product, list the test types run: functional, automation, API, performance, compatibility, detection or false-positive regression1.
- Engagement length (dimension 4). What is your longest engagement with a security product company, and is it ongoing?
- Security posture (dimension 6). Give the ISO 27001 certificate number and issuing body, and the SOC 2 report type, period and auditor.
- Team scale (dimension 7). How many QA engineers will work on our account, from which locations, and are they employees?
- Transparency (dimension 8). Send your rate card, the names of the leads on our account, and your QA process document.
Questions on data handling (dimension 6)
- Where will our builds, symbols and test data be stored, and in which jurisdiction?
- Who at your company can access them, and how is access removed when a person leaves the account?
- How do you keep test data free of our customers' content?
- What happened in your last security incident, and what changed after it?
Questions on ownership and exit
- Will automation code and test data live in our repository from the first week?
- What hand-over support do you provide at contract end?
Scoring the answers
Use the same 0 to 2 scale: a named case or certificate number beats a description, and a reference call beats a case. Compare the answers with each vendor's profile, which shows what the ranking found in public evidence; the raw evidence is in the data download.
- 1 false-positive regression: A case where a security tool starts flagging harmless activity as malicious after an update, when it did not do so in an earlier version. Source
Questions buyers ask
Which security certifications should an RFP ask a QA vendor for?
ISO 27001 with the certificate number and issuing body, and the SOC 2 report type, period and auditor. A claim without a reference scores zero in dimension 6 of this ranking.
How do we ask about experience with our specific product type?
Name your product class and ask for one case or reference per class, with test types, team size and engagement length. Compare the answer with the vendor's class matrix on its profile page.
How should RFP answers be scored?
Score each answer on evidence: a named case, a reference call, a certificate number or a document beats a description. Weight the questions in the same order as your release risks.
Which questions reveal vague or weak security practices?
Ask where your builds will be stored, who has access, how access is removed at exit, and what happened in the vendor's last security incident. Answers without a named system or document are weak.
What should the RFP say about test ownership and exit terms?
That automation code, test data and documentation are delivered to your repository continuously, and that the vendor supports a handover period at exit.
How many QA vendors should receive the RFP?
Two or three from the shortlist whose evidence covers your product class. More responses cost evaluation time without adding vendors with matching evidence.