How to Write an RFP Vendors Can't Answer With a Brochure
In brief
- A request for proposal gets back exactly what it asks for. No priorities, no weights and no dates means six brochures.
- Five steps fix it: a tight scope, prioritized requirements, scoring weights set up front, a timeline built backward from go-live, and a scope check before you send.
- MALA's free RFP & Requirements Builder does all five in about six minutes.
6 min
To build a scored, dated RFP with the free tool
~10 wks
Typical mid-market RFP, issue to award
≤60%
Of requirements should be must-haves
≤40%
Of the score should be total cost
You sent the RFP. Six responses came back. Six brochures.
Every proposal says the solution is secure, scalable and easy to implement. Every one has a glossy architecture diagram and a "contact sales" button where the pricing should be. And you are left comparing marketing copy instead of answers.
That isn't the vendors' fault. If your RFP lists 40 features with no priorities, no scoring weights and no dates, the easiest response is the standard pitch deck. The fix is structural, and it works the same whether you're buying UCaaS and contact center, SD-WAN, managed security or cloud.
The five steps at a glance
STEP 1
Define the scope
Users, sites, go-live, term, regulations
STEP 2
Prioritize requirements
Must, should, nice-to-have
STEP 3
Weight the scoring
Decided before responses arrive
STEP 4
Work back from go-live
Find your latest issue date
STEP 5
Scope check, then send
Four checks before it goes out
Step 1: Define exactly what you're buying
Vague scope produces vague proposals. Before you write a single requirement, pin down the facts a vendor needs to quote and plan against:
- Category. One RFP per category. Bundling UCaaS, SD-WAN and security invites a provider who is strong in one and passable in the others.
- Size. Users and locations drive both price and implementation time.
- Target go-live. The date you need to be live, not the date you'd like to start. Everything else works backward from it.
- Contract term. One, three or five years. Term changes pricing and which contract protections matter.
- Regulations. HIPAA, GLBA and NCUA, PCI DSS, CMMC. Each one you answer to becomes a mandatory requirement, not a footnote.
Example project
A credit union replacing a hosted phone system and a 60-seat contact center
Users
450
Locations
14
Go-live
May 12, 2027
Term · regulation
3 yrs · GLBA/NCUA
Step 2: Mark every requirement must, should or nice-to-have
A flat list tells vendors everything matters equally, which means nothing does. Give every line one of three priorities, and leave out anything you'd skip.
| Priority | What it means | Example (UCaaS & contact center) |
|---|---|---|
| Must | Missing it disqualifies the response | E911 compliant with Kari's Law and RAY BAUM'S Act |
| Should | Scored, but not a deal-breaker | Works inside Microsoft Teams |
| Nice-to-have | Earns a little credit if present | AI virtual agent and real-time agent assist |
Write requirements as testable statements, not wishes. "Number porting with a tested cutover plan and no downtime" can be answered yes or no; "seamless migration" cannot.
17
requirements
9
must-haves (53%)
Keep must-haves between three and about 60% of the list. Above that you disqualify everyone; below three, nothing gets screened out.
And don't forget the contract. Pricing locked for the full term, SLA credits with a right to exit for chronic failures, and termination rights with a full data return at no charge belong on the list as must-haves, not as something legal will "handle later."
Step 3: Set your scoring weights before responses arrive
Weights set after the proposals come in tend to drift toward whichever vendor gave the best demo. Pick five or six factors and make them add up to 100%. A balanced starting point for a communications project:
Functionality 24%
Total cost 18%
Support & SLA 18%
Implementation 15%
Security & compliance 15%
Vendor stability 9%
Total 100%, with must-haves kept as pass/fail gates outside the score
Two things to watch. If total cost carries more than 40% of the score, you're running a price auction and will get the cheapest bid that technically qualifies. And publish the weights in the RFP: vendors who know how they'll be scored write to the score instead of to their brochure. Score each factor on a 1–5 scale and multiply by its weight.
Step 4: Build the timeline backward from go-live
Most RFP timelines start from today and hope. Start from your go-live date instead. The date that matters is the latest day you can issue the RFP and still make it.
The formula
Latest issue date = go-live − implementation − 10 weeks
10 weeks = questions due week 2 · responses week 4 · shortlist and demos weeks 5–7 · negotiate and award weeks 8–10. Budget two more weeks before that to write and approve the RFP.
For the 450-user, 14-site credit union, implementation runs about 13 weeks. A May 12 go-live means the RFP has to go out by December 2:
| Milestone | Date |
|---|---|
| Start writing | Nov 18 |
| Issue RFP (latest date) | Dec 2 |
| Vendor questions due | Dec 16 |
| Responses due | Dec 30 |
| Shortlist and demos | Jan 20, 2027 |
| Award and sign | Feb 10, 2027 |
| Go live | May 12, 2027 |
Implementation time depends on what you're buying. Typical ranges MALA sees for mid-market projects:
UCaaS & contact center
8 wks + 1 per 150 users, +2 over 10 sites
SD-WAN
6 wks + 1.2 per site, 12 minimum with circuit orders
Managed detection & response
6 wks + 1 per 500 endpoints
Cloud & colocation
10 wks + 1 per 40 servers
Put these dates in the RFP. A vendor who can't meet your questions deadline is telling you something about how the implementation will go.
Step 5: Run a scope check before you send
The expensive RFP mistakes are visible before the document goes out. Run four checks:
✓ Must-have balance
More than 60% must-haves, or fewer than three? Rebalance.
✓ Contract protections
Price locks, SLA exit rights and termination terms marked as must-haves. As shoulds, you've given up leverage before negotiation starts.
✓ Cost weighting
Total cost at or under 40% of the score, or expect the lowest qualifying bid rather than the best fit.
✓ Timeline slack
At least three weeks between today and your latest issue date, so one slow approval doesn't move go-live.
Scope is balanced.
Must-haves are clear, contract protections are in, and the timeline has room. Write a two-sentence summary your project sponsor can approve, then send it.
An RFP gets back exactly what it asks for. Ask for specifics.
Build yours in six minutes with the free RFP Builder
MALA's RFP & Requirements Builder does all five steps in one place:
- Pick UCaaS and contact center, SD-WAN, managed security, or cloud and colocation. Each opens with a worked example you can edit.
- Enter users, sites, go-live, term and regulations. Each regulation adds its mandatory requirement automatically.
- Mark every requirement must, should, nice-to-have or skip, and set weights that always add to 100.
- Get your latest issue date, a dated timeline and a scope check, plus a summary for your project sponsor.
Then unlock the full draft: an eight-section RFP outline with your scope, dates and requirements filled in, a weighted scoring matrix with disqualification rules, and a requirements sheet that pastes into Excel. Not sure an RFP is the right route at all? Three Ways to Buy compares the options, and our 15 questions to ask at project kickoff help before you write a word.
RFP FAQ for IT leaders
How long should an IT RFP be?
Long enough to cover scope, requirements, scoring and dates, and no longer. Length that doesn't change a vendor's answer is padding.
How many must-have requirements should an RFP have?
At least three, and no more than about 60% of the total. Fewer screens nobody out; more disqualifies everyone.
Should I share scoring weights with vendors?
Yes. Published weights get answers aimed at what you value instead of a generic pitch.
How long does an RFP take from issue to award?
About 10 weeks for a typical mid-market project, plus two weeks to write and approve it and the implementation time for the category.
Independent. Vendor-neutral. No fee to you.
Rather not run the RFP yourself?
MALA sends your requirements to qualified providers from our 430+, manages the Q&A, normalizes the pricing side by side and negotiates the contract. MALA is paid by providers, never by you.
Build my RFP →Talk to an Advisor
An advisor responds within one business day.
Source: timelines, implementation ranges, scope-check rules and example figures are from MALA's RFP & Requirements Builder, based on typical ranges MALA sees for mid-market projects. Circuit lead times can extend network projects.
For informational use only. Not legal advice.
