Skip to content
MALA RFP & Requirements Builder: build a scored, dated RFP in six minutes
Vendor-Neutral Advisory

How to Write an RFP Vendors Can't Answer With a Brochure

Eric Anderson
Eric Anderson

In brief

  • A request for proposal gets back exactly what it asks for. No priorities, no weights and no dates means six brochures.
  • Five steps fix it: a tight scope, prioritized requirements, scoring weights set up front, a timeline built backward from go-live, and a scope check before you send.
  • MALA's free RFP & Requirements Builder does all five in about six minutes.

6 min

To build a scored, dated RFP with the free tool

~10 wks

Typical mid-market RFP, issue to award

≤60%

Of requirements should be must-haves

≤40%

Of the score should be total cost

You sent the RFP. Six responses came back. Six brochures.

Every proposal says the solution is secure, scalable and easy to implement. Every one has a glossy architecture diagram and a "contact sales" button where the pricing should be. And you are left comparing marketing copy instead of answers.

That isn't the vendors' fault. If your RFP lists 40 features with no priorities, no scoring weights and no dates, the easiest response is the standard pitch deck. The fix is structural, and it works the same whether you're buying UCaaS and contact center, SD-WAN, managed security or cloud.

The five steps at a glance

STEP 1

Define the scope

Users, sites, go-live, term, regulations

STEP 2

Prioritize requirements

Must, should, nice-to-have

STEP 3

Weight the scoring

Decided before responses arrive

STEP 4

Work back from go-live

Find your latest issue date

STEP 5

Scope check, then send

Four checks before it goes out

Step 1: Define exactly what you're buying

Vague scope produces vague proposals. Before you write a single requirement, pin down the facts a vendor needs to quote and plan against:

  • Category. One RFP per category. Bundling UCaaS, SD-WAN and security invites a provider who is strong in one and passable in the others.
  • Size. Users and locations drive both price and implementation time.
  • Target go-live. The date you need to be live, not the date you'd like to start. Everything else works backward from it.
  • Contract term. One, three or five years. Term changes pricing and which contract protections matter.
  • Regulations. HIPAA, GLBA and NCUA, PCI DSS, CMMC. Each one you answer to becomes a mandatory requirement, not a footnote.

Example project

A credit union replacing a hosted phone system and a 60-seat contact center

Users

450

Locations

14

Go-live

May 12, 2027

Term · regulation

3 yrs · GLBA/NCUA

Step 2: Mark every requirement must, should or nice-to-have

A flat list tells vendors everything matters equally, which means nothing does. Give every line one of three priorities, and leave out anything you'd skip.

Priority What it means Example (UCaaS & contact center)
MustMissing it disqualifies the responseE911 compliant with Kari's Law and RAY BAUM'S Act
ShouldScored, but not a deal-breakerWorks inside Microsoft Teams
Nice-to-haveEarns a little credit if presentAI virtual agent and real-time agent assist

Write requirements as testable statements, not wishes. "Number porting with a tested cutover plan and no downtime" can be answered yes or no; "seamless migration" cannot.

17

requirements

9

must-haves (53%)

Keep must-haves between three and about 60% of the list. Above that you disqualify everyone; below three, nothing gets screened out.

And don't forget the contract. Pricing locked for the full term, SLA credits with a right to exit for chronic failures, and termination rights with a full data return at no charge belong on the list as must-haves, not as something legal will "handle later."

Step 3: Set your scoring weights before responses arrive

Weights set after the proposals come in tend to drift toward whichever vendor gave the best demo. Pick five or six factors and make them add up to 100%. A balanced starting point for a communications project:

Functionality 24%

Total cost 18%

Support & SLA 18%

Implementation 15%

Security & compliance 15%

Vendor stability 9%

Total 100%, with must-haves kept as pass/fail gates outside the score

Two things to watch. If total cost carries more than 40% of the score, you're running a price auction and will get the cheapest bid that technically qualifies. And publish the weights in the RFP: vendors who know how they'll be scored write to the score instead of to their brochure. Score each factor on a 1–5 scale and multiply by its weight.

Step 4: Build the timeline backward from go-live

Most RFP timelines start from today and hope. Start from your go-live date instead. The date that matters is the latest day you can issue the RFP and still make it.

The formula

Latest issue date = go-live − implementation − 10 weeks

10 weeks = questions due week 2 · responses week 4 · shortlist and demos weeks 5–7 · negotiate and award weeks 8–10. Budget two more weeks before that to write and approve the RFP.

For the 450-user, 14-site credit union, implementation runs about 13 weeks. A May 12 go-live means the RFP has to go out by December 2:

Milestone Date
Start writingNov 18
Issue RFP (latest date)Dec 2
Vendor questions dueDec 16
Responses dueDec 30
Shortlist and demosJan 20, 2027
Award and signFeb 10, 2027
Go liveMay 12, 2027

Implementation time depends on what you're buying. Typical ranges MALA sees for mid-market projects:

UCaaS & contact center

8 wks + 1 per 150 users, +2 over 10 sites

SD-WAN

6 wks + 1.2 per site, 12 minimum with circuit orders

Managed detection & response

6 wks + 1 per 500 endpoints

Cloud & colocation

10 wks + 1 per 40 servers

Put these dates in the RFP. A vendor who can't meet your questions deadline is telling you something about how the implementation will go.

Step 5: Run a scope check before you send

The expensive RFP mistakes are visible before the document goes out. Run four checks:

✓ Must-have balance

More than 60% must-haves, or fewer than three? Rebalance.

✓ Contract protections

Price locks, SLA exit rights and termination terms marked as must-haves. As shoulds, you've given up leverage before negotiation starts.

✓ Cost weighting

Total cost at or under 40% of the score, or expect the lowest qualifying bid rather than the best fit.

✓ Timeline slack

At least three weeks between today and your latest issue date, so one slow approval doesn't move go-live.

Scope is balanced.

Must-haves are clear, contract protections are in, and the timeline has room. Write a two-sentence summary your project sponsor can approve, then send it.

An RFP gets back exactly what it asks for. Ask for specifics.

Build yours in six minutes with the free RFP Builder

MALA's RFP & Requirements Builder does all five steps in one place:

  • Pick UCaaS and contact center, SD-WAN, managed security, or cloud and colocation. Each opens with a worked example you can edit.
  • Enter users, sites, go-live, term and regulations. Each regulation adds its mandatory requirement automatically.
  • Mark every requirement must, should, nice-to-have or skip, and set weights that always add to 100.
  • Get your latest issue date, a dated timeline and a scope check, plus a summary for your project sponsor.

Then unlock the full draft: an eight-section RFP outline with your scope, dates and requirements filled in, a weighted scoring matrix with disqualification rules, and a requirements sheet that pastes into Excel. Not sure an RFP is the right route at all? Three Ways to Buy compares the options, and our 15 questions to ask at project kickoff help before you write a word.

RFP FAQ for IT leaders

How long should an IT RFP be?

Long enough to cover scope, requirements, scoring and dates, and no longer. Length that doesn't change a vendor's answer is padding.

How many must-have requirements should an RFP have?

At least three, and no more than about 60% of the total. Fewer screens nobody out; more disqualifies everyone.

Should I share scoring weights with vendors?

Yes. Published weights get answers aimed at what you value instead of a generic pitch.

How long does an RFP take from issue to award?

About 10 weeks for a typical mid-market project, plus two weeks to write and approve it and the implementation time for the category.

Independent. Vendor-neutral. No fee to you.

Rather not run the RFP yourself?

MALA sends your requirements to qualified providers from our 430+, manages the Q&A, normalizes the pricing side by side and negotiates the contract. MALA is paid by providers, never by you.

Build my RFP →Talk to an Advisor

An advisor responds within one business day.

Source: timelines, implementation ranges, scope-check rules and example figures are from MALA's RFP & Requirements Builder, based on typical ranges MALA sees for mid-market projects. Circuit lead times can extend network projects.

For informational use only. Not legal advice.

Share this post