Data security posture management (DSPM) evaluations go wrong when buyers score the demo instead of what the product finds in their own cloud accounts, SaaS tenants and databases. This template is a ready-to-issue request for proposal for a DSPM platform: discovery of data stores, including unmanaged and shadow copies; classification accuracy; the identities and access paths that can reach sensitive data; and coverage across infrastructure as a service, platform services, SaaS and on-premises stores. Its requirements are numbered and typed as mandatory or scored, and the proof of concept measures results against a seeded test environment you control. It is vendor-neutral and written for data security leads, cloud security architects, privacy officers and procurement. For how the market is shaped, read the DSPM Buyer's Guide; this page is the procurement document. DSPM finds and assesses data at rest; controlling data in motion is covered by the DLP RFP Template.
How to use this template
- Replace text in square brackets, such as [Organisation], [cloud providers] and [number of accounts], with your own details. Delete requirements for environments you are not buying for rather than leaving them unscored.
- Each requirement has an ID (for example DSPM-DS-03) and a type: M mandatory (pass or fail; a fail eliminates the bid), S scored (0 to 5, weighted) or I informational.
- Weights, volumes and thresholds in brackets are illustrative. Set them before issue and do not change them once responses arrive.
- Issue sections 1 to 8 to bidders. The Implementation guidance section is for the evaluation panel only.
- Involve your data protection officer and cloud platform owners before issue: DSPM reads the contents of production data stores, so the scanning architecture in section 4.6 needs privacy and security sign-off.
1. Purpose and scope
[Organisation] invites proposals for a DSPM platform. The platform must find where sensitive data is stored, classify it accurately, show which human and non-human identities can reach it and how, flag posture risks such as public exposure, missing encryption or stale copies, and route findings to the teams that fix them.
- In scope: [AWS, Microsoft Azure, Google Cloud] accounts and subscriptions; managed databases and data warehouses [list]; object storage; [SaaS: file storage, collaboration, CRM]; [on-premises file shares and databases]; integration with [identity provider], [SIEM], [ticketing], [DLP].
- Out of scope: [inline data loss prevention for endpoints, email and web]; [cloud workload vulnerability scanning, covered by CNAPP]; [records management], unless offered as an option.
- Contract term: [three] years with an option to extend by [two] years.
- Drivers: [unknown copies of customer data in development and analytics accounts]; [regulatory inventory obligations under UK GDPR Article 30, PCI DSS or sector rules]; [public bucket and snapshot exposure]; [AI training and retrieval pipelines reading sensitive data]; [over-privileged service accounts and roles].
2. Organisation background and current state
| Item | [Organisation] value |
|---|
| Cloud estate | [number of AWS accounts, Azure subscriptions, Google Cloud projects]; [regions]; [organisation or management group structure] |
| Data stores | [approximate counts of buckets, managed databases, warehouses, file shares]; [estimated total volume in TB] |
| SaaS | [file storage and collaboration], [CRM], [ticketing], [code repositories] |
| On-premises | [file servers], [database platforms], [network constraints on outbound scanning] |
| Sensitive data types | [personal data], [payment card data], [health data], [credentials and secrets in data], [source code], [named internal identifiers such as customer numbers] |
| Classification | [labelling scheme and coverage]; see the Data Classification Policy Template |
| Identity | [workforce identity provider], [cloud federation model], [approximate count of service accounts, roles and keys] |
| Current tooling | [CSPM or CNAPP], [DLP], [data catalogue], [SIEM], [ticketing] |
| Jurisdictions | [where data is stored and where scanning results may be stored] |
3. Instructions to bidders
- Timeline: RFP issued [date]; clarification questions by [date]; answers shared with all bidders by [date]; responses due [date, time, time zone]; shortlist and proof of concept [dates]; decision [date].
- Single point of contact: [name, email]. Contact with other [Organisation] staff about this RFP may lead to disqualification.
- Response scale: for each requirement state available now; available with configuration; available with custom development; third-party product required (name it); roadmap (with a committed date); not supported. Roadmap answers score zero unless the date is contractually committed.
- Coverage matrix: as Appendix A, list every data store type you support (by cloud service, database engine, SaaS application and on-premises platform) and for each state: discovery, content classification, access path analysis, and whether scanning is in place or copies data.
- Edition: state which edition or module each answer depends on and confirm it is in the Appendix B price.
4. Functional requirements
4.1 Data store discovery
| ID | Requirement | Type |
|---|
| DSPM-DS-01 | Discovers data stores across all connected accounts, subscriptions and projects automatically, including new accounts added to the cloud organisation, without per-account manual onboarding. | M |
| DSPM-DS-02 | Finds unmanaged data: databases running on virtual machines or containers, snapshots and backups, exported files in object storage, and data in non-production accounts. | M |
| DSPM-DS-03 | Detects copies and derivatives of the same dataset across stores and flags stale copies by last access or modification date. | S |
| DSPM-DS-04 | States discovery frequency and how quickly a newly created store appears in the inventory. | S |
| DSPM-DS-05 | Records owner, location, region, encryption state, backup state and public exposure for each store, and exports the inventory through API. | M |
4.2 Classification accuracy
| ID | Requirement | Type |
|---|
| DSPM-CL-01 | Provides built-in classifiers for [UK and EU personal data, payment card numbers with checksum validation, national identifiers, health data, credentials and keys], with confidence levels. | M |
| DSPM-CL-02 | Supports custom classifiers for [Organisation] identifiers (pattern, dictionary and exact match against hashed reference values). | M |
| DSPM-CL-03 | Classifies structured data at column level and unstructured files at file level, and states sampling method, sample sizes and how a full scan can be forced. | M |
| DSPM-CL-04 | Describe any machine learning classification: training data, whether customer data is used for training, and how precision and recall are measured. | I |
| DSPM-CL-05 | Lets analysts mark false positives and negatives, and applies that feedback to future scans. | S |
| DSPM-CL-06 | Reads and writes [Organisation]'s sensitivity labels or tags where the platform supports them. | S |
See the Data Classification Guide.
4.3 Access paths and identities
| ID | Requirement | Type |
|---|
| DSPM-AP-01 | For each sensitive store, lists every identity that can read, write or delete it: users, groups, roles, service accounts, workload identities, access keys and external principals, including access granted through role assumption chains and resource policies. | M |
| DSPM-AP-02 | Distinguishes effective access from configured access, and uses access logs where available to show which permissions were used in the last [90] days. | S |
| DSPM-AP-03 | Flags non-human identities with access to sensitive data that use long-lived keys, are unused, or are shared across workloads. | M |
| DSPM-AP-04 | Identifies third-party and cross-account access, public links and anonymous access to sensitive stores. | M |
| DSPM-AP-05 | Shows which AI services, training pipelines and retrieval indexes read sensitive stores. | S |
See the Data Access Governance Guide.
4.4 Posture risks and remediation
| ID | Requirement | Type |
|---|
| DSPM-PR-01 | Flags sensitive data that is publicly accessible, unencrypted, in a disallowed region, past its retention period, or copied to a lower environment. | M |
| DSPM-PR-02 | Prioritises findings by data sensitivity, volume, exposure and identity reach, and explains the score. | S |
| DSPM-PR-03 | Creates tickets in [ticketing] routed to the store owner, and tracks findings to closure with re-test. | M |
| DSPM-PR-04 | Describe any automated remediation (for example removing public access): what permissions it needs, whether it is opt-in per rule, and how it is approved and rolled back. | I |
| DSPM-PR-05 | Maps findings to [UK GDPR, PCI DSS, HIPAA, internal policy] and produces evidence reports for audit. | S |
4.5 Cloud and SaaS coverage
| ID | Requirement | Type |
|---|
| DSPM-CV-01 | Supports discovery, classification and access analysis for every store in Appendix A marked mandatory by [Organisation]. | M |
| DSPM-CV-02 | Supports [named SaaS applications] through their APIs, including sharing settings and external links. | S |
| DSPM-CV-03 | Supports on-premises stores through a collector deployed in [Organisation]'s network, with outbound-only connectivity. | S |
4.6 Scanning architecture and data handling
| ID | Requirement | Type |
|---|
| DSPM-AR-01 | States where content is inspected (in [Organisation]'s accounts, in the vendor's environment, or both) and what leaves [Organisation]'s environment: metadata, samples, matched values or full records. | M |
| DSPM-AR-02 | Stores no raw sensitive values by default; any stored evidence is masked, encrypted and retained for no more than [days]. | M |
| DSPM-AR-03 | Uses read-only permissions for discovery and classification, documented per cloud and SaaS connector, with any write permission separated and optional. | M |
| DSPM-AR-04 | Connects through federated roles or workload identity rather than long-lived access keys, and documents how each credential is scoped and rotated. | M |
| DSPM-AR-05 | States the compute cost the scanning places on [Organisation]'s cloud bill and how scans are throttled to avoid performance impact on production databases. | S |
| ID | Requirement | Type |
|---|
| DSPM-SEC-01 | Administrator access through [Organisation] SSO with phishing-resistant MFA and roles separating configuration, finding review, evidence view and connector management. | M |
| DSPM-SEC-02 | Logs all administrative actions, configuration changes and evidence views with actor and time, retained for [period], and streams them to [SIEM]. | M |
| DSPM-SEC-03 | Provide a current ISO/IEC 27001 certificate with in-scope service or a SOC 2 Type II report, the sub-processor list and a completed [SIG or CAIQ] questionnaire. | M |
| DSPM-SEC-04 | Keeps findings and metadata in [regions] and states support access arrangements to [Organisation] data. | M |
| DSPM-SEC-05 | Publishes availability targets for the console and API of at least [99.5%] and a documented incident notification commitment of [hours]. | S |
6. Implementation, services and support
- DSPM-IM-01 (M): provide a deployment plan to connect [number] accounts and [named stores] within [weeks], with [Organisation] and vendor tasks listed.
- DSPM-IM-02 (S): describe tuning services for classifiers during the first [90] days.
- DSPM-IM-03 (M): state support hours, severity definitions and response times, and named customer success contacts.
- DSPM-IM-04 (S): provide training for analysts and data owners, and administrator documentation.
- DSPM-IM-05 (M): describe exit: export of inventory, findings and configuration in a documented format, and deletion of [Organisation] data with written confirmation within [30] days.
7. Commercials
- Price in Appendix B for [three] years using the metric you license by (data stores, volume scanned, cloud accounts, or workloads) and show the price at [current] and [2x] estate size.
- List every add-on needed to meet the requirements you answered as available, including SaaS connectors and on-premises collectors.
- Estimate the cloud compute cost to [Organisation] for scanning the estate in section 2, monthly.
- State price protection for renewal and for growth beyond the licensed metric.
8. Evaluation method and proof of concept
[Organisation] will check mandatory requirements first, then score the rest with these illustrative weights:
| Criterion | Weight | Evidence |
|---|
| Discovery completeness (4.1, 4.5) | [20%] | Seeded environment results, Appendix A |
| Classification accuracy (4.2) | [25%] | Precision and recall on seeded data |
| Access path analysis (4.3) | [20%] | Seeded identity paths found |
| Prioritisation and remediation workflow (4.4) | [10%] | Analyst walkthrough |
| Architecture, data handling and platform security (4.6, 5) | [10%] | Architecture review, assurance reports |
| Life-cycle cost including cloud compute (7) | [15%] | Appendix B, measured scan cost |
Scores use 0 to 5: 0 not met; 1 roadmap only; 3 met with configuration; 5 met fully and demonstrated. Shortlisted bidders run a proof of concept of [three] weeks against a seeded environment:
- The panel prepares [two] cloud accounts and [one] SaaS tenant containing synthetic data only: known sensitive stores (synthetic personal data, valid test card numbers, fake keys), near misses (invalid card numbers, public data), a database on a virtual machine, a snapshot copy, and a stale export in object storage.
- The panel seeds access paths: a public link, a cross-account role, an unused service account with read access, and a long-lived access key with write access to a sensitive store.
- Bidders connect with the permissions they documented under DSPM-AR-03 and DSPM-AR-04. The panel records the permissions actually requested.
- The panel measures how many seeded stores, sensitive columns and files, and access paths each bidder finds, and how many false positives it raises, within [five] working days.
- Create a new store with sensitive data mid-test and record how long it takes to appear and be classified.
- Raise one finding to a ticket, fix it, and confirm the re-test closes it. Review the audit trail of evidence views.
- Read the cloud bill for the test accounts to measure scanning cost.
Implementation guidance
This section is for the evaluation panel, not for bidders.
- Seed, then score: a known answer key is the only fair way to compare discovery and classification. Score precision as heavily as recall: noisy classification creates findings nobody fixes.
- Use synthetic data only: the proof of concept should not move real personal data to bidder platforms or require new data processing agreements before award.
- Treat the DSPM connector as a privileged non-human identity: it can read your most sensitive stores. Hold it to DSPM-AR-03 and DSPM-AR-04, monitor it like any other high-value service account and include it in access reviews. See the NHI Security Platform RFP Template for the identity side.
- Test unmanaged data: databases on virtual machines, snapshots and exports are where unknown copies live. Answers that cover only managed services miss them.
- Check the overlap: CSPM and CNAPP tools may already report public buckets. Decide which tool owns each finding type before rollout to avoid duplicate tickets. See the CNAPP RFP Template.
- Plan the rollout: the DSPM Implementation Playbook covers phasing after award.
| Requirement group | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|
| Discovery and inventory (4.1) | CM-8, PM-5(1) | ID.AM-07 |
| Classification (4.2) | RA-2 | ID.AM-07 |
| Access paths (4.3) | AC-3, AC-6 | PR.AA-05 |
| Posture risks (4.4) | SC-28, SI-12 | PR.DS-01 |
| Monitoring and audit (5) | AU-6 | DE.CM-09 |
| Supplier assurance (5) | SA-9, SR-6 | GV.SC-06 |
After award, carry requirement IDs into the statement of work and rerun the seeded test before each major expansion of scope.
Standards and references
Related NHI Mgmt Group resources: DSPM Buyer's Guide · Data Security Posture Management (DSPM) · Security Vendor Evaluation and RFP Guide · Data Security Guide