Enterprise browser and browser security extension RFPs tend to collect feature lists, "yes, we have DLP" and "yes, we control GenAI", while the details that decide success, whether controls hold on unmanaged devices, what users can bypass and what browsing data the bidder collects, go untested. This template gives you a ready-to-issue request for proposal for enterprise browser security, whether delivered as a managed enterprise browser, an extension for mainstream browsers or a combination, with numbered requirements and test cases that can be scored. It covers policy and extension management, data protection, GenAI controls, threat protection, identity and session security, BYOD and contractor access, visibility, platform security and pricing. It is vendor-neutral and written for endpoint, security architecture and procurement teams. For the categories and how to choose between them, read the Browser Security Buyer's Guide and the Enterprise Browser and Browser Security Guide first; this page is the procurement document.
How to use this template
- Replace text in square brackets, such as [Organisation], [identity provider], [SSE] and [number], with your own details. Delete requirements that do not apply rather than leaving them unscored.
- Each requirement has an ID (for example EBS-DLP-02) and a type: M mandatory (pass or fail), S scored (weighted 0 to 5) or I informational.
- State the delivery model you will accept in section 1: managed browser only, extension only, or either. Bidders must answer every requirement for the model they propose and say where behaviour differs between managed and unmanaged devices.
- Complete Appendix A (user populations, device types and ownership, browsers in use, critical web and SaaS applications, sanctioned and unsanctioned GenAI services) yourself.
- Issue sections 1 to 8 to bidders. Implementation guidance is for the panel only.
1. Purpose and scope
[Organisation] invites proposals for an enterprise browser security solution to enforce access, data protection and threat protection policy for web and SaaS applications used by the populations in Appendix A.
- In scope: [managed enterprise browser / browser extension / either]; policy and extension management; data protection; GenAI usage controls; threat protection; identity and session controls; BYOD and third-party access; logging and reporting.
- Out of scope: [SSE or secure web gateway, separate procurement]; [endpoint DLP]; [remote browser isolation, unless proposed as part of the solution].
- Contract term: [three] years, with an option to extend by [two].
- Drivers: [contractor and BYOD access without VDI]; [data leaving through copy, paste, upload and print]; [GenAI use with sensitive data]; [extension risk]; [VDI cost reduction].
2. Current state
| Item | [Organisation] value |
|---|
| Browsers in use | [browsers and versions], managed by [Group Policy / MDM / cloud management] |
| User populations | [number] employees on managed devices; [number] contractors; [number] BYOD users |
| Operating systems | [Windows, macOS, Linux, ChromeOS, iOS, Android] with share of users |
| Identity provider and device trust | [identity provider], [conditional access or device compliance signals] |
| Network and data controls | [SSE, proxy, CASB, DLP products] |
| Critical applications | [number] SaaS and internal web applications in Appendix A |
| Extensions in use | [number] distinct extensions found; current allow or block policy [yes/no] |
3. Instructions to bidders
- Timeline: RFP issued [date]; questions by [date]; responses due [date, time, time zone]; proof of concept [dates]; decision [date].
- Contact: [name, email]; other contact about this RFP may lead to disqualification.
- Response scale: available now; available with configuration; third-party product required; roadmap (committed date); not supported. Answer separately for managed browser, extension and each operating system where behaviour differs.
- Browser engine: for a managed browser, state the engine it is built on, how quickly upstream security fixes are shipped (median and maximum days over the last [12] months) and how users are forced to update.
4. Functional requirements
4.1 Policy, configuration and extension management
| ID | Requirement | Type |
|---|
| EBS-POL-01 | Central policy by user group, device posture, application and network location, enforced without user action and applied within [minutes] of change. | M |
| EBS-POL-02 | Users cannot disable, uninstall or bypass the control (for example by using another browser profile, a private window or a second browser) on managed devices; state how bypass is prevented or detected. | M |
| EBS-EXT-01 | Inventories every installed extension per user and device with its permissions and host access, and risk-rates it. | S |
| EBS-EXT-02 | Enforces extension allow and block lists, force-installs required extensions, blocks extensions requesting named permissions and restricts extension access to named sites. | M |
| EBS-EXT-03 | Detects an extension update that adds permissions or changes ownership, and can block the update until reviewed. | S |
| EBS-CFG-01 | Enforces security settings: safe browsing protections, download restrictions, password manager policy, developer tools access and site permissions. | S |
Native browser policies can already do much of EBS-EXT-02 on managed devices: the ExtensionSettings policies documented in the references support blocked, force-installed and normal-installed modes, permission blocking and runtime_blocked_hosts. Score bidders on what they add beyond that. See the Browser Extension Security Guide.
4.2 Data protection
| ID | Requirement | Type |
|---|
| EBS-DLP-01 | Controls copy, paste, upload, download, print, screenshot and screen sharing per application, with allow, warn with justification, block and redact actions. | M |
| EBS-DLP-02 | Inspects content against [Organisation] classifiers and labels (for example payment card numbers, personal data, [sensitivity labels]) and states whether inspection happens on the device or in the bidder's cloud. | S |
| EBS-DLP-03 | Distinguishes corporate and personal accounts of the same SaaS service (tenant restrictions) and controls data movement between them. | S |
| EBS-DLP-04 | Applies watermarking and prevents local caching of corporate data on unmanaged devices. | S |
| EBS-DLP-05 | Uses or exchanges policy with [existing DLP]; state the integration method. | I |
See the DLP RFP Template if data protection is being procured more broadly.
4.3 GenAI controls
| ID | Requirement | Type |
|---|
| EBS-AI-01 | Discovers GenAI web applications and AI browser extensions in use, by user and frequency. | S |
| EBS-AI-02 | Allows sanctioned GenAI services only with corporate accounts, and blocks or warns on unsanctioned services. | M |
| EBS-AI-03 | Inspects prompts, pastes and file uploads to GenAI services against data protection policy, with block, warn and redact actions. | M |
| EBS-AI-04 | States how built-in AI features of the browser itself, and agentic browsing features, can be disabled or governed by policy. | S |
| EBS-AI-05 | States whether prompt content is stored in logs, for how long and who can view it. | M |
See the AI Usage Control and Shadow AI Buyer's Guide and the AI Browser Extensions Security Guide.
4.4 Threat protection
| ID | Requirement | Type |
|---|
| EBS-THR-01 | Blocks phishing and credential entry on unknown sites, including detection of corporate password reuse on non-corporate sites. | S |
| EBS-THR-02 | Scans downloads and blocks risky file types per policy. | S |
| EBS-THR-03 | Isolates or renders risky and uncategorised sites safely; state the method and its effect on user experience. | S |
4.5 Identity, session and device access
| ID | Requirement | Type |
|---|
| EBS-IDS-01 | Integrates with [identity provider] for sign-in to the browser or extension and passes device posture to conditional access decisions. | M |
| EBS-IDS-02 | Protects session cookies and tokens against theft and replay; state the mechanism, including support for device-bound session credentials where the browser supports them. | S |
| EBS-BYOD-01 | Provides a corporate workspace on unmanaged and personal devices without full device management, separating corporate data from personal browsing. | M |
| EBS-BYOD-02 | Wipes corporate data from an unmanaged device when access is revoked or the contract ends. | S |
| EBS-BYOD-03 | States what personal browsing data is visible to [Organisation] or the bidder on personal devices; none should be collected outside corporate applications. | M |
Stolen session cookies (ATT&CK T1539) and malicious extensions (T1176.001) are the two browser techniques these controls most directly address. See the BYOD Policy Template.
4.6 Visibility and integration
| ID | Requirement | Type |
|---|
| EBS-LOG-01 | Logs policy decisions, data protection events, extension changes and admin actions, exportable to [SIEM] in near real time in a documented format. | M |
| EBS-LOG-02 | States exactly which browsing data is collected by default (URLs, page content, keystrokes, screenshots), where it is stored and how collection is minimised. | M |
| EBS-INT-01 | Integrates with [SSE], [EDR] and [ITSM]; state the method for each. | I |
| ID | Requirement | Type |
|---|
| EBS-SEC-01 | Admin console access through [Organisation] SSO with phishing-resistant MFA and granular roles. | M |
| EBS-SEC-02 | Signed policy and software updates; describe the update pipeline and how a compromised update would be prevented. | M |
| EBS-SEC-03 | Current independent assurance report, completed [SIG or CAIQ], sub-processors and data locations; data processing terms for browsing data. | M |
| EBS-NF-01 | Performance impact on page load and memory for [reference applications]; state the measurement method. | S |
| EBS-NF-02 | Behaviour if the bidder's cloud is unreachable: fail open or fail closed, configurable per policy. | S |
6. Services and support
- Deployment: plan for pilot, phased rollout by population and migration of existing browser policies.
- User adoption: communications, training and handling of incompatible web applications.
- Support: tiers, hours and response targets by severity.
- References: [two or three] customers with contractor or BYOD populations of similar size.
7. Pricing
| Cost element | What to state |
|---|
| Licence metric | Per user, per device or per population; whether contractors and BYOD users cost differently |
| Modules | Data protection, GenAI controls, isolation and BYOD sold separately or included |
| Volume tiers | Price at [current users] and [current plus 30%] |
| Services | Deployment and policy migration, day rates |
| Offsets | Infrastructure the solution is expected to replace (for example [VDI seats]), stated as assumptions |
| Renewal and exit | Cap on renewal increases; export of policies and logs |
8. Evaluation method and proof of concept
| Criterion | Weight | Evidence |
|---|
| Data protection and GenAI controls (4.2, 4.3) | [30%] | Test cases below |
| Policy, extension and bypass resistance (4.1) | [20%] | Test cases below |
| BYOD, identity and session (4.5) | [15%] | Unmanaged device tests |
| Privacy and platform security (4.6, 5) | [15%] | Data collection review, assurance reports |
| Cost over the term (7) | [20%] | Priced against Appendix A |
Scores use 0 to 5: 0 not met; 1 roadmap only; 3 met with configuration; 5 met fully and demonstrated. Shortlisted bidders run a [three]-week proof of concept with [number] pilot users on managed and unmanaged devices. Test cases:
- Paste and upload synthetic card numbers and personal data into an unsanctioned GenAI service and into a personal account of a sanctioned SaaS service; confirm block or redact and the log entry.
- Try to bypass control on a managed device with a private window, a second browser profile and a different installed browser.
- Install a test extension requesting broad host permissions, then push an update adding permissions; confirm block and alert.
- On a personal device, access [critical application], download a file, then revoke access and confirm corporate data is removed.
- Replay a session cookie exported from a test account on another device and record the result.
- Review a sample of collected logs for personal browsing data outside corporate applications.
- Measure page load for [five] reference applications with and without the solution.
Implementation guidance
This section is for the evaluation panel, not for bidders.
- Baseline native controls first: configure managed browser policies for extensions and settings before the proof of concept, so bidders are scored on what they add. See the Browser Security Hardening Guide.
- Test unmanaged devices hardest: BYOD and contractor access is where the category earns its cost, and where privacy obligations to device owners apply.
- Involve privacy and works councils early: EBS-LOG-02 and EBS-BYOD-03 decide whether rollout is acceptable to employees.
- Plan for incompatible applications: keep a documented exception path and measure how often it is used.
- Rehearse response: use the Malicious Browser Extension Incident Playbook with the winning solution during rollout.
| Requirement group | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|
| Policy and extensions (4.1) | CM-7, CM-10, CM-11 | PR.PS-01, PR.PS-05 |
| Threat protection (4.4) | SI-3, SC-18, SC-7 | DE.CM-01 |
| BYOD and device access (4.5) | AC-19 | PR.PS-01 |
| Visibility (4.6) | AU-2, AU-12 | DE.CM-03 |
| Acquisition (all) | SA-4 | GV.SC-05 |
CIS Controls v8.1 Control 9 Email and Web Browser Protections sets the baseline; see the CIS Control 9 Email and Web Browser Protections Guide.
Standards and references
Related NHI Mgmt Group resources: Browser Security Buyer's Guide · Enterprise Browser and Browser Security Guide · Remote Browser Isolation Guide · SASE and SSE RFP Template · Security Vendor Evaluation and RFP Guide