Security awareness platforms are usually chosen on library size and demo polish, then judged on completion rates that say nothing about whether staff report the next real phish. This template is a ready-to-issue request for proposal for a security awareness training and phishing simulation platform. Its requirements cover the content library, simulation across channels, the reporting button, behavioural metrics, languages and accessibility, integrations and the platform's own security and privacy controls, with mandatory and scored criteria, a weighted scoring model and a proof of concept plan. It is written for security awareness leads, procurement and the evaluation panel. The market and the reasoning behind each criterion are explained in the Security Awareness Training Buyer's Guide; this page is the procurement document.
How to use this template
- Replace text in square brackets, such as [Organisation], [headcount] and [email platform], with your own details. Delete requirements you do not need rather than leaving them unscored.
- Each requirement has an ID (for example SAT-PH-03) and a type: M mandatory (pass or fail; a fail eliminates the bid), S scored (0 to 5, weighted) or I informational.
- Weights and thresholds in brackets are illustrative. Set them before issue and do not change them after responses arrive.
- Issue sections 1 to 8 to bidders. The Implementation guidance section is for the evaluation panel only.
- Involve HR, legal, the data protection officer and any works council before issue: simulation and individual risk scoring process personal data about staff.
1. Purpose and scope
[Organisation] invites proposals for a security awareness training and phishing simulation platform that changes behaviour, measurably increases reporting of suspicious messages, and gives evidence for our training obligations without creating a blame culture.
- In scope: awareness content library; role-based and just-in-time training; phishing simulation by [email, SMS, voice, QR code, collaboration tools]; a reporting button for [email clients]; reporting and analytics; integrations with identity, HR and learning systems.
- Out of scope: [email security filtering]; [general learning management system replacement]; [managed programme services], unless offered as an option.
- Contract term: [three] years with an option to extend by [one] year.
- Drivers: [low phishing report rates]; [audit findings on training evidence]; [regulatory training obligations]; [targeted social engineering of service desk and finance]; [replacing an expiring contract].
2. Organisation background and current state
| Item | [Organisation] value |
|---|
| Population | [employees], [contractors], [frontline staff without mailboxes], [countries] |
| Languages | [list of required languages] |
| Email and collaboration | [email platform], [mail clients and mobile apps], [collaboration tools] |
| Identity and HR | [identity provider], [HR system], [learning management system or learning record store] |
| Security operations | [phishing report mailbox], [SIEM or SOAR], [ticketing] |
| High-exposure roles | [service desk], [finance and payments], [executives and assistants], [developers], [administrators] |
| Current programme | [current tools], [annual completion rate], [simulation click and report rates], [contract end date] |
| Obligations | [CIS Controls v8.1 Control 14], [NIST SP 800-53 AT-2 and AT-3], [ISO/IEC 27001:2022 Annex A 6.3], [sector rules] |
3. Instructions to bidders
- Respond to every requirement with Comply, Partially comply (explain), Roadmap (give a committed date) or Do not comply. Roadmap items score at most [1].
- Reference documentation or screenshots for every Comply answer to a scored requirement.
- State plan or edition for every feature; features that need a higher tier must be priced in section 7.
- Name all sub-processors and hosting regions.
- Submit by [date and time] to [procurement contact]. Clarification questions by [date]; answers are shared with all bidders.
4. Functional requirements
4.1 Content library
| ID | Requirement | Type |
|---|
| SAT-CO-01 | Library covers phishing, social engineering by phone and messaging, passwords and MFA, MFA fatigue and push prompts, QR code phishing, deepfake voice and video, data handling, generative AI use, physical security and incident reporting. | M |
| SAT-CO-02 | Modules of [5] minutes or less are available for every core topic. | S |
| SAT-CO-03 | Content can be edited or extended to reference [Organisation]'s policies, reporting route and branding. | S |
| SAT-CO-04 | Content is reviewed at least annually; bidder states the review process and dates of last review for core modules. | M |
| SAT-CO-05 | Role tracks for service desk, finance, executives, developers and administrators. | S |
| SAT-CO-06 | Custom content upload (SCORM 1.2, SCORM 2004 or xAPI) and authoring tools. | S |
4.2 Phishing simulation
| ID | Requirement | Type |
|---|
| SAT-PH-01 | Simulations by email; state support for SMS, voice, QR code and collaboration tool lures. | M (email); S (others) |
| SAT-PH-02 | Each template carries a difficulty rating, and reports can normalise results by difficulty. | S |
| SAT-PH-03 | Credential capture pages never store entered passwords or secrets; describe exactly what is recorded. | M |
| SAT-PH-04 | Administrators can exclude lure themes (for example bonuses, redundancy, health, family emergencies) globally. | M |
| SAT-PH-05 | Delivery works with [email platform] simulation allow-listing without weakening production filtering; bidder documents the configuration. | M |
| SAT-PH-06 | Randomised send windows and template variation to avoid staff warning each other. | S |
| SAT-PH-07 | Landing pages and follow-up lessons are supportive and short; no automatic disciplinary notifications. | M |
4.3 Reporting button and SOC integration
| ID | Requirement | Type |
|---|
| SAT-RB-01 | One-click reporting in [desktop, web and mobile mail clients]. | M |
| SAT-RB-02 | Real reports are forwarded, with full headers, to [SOC phishing mailbox or SOAR]; simulations are recognised and credited without reaching the SOC. | M |
| SAT-RB-03 | Reporters receive feedback (thank you, and outcome where available). | S |
| SAT-RB-04 | Works alongside, or replaces, the native report button in [email platform] without duplicate buttons. | S |
4.4 Metrics and reporting
| ID | Requirement | Type |
|---|
| SAT-MR-01 | Reports report rate, time to first report, click and submission rates, real threats reported and repeat risky actions, by role, site and difficulty. | M |
| SAT-MR-02 | Training completion evidence exportable for audit, per person and per obligation. | M |
| SAT-MR-03 | Raw event export by API or scheduled file to [SIEM or data platform]. | S |
| SAT-MR-04 | Aggregate dashboards by default; individual-level views restricted by role. | M |
| SAT-MR-05 | If risk scoring is offered: signals are configurable, explained, can be switched off, and scores can be challenged. | S |
4.5 Languages and accessibility
| ID | Requirement | Type |
|---|
| SAT-LA-01 | Core modules available in [required languages], with human-reviewed translation; state which are machine translated. | M |
| SAT-LA-02 | Training player, content and landing pages conform to WCAG 2.2 Level AA; provide an accessibility conformance report. | M |
| SAT-LA-03 | Captions and transcripts for all video; keyboard and screen reader support. | M |
| SAT-LA-04 | Delivery to staff without corporate mailboxes (kiosk, mobile, QR code or LMS link). | S |
| ID | Requirement | Type |
|---|
| SAT-SE-01 | Administrator access by SSO (SAML 2.0 or OpenID Connect) with MFA enforced; no shared administrator accounts. | M |
| SAT-SE-02 | User provisioning and deprovisioning by SCIM 2.0 from [identity provider]; leavers removed within [24] hours. | M |
| SAT-SE-03 | Role-based administration with separate roles for simulation, reporting and individual data. | S |
| SAT-SE-04 | Tenant audit log of administrator actions, exportable to [SIEM]. | M |
| SAT-SE-05 | API keys and integration credentials scoped, rotatable and visible to the customer; any mailbox access uses least privilege and is documented. | M |
| SAT-SE-06 | Independent assurance (for example SOC 2 Type 2 or ISO/IEC 27001 certification) and a published vulnerability disclosure route. | M |
| SAT-PR-01 | Data processing agreement meeting UK GDPR and EU GDPR Article 28; named hosting regions and sub-processors. | M |
| SAT-PR-02 | Configurable retention and deletion of individual simulation and training data. | M |
| SAT-PR-03 | Bidder provides input for [Organisation]'s data protection impact assessment. | S |
The platform holds the whole workforce directory and integration credentials, so treat it as a privileged SaaS supplier. See the SaaS and OAuth App Governance Guide where OAuth grants to the mail platform are involved.
6. Implementation, services and support
- SAT-IM-01 (M): implementation plan covering SSO, SCIM, simulation allow-listing, report button deployment and first campaign within [60] days.
- SAT-IM-02 (S): named customer success contact and programme design support, including a first-year campaign calendar.
- SAT-IM-03 (M): support hours, severity definitions and response times; platform availability commitment of at least [99.5] per cent.
- SAT-IM-04 (I): optional managed programme services and their price.
- SAT-IM-05 (M): exit plan: export of all training records, results and custom content in open formats within [30] days of termination, then certified deletion.
7. Commercials
| Item | Bidder response |
|---|
| Price per user per year, by tier, for [headcount] users | [ ] |
| Features requiring higher tiers or add-ons (list each requirement ID) | [ ] |
| Non-email simulation (SMS, voice) usage charges | [ ] |
| Implementation and services fees | [ ] |
| Price protection on renewal | [ ] |
| Three-year total cost of ownership | [ ] |
8. Evaluation method and proof of concept
8.1 Bids that fail any mandatory requirement are eliminated. Scored requirements are rated 0 (absent) to 5 (fully meets with evidence) and weighted:
| Area | Illustrative weight |
|---|
| Metrics and reporting (4.4) and reporting button (4.3) | [25]% |
| Phishing simulation (4.2) | [20]% |
| Content (4.1) | [15]% |
| Languages and accessibility (4.5) | [10]% |
| Platform security, privacy and integration (5) | [15]% |
| Implementation and support (6) | [5]% |
| Commercials (7) | [10]% |
8.2 The top [two] bidders are invited to a [30]-day proof of concept with a pilot group of [200 to 500] users from [two] sites and at least [two] high-exposure roles:
- Week 1: configure SSO, SCIM and simulation allow-listing in a test tenant; verify deprovisioning removes a test leaver.
- Week 1: deploy the report button to the pilot; send a benign test real report and confirm it reaches the SOC with headers and the reporter gets feedback.
- Week 2: run one email simulation of medium difficulty and one non-email simulation; confirm no credentials are stored and excluded themes cannot be selected.
- Week 3: assign one role-based and one just-in-time lesson; test with a screen reader user and in [two] required languages.
- Week 4: export raw events to [SIEM]; produce the board metrics (report rate, time to report, repeat risky actions); collect pilot user feedback; score against section 4 and 5.
8.3 Demo script: bidders show, live and in this order, (a) building a simulation with an excluded theme blocked, (b) a real report flowing to the SOC, (c) the report rate dashboard normalised by difficulty, (d) restricting individual-level data to a named role, (e) SCIM deprovisioning, (f) data export at exit.
Implementation guidance
- Write the programme before the RFP: agree objectives (report rate, time to report, role-specific behaviours) and the no-blame stance first. NCSC guidance states that "Employees who are afraid for their jobs will not report mistakes" and advises tracking how many people reported a phish, not only how many clicked. See the Phishing Simulation Programme Guide.
- Score evidence, not slides: require documentation references for every scored Comply answer and verify the critical ones in the proof of concept.
- Do not over-weight library size: a few current, short, editable modules for each audience matter more than thousands of titles. NIST SP 800-50 Rev. 1 frames awareness as a learning programme aimed at behaviour change, with metrics and evaluation built in.
- Small organisations: the built-in simulation, training and report button in your email platform may meet the mandatory requirements; issue a shortened RFP (sections 4.1 to 4.4 and 5) and compare.
- Map to obligations: CIS Controls v8.1 Control 14, NIST SP 800-53 Rev. 5 AT-2 Literacy Training and Awareness and AT-3 Role-based Training, NIST CSF 2.0 PR.AT-01 and PR.AT-02, and ISO/IEC 27001:2022 Annex A 6.3. See the CIS Control 14 Security Awareness and Skills Training Guide.
- Plan the first year: use the Security Awareness Plan Template and track progress with the Security Awareness Maturity Model.
Standards and references
Related NHI Mgmt Group resources: Security Awareness Training Buyer's Guide · Security Awareness and Human Risk Management Guide · Security Vendor Evaluation and RFP Guide · Phishing Guide