Third-party risk management platforms are often chosen on a polished questionnaire demo, then struggle once they meet a real supplier inventory, real procurement workflows and the evidence a regulator or auditor expects. This template is a ready-to-issue request for proposal for a TPRM platform. Its numbered requirements cover the supplier inventory and tiering, questionnaire exchange, evidence and document management, continuous monitoring, issue and remediation workflow, regulatory registers, reporting, integrations, the platform's own security and commercials, with mandatory and scored criteria, weighted scoring and a proof of concept plan. It is vendor-neutral and written for third-party risk, procurement and security teams and their evaluation panels. For what the market offers, read the TPRM and Security Ratings Buyer's Guide; to judge where your programme stands before buying, use the Third-Party Risk Management Maturity Model.
How to use this template
- Replace text in square brackets, such as [Organisation], [number] and [regulation], with your own details. Delete requirements that do not apply.
- Each requirement has an ID (for example TP-MON-03) and a type: M mandatory (pass or fail), S scored (0 to 5, weighted) or I informational.
- Weights, volumes and timings in brackets are illustrative, not benchmarks. Fix them before issue and do not change them once responses arrive.
- Issue sections 1 to 9 to bidders. The Implementation guidance section is for your panel only.
- Agree your tiering model first: the Vendor Tiering and Inherent Risk Questionnaire Template gives a starting point, and the platform must be able to run it.
1. Purpose and scope
[Organisation] invites proposals for a third-party risk management platform. The aim is a single, accurate record of suppliers and the services they provide, risk-based assessment proportionate to each supplier's tier, timely visibility of changes in supplier risk, tracked remediation, and evidence that satisfies [internal audit, regulators and customers]. The platform supports, and does not replace, [Organisation]'s procurement, contract management and enterprise risk processes.
- Population: [number] active suppliers, of which approximately [number] are critical or high tier; [number] new suppliers onboarded per year.
- Users: [number] TPRM analysts; [number] business relationship owners; [number] procurement, legal, privacy and security reviewers; read-only users in [audit, executive].
- Drivers: [regulatory obligations, for example DORA ICT third-party requirements, outsourcing rules or sector supervisory expectations]; [customer assurance demands]; [audit findings]; [replacement of spreadsheets and email].
- Out of scope: [procure-to-pay processing]; [contract authoring]; [supplier payments], except where integration is required in section 6.
2. Current environment
| Item | [Organisation] value |
|---|---|
| Current supplier record | [spreadsheet, procurement system, contract system]; number of duplicate or incomplete records |
| Assessment content in use | [in-house questionnaire]; [an industry standard questionnaire]; [cloud provider self-assessments] |
| Assessments per year | [number] onboarding; [number] periodic reviews |
| Systems to integrate | [procurement or ERP]; [contract management]; [GRC]; [identity provider]; [ticketing]; [data warehouse or BI] |
| Regulatory registers | [register of information or outsourcing register required, with submission format] |
| Data residency | [regions where supplier data may be stored] |
3. Instructions to bidders
- Timeline: RFP issued [date]; clarification questions by [date]; responses due [date, time, time zone]; scripted demonstrations [dates]; proof of concept [dates]; decision [date].
- Single point of contact: [name, email].
- Response scale: for each requirement state available now, available via configuration, available via partner or custom work (with cost), on the roadmap (with date) or not met. Roadmap items score zero.
- Evidence: support claims with screenshots, documentation links, an independent assurance report or a demonstration in section 9.
- Scripted demonstration: demonstrations follow the script in section 9 using [Organisation]'s sample data, not a standard sales demo.
4. Functional requirements
4.1 Supplier inventory and tiering
| ID | Requirement | Type |
|---|---|---|
| TP-INV-01 | Maintains one record per legal entity with parent and subsidiary relationships, linked services, contracts, business owner, data types shared, systems and access granted, and criticality. | M |
| TP-INV-02 | Runs [Organisation]'s configurable inherent risk intake and calculates a tier automatically; tier changes are logged with reason and approver. | M |
| TP-INV-03 | Records fourth parties and subcontractors (Nth parties) supporting each critical service, and shows concentration where many suppliers depend on the same provider. | S |
| TP-INV-04 | Imports and deduplicates suppliers from [procurement system and spreadsheets]; describe matching rules. | S |
| TP-INV-05 | Records the non-human access each supplier holds: integrations, API keys, OAuth grants, service accounts and remote access, with owner and review date. | S |
See the Third-Party Concentration Risk Guide and the Third-Party NHI Due Diligence Questions Guide.
4.2 Questionnaire exchange and evidence
| ID | Requirement | Type |
|---|---|---|
| TP-QST-01 | Supports [Organisation]'s own questionnaires and imports industry standard questionnaires that [Organisation] is licensed to use, such as the Shared Assessments SIG or the CSA CAIQ; state which content is included in the price and which requires the bidder or [Organisation] to hold a licence. | M |
| TP-QST-02 | Scopes questionnaires by tier and service so low-risk suppliers receive short assessments and critical suppliers full ones. | M |
| TP-QST-03 | Supplier portal with no licence cost to suppliers, delegation to multiple supplier contacts, save and resume, and reuse of prior answers. | M |
| TP-QST-04 | Accepts completed standard questionnaires, certificates and independent assurance reports (for example ISO/IEC 27001 certificates, SOC 2 reports, cloud registry entries) in place of answers, with expiry dates tracked and renewal reminders. | S |
| TP-QST-05 | Answer-level scoring, analyst comments, and conversion of an unsatisfactory answer into a finding in one step. | S |
| TP-QST-06 | Describe any AI-assisted review of answers or documents: what it does, where the model runs, whether supplier data is used for training, and how analysts confirm its output. | S |
4.3 Continuous monitoring
| ID | Requirement | Type |
|---|---|---|
| TP-MON-01 | Ingests external signals for monitored suppliers: [security ratings], [breach and incident news], [financial health], [sanctions and adverse media], [certificate expiry]. State which are native and which come from partners, and the cost of each. | S |
| TP-MON-02 | For any external security rating, documents the method, data sources, how suppliers can view and dispute findings, and how often scores refresh. | M where ratings are offered |
| TP-MON-03 | Alerts route to the business owner and TPRM analyst by tier and severity, with thresholds [Organisation] can configure, and can trigger a reassessment or an incident workflow. | S |
| TP-MON-04 | When a widely used product or provider is publicly reported as compromised, identifies every supplier and internal service linked to it within [hours]. | S |
See the Third-Party Incident Response Playbook.
4.4 Workflow, issues and remediation
| ID | Requirement | Type |
|---|---|---|
| TP-WFL-01 | Configurable workflows for onboarding, periodic review, change of service, incident and offboarding, without vendor professional services for routine changes. | M |
| TP-WFL-02 | Findings carry severity, owner, due date, supplier action plan and evidence of closure; risk acceptance requires a named approver and expiry date. | M |
| TP-WFL-03 | Offboarding workflow confirms return or deletion of data and revocation of all supplier access, including credentials and integrations recorded under TP-INV-05. | M |
| TP-WFL-04 | Contract requirements (security clauses, audit rights, notification periods) are recorded per supplier and checked at renewal. | S |
| TP-WFL-05 | Full audit trail of every change, approval and supplier submission, exportable for auditors. | M |
See the Third-Party Security Contract Clauses Template.
4.5 Regulatory registers and reporting
| ID | Requirement | Type |
|---|---|---|
| TP-REP-01 | Produces [regulatory register, for example the DORA register of information] in the format required by [competent authority], with validation before submission. | [M where applicable] |
| TP-REP-02 | Dashboards for the board and risk committee: suppliers by tier, overdue assessments, open findings by severity, accepted risks, concentration. | S |
| TP-REP-03 | Self-service reporting and scheduled exports to [BI tool or data warehouse] via API. | S |
| TP-REP-04 | Maps questionnaire content and findings to frameworks used by [Organisation], such as NIST CSF 2.0 GV.SC outcomes and ISO/IEC 27001:2022 supplier controls. | S |
See the DORA ICT Third-Party Register of Information Guide.
5. Platform security and data protection
| ID | Requirement | Type |
|---|---|---|
| TP-SEC-01 | Single sign-on via [SAML 2.0 or OpenID Connect] for internal users; supplier users protected by multi-factor authentication; role-based access with field-level restriction for sensitive documents. | M |
| TP-SEC-02 | User provisioning and deprovisioning via SCIM or equivalent; supplier contacts removed automatically when deactivated by the supplier admin or at offboarding. | S |
| TP-SEC-03 | Data encrypted in transit and at rest, stored in [region]; describe key management and any customer-managed key option. | M |
| TP-SEC-04 | Current independent assurance report or certification covering the service [ISO/IEC 27001, SOC 2 Type II or equivalent]; penetration test summary from the last 12 months. | M |
| TP-SEC-05 | API tokens are scoped, expiring and revocable; list all service accounts the platform needs in [Organisation]'s systems and the minimum permissions for each. | M |
| TP-SEC-06 | List sub-processors, the data each receives, and the notice given before changes; accept [Organisation]'s data processing agreement. | M |
| TP-SEC-07 | Notifies [Organisation] of a security incident affecting its data within [hours] and supports investigation with logs. | M |
6. Integrations
- Procurement and ERP: supplier creation triggers intake; purchase orders blocked or flagged for suppliers without a completed assessment [where required].
- Contract management: contract dates, clauses and renewal triggers synchronised.
- GRC and enterprise risk: third-party risks and findings appear in the enterprise risk register.
- Ticketing: findings and access revocation tasks raised in [ticketing system].
- Identity and access: supplier user and integration accounts linked to supplier records for review and offboarding.
- Open API: documented REST API with rate limits, webhooks and no extra charge for [number] calls per day.
7. Implementation, support and service levels
| ID | Requirement | Type |
|---|---|---|
| TP-IMP-01 | Implementation plan with phases, roles, data migration from [current tools] and the effort expected from [Organisation]. | S |
| TP-IMP-02 | Availability of at least [99.5%] per month with service credits; support hours, response times by severity, and a named customer success contact. | M |
| TP-IMP-03 | Data export of all records, documents and audit history in open formats on request and at contract end, at no extra charge. | M |
| TP-IMP-04 | References: [two or three] customers of similar size and sector, at least one live for [two] years. | S |
8. Commercials
| Cost element | What to state |
|---|---|
| Licence basis | Per supplier record, per assessment, per internal user or platform fee; price at [number] and at [number] suppliers |
| Content and data feeds | Questionnaire content licences, ratings, financial and sanctions feeds, each priced separately |
| Managed services | Optional assessment or evidence collection services, priced per assessment |
| Implementation | Fixed price or capped time and materials |
| Price protection | Annual increase cap for [years]; renewal terms |
| Five-year total cost | All of the above for [Organisation]'s volumes in section 1 |
9. Evaluation method, demonstration script and proof of concept
| Criterion | Weight | Evidence |
|---|---|---|
| Inventory, tiering and workflow (4.1, 4.4) | [25%] | Scripted demo, proof of concept |
| Questionnaire exchange and supplier experience (4.2) | [20%] | Proof of concept with real suppliers |
| Continuous monitoring (4.3) | [10%] | Demo, method documentation |
| Registers and reporting (4.5) | [10%] | Sample register output |
| Security, integrations and service (5, 6, 7) | [15%] | Assurance reports, API documentation, references |
| Five-year total cost (8) | [20%] | Price schedule |
Scored requirements use 0 to 5: 0 not met or roadmap only; 3 met with gaps or configuration effort; 5 fully met, demonstrated. A mandatory requirement not met excludes the bid.
Demonstration script (90 minutes, [Organisation]'s sample data):
- Import [50] sample supplier records with deliberate duplicates and show deduplication.
- Run the intake for a new cloud supplier that will hold personal data and receive an API key; show the tier calculated and the questionnaire scoped.
- Complete the questionnaire as the supplier, attaching a certificate in place of answers; show expiry tracking.
- Raise a finding, agree a supplier action plan, then record a time-limited risk acceptance.
- Simulate a public report that a widely used provider is compromised; show which suppliers and services are affected.
- Offboard a supplier and show the data deletion and access revocation tasks.
- Produce the board dashboard and [regulatory register] extract.
Proof of concept (shortlisted bidders, [four to six] weeks):
- Load [200] real supplier records and [Organisation]'s tiering model.
- Send assessments to [five to ten] volunteer suppliers of different sizes and collect their feedback on the portal.
- Connect single sign-on and one integration, such as procurement or ticketing.
- Measure analyst time per assessment against the current process.
- Export all proof of concept data and confirm deletion from the bidder's environment at the end.
Implementation guidance
This section is for the evaluation panel, not for bidders.
- Fix the process before the tool: a platform automates your tiering and review cycle; if those are undefined, configuration stalls. The maturity model linked above helps set the target.
- Price the whole thing: questionnaire content, monitoring feeds and managed services are often separate line items. Compare the five-year total, not the platform fee.
- Ask suppliers, not just the bidder: supplier portal friction drives response times. Proof of concept feedback from real suppliers is the best evidence.
- Treat ratings as signals: external scores are useful for prioritising, but they see only what is visible from outside. Check the method and dispute process under TP-MON-02 and confirm findings before acting on them.
- Track the access, not just the paperwork: many supplier incidents run through credentials and integrations a supplier holds. Requirements TP-INV-05 and TP-WFL-03 link the risk record to real access so that offboarding removes it.
- Use public standards for content: NIST SP 800-161 Rev. 1 and the NCSC supply chain security guidance (grouped into four stages: understand the risks, establish control, check your arrangements and continuous improvement) give structure that suits any platform.
| Requirement group | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Supplier inventory and tiering (4.1) | SR-3, RA-3 | GV.SC-04 |
| Due diligence and questionnaires (4.2) | SR-6, SA-9 | GV.SC-06, GV.SC-07 |
| Contract requirements (4.4) | SA-4 | GV.SC-05 |
| Monitoring and programme oversight (4.3, 4.5) | SR-6 | GV.SC-07, GV.SC-09 |
| Offboarding (4.4) | SA-9 | GV.SC-10 |
Standards and references
- NIST: SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NCSC: Supply chain security guidance
- Shared Assessments: Standardized Information Gathering (SIG) Questionnaire
- Cloud Security Alliance: STAR Level 1 Security Questionnaire (CAIQ v4)
- EUR-Lex: Regulation (EU) 2022/2554 Digital Operational Resilience Act
Related NHI Mgmt Group resources: Third-Party Risk Management Guide · TPRM and Security Ratings Buyer's Guide · Third-Party Risk Management Maturity Model · Security Questionnaires Guide · Security Vendor Evaluation and RFP Guide