Threat intelligence platform RFPs that ask "how many feeds do you integrate?" or "do you support STIX?" get a big number and a yes from every bidder, and the real problems surface later as millions of stale indicators, scores nobody can explain and sharing rules the platform does not enforce. This template gives you a ready-to-issue request for proposal for a threat intelligence platform (TIP), with numbered requirements written so answers can be tested in a proof of concept and scored. It covers ingestion and STIX 2.1 normalisation, TAXII 2.1 exchange, deduplication and ageing, enrichment, scoring, TLP 2.0 handling, analyst workflow, integrations with SIEM, SOAR and EDR, platform security, services and pricing. It is vendor-neutral and written for CTI leads, SOC managers, procurement and evaluation panels. For what a TIP is for, deployment options and how to define priority intelligence requirements, read the Threat Intelligence Platform Buyer's Guide first; this page is the procurement document.
How to use this template
- Replace text in square brackets, such as [Organisation], [SIEM] and [number], with your own details. Delete requirements that do not apply rather than leaving them unscored.
- Each requirement has an ID (for example TIP-ING-03) and a type: M mandatory (pass or fail), S scored (weighted 0 to 5) or I informational. Keep M items few, so good bidders are not excluded on detail.
- Volumes, weights and periods in brackets are illustrative. Fix weights before responses arrive.
- Complete Appendix A (your priority intelligence requirements, sources and consuming tools) yourself. Bidders must answer and price against it, which makes responses comparable.
- Issue sections 1 to 8 and Appendix A to bidders. Implementation guidance is for the panel only. Ask for responses in a spreadsheet with one row per requirement ID and a documentation link for each answer.
1. Purpose and scope
[Organisation] invites proposals for a threat intelligence platform and associated services to collect, normalise, assess, enrich, store, share and operationalise cyber threat intelligence in support of detection, incident response, vulnerability management and risk decisions.
- In scope: ingestion of the sources in Appendix A; normalisation to STIX 2.1; deduplication, scoring and expiry; enrichment; analyst workspace and reporting; sharing with [ISAC or community names] over TAXII 2.1 or [MISP]; export to the consuming tools in Appendix A.
- Out of scope: [commercial intelligence subscriptions, procured separately]; [SIEM and SOAR platforms]; [managed intelligence analyst service, unless offered as an option in section 6].
- Contract term: [three] years, with an option to extend by [one].
- Drivers: [indicator overload in the SIEM]; [new sharing obligation or community membership]; [replacement of spreadsheets or an unsupported open-source deployment]; [audit finding on threat awareness].
2. Current state
| Item | [Organisation] value |
|---|
| Current tooling | [product or open-source platform, version, contract end date / none] |
| Intelligence team | [number] analysts, [hours of cover], reporting line |
| Sources | [number] open feeds, [number] commercial feeds, [ISAC, CERT or government sharing], internal incident data |
| Indicator volume | [number] new indicators a day; [number] currently stored; share older than [90] days |
| Consumers | [SIEM], [SOAR], [EDR], [firewall or secure web gateway], [email security], [vulnerability management] |
| Sharing obligations | [communities, formats, TLP rules, contractual or regulatory sharing] |
| Hosting constraints | [SaaS in named regions acceptable / self-managed or air-gapped required] |
3. Instructions to bidders
- Timeline: RFP issued [date]; clarification questions by [date]; responses due [date, time, time zone]; demonstrations [dates]; proof of concept [dates]; decision [date].
- Contact: [name, email]. Other contact with [Organisation] staff about this RFP may lead to disqualification.
- Response scale: available now; available with configuration; custom development; third-party product required (name it); roadmap (committed date); not supported. Roadmap answers score zero unless contractually committed.
- Evidence: link the product documentation page supporting each "available now" answer, and state the product edition and any add-on module required.
- Confidentiality: this RFP and Appendix A are [TLP:AMBER+STRICT or your classification]; bidders must not share them beyond the response team.
4. Functional requirements
4.1 Ingestion and normalisation
| ID | Requirement | Type |
|---|
| TIP-ING-01 | For each source in Appendix A, state the connector (TAXII 2.1 client, MISP, REST API, email, file), who maintains it, polling frequency and any extra charge. | M |
| TIP-ING-02 | Normalises all ingested content to STIX 2.1 objects (OASIS Standard, June 2021), including indicators, observed data, malware, threat actors, intrusion sets, campaigns, attack patterns, vulnerabilities, reports, relationships and sightings, and preserves the original source record. | M |
| TIP-ING-03 | Ingests unstructured reports (PDF, HTML, email) and extracts observables, ATT&CK techniques and CVE identifiers, with analyst review before extracted content is published to consumers. | S |
| TIP-ING-04 | Deduplicates objects across sources while keeping per-source provenance, first seen, last seen and source count. | M |
| TIP-ING-05 | Detects and alerts when a feed stops updating or its volume changes sharply, within [hours]. | S |
| TIP-ING-06 | Ingests internal intelligence: incident findings, sandbox results, phishing submissions and sightings from consuming tools. | S |
See the STIX and TAXII Guide and the Threat Intelligence Feed Evaluation Guide.
4.2 Scoring, confidence and ageing
| ID | Requirement | Type |
|---|
| TIP-SCR-01 | Scores indicators with a documented, configurable model; shows for any indicator which inputs (source reliability, corroboration, age, sightings, enrichment) produced its score. | M |
| TIP-SCR-02 | Supports the STIX 2.1 confidence property (0 to 100) and maps source and analyst confidence to it. | S |
| TIP-SCR-03 | Sets expiry per indicator type and source (for example IP addresses [30] days, domains [90] days, file hashes [longer]), honours valid_until from sources, and withdraws expired indicators from every consumer automatically. | M |
| TIP-SCR-04 | Lets analysts mark false positives and allowlist benign infrastructure (cloud provider ranges, content delivery networks, [Organisation] domains) so they are never pushed for blocking. | M |
| TIP-SCR-05 | Reports per-source quality: unique contribution, overlap with other sources, false positive rate and sightings in [Organisation] telemetry. | S |
4.3 Enrichment and analysis
| ID | Requirement | Type |
|---|
| TIP-ENR-01 | Enriches observables (passive DNS, WHOIS, geolocation, ASN, certificate data, sandbox verdicts, vulnerability context) through built-in or customer-keyed services; list each and its cost. | S |
| TIP-ENR-02 | Maps intelligence to MITRE ATT&CK techniques and shows coverage against [Organisation] detections when detection content is imported. | S |
| TIP-ENR-03 | Provides a graph or pivot view across actors, campaigns, infrastructure, malware and indicators, with relationship provenance. | S |
| TIP-ENR-04 | Tracks vulnerabilities with exploitation intelligence (for example presence in the CISA Known Exploited Vulnerabilities catalogue) and links them to actors and campaigns. | S |
| TIP-AI-01 | Describe any generative AI feature: which data it reads, whether [Organisation] data or prompts train models, how outputs cite source objects, how TLP is respected, and how it is priced. | I |
4.4 Sharing and handling
| ID | Requirement | Type |
|---|
| TIP-SHR-01 | Acts as a TAXII 2.1 client and server: discovery, API roots, collections, manifest, and filtering by added_after, type and id, with pagination. | M |
| TIP-SHR-02 | Applies FIRST TLP 2.0 labels (TLP:RED, TLP:AMBER+STRICT, TLP:AMBER, TLP:GREEN, TLP:CLEAR) as STIX marking definitions at object level, and enforces them on every export, share, report and AI feature. | M |
| TIP-SHR-03 | Supports sharing with [communities] including per-recipient rules, anonymisation of [Organisation] identifiers and approval before publication. | S |
| TIP-SHR-04 | Imports and exports MISP format events, or interoperates with a MISP instance, preserving tags and galaxies where possible. | S |
See the MISP Threat Sharing Guide.
4.5 Operationalisation and integrations
| ID | Requirement | Type |
|---|
| TIP-INT-01 | Pushes curated indicator sets to each consumer in Appendix A by score, type, TLP and confidence threshold, and removes them on expiry or false positive marking. | M |
| TIP-INT-02 | Receives sightings back from [SIEM] and [EDR] and records them as STIX sightings that update scores. | S |
| TIP-INT-03 | Supports retrospective search: new indicators matched against [number] days of retained telemetry, directly or through the SIEM. | S |
| TIP-INT-04 | Exposes a documented REST API covering all objects and administrative functions, with rate limits stated. | M |
| TIP-INT-05 | Supports SOAR playbooks for enrichment and indicator lifecycle, with an audit trail of automated changes. | S |
See the SIEM RFP Template and the SOAR Buyer's Guide.
4.6 Analyst workflow and reporting
| ID | Requirement | Type |
|---|
| TIP-WF-01 | Tracks priority intelligence requirements and links collection, analysis and products to them. | S |
| TIP-WF-02 | Provides case or investigation workspaces with notes, tasks and evidence, and STIX notes and opinions for analyst assessments. | S |
| TIP-WF-03 | Produces finished intelligence reports from templates, with TLP banners and source citations. See the Threat Intelligence Report Template. | S |
| TIP-WF-04 | Dashboards and metrics: indicators by source and age, consumer push volumes, sightings, false positives and requirement coverage. | S |
| ID | Requirement | Type |
|---|
| TIP-SEC-01 | Analyst and administrator access through [Organisation] SSO with phishing-resistant MFA and granular roles, including restricting TLP:RED and TLP:AMBER+STRICT content to named groups. | M |
| TIP-SEC-02 | Feed, enrichment and integration credentials (API keys, TAXII credentials, service accounts) stored encrypted, scoped per connector, rotatable without data loss and never shown in full after entry. | M |
| TIP-SEC-03 | Write access to consumers (for example adding block rules to firewalls or EDR) uses dedicated least-privilege service identities, with changes logged on both sides. | M |
| TIP-SEC-04 | Logs all administrative actions, scoring changes, publication and sharing events, exports and API calls, retained for [period] and exportable to [SIEM]. | M |
| TIP-SEC-05 | Current independent assurance report and completed [SIG or CAIQ]; list sub-processors, data locations and how bidder staff access customer data. | M |
| TIP-NF-01 | Availability commitment of [percentage]; behaviour of consumers if the platform is unavailable (indicator lists cached or emptied). | S |
| TIP-NF-02 | Full export of all objects, relationships, scores, notes and sharing history in STIX 2.1 on request and at exit, at [no charge / stated charge]. | M |
A TIP holds credentials for most of your security stack and can push block rules into production controls. Treat its integrations as privileged non-human identities; see the Threat Intelligence for Identity and NHI Guide.
6. Services and support
- Onboarding: plan to connect the Appendix A sources and consumers within [weeks], with acceptance criteria per connector.
- Scoring design: workshop to configure scoring, expiry and allowlists against [Organisation]'s requirements.
- Training: analyst and administrator training, and documentation of the data model.
- Optional analyst service: [if wanted] scope, hours and deliverables of any managed intelligence service, priced separately.
- Support: tiers, hours and response targets by severity; connector fix times when a source changes its API.
- References: [two or three] customers of similar size, sector or sharing community.
7. Pricing
Price the full term against Appendix A.
| Cost element | What to state |
|---|
| Licence metric | Named analysts, total users, objects stored, API calls or a platform fee; how it is measured |
| Connectors | Which Appendix A connectors are included; premium connector charges |
| Bundled intelligence | Any feeds included, listed separately so the platform can be compared without them |
| Enrichment | Included lookups, quotas and overage rates |
| Add-ons | Sharing module, AI features, sandbox, extra environments |
| Services | Onboarding, scoring design, training and day rates |
| Renewal and exit | Cap on renewal increases; export charges |
8. Evaluation method and proof of concept
| Criterion | Weight | Evidence |
|---|
| Scoring, ageing and quality (4.2) | [25%] | Proof of concept results on Appendix A sources |
| Ingestion and normalisation (4.1) | [15%] | Proof of concept, STIX export review |
| Operationalisation (4.5) | [20%] | Push, withdrawal and sighting tests |
| Sharing and TLP (4.4) | [10%] | TAXII and TLP enforcement tests |
| Platform security (5) | [15%] | Assurance reports, questionnaire, connector permissions |
| Cost over the term (7) | [15%] | Priced against Appendix A |
Scores use 0 to 5: 0 not met; 1 roadmap only; 3 met with configuration; 5 met fully and demonstrated in the proof of concept. Shortlisted bidders will run a [four]-week proof of concept with [Organisation] sources covering:
- Connect [five] Appendix A sources, including one TAXII 2.1 collection and one community feed, and report deduplication and per-source unique contribution after two weeks.
- Explain the score of [ten] indicators chosen by the panel, input by input.
- Push a scored indicator set to [SIEM] and a test blocklist, mark one indicator as a false positive and one as expired, and time their removal from both.
- Run a retrospective search for [ten] indicators from a past incident against retained telemetry and record hits.
- Label objects TLP:RED and TLP:AMBER+STRICT and attempt to share, export, report and summarise them as a user without access; all must be blocked.
- Ingest one unstructured report and measure extraction accuracy before and after analyst review.
- Rotate one connector credential and confirm no data loss, then export the full dataset in STIX 2.1 and validate it.
Appendix A: Requirements, sources and consumers (completed by [Organisation])
| Item | Detail |
|---|
| Priority intelligence requirements | [five to ten questions, for example: which actors target our sector; which exploited vulnerabilities affect our external estate; which phishing infrastructure impersonates our brand] |
| Sources | [name, type, format (STIX, MISP, CSV, API), volume per day, TLP of content, contract owner] |
| Consumers | [tool, integration method, indicator types accepted, maximum list size] |
| Sharing communities | [name, protocol, obligations] |
Implementation guidance
This section is for the evaluation panel, not for bidders.
- Write requirements before features: NIST SP 800-150 frames sharing around defined goals, sources and scope. Without Appendix A filled in, every bidder will look equally capable.
- Score on quality, not volume: weight TIP-SCR-01, TIP-SCR-03 and TIP-SCR-05 highest. A platform that pushes fewer, explainable, expiring indicators is worth more than one that pushes everything.
- Test withdrawal, not only delivery: stale indicators in blocklists cause outages and alert fatigue. The proof of concept step on expiry is the one most often skipped.
- Enforce TLP technically: a label that the platform shows but does not enforce on export, sharing or AI summaries breaks the source's terms.
- Protect the hub: issue proof of concept connectors with least privilege and short expiry, and revoke them after the evaluation.
- Plan the exit at entry: TIP-NF-02 decides what the next migration costs.
| Requirement group | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|
| Ingestion, sharing (4.1, 4.4) | PM-16, PM-16(1), SI-5 | ID.RA-02 |
| Analysis and enrichment (4.2, 4.3, 4.6) | PM-16, RA-10 | ID.RA-03, DE.AE-02 |
| Operationalisation (4.5) | SI-4, IR-4(1) | DE.AE-02 |
| Platform security (5) | AC-6, AU-9 | DE.CM-03 |
| Acquisition (all) | SA-4 | GV.SC-05 |
Standards and references
Related NHI Mgmt Group resources: Threat Intelligence Platform Buyer's Guide · Threat Intelligence Guide · Threat Intelligence Maturity Model · STIX and TAXII Guide · Security Vendor Evaluation and RFP Guide