Answering the security section of an RFP

The security section of an RFP is a questionnaire with a deadline and a scoring sheet. The companies that score well answered most of it before the RFP arrived.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Answer an RFP's security section from your approved answer library, cite your trust centre and gated documents as evidence, answer every question even where the answer is "no" with a plan, and have someone accountable review it before submission. RFP answers usually become part of the contract, so accuracy beats optimism. A company with a current trust centre and library can turn a security section around in days rather than weeks.

How are RFP security sections scored?

Evaluators commonly score completeness, whether evidence is attached or referenced, and whether the answer meets the stated requirement. An unanswered question often scores zero. A "partially meets" with a dated plan scores better than silence, and far better than a "yes" that later fails due diligence.

What process works for RFPs?

1. Read the mandatory requirements first. Anything marked mandatory, such as Canadian data residency or a specific certification, decides whether to bid.
2. Pull answers from the library. See building an answer library.
3. Attach evidence. Reference the trust centre and attach gated documents under the RFP's confidentiality terms.
4. Flag gaps honestly. State what is in progress with a date.
5. Review and sign off. Someone who can commit the company reads every security answer.

What do Canadian public sector RFPs add?

Expect data residency requirements, sometimes security screening of staff, accessibility and official languages terms, and references to the buyer's own security policies. Read the security schedule in full; public sector evaluators apply it literally.

Common questions