Hiring a Consultant

How to Write a Security RFP That Gets Comparable Proposals

By the FASC editorial team Updated Nov 4, 2026 5 min read

A good security RFP (request for proposals) explains who you are, what problem you need solved, exactly what the consultant must deliver, when, and how you will choose. The more specific your scope, deliverables and evaluation criteria, the more comparable the proposals you get back. Most security RFPs can be written in a few pages using the structure below.

Security RFP key takeaways

Write the scope around outcomes and deliverables (for example, “a written assessment of 12 buildings with prioritized recommendations”), not a vague request for “security services”.
Give bidders the facts they need to price: number of sites, square footage, hours of operation, existing systems and any recent incidents.
Ask every bidder to price the work in the same format, so you can compare proposals line by line.
Require a conflict of interest statement if you want independent advice rather than a sales pitch.
Publish your evaluation criteria in the security RFP and score proposals against them.

When do you need a security RFP?

A security RFP makes sense when the work is significant, when several firms could do it, and when you need to compare approaches as well as price. Public school districts, municipalities, universities and hospitals often must use one under their procurement rules. Private companies use RFPs to bring discipline to a large spend and create a paper trail for the board.

It helps to know the related documents:

RFI (request for information): you are still learning what is possible and want input from the market. No commitment.
RFQ (request for qualifications or quotation): you want to shortlist firms by qualifications, or you have a tightly defined scope and only need a price.
RFP (request for proposals): you have a defined need and want firms to propose how they would meet it, with pricing.

For a single small project, a short scope of work sent to three qualified consultants may be enough. Our free Request Proposals form does this for you by matching your project with vetted consultants.

What should a security RFP include?

1. Organization background

Who you are, what you do, how many people and sites are involved and any context that shapes the work. A K-12 district, a hospital and a distribution center have very different needs, and bidders price accordingly.

2. Purpose and objectives

Explain why you are doing this now. A new building, a serious incident, a board directive, a grant, an insurance requirement or a new law (for example, California employers updating plans under SB 553) all lead to different scopes. One or two paragraphs is enough.

3. Scope of work

This is the heart of the security RFP. List the sites, the types of work and the boundaries. For an assessment, specify whether you want review of policies and plans, interviews with staff, after hours site visits, review of existing technology, CPTED review and emergency plan review. Say what is out of scope, too.

4. Deliverables

Spell out what you will receive: a written report, an executive summary for the board, prioritized recommendations with rough cost ranges, drawings, specifications, training sessions or a presentation. If you want recommendations grouped by priority and cost, say so.

5. Site and facility data

Provide the number of buildings, approximate square footage, hours of operation, population, existing access control and camera systems, and whether a guard service is in place. Missing information leads to padded pricing or wildly different assumptions.

6. Timeline

Include the security RFP release date, deadline for questions, date answers will be published, proposal due date, expected award date and the date you need the final deliverable.

7. Proposal requirements

Tell bidders exactly what to submit in response to the security RFP and in what order, with page limits if you want them. Common items include:

Firm overview and relevant experience in your sector
Resumes and certifications of the people who will do the work
Proposed approach and methodology
Sample deliverable (redacted)
Three references from similar clients
Proof of insurance, typically general liability and professional liability
Pricing, in your required format
Conflict of interest and independence statement

8. Pricing format

Ask for a fixed fee for the defined scope, broken down by phase or site, plus hourly rates for additional work and a clear statement on travel expenses. Without a common format you will spend more time decoding proposals than evaluating them. Our cost guides show published price ranges for common projects, so you can set a realistic budget before you issue the security RFP.

9. Evaluation criteria and terms

List how you will score proposals, your contract terms, confidentiality requirements and any public procurement conditions that apply.

How should you evaluate security RFP responses?

Publishing your criteria keeps the process fair and makes your decision easier to defend. The weights below are an example only; adjust them to your priorities and procurement rules.

Criterion	What to look for	Example weight
Relevant experience	Recent projects in your sector and facility type	25%
Team qualifications	Named staff, certifications, who actually does the work	20%
Approach and methodology	Clear, specific plan that fits your scope	20%
Quality of sample work	Actionable, prioritized, readable by non-specialists	10%
Independence	No product sales or referral fees tied to recommendations	10%
Price	Total cost and value for the scope proposed	15%

Have at least two or three people score independently, then compare. Interview the top two or three firms if the project is large. Call references and ask specific questions: was the report useful, did the team meet deadlines, and would you hire them again?

Why include an independence requirement in a security RFP?

If you are hiring for an assessment or design, you usually want advice that is not tied to selling equipment or guard hours. Ask bidders to disclose whether they sell, install or resell security products or services, and whether they receive commissions from vendors. Many public owners also bar the firm that designs a system from bidding on the installation. Our article on security consultants vs security integrators explains the difference.

What mistakes should you avoid in a security RFP?

Vague scope. “Assess our security” invites proposals that range from a two hour walkthrough to a multi-month study.
Too little site data. Bidders guess, and their guesses differ.
No common pricing format. You cannot compare a lump sum with an hourly estimate.
Choosing on price alone. Published guidance from security firms notes that a very cheap “assessment” is often little more than a camera count or a sales call.
Not saying who reviews the report. Tell bidders whether the results go to a board, a superintendent, an insurer or counsel.
Unrealistic deadlines. A rushed assessment produces a thin report.
Forgetting confidentiality. Security reports describe your vulnerabilities. Require that they be handled and shared only as you direct.

Are there examples for specific sectors?

Schools can align the scope with federal guidance and free tools. The SchoolSafety.gov site collects federal resources, and a district may ask bidders to build on a self assessment already done with a free tool. Our guides on hiring a school security consultant and the school security assessment cost guide can help shape the scope. Businesses commissioning a facility review can use the physical security assessment cost guide to set expectations.

Skip the RFP paperwork for smaller projects

Not every project needs a formal security RFP. Describe your facility and goals in our free form, and we will match you with vetted, independent security consultants who will send proposals you can compare side by side. No cost and no obligation.

Request free proposals

Frequently asked questions

What is a security RFP?

A security RFP, or request for proposals, is a document an organization issues to invite security consultants or vendors to propose how they would handle a defined project, such as a security assessment, system design or plan development, and at what price. It describes the scope, deliverables, timeline, submission requirements and how proposals will be evaluated.

How long should a security RFP be?

Long enough to describe the scope, deliverables, site details, timeline, submission requirements and evaluation criteria clearly. For many assessment projects that is a handful of pages plus attachments such as site lists. Public entities often add required legal and procurement language. Clarity matters more than length; vague security RFPs produce proposals you cannot compare.

How many firms should receive a security RFP?

For a private project, inviting three to five qualified firms usually gives enough competition without overwhelming your evaluation team. Public entities may be required to advertise publicly and accept any responsive bid. In either case, a clear scope and pricing format matters more than the number of bidders for getting comparable, useful proposals.

Should price be the main factor in choosing a security consultant?

Price matters, but it should rarely be the deciding factor on its own. Experience in your sector, the qualifications of the people doing the work, methodology, sample work and independence all affect the value of the result. Many organizations give price a moderate weight and score the other factors first, then compare cost among the strongest proposals.

What is the difference between an RFP and an RFQ for security services?

A security RFP asks firms to propose an approach and price for a defined need, and you compare both. An RFQ is used either to shortlist firms by qualifications before requesting proposals, or to get a price for a tightly defined scope. Some organizations issue an RFQ first, then send an RFP to the shortlisted firms.