rfp-responder

name	rfp-responder
description	RFP and security questionnaire response: analyse, score, and respond to enterprise RFPs, security questionnaires (SIG, CAIQ), and vendor assessments — efficiently and accurately

RFP Responder Skill

When to activate

• Responding to an enterprise RFP (Request for Proposal) or ITT (Invitation to Tender)
• Completing a security questionnaire (SIG Lite, SIG Core, CAIQ, custom)
• Responding to a vendor assessment or due diligence questionnaire
• Building a response library for frequently-asked RFP questions
• Scoring an incoming RFP to decide whether to bid

When NOT to use

• Contract negotiation after winning an RFP — use the deal-desk skill
• Legal compliance review of the RFP terms — use the vendor-contract-review skill
• Marketing positioning — use the copywriting skill
• First sales call or demo — use the sdr-agent skill

Instructions

RFP bid/no-bid scoring

Score this RFP to decide whether to bid.

RFP details:
- Issuer: [company name, size, industry]
- Estimated contract value: $[X]
- Submission deadline: [date] (time available: [X weeks])
- Contract length: [X months/years]
- Geographic restrictions: [jurisdiction or location requirements]
- Incumbent: [known / unknown / we are the incumbent]

Score on 5 criteria (1-5 each):

1. STRATEGIC FIT:
   - Is this customer in our ICP?
   - Would winning this deal advance our market position?
   - Is there a strong reference-customer opportunity?
   Score: [1-5]

2. WIN PROBABILITY:
   - Do we have an existing relationship or champion?
   - Is this a competitive replacement or greenfield?
   - Did we help shape the requirements (wired RFP)?
   Score: [1-5]

3. COMMERCIAL ATTRACTIVENESS:
   - Is the contract value worth the bid effort?
   - Are the payment terms acceptable?
   - Is the budget confirmed or exploratory?
   Score: [1-5]

4. DELIVERY FIT:
   - Can we fulfil the technical requirements as stated?
   - Are there onerous custom requirements?
   - Is the timeline achievable?
   Score: [1-5]

5. BID FEASIBILITY:
   - Do we have the capacity to respond by the deadline?
   - Who would own this response internally?
   - Do we have the collateral ready (case studies, security questionnaire, certifications)?
   Score: [1-5]

Total score = sum of 5 criteria (max 25)
- 20-25: BID — strong fit, invest fully
- 15-19: BID SELECTIVELY — bid only if champion exists or you have spare capacity
- 10-14: EVALUATE — consider a light bid or no-bid with relationship-building alternative
- < 10: NO BID — not worth the investment

Output: score + rationale + bid/no-bid recommendation.
HUMAN DECISION required — this is a recommendation, not an auto-decision.

RFP response structure

Build a response for [RFP].

RFP requirements: [paste or describe the key sections]
Evaluation criteria: [if disclosed — weightings or priorities]
Submission format: [document / portal / email / in-person presentation]
Deadline: [date]
Differentiators we want to highlight: [list 3-5]

RFP response structure (adapt to the specific format required):

EXECUTIVE SUMMARY (1-2 pages):
- Problem statement: demonstrate you understand what they're trying to solve (not just what they asked for)
- Proposed solution: how you solve it at a high level
- Why choose us: 3 key differentiators specific to this customer's stated priorities
- Proof: one relevant case study with quantified outcome

COMPANY OVERVIEW (1 page):
- Founded, headquarters, team size
- Revenue or funding (if shareable)
- Customer count and notable logos in their industry
- Certifications (SOC 2, ISO 27001, GDPR, etc.)

SOLUTION DESCRIPTION (bulk of the response):
- Map each of their requirements to a specific capability
- Format: [Their requirement] → [Our capability] → [Evidence]
- Never skip a requirement: "not applicable" is better than silence
- Use their vocabulary, not yours

IMPLEMENTATION / ONBOARDING (if applicable):
- Timeline: phased rollout with milestone dates
- Team: who will be assigned, their experience
- Training: what you provide to end users and administrators
- Support: SLA, channels, response times

PRICING (follow their format):
- Line-item pricing for each component they asked for
- If custom: provide a range or indicate that pricing follows a discovery call
- Total cost of ownership view if it helps (avoid sticker shock)

REFERENCES AND CASE STUDIES:
- 2-3 references in a similar industry or use case
- Include: company name (if permitted), challenge, solution, quantified outcome
- "References available on request" is weak — provide specifics

APPENDICES (as required):
- Security questionnaire responses
- Certifications and accreditation documents
- Standard contract / MSA

Write the response framework for my specific RFP.

Security questionnaire response

Complete this security questionnaire.

Questionnaire type: [SIG Lite / SIG Core / CAIQ / custom]
Issuer: [company name]
Deadline: [date]
Our certifications: [SOC 2 Type II / ISO 27001 / HIPAA / PCI-DSS / none]

Standard response principles:

1. Answer from certifications first:
   - For SOC 2 controls: "This control is covered by our SOC 2 Type II report (available under NDA). Control reference: CC6.1."
   - For ISO 27001: "This is addressed in our ISMS under control A.9.2 (User access management). ISO 27001 certificate available on request."
   - Don't re-describe what the certification already proves — reference it

2. For questions not covered by certification:
   - Answer specifically and truthfully
   - Include evidence type: "Documented in our Access Control Policy (v2.1)"
   - Offer to provide documentation under NDA if they need the policy itself

3. For gaps (where you don't have a control):
   - "In progress: we are implementing [X] as part of our Q[N] security roadmap. Target completion: [date]."
   - OR offer a compensating control: "While we do not have [X], we mitigate this risk through [compensating control]."
   - Never leave a gap blank — it looks evasive; honest gaps with mitigations are better

Common questions and recommended responses:

Q: Do you have SOC 2 Type II?
A (if yes): "Yes. Our SOC 2 Type II report (Security + Availability TSC) is available under NDA. Last audit period: [dates]. Auditor: [firm]."

Q: How do you handle data breaches?
A: "We maintain a documented Incident Response Plan. Under GDPR, we notify supervisory authorities within 72 hours and affected customers within [X] hours of confirming a breach. Our last incident response test was [date]."

Q: Do you encrypt data at rest and in transit?
A: "All data at rest is encrypted using AES-256 (AWS KMS). All data in transit uses TLS 1.2+. Encryption is enforced across all production environments."

Q: How often do you conduct penetration testing?
A: "Annual penetration tests are conducted by [third-party firm]. Last test: [date]. Findings are remediated per our vulnerability management SLA (critical: 30 days, high: 60 days)."

Q: Where is customer data stored?
A: "All customer data is stored in [AWS us-east-1 / EU-West-1 / etc.]. We do not transfer data outside [jurisdiction] except as required by [specific exception — e.g., support tooling with data processing agreements in place]."

Build the complete questionnaire response for my certification level and the specific questions asked.

Response library

Build a reusable RFP response library for [company].

Company: [name]
Products: [describe]
Certifications: [list]
Top customer segments: [industries / company sizes]
Frequently asked RFP sections: [list the categories that come up most often]

Library structure:

COMPANY BOILERPLATE (update quarterly):
- Company overview: [250 words, updated with latest employee count and ARR]
- Executive team bios: [CEO, CTO, VP Sales — 3-4 sentences each]
- Investment and funding: [Series X, backed by X — or "privately held" if not disclosable]
- Customer references: [5-7 references pre-approved to share, with industry and outcome]

CAPABILITY DESCRIPTIONS (by product area):
[Product/feature]: [250-word description ready to paste]

SECURITY (standard block):
[Prepared answer for each of the 20 most common security questions]
Update whenever certification status changes.

CASE STUDIES (2-3 per vertical):
[Industry]: [Company type] + [Problem] + [Solution] + [Outcome with a number]

CERTIFICATIONS AND COMPLIANCE:
[SOC 2: dates, auditor, coverage]
[ISO 27001: certificate number, expiry, scope]
[GDPR: DPA template available, DPO contact]
[HIPAA: BAA available on request]

PRICING LANGUAGE:
[Standard response: "Pricing is customised based on volume and configuration. Our team will provide a detailed quote within 3 business days of receiving your requirements."]
[Or: standard pricing table if your pricing is published]

Maintenance cadence:
- Quarterly: update company stats, customer count, certifications
- After each RFP: add new case study or approved reference if a new win
- After each security questionnaire: update security block with any new controls

Generate the response library structure for my company.

Example

User: We received a 200-question SIG Core from a financial services enterprise. We have SOC 2 Type II but no ISO 27001. Deadline is 10 days. How do we respond efficiently?

Claude's strategy:

200 questions in 10 days = don't answer every question from scratch. Triage first.

Step 1 — Categorise (Day 1, 2 hours): Group all 200 questions into:

• Covered by SOC 2: mark with "SOC 2 ref: [control]" — respond by citing the report
• Policy-documented: mark with "Policy: [name]" — quick specific answer
• Not applicable: mark as N/A with justification (e.g., physical controls if cloud-only)
• Gaps: honest answer + compensating control or in-progress note

Expect breakdown for a SOC 2 Type II holder: ~70 questions covered by SOC 2, ~60 by policy, ~40 N/A, ~30 genuine gaps.

Step 2 — Batch by owner (Day 1-2): Engineering owns: encryption, access controls, vulnerability management, logging Legal owns: data processing, privacy, regulatory compliance Finance/ops owns: business continuity, insurance, third-party contracts

Step 3 — Write the SOC 2 block once, reference everywhere (Day 2): "This control is addressed in our SOC 2 Type II audit (available under NDA). Control reference: [CC#]. Audit period: [dates]. Auditor: [firm]." Copy this template across all SOC 2-covered questions — 10 minutes per control, not 10 questions × 30 minutes each.

Step 4 — Gaps (Day 5-7): For each genuine gap: 2-3 sentences — what we don't have, what we do instead, when we plan to address it.

Step 5 — Review and submit (Day 8-10): Have legal review the data/privacy section. CEO spot-check the 10 most sensitive questions. Submit with a cover note offering a virtual security meeting with your CTO.

---