Penetration Testing RFP Checklist for Indian Enterprises (2026)

Writing a penetration testing RFP that attracts strong vendors and filters weak ones is itself a security skill. Most RFPs we receive are either too vague (test everything, give us a report) or too prescriptive (run these 14 tools in this order). Both produce bad outcomes. This checklist sits in the middle — specific enough to get comparable quotes, open enough to let good operators show what they can do.

Section 1: Scope definition

The scope section is where most RFPs fail. An ambiguous scope means every vendor quotes against a different target, and you cannot compare the responses. Be explicit about:

• **Asset inventory** — list every application, API, network range, cloud account and mobile app in scope. Include URLs, IP ranges and environment (production vs staging).
• **User roles** — for authenticated testing, list the roles to be tested (admin, user, guest, API consumer). Each role is a separate test pass.
• **Environments** — specify whether testing runs on production, staging, or both. Production testing requires change-control coordination.
• **Exclusions** — explicitly list anything out of scope (third-party SaaS, specific IP ranges, DDoS testing, social engineering).
• **Compliance requirement** — state whether the report must satisfy CERT-In, RBI, SEBI, IRDAI or ISO 27001 audit requirements. This changes the report format, the methodology documentation and the vendor qualifications needed.

Section 2: Vendor qualification requirements

• **CERT-In empanelment** — for regulated entities, require current CERT-In empanelment with audit scope covering information security assessments.
• **Operator certifications** — require at least OSCP for web/network testing. For red team scope, require OSEP or CRTO. For web application focus, require OSWE or BSCP. CEH alone is not sufficient for manual exploitation.
• **Insurance** — require professional indemnity and cyber liability insurance covering the engagement value.
• **Past engagements** — ask for 3 anonymised case studies in your sector (BFSI, healthcare, SaaS, government). Verify the vendor actually performed the work, not a subcontractor.
• **Team composition** — require the vendor to name the lead operator and provide their individual certifications. Firms that staff senior operators at sales and junior operators at delivery are common.

Section 3: Methodology and deliverables

Require the vendor to describe their methodology in their response. A good response will reference OWASP Testing Guide, PTES, or OSSTMM and explain how they adapt it to your scope. A bad response will paste a generic waterfall diagram.

• **Automated vs manual split** — ask vendors to state the percentage of manual testing. Below 60% manual is an automated scan dressed as a pentest.
• **Tool disclosure** — ask vendors to list their primary tools. This is not so you can dictate tools, but so you can verify they have commercial licences (Burp Suite Pro, not Community).
• **Critical finding escalation** — require same-day notification for critical/high findings (RCE, authentication bypass, data exposure) with a secure communication channel.
• **Report format** — specify the structure: executive summary, technical findings with CVSS scores, evidence (screenshots, request/response pairs), remediation guidance, and a compliance mapping section if applicable.
• **Retest** — require at least one free retest cycle within 30 days of remediation. Define what counts as a retest (re-validation of fixed findings only, or full re-engagement).

Section 4: Evaluation criteria

Section 5: Compliance and legal clauses

• **NDA** — mutual, executed before scope details are shared.
• **Rules of engagement** — define testing windows, escalation contacts, and what constitutes a stop condition (data exposure, service disruption).
• **Data handling** — require the vendor to delete all engagement data (findings, evidence, credentials) within 90 days of report delivery.
• **Subcontracting** — prohibit subcontracting of the testing work without prior written consent. Many firms resell capacity from freelance operators.
• **Incident during testing** — define liability and response procedures if the vendor causes a service disruption.

RFP timeline template

For a broader vendor comparison methodology, see our top VAPT companies in India buyer guide and the cybersecurity company buyer checklist.