Ctrl+K
tatersecurity.com Open App

Vendor RFP Evaluations

Weighted-criteria vendor selection: define criteria, invite candidates, score across evaluators, compare in a live matrix, and award the winner. Last updated 2026-07-18

TPRM Hub → Vendor RFPs tracks a Request-For-Proposal evaluation from first draft through award: a set of weighted scoring criteria, a list of candidate vendors, and per-evaluator scores rolled up into a weighted total per candidate. The scoring matrix on the detail page shows every candidate against every criterion, so the comparison that usually lives in a spreadsheet stays inside TATER - next to the vendor register, contracts, and security ratings the winner will end up in.

What is an RFP evaluation?

An RFP evaluation is one procurement decision - "pick an EDR vendor," "select a payroll provider" - captured as a single record with three moving parts:

  • Criteria - up to 25 weighted scoring dimensions (e.g. "Security certifications, weight 30", "Pricing, weight 25", "SLA tier, weight 20"). Weights should sum to 100.
  • Candidates - up to 50 vendors under consideration, each with an optional contact email and an optional link to an existing Vendor record (existing_vendor_id). Candidates carry a status of their own (Invited / Responded / Disqualified / Withdrew).
  • Scores - 0–100 scores recorded per (candidate, criterion) pair, per evaluator, with an optional comment.

The RFP itself moves through Draft → Open → Scoring → Awarded (or Cancelled). You don't have to manage the Scoring transition by hand - recording the first score on a Draft or Open RFP flips it to Scoring automatically.

Don't confuse this with security questionnaires. A questionnaire (see the Questionnaire guide) is a vendor answering your security questions, or you answering a prospect's. An RFP evaluation is your team scoring multiple vendors against each other to pick one. They complement each other: questionnaire results often feed a "Security" criterion's score.

Creating an RFP

Vendor RFPs → + New RFP. Required: title. Optional: description, status, budget (free-form, e.g. "$50K–$150K/yr"), and closeDate.

Criteria and candidates are entered one per line in the modal:

  • Criteria - label, weight, description (description optional), e.g. Security certifications, 30, SOC2/ISO27001/HIPAA presence
  • Candidates - Vendor name, contact_email, existing_vendor_id (both optional), e.g. Acme Corp, sales@acme.com

Set existing_vendor_id when a candidate is already in your vendor inventory - it links the candidate to the Vendor record, and if that candidate wins, the award carries the link forward automatically. Editing an RFP later re-opens the same modal; criteria and candidate lines are re-parsed on save (full-list replace).

Scoring candidates

Open an RFP from the list to reach its detail page. When the RFP has at least one criterion and one candidate, the Scoring Matrix renders: one row per candidate, one column per criterion (weight shown in the header), plus a weighted Total column. Click any cell to record a 0–100 score for that (candidate, criterion) pair, with an optional comment.

  • Multiple evaluators are first-class. Each evaluator gets one score per cell - re-submitting a score for the same cell replaces your own previous score, never a colleague's. The cell displays the average across all evaluators.
  • The Total is a weighted rollup: per criterion, the evaluator scores are averaged; each average is multiplied by the criterion's weight; the sum is normalized by the total weight. If your weights sum to 100, the total is directly comparable to the 0–100 cell scores.
  • Cell coloring: scores of 75+ render green, 50–74 blue, below 50 red; unscored cells show a dash.
  • The list view surfaces the current leader (highest weighted total) on each RFP card, so you can see where every open evaluation stands without opening it.

Awarding the RFP

The detail page's Award button (shown until the RFP is Awarded or Cancelled) opens a modal to pick the winning candidate and record an optional award note. Awarding sets status to Awarded, stamps the award date, and marks the winner with a 🏆 in the matrix. The scores stay intact - the full matrix remains as the documented rationale for the decision.

If the winner was linked to an existing Vendor record, that linkage is preserved as winningVendorId. If not, the next step is to onboard the winner as a Vendor record (TPRM Hub → Vendors) so contracts, ratings, and assessments can attach to it - the award response reminds you of this.

Permissions

  • Viewer+ - view RFPs and the scoring matrix
  • Auditor+ - create/edit RFPs and record scores
  • Admin - award and delete

The Vendor RFPs page is part of the TPRM module set - like the rest of the vendor pages, it requires the vendor-rfp module to be enabled for your organization.

REST endpoints

  • GET /api/rfp-evaluations (Viewer+) - list, optional ?status= filter; each item is decorated with leader candidate, leader score, and candidate/criteria counts
  • GET /api/rfp-evaluations/:id (Viewer+) - single RFP plus the per-candidate rollup (weighted total, raw average, criteria coverage)
  • POST /api/rfp-evaluations (Auditor+) - create or update via id in body; criteria and candidates are full-array-replace fields
  • POST /api/rfp-evaluations/:id/score (Auditor+) - record a score (candidateId, criterionId, score 0–100, optional comment); replaces the caller's previous score for the same pair, and auto-transitions Draft/Open → Scoring
  • POST /api/rfp-evaluations/:id/award (Admin) - mark Awarded (winningCandidateId required, optional winningVendorId and note)
  • DELETE /api/rfp-evaluations/:id (Admin)

MCP tools (HTTP + stdio parity)

  • list_rfp_evaluations - all RFPs with rollup summaries
  • create_rfp_evaluation - create or update; defines weighted criteria and candidate vendors
  • score_rfp_evaluation - record a per-evaluator, per-criterion score
  • award_rfp_evaluation - close the RFP with a winner

This makes the whole workflow agent-drivable: paste vendor proposals into a chat and ask your AI agent to draft the criteria, seed the candidates, and record your scores as you talk through them.

Recommended patterns

  • Make the weights sum to 100 before scoring starts. The rollup normalizes by whatever the weights actually sum to, so totals stay comparable either way - but 100 keeps the mental math honest and the matrix readable.
  • Give every criterion a description. "Pricing, 25, Annual TCO including support" scores consistently across evaluators; a bare "Pricing" doesn't.
  • Score independently, then compare. Because each evaluator's scores are kept separately and averaged, have evaluators fill in their cells before discussing - the average then reflects genuine independent judgment.
  • Link candidates to existing Vendor records up front. It de-duplicates your vendor inventory and makes the award step a one-click close-out.

Pitfalls

  • Editing an RFP replaces the criteria and candidate lists wholesale. Removing a criterion or candidate line in the edit modal drops it (and orphans its recorded scores from the rollup) - add lines rather than rewriting the list once scoring has begun.
  • A cell shows the average across evaluators, not your own score. Re-open the cell to change your contribution; you can't overwrite someone else's.
  • Award doesn't create a Vendor record. If the winner wasn't linked via existing_vendor_id, onboarding it into the vendor inventory is a separate follow-up step.
  • The score cap is 5,000 entries per RFP. Far beyond any realistic panel, but if you script bulk scoring via MCP, oldest entries roll off past the cap.

Was this page helpful?