Give every vendor the same response template: one row per question, a status label, a short answer with a word limit, and a place for an evidence link. Free-form essays are hard to compare. A structured template makes scoring faster and stops marketing language from hiding gaps.
Why format is a security issue
The way you ask shapes the way vendors answer. If you accept narrative, you get adjectives. If you ask for a status and proof, you get facts you can verify. This matters more in security than elsewhere, because overstated claims cost you later in audits and incidents.
The template
| Field | What the vendor provides |
|---|---|
| Question ID | Pre-filled by you |
| Status | One of: Generally available, Early access, Roadmap, Not offered, Partner |
| Short answer | Up to 80 words, plain text |
| Evidence | Link to documentation, a sample file, or an attachment name |
| Date of evidence | When the document was last updated |
| Customer data impact | Whether answering this involves sending any of our data out |
The status field is the most useful. Defining it in advance lets you compare "we do this today" with "we plan to," which vendors often blur.
Rules to put at the top of the document
- Answer in the template only. Do not reformat it.
- One answer per question. If a question has two parts, answer both in the box.
- Claims without an evidence link are scored as unverified.
- Label every capability by status. Roadmap items do not count toward must-haves.
- Marketing attachments are not evidence unless they directly answer the question.
- State any capability that depends on a third party or a partner.
What to do with attachments
Ask for a short list: a security whitepaper, a sample export, and a current architecture diagram under NDA if needed. Do not accept a folder of thirty files and an instruction to "see attached." Ask vendors to point to the page or section.
Scoring the evidence field
You can add a simple rule: no evidence caps the score at one, evidence you could not verify caps it at two, and verified evidence allows three or four. This ties into the scoring scale from your panel session and rewards vendors who prepare.
Give vendors a fair chance
A template is only fair if it is clear. Run it past a colleague who did not write it, and answer two sample questions yourself. If you cannot fill in the status field without arguing about definitions, the vendors will struggle too. Publish the definitions on the first page, and allow a short clarification window so nobody guesses.
Check for copy and paste
Boilerplate answers read the same across questions. If a vendor pastes the same paragraph under five different questions, ask one follow-up that forces specifics: "For question 12 only, show the setting in the product or the page in your documentation."
A worked example: one row, three answers
Take question 14: "Can the product open fix pull requests, and how can a team control it?" The template asks for status, a short answer, evidence and a date. Here are three possible responses.
| Field | Vendor X | Vendor Y | Vendor Z |
|---|---|---|---|
| Status | Generally available | Early access | Roadmap |
| Short answer | Fix pull requests are opened per repository; categories are off until a team turns them on; each fix needs human approval to merge | Available to design partners; opens pull requests on request | Planned for next year |
| Evidence | Link to documentation, sample pull request | Slide deck | None |
| Date | Updated this quarter | Not stated | Not stated |
The scoring is nearly automatic. Vendor X can score three or four if the evidence checks out. Vendor Y gets one or two, because the status is not generally available and the evidence is not verifiable. Vendor Z scores zero against a must-have, though it might earn a few points as a should if there is a dated commitment you can put in the contract.
Compare that with a free text answer: all three would write a confident paragraph, and your panel would struggle to separate them.
Define the status labels in the document
| Label | Definition |
|---|---|
| Generally available | In production use by customers today, documented, supported |
| Early access | Available to a limited group, may change, may not be supported under standard terms |
| Roadmap | Planned, not yet delivered |
| Not offered | Not available and not planned |
| Partner | Delivered by a third party, name it |
Ask vendors to apply the labels honestly and tell them that you will verify a sample.
Verify a sample
Pick five answers at random, plus any that look surprisingly strong, and verify them in the trial or from documentation. Tell vendors in the RFP that you will do this. A vendor that finds a mismatch between its answer and its product will correct it. A vendor that does not will lose credibility on every other answer.
Protect your own team
A template also helps your panel. It reduces reading time, it forces comparable answers and it makes the later audit trail of the decision easy. When someone asks six months from now why you chose a vendor, you can show the row.
Provide a sample answer
Include one fully worked example row, on a topic unrelated to the vendor's product, so everyone sees the level of detail you expect. It cuts down on both short non-answers and long essays.
Where Safeguard fits
If Safeguard is one of your respondents, expect the same format. Its GA capabilities include dependency scanning, SBOMs, reachability analysis, and policies and gates. Verify each claim with a scan of your own repo at https://gold.safeguard.sh/scan, and be wary of any vendor, including us, that cannot label status clearly.
Try it yourself
Click through it at your own pace, or open it full screen. Look at the SBOM and inventory details the demo shows, then decide what evidence you would require for a vendor claiming the same.
Quick check
What status labels should the template use?
Generally available, early access, roadmap, not offered, and partner. Define each in the RFP.
Can vendors add their own sections?
Allow one short appendix. Keep the scored answers inside your template.
What do we do with answers that have no evidence link?
Score them as unverified, which in the scale above means a low score, and invite the vendor to supply evidence in a follow-up round with a deadline.
Last reviewed: 19 October 2026.
