Collect vendor questions in writing by a fixed date, answer each one in a single document sent to every vendor, remove any vendor names from the questions, and log any change to requirements. This keeps the process fair, protects you from claims of bias and gives vendors the same information.
Why a formal question period
Vendors always have questions, and some will phone your engineers. If one vendor gets a clarification that others do not, you have tilted the field, and the scores you produce will be hard to defend. A written process is less friendly than a call, but it is also faster, because you answer once.
The general principle is not new. US federal rules encourage open exchanges between buyers and interested parties early on, with the aim of making proposal preparation and evaluation more efficient. A private buyer can capture the benefit without the paperwork by sharing answers widely.
The process
- Announce the window. State the opening and closing dates in the RFP, and one contact address.
- Take questions in writing only. Politely redirect phone calls to the shared mailbox.
- Strip names. Remove vendor identity from the questions before sharing.
- Answer once, to everyone. Send the full question and answer list to all vendors on the same day.
- Close the window. After the closing date, answer only questions that expose an error in your RFP.
- Log amendments. If an answer changes a requirement, issue a numbered amendment and give vendors time to respond.
What to answer, and what not to
| Type of question | Handling |
|---|---|
| Clarifies wording | Answer, share with all |
| Asks for environment details | Answer, add to the environment section |
| Asks about your budget | Decide in advance whether to say. Be consistent |
| Asks who else is bidding | Decline |
| Asks about the incumbent | Decline details, share only what is relevant to scope |
| Proposes a change to requirements | Consider it, and issue an amendment if you accept |
Handling private contact
If a vendor contacts a stakeholder directly, note the contact, redirect to the mailbox and remind the stakeholder of the rule. The aim is not to punish. It is to keep a consistent record. If useful information emerges, share it with the others.
Using the period to improve your RFP
Count how many vendors ask about the same item. That is a sign the wording is unclear. Fix it in an amendment. Also notice which questions suggest the vendor misread your environment. They may reveal gaps in your own description.
Keep the tone helpful
Fair does not mean cold. Short, prompt answers show the vendor you take the process seriously, and that is a good sign for the later relationship.
A worked example: a question log
A team keeps one shared log during the window. Here is a short extract.
| ID | Question, with vendor name removed | Answer | Amendment? |
|---|---|---|---|
| Q1 | Does the environment include mobile applications? | Yes, three mobile apps; added to the environment section | Yes, amendment 1 |
| Q2 | Is the incumbent tool in scope for replacement? | The incumbent remains during the trial; replacement depends on the result | No |
| Q3 | Can we propose a hosted and a self-managed option? | Yes, answer both in the template, labeling each | No |
| Q4 | What is the budget range? | Not disclosed; please propose according to the units defined in the RFP | No |
| Q5 | Will the evaluation include a hands-on test? | Yes, two weeks, on our repositories, criteria shared with finalists | No |
| Q6 | Who else is invited? | Not disclosed | No |
The entire list goes to every vendor on the same day. Vendors can see that the buyer is consistent and open, even where the answer is "not disclosed."
Amendments done right
An amendment is a numbered document that changes the RFP. Include:
- The number and date.
- The section it changes, quoted before and after.
- A statement of whether response dates move.
- A request for acknowledgment from each vendor.
Keep a copy of every acknowledgment. If a vendor misses an amendment and answers the old version, you will have a record.
Dealing with a vendor that asks for an extension
Decide a policy in advance. A common approach is to grant extensions only if every vendor gets the same one, and to refuse extensions requested after the deadline. If your own RFP changed late, offer one to everybody.
Dealing with vendors that ask to talk to users
Some vendors will ask to speak to your engineers. Politely decline during the response period and explain that all contact goes through the mailbox. Offer vendors the chance to ask the same questions in writing. After the finalists are chosen, structured calls with your team are normal. Give all finalists equal time.
Confidentiality during the window
Remind your own staff not to discuss one vendor's response with another vendor, and not to share scoring. If a vendor's response includes confidential information, handle it according to the agreement you have in place. This is general process guidance, not legal advice.
After the window
When the window closes, publish a final consolidated Q and A and any amendments. Keep a clean folder with the original RFP, all amendments and the full question log. It is the foundation of a defensible process.
Where Safeguard fits
If Safeguard is invited to respond, it would follow the same written process. Its GA capabilities include dependency scanning, reachability analysis, SBOMs, and policies and gates, and the free scan at https://gold.safeguard.sh/scan can help you decide which questions to ask before the window opens.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a finding moves through a clear process with owners and dates, a good model for the audit trail of your own question log.
Quick check
Should we allow phone calls during the question period?
Prefer written questions. If you take a call, summarize the answer to every vendor.
What if an answer changes a requirement?
Issue a numbered amendment to all vendors and allow time to respond.
Do we have to answer every vendor question?
No. You may decline questions about other bidders or confidential details. Say so clearly and consistently, and share the same refusals with everyone.
Sources
Last reviewed: 19 October 2026.
