baselineRFIHow does the platform define and prioritize the attack surface for continuous exposure assessment — is discovery limited to known/inventoried assets, or does it include unknown/shadow assets discovered externally?weight 3
Answer key — what a strong answer shows
Look for external, attacker-perspective discovery beyond the existing CMDB, since unknown assets are often the actual exposure.
baselineRFPDescribe the validation step that confirms an identified exposure is actually exploitable versus theoretical, and provide a customer reference showing the reduction in 'must-fix' volume after validation.weight 3
Answer key — what a strong answer shows
Strong answers describe real exploitability testing (safe simulated exploitation or attack-path validation), not just vulnerability scan aggregation, with a concrete reduction figure.
baselineRFIHow are exposures prioritized across the CTEM stages (scoping, discovery, prioritization, validation, mobilization) — is there a single unified risk score spanning vulnerabilities, misconfigurations, and identity exposures, or are these scored separately per tool?weight 3
Answer key — what a strong answer shows
A unified cross-domain score is stronger than siloed per-category scores requiring manual reconciliation.
baselineRFIDoes the platform model attack paths (how an external exposure chains to a critical asset) rather than just listing individual findings, and how is 'critical asset' defined or configured?weight 3
Answer key — what a strong answer shows
Attack-path/graph modeling that shows the chain to a defined crown-jewel asset is materially more actionable than a flat findings list.
baselineRFPDetail the mobilization/remediation workflow — how are findings routed to the right owning team, and what evidence exists that remediation actually reduces the validated exposure via re-validation, not just ticket closure?weight 3
Answer key — what a strong answer shows
Look for automated re-validation after a fix, not just relying on a closed ticket as proof of remediation.
baselineRFIWhat is the assessment cadence — continuous/near-real-time versus periodic scheduled scans — and how quickly does a newly exposed asset (e.g., a misconfigured cloud bucket) get flagged after it appears?weight 3
Answer key — what a strong answer shows
Strong answers state a concrete detection-latency figure for newly appeared exposures, not just scan frequency.
baselineRFPExplain how the platform reports program maturity/trend over time to leadership — is there a maintained metric showing exposure reduction quarter over quarter, and is it a built-in report or custom BI work?weight 3
Answer key — what a strong answer shows
Native trend reporting suitable for board-level consumption is stronger than requiring the customer to build it themselves.
baselineRFIWhat data sources feed the exposure inventory (EASM scanning, cloud config, identity/IAM posture, vulnerability scanners, threat intel) — are these native capabilities or third-party integrations the customer must separately license?weight 3
Answer key — what a strong answer shows
Look for clarity on which sources are native versus requiring separate licenses/integrations from other vendors.
baselineRFIWhat is the pricing model — per asset, per validated exposure, or a flat program-level subscription — and how does cost scale as the customer's asset inventory grows significantly (e.g., cloud auto-scaling or M&A-driven growth)?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics; per-asset pricing that spikes unpredictably with cloud elasticity creates real budget risk for CTEM specifically, given its continuous/dynamic nature.
baselineRFPDescribe how the platform integrates with (versus replaces) the customer's existing vulnerability management and ASM tools — is CTEM built as an orchestration layer unifying existing tool output, or does it require ripping out and replacing point solutions already in place?weight 3
Answer key — what a strong answer shows
An orchestration-layer approach that unifies existing tooling investment is materially less disruptive than a rip-and-replace requirement — ask explicitly which model this vendor uses.
baselineRFIDoes the validation stage include integration with breach-and-attack-simulation or red-team tooling to confirm exploitability with real (safe) attack execution, or is validation limited to passive/theoretical analysis?weight 3
Answer key — what a strong answer shows
Active validation via BAS/red-team integration (safely confirming exploitability) is a materially stronger claim than passive analysis alone, which can still misjudge real-world exploitability.
baselineRFPExplain compliance-driven CTEM reporting — can the platform generate evidence suitable for frameworks that require continuous exposure management or attack-surface monitoring as a control (e.g., emerging cyber-insurance or regulatory requirements), or is reporting built purely for internal security-team consumption?weight 3
Answer key — what a strong answer shows
Purpose-built compliance/audit-ready reporting is a distinct capability from internal dashboards — a vendor should be explicit about whether external-audience reporting exists.
baselineRFIWhat is a customer-referenced onboarding timeline from contract signature to the program producing its first validated, prioritized exposure list, and what customer-side effort (asset inventory input, integration configuration) does that require?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete timeline backed by a real customer and are honest about the customer-side effort required, not just vendor-side setup time.
baselineRFIWhat categories of exposure does the platform explicitly NOT cover (e.g., physical security, insider threat, specific asset types), and how does the vendor recommend customers fill those gaps with complementary tooling?weight 3
Answer key — what a strong answer shows
A vendor willing to explicitly name their coverage boundaries and recommend complementary tools is more credible than one implying comprehensive coverage of every exposure type.
baselineRFPDetail how identity-specific exposures (excessive entitlements, stale accounts, credential exposure) are specifically validated for real exploitability within the CTEM program, distinct from generic vulnerability/misconfiguration validation.weight 3
Answer key — what a strong answer shows
Identity exposures require different validation logic than infrastructure vulnerabilities — a vendor should describe identity-specific validation explicitly rather than treating all exposure types identically.
baselineRFIHow much of the prioritization and validation workflow is AI/automation-driven versus requiring a human analyst, and what is the customer-facing transparency into how an AI-driven prioritization decision was reached?weight 3
Answer key — what a strong answer shows
Look for explainable prioritization logic (not a black-box score) — security teams need to understand and defend prioritization decisions to stakeholders, not just trust an opaque AI output.
baselineRFPContractor shall lead, maintain, and track enterprise-wide configuration management as a dedicated, non-collateral security function: develop/maintain security configuration baselines (updated at least annually), perform automated configuration compliance scanning, analyze failed settings for security risk/technical conflict/formal deviation, integrate configuration data into the authorization boundary (e.g., Xacta/GRC tool), manage deviation/risk decisions via Security Impact Analyses (SIA) with annual re-review, and implement a continuous tuning maintenance cycle.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
