baselineRFIHow does the platform discover and classify who has access to what sensitive data across file shares, SaaS apps (Google Drive, SharePoint, Box), and structured data stores — is discovery continuous or a point-in-time scan?weight 3
Answer key — what a strong answer shows
Continuous discovery is materially stronger than a periodic scan, since access grants change constantly; look for a stated refresh cadence, not just 'we scan your environment.'
baselineRFPDescribe how the platform identifies excessive or stale permissions (over-privileged users, unused access, orphaned accounts) and quantify the reduction in standing access achieved with a customer reference.weight 3
Answer key — what a strong answer shows
Strong answers give a concrete before/after figure (e.g., '% of standing access revoked') tied to a named customer, not a generic 'we reduce your attack surface' claim.
baselineRFIWhat remediation workflow exists for flagged over-permissioned access — automated revocation, owner-approval workflow, or detection-only requiring manual cleanup by IT?weight 3
Answer key — what a strong answer shows
Look for an owner-approval or automated revocation workflow; detection-only tools that dump a report on IT rarely result in actual remediation at scale.
baselineRFIHow does the platform handle non-human identities (service accounts, API keys, OAuth app grants) in its access governance model, separately from human user access?weight 3
Answer key — what a strong answer shows
Non-human identity sprawl is a distinct and growing risk; a platform that only governs human user access is missing a large and often more dangerous share of standing access.
baselineRFPDetail support for just-in-time (JIT) access — can standing access be converted to time-bound, approval-gated access for sensitive data stores, and what is the typical approval latency in production deployments?weight 3
Answer key — what a strong answer shows
Look for a real JIT workflow with a stated approval-latency figure from production use, not a theoretical capability never deployed at scale.
baselineRFIWhat data classification taxonomy does the platform use (custom labels versus a fixed built-in taxonomy), and how does it integrate with existing DLP or classification tools already in place rather than requiring a second, conflicting taxonomy?weight 3
Answer key — what a strong answer shows
Strong answers support a custom or imported taxonomy and explicitly address integration with existing classification tooling, avoiding a second source of truth.
baselineRFPExplain how access governance findings map to compliance requirements (SOX access reviews, least-privilege attestations for SOC 2/ISO 27001) and whether periodic access-certification campaigns are automated end-to-end.weight 3
Answer key — what a strong answer shows
Look for automated certification campaigns (reviewers notified, decisions tracked, evidence exported) rather than a report the compliance team must manually turn into a certification process.
baselineRFIWhat is the coverage breadth across cloud data platforms (Snowflake, Databricks, BigQuery, Redshift) versus traditional file shares — is one architecture, or are cloud-data and file-share governance separate bolted-on products?weight 3
Answer key — what a strong answer shows
A single unified data model across both structured cloud data and unstructured file shares is stronger than two separate products with inconsistent policy definitions.
baselineRFIWhat is the pricing model — per user, per data source connected, or a flat enterprise tier — and how does cost scale as discovery inherently reveals a larger access-sprawl population than initially estimated?weight 3
Answer key — what a strong answer shows
Same tension as other discovery-driven categories: successful access-sprawl discovery inherently increases the counted population — ask explicitly how pricing handles a large post-onboarding jump.
baselineRFPDescribe incident-forensics capability for a confirmed data breach — can the platform quickly answer 'exactly who had access to this compromised data store, and was any of that access anomalous or over-permissioned' during an active investigation, with a customer-referenced example?weight 3
Answer key — what a strong answer shows
Strong answers describe a fast, specific forensic query capability with a real turnaround-time figure — this is one of DAG's highest-value use cases during an actual breach, not just preventive posture.
baselineRFIDetail historical trend reporting on access-governance maturity (standing-access-reduction trend, stale-account count trend) over time, suitable for demonstrating program progress to leadership and auditors.weight 3
Answer key — what a strong answer shows
Trend-over-time reporting is a distinct capability from a real-time dashboard — confirm this exists as a maintained, exportable report.
baselineRFPHow does the platform integrate with (versus duplicate) the customer's existing IAM/PAM tooling so access-governance findings feed into the same unified identity risk view rather than a disconnected, separate system?weight 3
Answer key — what a strong answer shows
Look for genuine integration into a unified identity risk view; a standalone DAG dashboard disconnected from the broader IAM/PAM picture creates real reconciliation burden.
baselineRFIWho within the customer organization gets access to the platform's own findings (which teams can see the complete map of who has access to what sensitive data), and is there role-based access control given how sensitive this information is?weight 3
Answer key — what a strong answer shows
A complete access-to-sensitive-data map is a meaningful target in its own right — role-based access control over the tool's own findings is an often-overlooked consideration.
baselineRFIWhat is the measured false-positive rate on flagged excessive/stale access (correctly identifying real over-permissioning versus legitimate but infrequently-used access), and what mechanism exists for owners to correct and permanently suppress a false positive?weight 3
Answer key — what a strong answer shows
A high false-positive rate creates real alert fatigue and can lead to legitimate access being incorrectly revoked — ask for a real, customer-validated accuracy figure and a correction workflow.
baselineRFPDoes the platform support genuinely isolated, per-subsidiary access-governance views for a multi-entity organization with different data environments and risk tolerances, or is there only one flat, shared view across the whole organization?weight 3
Answer key — what a strong answer shows
Genuine multi-entity isolation is materially more useful for a diversified organization than one shared view forcing a one-size-fits-all governance posture.
baselineRFIWhat is a customer-referenced onboarding timeline from contract signature to the platform producing a genuinely useful, comprehensive access map across an existing, large, pre-existing environment with significant access sprawl?weight 3
Answer key — what a strong answer shows
Strong answers give a concrete, customer-validated timeline for a realistic existing-sprawl scenario (not a small greenfield deployment), and are honest about the customer-side connection effort required.
baselineRFPWill your employees have access to the university's Human Resource, Student Information, or Financial Records data? (Indicate all that apply)weight 3
baselineRFPHow do you separate the university's data from other customers' data?weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
