baselineRFIWhat categories of digital risk does the platform monitor — brand/executive impersonation, domain squatting/typosquatting, leaked credentials, source code leaks, mobile app clones, social media impersonation — and which are core versus add-on modules?weight 3
Answer key — what a strong answer shows
Look for a clear breakdown of core vs. add-on coverage; DRP marketing often implies broader coverage than what's actually licensed by default.
baselineRFPDescribe the takedown process for a confirmed malicious asset (phishing domain, fake social profile, rogue mobile app) — is takedown performed by the vendor directly, and what is the average time-to-takedown with a customer reference?weight 3
Answer key — what a strong answer shows
Strong answers state a concrete average takedown time backed by a real customer, and clarify whether takedown is included or a paid service per incident.
baselineRFIHow does the platform distinguish a genuine threat (active phishing kit, real credential dump) from noise (expired lookalike domains, unrelated mentions), and what is the analyst-reviewed versus fully-automated triage split?weight 3
Answer key — what a strong answer shows
Look for a described triage methodology and honest disclosure of how much is human-reviewed versus automated, since false positives are a common DRP complaint.
baselineRFIWhat is the monitoring footprint for dark web and closed criminal forums specifically — are these paid/human-operated sources, or automated crawling of readily indexable sites only?weight 3
Answer key — what a strong answer shows
Genuine closed-forum access (often requiring human analyst infiltration/relationships) is a materially different and stronger capability than automated open-web crawling alone.
baselineRFPDetail integration with the SOC/SIEM for automated alerting when a DRP finding indicates active compromise (e.g., a leaked credential matching a real employee), including the response workflow triggered.weight 3
Answer key — what a strong answer shows
Look for closed-loop integration (auto-triggering credential reset or SOC investigation), not just a standalone DRP dashboard the SOC has to check separately.
baselineRFIHow does the platform monitor for source-code and API-key leaks across public code repositories, and what is the scope — public repos only, or also known leak-paste sites?weight 3
Answer key — what a strong answer shows
Strong answers cover both public repo scanning and paste-site/leak-forum monitoring, since attackers use both.
baselineRFPExplain executive/VIP protection specifically — what is monitored for named individuals (impersonation, PII exposure, physical threat chatter), and how is this scoped/priced per protected executive?weight 3
Answer key — what a strong answer shows
Look for a clear per-executive scope and pricing model, and specifics on physical-threat chatter monitoring if claimed.
baselineRFIWhat is the false-positive burden in practice — roughly how many alerts per week should a customer of a given size expect, and what tuning controls exist to reduce noise without missing real threats?weight 3
Answer key — what a strong answer shows
A vendor that can't give even a rough alert-volume expectation likely hasn't been tested at scale by real customers.
baselineRFIDoes the platform monitor mobile app stores specifically for fake/clone apps impersonating the customer's brand, and what is the actual app-store takedown success rate and average timeline with a customer reference, distinct from web-domain takedowns?weight 3
Answer key — what a strong answer shows
Mobile app-store takedowns follow a different process (and success rate) than web domain takedowns — ask for a distinct, mobile-specific figure rather than accepting a blended 'takedown rate' that obscures weaker mobile performance.
baselineRFPDetail supply-chain and third-party brand-risk monitoring — does the platform flag when a partner or supplier's brand is being impersonated in a way that could be used to attack the customer (e.g., a fake update notice appearing to come from a known vendor)?weight 3
Answer key — what a strong answer shows
This is a more advanced capability than direct-brand monitoring alone — a vendor covering only the customer's own brand, not adjacent supply-chain impersonation risk, has a real scope gap.
baselineRFIWhat is the pricing model — per monitored brand/domain, per protected executive, or a flat enterprise tier — and how does cost change as the customer adds additional brands or a growing executive-protection roster mid-contract?weight 3
Answer key — what a strong answer shows
Look for transparent incremental pricing; vendors who quote only a base package while brand/executive additions trigger unclear upsells create budget-planning risk.
baselineRFIDoes the platform provide dedicated support for M&A due-diligence use cases — assessing a target company's digital-risk exposure (leaked credentials, impersonation, brand risk) before an acquisition — as a distinct, time-bounded engagement type?weight 3
Answer key — what a strong answer shows
A dedicated M&A-diligence engagement model (versus only ongoing continuous monitoring of the customer's own brand) is a genuinely different product use case worth confirming explicitly.
baselineRFPExplain the API/export capability for findings — can DRP alerts and takedown status be pulled programmatically into the customer's own SIEM/ticketing/GRC system, or is access limited to the vendor's own portal UI?weight 3
Answer key — what a strong answer shows
A real, documented API is materially more useful for a mature security team than portal-only access requiring manual checking and copy-paste into other systems.
baselineRFIWhat historical trend reporting is available for executive/board audiences — can the platform show digital-risk exposure trending up or down over quarters, or does it only provide a real-time current-state view with no historical trend?weight 3
Answer key — what a strong answer shows
Trend-over-time reporting suitable for board audiences is a distinct capability from a real-time alert feed built for analysts — ask specifically whether this exists as a built-in report.
baselineRFIDoes the platform monitor threat activity on closed messaging platforms (Telegram channels, Discord servers) used increasingly by criminal groups, in addition to traditional dark-web forums, and how is access to these closed communities obtained and maintained?weight 3
Answer key — what a strong answer shows
Look for a specific answer on messaging-platform coverage and how the vendor actually gains and sustains access to closed criminal communities — this is a genuinely harder and more valuable capability than open-web monitoring.
baselineRFPDetail international and multi-language monitoring coverage — does detection and analyst triage extend meaningfully to non-English threats and lookalike domains using non-Latin character sets (e.g., Cyrillic homoglyph attacks), or is coverage effectively English/Latin-script only?weight 3
Answer key — what a strong answer shows
Homoglyph/non-Latin-script impersonation is a real, commonly-missed attack vector — a vendor should give a specific answer on language/script coverage rather than an unqualified 'global coverage' claim.
baselineRFPProvide periodic Deep Dark Web scanning to determine any unauthorized usage of the housing finance agency's information or data, with a deliverable report and debriefing.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
