Start from a neutral baseline and add what matters to you. Criteria are labeled by source — the platform baseline is architecture-neutral; buyer-contributed criteria are shown separately.
Build your evaluation
no account needed
Match on your requirements
no account needed
This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.
1. Weight what matters
27 criteria
baselineWhat is the scope of encryption coverage — data at rest (databases, file storage), data in transit, and data in use (confidential computing/homomorphic techniques) — and which of these are native versus requiring a separate product?
baselineDescribe the key management architecture — is key management built in, or does it require integration with an external KMS/HSM — and detail support for customer-managed keys (CMK) or bring-your-own-key (BYOK) for regulated customers.
baselineWhat cryptographic algorithms and key lengths are used by default, and does the platform have a documented roadmap for post-quantum cryptography migration?
baselineHow is performance overhead managed for encryption/decryption on high-throughput or latency-sensitive workloads, and what is the measured throughput/latency impact under realistic production load?
baselineDetail key rotation and revocation processes — can keys be rotated without downtime or re-encrypting the full dataset, and what is the process and typical time for emergency key revocation after a suspected compromise?
baselineWhat certifications or validations does the cryptographic implementation carry (FIPS 140-2/140-3 validation, Common Criteria), and is validation at the module level or only claimed at the product level?
baselineExplain access control integration — how does the platform ensure only authorized users/services can decrypt data (tied to IAM/RBAC), and is there audit logging of every decryption event for compliance evidence?
baselineHow does the platform handle encryption for cloud-native and multi-cloud environments specifically — native integration with each major cloud provider's encryption services, or a single cross-cloud abstraction layer?
baselineWhat is the pricing model — per key, per data volume encrypted, or a flat enterprise tier — and how does cost scale as the volume of encrypted data grows significantly across the environment?
baselineWhat is the incident-response process if a vulnerability in the encryption product's own implementation is disclosed — how quickly are affected deployments identified, and what is the re-keying process for already-encrypted data?
baselineDoes the platform map coverage to industry-specific regulatory encryption requirements (HIPAA encryption safe-harbor, PCI DSS encryption requirements) with audit-ready evidence, and has this been accepted by a real assessor for a customer's actual compliance audit?
baselineDetail historical trend reporting on encryption coverage across the data estate (percentage of sensitive data sources actively encrypted, coverage-gap trend) over time, suitable for demonstrating program maturity to leadership.
baselineHow does the platform integrate with the customer's existing DSPM/data-classification tooling so encryption policy can be automatically targeted at data actually found to be sensitive, rather than requiring the customer to already know exactly what to encrypt?
baselineWho within the customer organization can perform key-management operations (rotation, revocation, access-policy changes), and is there a strict, documented separation-of-duties model given how sensitive control over encryption keys is?
baselineWhat migration/portability support exists if the customer later needs to switch encryption vendors — can encrypted data be re-keyed and migrated without a full re-encryption of the entire dataset from scratch, and what is a customer-referenced migration timeline?
baselineWhat developer-facing SDK/API experience exists for integrating encryption into custom applications, and what is a customer-referenced integration timeline for a team building encryption into a new or existing application?
baselineDo you have plans to move away from SSL v2/v3 to TLS v1.1 or later? If so, when?
baselineProvide a Product Overview (description of platform/software, architecture, key features/functionalities, track record of solving complex identity problems), Implementation Plan (work required, timeline/milestones, transition plan, expected data migration duration and vendor role), Training Plan (knowledge transfer, system management training for ITS roles, future training options), Security and Privacy Considerations (protocols, encryption methods, FERPA/NIST 800-171 compliance, disaster recovery/backup procedures), and Support/Maintenance Considerations.
baselineVendor shall ensure all laptops, mobile devices, and removable media used to store, process, or transport agency-identified restricted or sensitive data are encrypted at all times, meeting or exceeding current industry standards and best practices.
baselineEnsure encryption in transit and at rest, immutable log storage, and verifiable audit trails.
baselineEncrypt PII at all times, both at rest and in transit, in accordance with FIPS 140-3 standards.
baselineMust encrypt logs in transit and at rest.
baselineProposed solution should provide role-based security, encryption of data-at-rest, data in use, data-in-transit, and data on backup media.
baselineThe proposed system shall capture all raw log, event and alert details and normalize them into a standard format; the solution should prevent tampering of any type of logs, log any attempts to tamper logs, and provide encrypted transmission of log data to log management.
baselineFor cloud-based solutions, the system shall support the ability to configure encryption at rest and/or in transit for the organization's sensitive data, as determined by the organization's policy and use cases.
baselineProvide application penetration testing services including authentication process testing, automated fuzzing, development of test datasets and harnesses, encryption usage testing, manual/automatic code review for sensitive information, input validation and transaction testing, and user session/cookie/lockout testing.
baselineDescribe your data-at-rest and data-in-motion protection. What encryption methods are used for data-at-rest and data-in-motion?
Signing up adds sharing with your team, sending this as an RFP to vendors, and private document sharing. Nothing above is taken away, and nothing here is sent anywhere until you choose to.
Platform baseline
neutral · staff-reviewed
RFIWhat is the scope of encryption coverage — data at rest (databases, file storage), data in transit, and data in use (confidential computing/homomorphic techniques) — and which of these are native versus requiring a separate product?Answer key — what a strong answer shows
Strong answers give an explicit per-category breakdown; 'encryption' is a broad category and a vendor covering only data-at-rest should say so rather than implying full-lifecycle coverage.
RFPDescribe the key management architecture — is key management built in, or does it require integration with an external KMS/HSM — and detail support for customer-managed keys (CMK) or bring-your-own-key (BYOK) for regulated customers.Answer key — what a strong answer shows
Look for clear support for customer-managed/BYOK keys, which many regulated buyers require for data sovereignty; a vendor holding all keys with no CMK option is a real limitation for that segment.
RFIWhat cryptographic algorithms and key lengths are used by default, and does the platform have a documented roadmap for post-quantum cryptography migration?Answer key — what a strong answer shows
A vendor with no stated post-quantum roadmap is a meaningful gap given the multi-year migration timelines involved; look for named PQC algorithm support or a concrete timeline, not silence.
RFIHow is performance overhead managed for encryption/decryption on high-throughput or latency-sensitive workloads, and what is the measured throughput/latency impact under realistic production load?Answer key — what a strong answer shows
Look for real measured overhead figures under production-like load, not theoretical or lab-only benchmarks that don't reflect actual deployment conditions.
RFPDetail key rotation and revocation processes — can keys be rotated without downtime or re-encrypting the full dataset, and what is the process and typical time for emergency key revocation after a suspected compromise?
From other buyers
crowdsourced · anonymized
💬
No buyer-contributed criteria yet
Verified buyers can suggest criteria (anonymized before pooling).
Answer key — what a strong answer shows
Zero-downtime rotation and a fast, well-defined emergency revocation process are critical; a vendor requiring full dataset re-encryption on every rotation has an operationally costly design.
RFIWhat certifications or validations does the cryptographic implementation carry (FIPS 140-2/140-3 validation, Common Criteria), and is validation at the module level or only claimed at the product level?Answer key — what a strong answer shows
FIPS module-level validation (not just a product-level marketing claim) matters for regulated buyers (government, healthcare, finance); ask for the specific certificate number.
RFPExplain access control integration — how does the platform ensure only authorized users/services can decrypt data (tied to IAM/RBAC), and is there audit logging of every decryption event for compliance evidence?Answer key — what a strong answer shows
Look for granular, IAM-tied decryption authorization and comprehensive audit logging of decrypt events — encryption without access control and logging provides limited real protection against insider misuse.
RFIHow does the platform handle encryption for cloud-native and multi-cloud environments specifically — native integration with each major cloud provider's encryption services, or a single cross-cloud abstraction layer?Answer key — what a strong answer shows
Both approaches are valid; look for the vendor being explicit about which model they use and any resulting limitations (e.g., an abstraction layer might lag behind a cloud provider's newest native features).
RFIWhat is the pricing model — per key, per data volume encrypted, or a flat enterprise tier — and how does cost scale as the volume of encrypted data grows significantly across the environment?Answer key — what a strong answer shows
Look for transparent, predictable scaling economics; a vendor unable to project cost at meaningfully larger data volume creates real budget risk for a growing encrypted-data footprint.
RFPWhat is the incident-response process if a vulnerability in the encryption product's own implementation is disclosed — how quickly are affected deployments identified, and what is the re-keying process for already-encrypted data?Answer key — what a strong answer shows
A vulnerability in the encryption implementation itself is a severe finding — ask for a specific, tested incident-response process rather than a hypothetical assurance that the product is inherently secure.
RFIDoes the platform map coverage to industry-specific regulatory encryption requirements (HIPAA encryption safe-harbor, PCI DSS encryption requirements) with audit-ready evidence, and has this been accepted by a real assessor for a customer's actual compliance audit?Answer key — what a strong answer shows
Ask for real evidence of assessor acceptance for a specific named regulation, not just a generic 'compliance-ready' marketing claim.
RFPDetail historical trend reporting on encryption coverage across the data estate (percentage of sensitive data sources actively encrypted, coverage-gap trend) over time, suitable for demonstrating program maturity to leadership.Answer key — what a strong answer shows
Trend-over-time coverage reporting is a distinct capability from a per-source encryption configuration — confirm this exists as a maintained, exportable report.
RFIHow does the platform integrate with the customer's existing DSPM/data-classification tooling so encryption policy can be automatically targeted at data actually found to be sensitive, rather than requiring the customer to already know exactly what to encrypt?Answer key — what a strong answer shows
Classification-driven encryption targeting is a materially more complete workflow than requiring the customer to manually identify every data source needing encryption beforehand.
RFIWho within the customer organization can perform key-management operations (rotation, revocation, access-policy changes), and is there a strict, documented separation-of-duties model given how sensitive control over encryption keys is?Answer key — what a strong answer shows
Key-management operations are uniquely sensitive — ask for a specific, strict access-control and separation-of-duties model, not just a general RBAC claim.
RFPWhat migration/portability support exists if the customer later needs to switch encryption vendors — can encrypted data be re-keyed and migrated without a full re-encryption of the entire dataset from scratch, and what is a customer-referenced migration timeline?Answer key — what a strong answer shows
A full from-scratch re-encryption is a major, costly undertaking at scale — ask for a specific, more efficient migration/re-keying capability and a real customer-validated timeline.
RFIWhat developer-facing SDK/API experience exists for integrating encryption into custom applications, and what is a customer-referenced integration timeline for a team building encryption into a new or existing application?Answer key — what a strong answer shows
Strong answers point to real, well-documented SDKs and a customer-validated integration timeline, not just console-based configuration for pre-built integrations.
RFPDo you have plans to move away from SSL v2/v3 to TLS v1.1 or later? If so, when?
RFPProvide a Product Overview (description of platform/software, architecture, key features/functionalities, track record of solving complex identity problems), Implementation Plan (work required, timeline/milestones, transition plan, expected data migration duration and vendor role), Training Plan (knowledge transfer, system management training for ITS roles, future training options), Security and Privacy Considerations (protocols, encryption methods, FERPA/NIST 800-171 compliance, disaster recovery/backup procedures), and Support/Maintenance Considerations.
RFIVendor shall ensure all laptops, mobile devices, and removable media used to store, process, or transport agency-identified restricted or sensitive data are encrypted at all times, meeting or exceeding current industry standards and best practices.
RFPEnsure encryption in transit and at rest, immutable log storage, and verifiable audit trails.
RFPEncrypt PII at all times, both at rest and in transit, in accordance with FIPS 140-3 standards.
RFPMust encrypt logs in transit and at rest.
RFPProposed solution should provide role-based security, encryption of data-at-rest, data in use, data-in-transit, and data on backup media.
RFPThe proposed system shall capture all raw log, event and alert details and normalize them into a standard format; the solution should prevent tampering of any type of logs, log any attempts to tamper logs, and provide encrypted transmission of log data to log management.
RFPFor cloud-based solutions, the system shall support the ability to configure encryption at rest and/or in transit for the organization's sensitive data, as determined by the organization's policy and use cases.
RFPProvide application penetration testing services including authentication process testing, automated fuzzing, development of test datasets and harnesses, encryption usage testing, manual/automatic code review for sensitive information, input validation and transaction testing, and user session/cookie/lockout testing.
RFPDescribe your data-at-rest and data-in-motion protection. What encryption methods are used for data-at-rest and data-in-motion?
