Encryption evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 16 vendors in this category.

• baselineRFIWhat is the scope of encryption coverage — data at rest (databases, file storage), data in transit, and data in use (confidential computing/homomorphic techniques) — and which of these are native versus requiring a separate product?weight 3
  Answer key — what a strong answer shows

  Strong answers give an explicit per-category breakdown; 'encryption' is a broad category and a vendor covering only data-at-rest should say so rather than implying full-lifecycle coverage.

• baselineRFPDescribe the key management architecture — is key management built in, or does it require integration with an external KMS/HSM — and detail support for customer-managed keys (CMK) or bring-your-own-key (BYOK) for regulated customers.weight 3
  Answer key — what a strong answer shows

  Look for clear support for customer-managed/BYOK keys, which many regulated buyers require for data sovereignty; a vendor holding all keys with no CMK option is a real limitation for that segment.

• baselineRFIWhat cryptographic algorithms and key lengths are used by default, and does the platform have a documented roadmap for post-quantum cryptography migration?weight 3
  Answer key — what a strong answer shows

  A vendor with no stated post-quantum roadmap is a meaningful gap given the multi-year migration timelines involved; look for named PQC algorithm support or a concrete timeline, not silence.

• baselineRFIHow is performance overhead managed for encryption/decryption on high-throughput or latency-sensitive workloads, and what is the measured throughput/latency impact under realistic production load?weight 3
  Answer key — what a strong answer shows

  Look for real measured overhead figures under production-like load, not theoretical or lab-only benchmarks that don't reflect actual deployment conditions.

• baselineRFPDetail key rotation and revocation processes — can keys be rotated without downtime or re-encrypting the full dataset, and what is the process and typical time for emergency key revocation after a suspected compromise?weight 3
  Answer key — what a strong answer shows

  Zero-downtime rotation and a fast, well-defined emergency revocation process are critical; a vendor requiring full dataset re-encryption on every rotation has an operationally costly design.

• baselineRFIWhat certifications or validations does the cryptographic implementation carry (FIPS 140-2/140-3 validation, Common Criteria), and is validation at the module level or only claimed at the product level?weight 3
  Answer key — what a strong answer shows

  FIPS module-level validation (not just a product-level marketing claim) matters for regulated buyers (government, healthcare, finance); ask for the specific certificate number.

• baselineRFPExplain access control integration — how does the platform ensure only authorized users/services can decrypt data (tied to IAM/RBAC), and is there audit logging of every decryption event for compliance evidence?weight 3
  Answer key — what a strong answer shows

  Look for granular, IAM-tied decryption authorization and comprehensive audit logging of decrypt events — encryption without access control and logging provides limited real protection against insider misuse.

• baselineRFIHow does the platform handle encryption for cloud-native and multi-cloud environments specifically — native integration with each major cloud provider's encryption services, or a single cross-cloud abstraction layer?weight 3
  Answer key — what a strong answer shows

  Both approaches are valid; look for the vendor being explicit about which model they use and any resulting limitations (e.g., an abstraction layer might lag behind a cloud provider's newest native features).

• baselineRFIWhat is the pricing model — per key, per data volume encrypted, or a flat enterprise tier — and how does cost scale as the volume of encrypted data grows significantly across the environment?weight 3
  Answer key — what a strong answer shows

  Look for transparent, predictable scaling economics; a vendor unable to project cost at meaningfully larger data volume creates real budget risk for a growing encrypted-data footprint.

• baselineRFPWhat is the incident-response process if a vulnerability in the encryption product's own implementation is disclosed — how quickly are affected deployments identified, and what is the re-keying process for already-encrypted data?weight 3
  Answer key — what a strong answer shows

  A vulnerability in the encryption implementation itself is a severe finding — ask for a specific, tested incident-response process rather than a hypothetical assurance that the product is inherently secure.

• baselineRFIDoes the platform map coverage to industry-specific regulatory encryption requirements (HIPAA encryption safe-harbor, PCI DSS encryption requirements) with audit-ready evidence, and has this been accepted by a real assessor for a customer's actual compliance audit?weight 3
  Answer key — what a strong answer shows

  Ask for real evidence of assessor acceptance for a specific named regulation, not just a generic 'compliance-ready' marketing claim.

• baselineRFPDetail historical trend reporting on encryption coverage across the data estate (percentage of sensitive data sources actively encrypted, coverage-gap trend) over time, suitable for demonstrating program maturity to leadership.weight 3
  Answer key — what a strong answer shows

  Trend-over-time coverage reporting is a distinct capability from a per-source encryption configuration — confirm this exists as a maintained, exportable report.

• baselineRFIHow does the platform integrate with the customer's existing DSPM/data-classification tooling so encryption policy can be automatically targeted at data actually found to be sensitive, rather than requiring the customer to already know exactly what to encrypt?weight 3
  Answer key — what a strong answer shows

  Classification-driven encryption targeting is a materially more complete workflow than requiring the customer to manually identify every data source needing encryption beforehand.

• baselineRFIWho within the customer organization can perform key-management operations (rotation, revocation, access-policy changes), and is there a strict, documented separation-of-duties model given how sensitive control over encryption keys is?weight 3
  Answer key — what a strong answer shows

  Key-management operations are uniquely sensitive — ask for a specific, strict access-control and separation-of-duties model, not just a general RBAC claim.

• baselineRFPWhat migration/portability support exists if the customer later needs to switch encryption vendors — can encrypted data be re-keyed and migrated without a full re-encryption of the entire dataset from scratch, and what is a customer-referenced migration timeline?weight 3
  Answer key — what a strong answer shows

  A full from-scratch re-encryption is a major, costly undertaking at scale — ask for a specific, more efficient migration/re-keying capability and a real customer-validated timeline.

• baselineRFIWhat developer-facing SDK/API experience exists for integrating encryption into custom applications, and what is a customer-referenced integration timeline for a team building encryption into a new or existing application?weight 3
  Answer key — what a strong answer shows

  Strong answers point to real, well-documented SDKs and a customer-validated integration timeline, not just console-based configuration for pre-built integrations.

• baselineRFPEnsure encryption in transit and at rest, immutable log storage, and verifiable audit trails.weight 3
• baselineRFPEncrypt PII at all times, both at rest and in transit, in accordance with FIPS 140-3 standards.weight 3
• baselineRFPMust encrypt logs in transit and at rest.weight 3
• baselineRFPProposed solution should provide role-based security, encryption of data-at-rest, data in use, data-in-transit, and data on backup media.weight 3
• baselineRFPThe proposed system shall capture all raw log, event and alert details and normalize them into a standard format; the solution should prevent tampering of any type of logs, log any attempts to tamper logs, and provide encrypted transmission of log data to log management.weight 3
• baselineRFPFor cloud-based solutions, the system shall support the ability to configure encryption at rest and/or in transit for the organization's sensitive data, as determined by the organization's policy and use cases.weight 3
• baselineRFPProvide application penetration testing services including authentication process testing, automated fuzzing, development of test datasets and harnesses, encryption usage testing, manual/automatic code review for sensitive information, input validation and transaction testing, and user session/cookie/lockout testing.weight 3
• baselineRFPDescribe your data-at-rest and data-in-motion protection. What encryption methods are used for data-at-rest and data-in-motion?weight 3
• baselineRFPDo you have plans to move away from SSL v2/v3 to TLS v1.1 or later? If so, when?weight 3
• baselineRFPProvide a Product Overview (description of platform/software, architecture, key features/functionalities, track record of solving complex identity problems), Implementation Plan (work required, timeline/milestones, transition plan, expected data migration duration and vendor role), Training Plan (knowledge transfer, system management training for ITS roles, future training options), Security and Privacy Considerations (protocols, encryption methods, FERPA/NIST 800-171 compliance, disaster recovery/backup procedures), and Support/Maintenance Considerations.weight 3
• baselineRFIVendor shall ensure all laptops, mobile devices, and removable media used to store, process, or transport agency-identified restricted or sensitive data are encrypted at all times, meeting or exceeding current industry standards and best practices.weight 3

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.