Password Management evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 38 vendors in this category.

• baselineRFIWhat is the encryption architecture — is it end-to-end/zero-knowledge (vault decryptable only client-side), and has this been validated by a named third-party security audit with a published report?weight 3
  Answer key — what a strong answer shows

  Zero-knowledge architecture with a named, dated, published audit is table stakes — vendors unable to produce the actual report (not just 'we're audited') should be treated cautiously given breach history in this category.

• baselineRFPDescribe the vendor's own security incident history and response — for any past breaches or vault-exposure incidents in this product category, what architectural changes were made, and how would your architecture limit blast radius if your infrastructure were compromised?weight 3
  Answer key — what a strong answer shows

  This category has had major real breaches; a credible vendor addresses the risk directly with architectural specifics (zero-knowledge limits, KDF iteration hardening) rather than deflecting.

• baselineRFIWhat SSO/SCIM integration exists for enterprise deployment — automated provisioning/deprovisioning, group-based vault/collection access, and what happens to a departing employee's vault items?weight 3
  Answer key — what a strong answer shows

  Look for SCIM-driven lifecycle including a defined offboarding flow (item transfer/recovery by admins under policy) — orphaned vaults on departure are a real operational failure mode.

• baselineRFIHow does secure sharing work — item/collection-level sharing with granular permissions (view vs. edit vs. share), external/guest sharing, and a full audit trail of who accessed what and when?weight 3
  Answer key — what a strong answer shows

  Look for cryptographically-enforced sharing (re-encryption per recipient) with real audit events, not vault-password sharing workarounds.

• baselineRFPDetail passkey support — can the product store and sync passkeys across platforms, act as a passkey provider on iOS/Android/browsers, and what is the migration path as passwords decline?weight 3
  Answer key — what a strong answer shows

  Passkey provider capability (not just storage) across all major platforms is the forward-looking requirement; a password-only product is buying into a shrinking category.

• baselineRFIWhat breach/exposure monitoring is included — checking stored credentials against known breach corpora, weak/reused password reporting, and automated user nudges to rotate?weight 3
  Answer key — what a strong answer shows

  Look for continuous monitoring with per-user actionable reporting and admin-visible security scores, not a one-time import check.

• baselineRFPExplain emergency access and account recovery — what happens when a user loses all devices and their master password, and how does the recovery path avoid becoming the weakest link in the zero-knowledge model?weight 3
  Answer key — what a strong answer shows

  Recovery must be explicit about tradeoffs (recovery keys, admin-held escrow under policy, or genuinely unrecoverable) — a too-easy recovery path silently breaks the zero-knowledge promise.

• baselineRFIWhat offline access and platform coverage exists (desktop apps, browsers, mobile, CLI for developers), and does functionality degrade on any platform?weight 3
  Answer key — what a strong answer shows

  Look for full offline vault access and per-platform feature parity — CLI/API access matters for developer adoption, offline for travel/incident scenarios.

• baselineRFIWhat is the pricing model, and does it differ meaningfully between an individual/family tier and the enterprise tier — is a personal/family license bundled with enterprise seats as an employee-retention perk, and at what incremental cost?weight 3
  Answer key — what a strong answer shows

  A bundled personal/family tier is a common, real differentiator for enterprise password-manager deals — ask explicitly whether it's included and at what cost.

• baselineRFPDetail admin/IT visibility and reporting — can IT see an org-wide password-hygiene dashboard (weak/reused/breached password counts, MFA adoption) without breaking the product's own zero-knowledge encryption model for individual vault contents?weight 3
  Answer key — what a strong answer shows

  Look for a real answer on how aggregate hygiene reporting is reconciled with a genuine zero-knowledge architecture — these two goals are in real tension and a vendor should explain the actual mechanism, not just claim both.

• baselineRFIDoes the platform support privileged/shared-account credential management for business use cases (shared service-account passwords, team-shared credentials) distinct from individual employee password vaults, or is that entirely out of scope requiring a separate PAM product?weight 3
  Answer key — what a strong answer shows

  Shared/privileged credential management is a distinct use case from individual password vaults — a vendor should clarify this scope boundary explicitly.

• baselineRFPWhat is the business-continuity plan if the vendor's own infrastructure has an outage — can employees still access their vaults (e.g., via a cached local copy), or does an outage fully lock out the workforce from all their credentials?weight 3
  Answer key — what a strong answer shows

  A password manager outage that fully locks users out of every credential is an unusually severe availability failure mode — ask for a specific offline/cached-access fallback, not just an uptime SLA number.

• baselineRFIWhat compliance certifications does the platform hold (SOC 2 Type II, ISO 27001) given the extreme sensitivity of what it stores, and can the customer request the actual audit report rather than accepting a compliance-badge claim?weight 3
  Answer key — what a strong answer shows

  Given this product stores the literal keys to every other system, insist on the real audit report — a compliance-badge claim without the underlying report is insufficient evidence for a product this sensitive.

• baselineRFIWhat migration tooling exists for moving from a competing password manager (bulk import preserving folder structure/sharing permissions, not just a flat CSV dump), and what is a customer-referenced migration timeline for a large organization?weight 3
  Answer key — what a strong answer shows

  A flat CSV import that loses folder structure and sharing permissions creates real migration friction — ask for a concrete example of a structure-preserving migration and a real customer timeline.

• baselineRFPBeyond passwords, what secure-document/note storage capability exists (e.g., storing sensitive files, software licenses, secure notes), and does this share the same zero-knowledge encryption guarantees as password storage?weight 3
  Answer key — what a strong answer shows

  Secure document storage is a common adjacent use case — confirm it carries the same encryption guarantees as core password storage, not a weaker tier.

• baselineRFIDetail rollout/adoption support for a large workforce — self-service enrollment, bulk provisioning via SCIM, and a customer-referenced measured adoption rate (percentage of employees actively using the tool, not just provisioned) after a defined rollout period.weight 3
  Answer key — what a strong answer shows

  Provisioning a license doesn't guarantee real adoption — ask for an actual usage/adoption figure from a customer reference, not just a provisioning count, since unused licenses provide zero security benefit.

• baselineRFPEvaluate password resilience across enterprise authentication systems (e.g., Microsoft AD, cloud identity platforms, critical directories) to identify weak or reused credentials and provide actionable remediation without disrupting operations.weight 3
• baselineRFPDocument Rules of Engagement for the annual password strength assessment.weight 3
• baselineRFPProvide an example of a past password strength assessment report (anonymized) showing both executive and technical findings.weight 3
• baselineRFPProvide a methodology description for the password assessment (tools, hash types, and recovery techniques).weight 3
• baselineRFPProvide credentials of staff conducting the password assessment work (e.g., CISSP, OSCP).weight 3
• baselineRFPProvide two or more client references for similar password assessment engagements.weight 3
• baselineRFPDocument chain of custody: how password data is accessed, transferred, stored, and protected end-to-end.weight 3
• baselineRFPProvide certified disposal of all password data and recovered credentials, with a written certificate of destruction, immediately after reporting.weight 3
• baselineRFPProvide an executive and technical report showing percentage of weak/recoverable credentials, estimated recovery times, and risk summary.weight 3
• baselineRFPProvide remediation recommendations from the password assessment (e.g., password policy changes, MFA enforcement, privileged account hardening).weight 3
• baselineRFPProvide an option for retest to confirm password remediation fixes are effective.weight 3
• baselineRFPWhat is the process for handling password resets?weight 3
• baselineRFPRespond to evaluation criteria categories: Pricing, Workflow and Access, Deployment and Administration, Identity and Entitlements, Fulfillment and Connectors, Dynamic Password Administration and Management, and Vendor Information and Higher Education Experience.weight 3
• baselineRFPProvide self-service password reset allowing end users to unlock/reset password after proving identity ownership via alternate email, security questions, or pre-registered MFA options.weight 3

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.