1. Vendor background
- 1.1
Background, ownership, scale of MAU served.
- 1.2
3-5 reference customers in our model (B2C / B2B / hybrid).
RFP template · reviewed 2026-05-22
CIAM RFP template — the questions to actually ask
A copy-into-Word RFP scaffold for selecting a CIAM platform (Auth0, Microsoft External ID, Ping, Akamai, WorkOS). Focuses on developer experience + B2B + ATO defense.
Who uses it
Product engineering / platform leadership at consumer or B2B SaaS companies.
Typical timeline
4-8 weeks RFP → shortlist → POC → award
21 questions across 8 sections. CC BY 4.0 — copy freely.
2. Authentication + user flows
- 2.1
Supported authentication factors — password, passkey, social, OTP, SMS, biometric.
- 2.2
Passkey rollout maturity — registration UX, fallback flows, multi-device.
- 2.3
Account recovery flows — what mitigations against social engineering?
3. Multi-tenancy (B2B)
- 3.1
How is multi-tenant identity modeled (Organizations, realms, separate tenants)?
- 3.2
How are tenant-specific configurations isolated (branding, MFA policy, identity providers)?
- 3.3
Describe the customer-IdP federation experience (their Okta / Entra signing in to your platform).
4. SCIM provisioning
- 4.1
SCIM 2.0 server conformance. Tested against which IdPs?
- 4.2
Custom-attribute handling. Push vs pull. Latency profile.
5. Developer experience
- 5.1
List SDKs (JavaScript, React Native, iOS, Android, server-side languages).
- 5.2
Describe custom logic extension points — Auth0 Actions, Rules, API connectors.
- 5.3
Describe local development workflow.
6. ATO defense
- 6.1
Describe credential-stuffing mitigation — rate limits, CAPTCHA escalation, bot mitigation.
- 6.2
Describe risk-based authentication signals.
- 6.3
Describe leaked-credential detection (HIBP-style screening).
7. UX + branding
- 7.1
Describe branding / customization options — colors, copy, fully custom UI vs hosted login.
- 7.2
Custom domain support.
8. Pricing
- 8.1
MAU pricing tiers. Free tier + cap.
- 8.2
What features are per-tier vs per-MAU adders?
- 8.3
How do prices change at 100K, 1M, 10M MAU?
Evaluation rubric
How to score responses.
| Criterion | Weight | How to score |
|---|---|---|
| Passkey / phishing-resistant depth | 15% | WebAuthn implementation maturity + UX. |
| Multi-tenancy (if B2B) | 20% | Organizations model + per-tenant federation. |
| Developer experience | 15% | SDK quality + extension points + docs. |
| ATO defense | 15% | Bot mitigation + risk-based + leaked-credential screening. |
| TCO at projected MAU | 15% | Year 1, 2, 3 cost at projected user growth. |
| Compliance posture | 10% | SOC 2 + (if applicable) HIPAA, GDPR, PCI DSS. |
| Reference customer signal | 10% | 3-5 references. |
Want help running it?
We run vendor selections + bake-offs.
Vendor-neutral procurement assistance — from RFP to shortlist to bake-off to negotiation. We’ve seen every vendor pitch + every contract structure.