Brand Protection RFP Checklist: Questions to Copy and Score

A brand protection RFP checklist you can copy: questions on scope, detection, takedown, metrics, authorization, pricing and exit, plus how to score answers.

Quick answer: A brand protection RFP checklist should make every vendor answer the same questions about scope, detection, verification, takedown and follow-up, reporting, authorization, data handling, pricing and exit, in writing and with evidence. The checklist below is grouped into nine sections you can paste into your own RFP, followed by a simple way to score the answers and the proof to ask for before you sign.

This page is the working template. If you are still deciding what kind of help you need, start with brand protection services: what they cover and brand protection software vs managed service, then come back here to run the selection.

Before you write the RFP: fix the scope

Vendors price and plan around what you list, so a vague scope produces answers you cannot compare. Put these facts in the RFP itself:

• Brands, product names and executive names in scope.
• Official domains, apps, social media accounts and SMS sender names, so vendors can tell genuine from fake.
• Countries and languages where your customers live.
• Channels you care about: websites, domains, search ads, social media, app stores, messaging apps.
• A rough count of incidents over the last twelve months and where they came from.
• Who internally will sign the letter of authorization and confirm edge cases.

Ask every vendor to answer each question with how they do it, who does it and what you will see, not just "yes". A yes without a method is the most common weak answer in brand protection RFPs.

The brand protection RFP checklist

1. Scope and coverage

• Which channels are included in the base price, and which cost extra?
• Is there a limit on brands, domains, keywords or countries monitored?
• Which languages and scripts can you detect and report in?
• Do you cover hacked legitimate websites as well as malicious domains?

2. Detection

• Which sources do you use: new domain registrations, certificate transparency logs, search ads, social platforms, app stores, customer reports?
• How quickly after a domain is registered or a page goes live do you typically see it, and how do you measure that?
• How do you find pages that hide from scanners through cloaking or geofencing?
• Can we forward suspicious links to you, and how fast are they handled?

3. Verification and evidence

• Does a person review every finding before anything is reported in our name?
• What evidence do you capture: full URLs, screenshots, page source, hosting and registration data, timestamps?
• How do you handle resellers, partners, fan sites and parked lookalikes?
• How do you avoid reporting our own legitimate assets?

4. Takedown and follow-up

• Which parties do you report to: browser blocklists, hosts, registrars, CDNs, search engines, social platforms, app stores, national CERTs?
• What is your definition of a completed takedown? Ask for an outcome, such as content removed or domain suspended, verified from more than one location.
• How do you escalate when a provider does not respond?
• Are follow-ups made outside business hours and at weekends?
• How do you handle a site that returns on a new domain or host? See what to do when a phishing site comes back.

5. Reporting and metrics

• Which metrics do you report: median time to blocklist, median time to removal, open cases, repeat campaigns?
• Are medians calculated across all cases or only successful ones?
• Can we see each case with its evidence and timeline?
• Can reports be exported or sent to our ticketing or SIEM tools?

6. Authorization, legal and compliance

• What authorization do you need from us, and do you act for any brand without one?
• Do reports go out in our name or yours?
• Which methods do you never use? The only acceptable answer excludes attacking or disrupting sites.
• Do you handle domain recovery routes such as UDRP, or refer them to counsel?

7. Security and data handling

• What data do you need from us, and where is it stored and processed?
• Will you sign a data processing agreement?
• Who on your staff can access our cases?
• Do you need access to any of our systems? Most takedown work does not.

8. Pricing and commercial terms

• Which pricing model applies: per takedown, tiered quota or all-inclusive subscription?
• What happens in a month with a large campaign: overage fees, fair-use limits or nothing?
• Does a redeployed site or a failed attempt count as a new takedown?
• What is the minimum term and notice period?

9. Onboarding and exit

• What does the first month look like, and what do you need from us?
• Who is our day-to-day contact, and what are their hours?
• Can we export our full case history and evidence if we leave?

How to score the answers

Score each section from 0 to 3: 0 for no answer, 1 for a claim without method, 2 for a clear method, 3 for a method backed by evidence such as sample reports or case timelines. Then weight the sections by what matters to you. A team without spare analysts might weight takedown and follow-up most heavily; a team with strict data rules might weight security higher. Have two people score independently, and score before you look at price, so a low quote does not color the reading of weak answers.

Compare cost last, and compare total cost: the fee plus the staff time each option leaves with you. Our phishing takedown service guide explains how the common pricing models behave during a busy month.

Ask for proof, not promises

Written answers narrow the list. Evidence decides it.

• A test on your own brand. Ask each finalist to scan your brand for a short period and show what they found and what they would report. Phishvoid, for example, runs an exposure scan for your brand as part of a demo.
• Anonymized case timelines. Ask for several complete cases, including ones that were slow or failed, with every step timestamped.
• References in your sector. Ask references how the vendor handled a large campaign and a disputed finding.
• A sample report. Check whether you could hand it to legal, fraud or customer support without rewriting it.

Mistakes that weaken a brand protection RFP

• Counting reports as takedowns. A report sent is activity. A site gone is the outcome. Make the contract say which one you are paying for.
• Accepting best-case times. A vendor's fastest case says little. Ask for medians across all cases and read our guide on how long a phishing takedown takes to set realistic expectations.
• Leaving caps vague. "Fair use" needs a number, or a written statement that there is none.
• Forgetting the exit. Your evidence and case history may be needed for litigation or insurance later. Secure the right to export them.

FAQ

How many vendors should receive a brand protection RFP?

Enough to compare, few enough to evaluate properly. Many teams send a short questionnaire to a wider list, then the full checklist and a live test to a small shortlist.

Should the RFP ask for prices?

Yes, but ask for the pricing model and what it includes as well as the number, and score quality before you open the price section. Many providers quote only after seeing your scope.

What is the most important question in a brand protection RFP?

How the vendor defines a completed takedown. It decides what the metrics mean, what you are billed for and whether cases stay open until the fake site is actually gone.

Can we reuse this checklist for a renewal review?

Yes. Send it to your current provider before renewal and compare the answers with what you actually saw in the case history over the past year.