QHSE Software RFP Template
Turn your workflows into requirements that vendors can answer and demonstrate. Customize the worksheet below, export it as CSV, and use the question library to add details for your organization. This is an editorial template; adapt it with your procurement, IT and operational teams.
Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn
Require an evidence-bearing response
For every applicable requirement, ask for the current product, plan, module, role and configuration; the response status; a documentation link or demonstration artifact; the date and version; implementation dependencies; separate costs; and an accountable follow-up owner.
Keep available now, configurable, custom work, roadmap, not supported and unknown distinct. An unanswered question or roadmap intention is not a passed requirement. Agree critical acceptance conditions separately from weighted preferences, and verify the proposed production plan rather than relying on a privileged demonstration tenant.
Separate offline preparation, capture and restart from synchronization, server receipt and onward delivery. Request a recovery demonstration for a failed transfer. Integration entitlement does not establish a completed implementation; identify mappings, monitoring, retry handling and support ownership.
Customize and download your RFP worksheet
Start with these 14 questions, edit the acceptance criteria, and mark your priorities. The CSV includes blank response, evidence, plan and cost columns for vendors to complete. Exclude irrelevant requirements before exporting.
Draft saved in this browser. Your entries are not submitted to us. Keep personal or confidential information out of this worksheet.
Agree your evaluation weights before receiving proposals. Treat an unresolved must-have as a decision gate; do not hide it inside a strong average score. A roadmap promise is not a demonstrated capability.
Ask every vendor to answer in the same shape
The questions below are written as requests for something you can check. Add this response format to your RFP so that every answer to every question has the same parts, and an answer without evidence is read as unproven.
- Status: available now, configurable, custom work, roadmap, not supported or unknown.
- Delivered how: out of the box, set up by our administrator, or needing vendor services.
- Product, edition and version that the answer applies to.
- Evidence: a document, a screen, a report or a date for the demonstration, with its version.
- Cost: included, optional or separately charged, with the amount or the rule.
1. Company Overview & Requirements
- Describe your organization size, industry, and number of sites
- List current QHSE processes (paper, spreadsheets, legacy software)
- Define primary objectives for the new platform
- Specify user count by role (admin, manager, frontline, contractor)
- Outline required deployment model (cloud, on-premise, hybrid)
- List languages required for the interface and reports
2. Functional Requirements
- Incident reporting, investigation, and CAPA management
- Risk assessment with configurable matrices
- Audit and inspection management with mobile capability
- Permit-to-work digital workflows
- Training management and competency tracking
- Document control with version management
- Compliance tracking and legal register
- Management of Change (MOC) workflows
- Environmental monitoring and sustainability reporting
- Contractor and visitor safety management
- KPI dashboards and executive reporting
- Near-miss and safety observation capture
3. Technical Requirements
- Name the mobile app, version, device and role; specify offline preparation, new capture, attachments, restart and connected server-receipt checks
- Name the API or connector, licensed tier, add-ons, authentication, limits, direction and supported operations; provide documentation
- Name the single sign-on protocols supported (for example SAML 2.0 or OpenID Connect), the plan that includes them, and whether automatic user provisioning is included. Be ready to test the sign-in with our identity team
- State the encryption used for data at rest and in transit, who manages the keys, and whether customer-managed keys are offered and on which plan
- Provide the relevant ISO 27001 certificate and scope or SOC 2 Type II report, reporting period and scope; identify the entity and service covered
- Data residency options (EU, US, Asia-Pacific)
- State any contractual uptime commitment and what happens when it is missed. Give the recovery time and recovery point you commit to and the date of your last recovery test
- List the supported browsers, operating systems and mobile OS versions, and how long you support an older version
- If we need sensor or device data: name the devices or protocols supported, whether the data arrives through a connector or custom work, and who maintains it
- Describe how sites, business units and roles are modelled, and demonstrate a supervisor who can see only one site and a contractor who can submit but not read other records
4. Integration Requirements
- For each system we name (ERP, HR, maintenance, identity): state whether the link is a published API, a pre-built connector, a webhook or custom work, the direction of the data, the licence that includes it, and who maintains it
- Show how a new starter, a leaver and a role change in the HR system reach this product, including what happens when the interface fails
- State how reporting data reaches our BI tool: live connector, scheduled export or API, any row or volume limits, and the licence that includes it
- Email and calendar system integration
- GRC platform integration (if applicable)
- Document management system (SharePoint, etc.)
5. Vendor Evaluation Criteria
- Pricing model: per-user, per-site, or enterprise license?
- Implementation timeline and methodology
- Training approach: on-site, virtual, self-paced, or hybrid?
- Data migration support from existing systems
- Customer support: hours, channels, SLA response times
- Product roadmap and release frequency
- Customer references in your industry and region
- Contract terms: minimum commitment, exit clauses, data portability
6. Data Protection & Processing
- Provide the data processing agreement before signing. Confirm it sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people concerned
- List every sub-processor, where it operates and what it does for the service. Say how we are told of an addition or replacement and how we can object
- Confirm that personal data is processed only on our documented instructions, including for transfers to a country outside the EU or UK
- Describe how we can audit you or receive the information needed to show compliance, and how an audit by our appointed auditor is handled
- State where customer data, backups and support access are stored and processed, whether we can choose or fix the region by contract, and which plan includes that option
- State what happens to our personal data when the service ends: deleted or returned at our choice, in what format and by when, and whether existing copies are deleted
7. Exit & Data Portability
- List every category of data and digital asset we can export, including records, attachments, audit trail, history, users and configuration. Say which categories you exclude and why
- State the export formats, and whether an administrator can run a complete export without vendor services or a paid request
- State, in days, the notice period to start an exit, the transitional period during which the contract continues, the period after termination in which we can still retrieve data, and when remaining data is erased
- List every charge that could apply at exit: switching, data transfer out, early termination, professional services. Give the amounts or the rule, before signing
- Say whether you regard this service as a data processing service under the EU Data Act and, if so, which of its switching terms the contract carries
- Describe the help you give for an exit plan, and demonstrate a complete export of a sample record with its attachments and history
8. Accessibility & AI Features
- Provide an Accessibility Conformance Report for this product. Name the VPAT edition (WCAG, EU, 508 or INT), the standard and version it reports against, the date, the product version it covers and who prepared and tested it
- State which assistive technologies the product was tested with, and the known gaps and when they will be fixed
- List every AI feature in the quoted edition: what it does, whether it is on by default, and whether we can switch it off
- State what data an AI feature sends outside our tenant, to whom, and whether our data is used to train or improve any model
- Describe how a person reviews an AI output before it becomes a record, and how the review is logged
9. Response Format & Timeline
- RFP issued: [DATE]
- Questions deadline: [DATE — allow time to clarify scope]
- Responses due: [DATE — agree a feasible response window]
- Shortlist notification: [DATE]
- Demo presentations: [DATE RANGE]
- Pilot/trial period: [DATE RANGE — linked to acceptance tests]
- Final decision: [DATE]
What vendors document, and what that means for the questions
We checked the records of 212 QHSE, EHS and ESG software profiles through 2026-10-14. Where a profile has no statement, we found none; that does not mean the product lacks it. Every statement is the vendor's own and was not tested. The counts come from our security and trial study and hosting and data location study, which give the rules for each count. No product is named here and nothing is ranked.
| The record states | Profiles | So the RFP should ask |
|---|---|---|
| Names any security certification or attestationA certification or attestation named in the record, such as SOC 2 or ISO/IEC 27001. | 130 of 212 | Ask for the certificate or report itself: the legal entity, the service and sites in scope, the period or validity, and any exceptions. |
| Names SOC 2Of these, 59 state Type II, 3 state Type I only and 16 do not state the type. | 78 of 212 | Ask which type, which trust criteria and which reporting period. |
| Names ISO/IEC 2700135 profiles name both SOC 2 and ISO/IEC 27001. | 79 of 212 | Ask for the certificate, its scope statement and the certification body. |
| States a provider, region, residency option or choice of region44 of the 73 profiles that describe a cloud-hosted service name no provider, region or residency option. | 42 of 212 | Ask where customer data is stored and processed, which provider hosts it, and whether you can choose or fix the region by contract. |
| States a choice of region or a residency option14 profiles contain a residency or storage-location statement. | 10 of 212 | Ask whether the option is on your plan, and whether backups and support access follow the same region. |
| Mentions a data processing agreement4 mention subprocessors; 17 contain any GDPR, DPA or subprocessor statement. | 4 of 212 | Ask for the agreement and the current subprocessor list before you sign, and how you are told about changes. |
| Says what can be exported at exit11 give a deletion or retention rule. | 4 of 212 | Ask for the exhaustive list of exportable data and attachments, the formats, the timing and what is deleted afterwards. |
The gaps are the point. 82 profiles name no certification, and fewer than one in ten mention a data processing agreement or an export at exit. A question that only asks "do you have it?" invites a yes that nobody can check, so ask for the document, its scope and its date.
Cut the list before you send it
A long list of requirements gets long, vague answers, and your team has to read all of them. Keep a requirement only if you can say who will check the answer and what you would do with a no. If the answer would not change your decision, take the question out.
Split what is left in two. Must-pass conditions are the few things that rule a product out if it cannot do them, such as a required sign-in method, a data location or an offline workflow. Everything else is a weighted preference. Check the must-pass conditions first and score the rest afterwards, so that a high score cannot make up for a failed condition.
An invented example: a team starts with 60 questions drawn from every section above. It keeps 9 as must-pass, 20 as weighted preferences and drops 31 that nobody could say how they would check or use. The 29 that remain are easier for a vendor to answer well and for the team to compare. Score the preferences with the vendor shortlist template and record observed results in the demo scorecard.
What a checkable answer looks like
Both answers below are invented and describe no vendor. They answer the same question: "Describe how we can export our data when the contract ends."
An answer you cannot check
"Yes, full data portability is supported. Customers can export their data at any time using standard formats."
It says nothing about which data, which formats, who runs it, how long it takes or what it costs, so every vendor can answer yes.
An answer you can test
"Administrators can export records, attachments, audit history and user lists as CSV and original files (Plan: Enterprise, version 14.2). Configuration is not exportable. A full export of a sample site completes within 24 hours. There is no charge. See the admin guide, section 9. Demonstrated on 12 November."
It names the data, the formats, the exclusion, the timing, the cost, the plan, the version, a document and a demonstration, so you can compare it with the next vendor's answer.
Sketch the schedule before you fill in the dates
Section 6 of the template lists the dates to fill in. This example shows one order they can take and which stages wait for another. Vendors with integrations or a security questionnaire to complete may need longer, so ask them how long they need before you fix the response date.
- Prepare
- Vendors
- Evaluate
- Decide
Text version of this diagram
- Draft and approve the RFP. Weeks 1 to 3. Owner: Procurement, process owner. Group: Prepare.
- Vendor questions and answers. Weeks 4 to 5. Owner: Procurement. Group: Vendors. Share every answer with all invited vendors.
- Vendors prepare responses. Weeks 4 to 7. Owner: Vendors. Group: Vendors.
- Score responses, set shortlist. Weeks 8 to 9. Owner: Evaluation panel. Group: Evaluate. Must-pass requirements first, then weighted preferences.
- Scripted demos. Weeks 10 to 11. Owner: Panel, vendors. Group: Evaluate.
- Pilot or trial, acceptance tests. Weeks 12 to 15. Owner: Panel, pilot users. Group: Evaluate.
- References, security and commercial review. Weeks 14 to 16. Owner: Procurement, IT. Group: Decide.
- Final decision. Week 17. Owner: Sponsor. Group: Decide.
Milestones
- RFP issued. Reached at the end of week 3.
- Responses due. Reached at the end of week 7.
- Shortlist notified. Reached at the end of week 9.
- Decision communicated. Reached at the end of week 17.
Dependencies
- Vendor questions and answers starts only after Draft and approve the RFP finishes.
- Vendors prepare responses starts only after Draft and approve the RFP finishes.
- Score responses, set shortlist starts only after Vendors prepare responses finishes.
- Scripted demos starts only after Score responses, set shortlist finishes.
- Pilot or trial, acceptance tests starts only after Scripted demos finishes.
- Final decision starts only after Pilot or trial, acceptance tests finishes.
- Final decision starts only after References, security and commercial review finishes.
Where the data, privacy and exit questions come from
The questions in sections 6 to 8 follow the wording of three primary texts, read on 18 October 2026: Article 28 of the GDPR (the processor contract: written authorisation for another processor, documented instructions, audits, deletion or return at the end of the service); Articles 23 to 29 of the EU Data Act (Regulation 2023/2854, applying from 12 September 2025); and the ITI VPAT page (the VPAT template, the ACR that is a VPAT completed for a product, and its four editions, 2.5Rev of April 2025).
Under Article 25 of the Data Act, a data processing service contract has to carry a maximum notice period for starting a switch of two months, a transitional period of no more than 30 calendar days, a data retrieval period of at least 30 calendar days, an exhaustive specification of the exportable data and a clause on erasure afterwards. Article 29 bars switching charges from 12 January 2027 and limits them to the provider's direct costs before then; the provider has to give the prospective customer clear information on service fees, early termination penalties and any reduced switching charges before the contract. Whether your product is a data processing service, and whether you are a customer in the Union, are questions for your own legal adviser. Its recitals name software as a service as one delivery model of data processing services.
This is an editorial template, not legal advice. We have not checked national rules, sector rules, or the AI Act, and a vendor's ACR is the vendor's own report: ask who tested it and how. The counts in the table are what the profiles say; none was tested.
For the questions that sit around these sections, see the pricing guide for the quote, the integration guide for interfaces and the AI guide for AI features.
RFP Best Practices
Be specific about must-haves vs nice-to-haves
Vendors need to know where they can't compromise. Use MoSCoW prioritization (Must, Should, Could, Won't).
Include realistic evaluation criteria weights
Agree and publish weights that reflect your workflow and budget before reviewing responses. Keep must-pass requirements separate from the weighted score.
Request a reference customer in your industry
Ask for 2-3 references of similar size and industry. Plan to actually call them — vendor demos only show the best case.
Keep the list short enough to answer
A long list of requirements produces long, vague answers. Mark the few must-pass conditions, say what context each one comes from, and drop the questions your team would not act on.
Ask for a working demo, not just slides
Request a live demo using a scenario from your actual operations. Prepared slideware doesn't reveal usability issues.
Not ready for a full RFP?
Start with our 2-minute quiz to identify which vendors to include in your shortlist.
Get Matched FirstRelated Guides
More related guides
- EHS Software Selection Checklist
Evaluation brief on an EHS software selection checklist.
- Unified QHSE vs Point Solutions: Build the Cost Case
Evaluation brief on unified QHSE versus point solutions.
- QHSE Technology: An Evaluation Brief
Evaluation brief on QHSE technology.
- All QHSE, EHS & ESG Software — A–Z
Directory of every researched product, in alphabetical order.
- Leaving a QHSE System: Data Export and EU Data Act Switching
Article on the exit and switching terms to settle before signing a QHSE software contract.