By Deb Mielke
Network World, 5/18/98

The most important thing to remember when you draft an RFP is "garbage out, garbage back." In other words, if your RFP is comprehensive and honest, the proposals you receive are likely to be comprehensive and honest, too. But outsourcing fails miserably when the customer and vendor are discovering information about each other during the term of the contract. Share as much information as you can with prospective vendors.

The following RFP outline is geared toward a virtual private network (VPN). Your RFP should include all of the following sections to ensure comprehensive and clear responses:

Section 1 - General information

• Executive summary. Describe your business, market position and revenue. Outline the business and technical reasons you're considering outsourcing.

• Scope. Outline the organization of the RFP document.

• Schedule of events. Provide a time line for the vendors, including the date of the RFP release, proposal deadline, vendor presentations, contract award and letter of intent. Also list your evaluation procedures and criteria.

• Introduction. Clearly define the expected proposal format, to whom and how the proposal should be delivered (including number of copies) and how questions regarding the RFP will be handled (will you publish all vendors' questions and your answers to all parties involved?)

• Letter of transmittal. Define the content of each responding vendor's cover letter. Require an officer of the company to sign the letter so you know the vendor's bid has management approval and backing.

• Content. Define the section layout of all vendor proposals. Ensuring consistent proposal format and content will save you time evaluating and comparing proposals.

As you get to the meat of the RFP, make sure to ask detailed questions to gain a comprehensive understanding of each vendor's service offering.

• General considerations. Provide an overview of your current environment. For example, you might include the number of telecommuters, geographic dispersion, applications, equipment, software, security, network infrastructure, network management, help desk and network service levels.

• Equipment specifications. Outline the specifications for the equipment you want the outsourcer to supply or manage. Do you have a particular vendor standard? VPN requirements might include ISDN terminal adapters, DSL equipment, small office/home office router, remote access concentrator, router and firewall.

• Software specifications. List the specifications for the software you want the outsourcer to supply or manage. This could include a Remote Authentication Dial-In User Service system, security client, router software and firewall software.

• Installation and project management. Outline your expectations for installation and project management. How long will the project last? Are the vendor's personnel qualified? Does the vendor have personnel in the geographic regions you require? What is the implementation time frame for new users?

• Configuration management. Outline your expectations for configuration management. How often are changes implemented? What are the vendor's "back-out" procedures should a configuration change go wrong? Are configurations stored in more than one location?

• Performance management. Outline your performance management requirements and reporting needs. What does your management expect from you? Make sure your requests are reasonable yet meet the needs of your business users. A VPN would include availability, latency, mean time to restore, utilization and Web-based management reports by region.

• Fault management. Define the faults for which you expect the vendor to assume responsibility. Defining boundaries of responsibility is critical, otherwise you and your vendor will be finger-pointing for the life of the contract. A vendor's response to this section will tell you how it manages networks, the vendor's network management infrastructure and the number and experience of network management personnel.

• Security management. Along with protecting your business from intrusion, security management is key to understanding how the vendor manages the security of your network. For a VPN, make sure you understand the exact level of security provided by encryption, key management, authentication, token cards and the vendor.

• Asset management. Because outsourcing implies giving up control of your network, make sure vendors have a plan for managing and tracking your assets. Poor asset management can lead to extended outages.

• Help desk. Network outsourcing and help desk support is tricky. Most vendors will only supply Level two and Level Three network support, which means your help desk needs to take the initial call, diagnose the problem and notify the vendor if the problem originated in the network. But it could be nearly impossible to diagnose whether a remote user is having a network problem vs. an application problem, so you may want to consider outsourcing first-level help desk services too.

• Maintenance. Find out who will actually provide hardware maintenance. Vendors of-ten use a subcontractor for these services, so be sure you understand the service-level agreements (SLA) between the vendor and its subcontractor.

• Provide your company's standard contract terms and conditions and reiterate the service levels you expect the vendor to meet.

• Include any information the vendor will require to complete its proposal, such as location addresses and telephone numbers, traffic volumes and depreciation schedules.