1. For Web Application Security Projects.
OWASP RFP Criteria.
For Web Application Security Projects.

2. Table of Contents. 3. Recommended RFP Questions 1. Introduction
2. Recommended Information the Client should provide to Service Providers/Vendors.
3. Recommended RFP Questions

3. 1. Introduction

4. Introduction:
A Request For Proposal, (RFP) is a call made by an organization soliciting for bids by service providers or vendors to meet a need and it is often done by documents.
The information provided in RFPs are important and when you create an RFP for an Application Security Verification project , emphasis should be on providing clear information about the scope of verification activities and evaluation criteria so prospective service providers and vendors can submit proposals that are comparable.
References.
An empirical study on the use of the Generic Security Template for structuring the lessons from information security incidents By Ying He, Chris Johnson,Karen Renaud ,Yu Lu and Salem Jebriel. School of Computing Science University of Glasgow,Glasgow, UK
URL:

5. 2. Recommended Information the Client should provide to Service Providers/Vendors.

6. Provide details about:
Lines of Code
Number of Dynamic Pages.
An Inventory of user roles and role descriptions.
Brief Application Summary and Application Architecture.
Degree of Verification Required.
The frequency or duration for performing verification.
References.
An empirical study on the use of the Generic Security Template for structuring the lessons from information security incidents By Ying He, Chris Johnson,Karen Renaud ,Yu Lu and Salem Jebriel. School of Computing Science University of Glasgow,Glasgow, UK
URL:

7. 2. Recommended RFP Questions.

8. Number of Dynamic Pages.
Ask Service Providers/Vendors to Provide details on:
Lines of Code
Number of Dynamic Pages.
An Inventory of user roles and role descriptions.
Brief Application Summary and Application Architecture.
Degree of Verification Required.
The frequency or duration for performing verification.
References.
An empirical study on the use of the Generic Security Template for structuring the lessons from information security incidents By Ying He, Chris Johnson,Karen Renaud ,Yu Lu and Salem Jebriel. School of Computing Science University of Glasgow,Glasgow, UK
URL:

9. Application Security Verification Methodology. Security Coverage.
Ask Service Providers/Vendors to Provide details on:
Company Background.
Application Security Verification Methodology.
Security Coverage.
Application Coverage.
Risk Evaluation.
Differentiators.
Scope.
Security.
References.
An empirical study on the use of the Generic Security Template for structuring the lessons from information security incidents By Ying He, Chris Johnson,Karen Renaud ,Yu Lu and Salem Jebriel. School of Computing Science University of Glasgow,Glasgow, UK
URL:

10. Client Support Details. Pricing/Licensing Information.
Ask Service Providers/Vendors to Provide details on:
Burden.
Reporting Interface.
Innovation.
Integration.
Benefits.
Supporting Services. .
Client Support Details.
Pricing/Licensing Information.
References.
An empirical study on the use of the Generic Security Template for structuring the lessons from information security incidents By Ying He, Chris Johnson,Karen Renaud ,Yu Lu and Salem Jebriel. School of Computing Science University of Glasgow,Glasgow, UK
URL: