Generator

Vendor checklist and RFP generator

Written from the HRM Maturity Model 2.0, the open standard Living Security publishes under CC BY 4.0.

Hands-on · RFP generator

Vendor checklist and RFP questions, written from the framework.

Tap the level you want to reach, the practices that matter, the risk domains in scope and the sources you already run. Every requirement, weight and question comes from the HRM Maturity Model 2.0. Export takes one field.

Target levelWhere the program should be at the end of the contract

Threat, access and behavior are joined per person; the riskiest cohorts are known and targeted.

Practices that matter mostSix practices of the model; all on by default

Risk domains in scopeNine domains of the taxonomy

Data sources you already runThe standard set is on; each adds a coverage requirement

Must-havesEach one adds a must requirement

Assumptions

Weight of a must requirementAssumption. A must is worth three shoulds so a vendor cannot make up a missing must with extras.Weight of a should requirementAssumption. One point keeps the next level visible without deciding the ranking.Criteria one level below the target are mustAssumption. The model is cumulative: a level 3 program also meets level 2.Criteria one level above the target are shouldAssumption. The next level is where the program goes in the contract term.Every level from 2 up to the target is mustAssumption. Off by default; turn on to list the whole ladder instead of the target and the level below.Vendor score scale, 0 to this numberAssumption. 0 absent, 1 roadmap, 2 partial, 3 shown in a demo on your data.

Fixed by the model

Level 1, Counting, generates no requirements. Its criteria describe a program before human risk management (completion and click counts only), so there is nothing a solution must deliver.

Evidence requests come from the model. Each question asks for an item from the evidence list of the same practice and level in the HRM Maturity Model 2.0.

Source coverage uses the framework’s signal list. The count per source is the number of the 137 signals the HRM Taxonomy computes from that source.

Requirements

level 3, Connecting

Must

weight 3

Should

weight 1

RFP questions

max score 600

Generated from the HRM Maturity Model 2.0 (CC BY 4.0). How the model works.

Exports need a work email. The link does not.

Scored checklist

Preview. Score each row 0 to 3 after the vendor demo; weighted = weight × score.

Scored checklist preview: requirement, practice, level, type, weight and an empty score column
#	Requirement	Practice	Level	Type	Weight	Your score (0–3)
R-001	Reported simulations and reported real emails are counted per person and per team.	See	L2	must	3	0123
R-002	Behaviors from at least two risk domains are measured, for example simulation clicks and MFA enrollment.	See	L2	must	3	0123
R-003	Privileged and sensitive access is listed from directory groups and refreshed at least quarterly.	See	L2	must	3	0123
R-004	Every reported number has a named source and a refresh date.	See	L2	must	3	0123
R-005	Threat, access and behavior signals are joined per person on one identifier from the HR system.	See	L3	must	3	0123
R-006	Phishing simulation results are joined to real-phishing targeting data per person.	See	L3	must	3	0123
R-007	Signals cover at least four risk domains, including social engineering and identity and access.	See	L3	must	3	0123
R-008	Each signal has a dwell window, and a source silent for more than seven days marks its signals unknown.	See	L3	must	3	0123
R-009	Signals from five or more risk domains refresh at least daily.	See	L4	should	1	0123
R-010	Ordered signal sequences, for example real phish delivered, link clicked, new MFA device inside 72 hours, are detected inside their window.	See	L4	should	1	0123

RFP questions by practice

92 questions, each with the evidence to request

See · Which signals can you see, for whom, and how fresh are they?18

Q-001
Describe how the solution ensures that reported simulations and reported real emails are counted per person and per team.
Provide: a per-team behavior scorecard with its refresh date
must · weight 3 · level 2
Q-002
Describe how the solution ensures that behaviors from at least two risk domains are measured, for example simulation clicks and MFA enrollment.
Provide: the directory export of privileged accounts with the date it was pulled
must · weight 3 · level 2
Q-003
Describe how the solution ensures that privileged and sensitive access is listed from directory groups and refreshed at least quarterly.
Provide: the source inventory with refresh cadence
must · weight 3 · level 2
Q-004
Describe how the solution ensures that every reported number has a named source and a refresh date.
Provide: a per-team behavior scorecard with its refresh date
must · weight 3 · level 2
Q-005
Describe how the solution ensures that threat, access and behavior signals are joined per person on one identifier from the HR system.
Provide: a per-person record that shows threat, access and behavior fields side by side
must · weight 3 · level 3
Q-006
Describe how the solution ensures that phishing simulation results are joined to real-phishing targeting data per person.
Provide: the signal list with source and dwell window per signal
must · weight 3 · level 3
Q-007
Describe how the solution ensures that signals cover at least four risk domains, including social engineering and identity and access.
Provide: the staleness report for the last 30 days
must · weight 3 · level 3
Q-008
Describe how the solution ensures that each signal has a dwell window, and a source silent for more than seven days marks its signals unknown.
Provide: a per-person record that shows threat, access and behavior fields side by side
must · weight 3 · level 3
Q-009
Describe how the solution ensures that signals from five or more risk domains refresh at least daily.
Provide: the sequence detection list with window and last firing date
should · weight 1 · level 4
Q-010
Describe how the solution ensures that ordered signal sequences, for example real phish delivered, link clicked, new MFA device inside 72 hours, are detected inside their window.
Provide: the AI use report by team
should · weight 1 · level 4
Q-011
Describe how the solution ensures that AI tool use per person is measured, split by corporate and personal accounts.
Provide: the agent inventory with owner, scopes and last attestation date
should · weight 1 · level 4
Q-012
Describe how the solution ensures that AI agents and service identities are inventoried with a named human owner and their scopes.
Provide: the sequence detection list with window and last firing date
should · weight 1 · level 4
Q-073
Describe how the solution ingests signals from Awareness & phishing simulation: which of the 23 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: a per-person record that shows threat, access and behavior fields side by side
must · weight 3 · level 3
Q-074
Describe how the solution ingests signals from Identity provider & MFA: which of the 17 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: the signal list with source and dwell window per signal
must · weight 3 · level 3
Q-075
Describe how the solution ingests signals from Email security: which of the 14 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: the staleness report for the last 30 days
must · weight 3 · level 3
Q-076
Describe how the solution ingests signals from Endpoint protection: which of the 8 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: a per-person record that shows threat, access and behavior fields side by side
must · weight 3 · level 3
Q-077
Describe how the solution ingests signals from HR system: which of the 3 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: the signal list with source and dwell window per signal
must · weight 3 · level 3
Q-078
Describe how the solution ingests signals from Pulse survey: which of the 6 signals in the framework it computes, the connector it uses and the refresh cadence.
Provide: the staleness report for the last 30 days
must · weight 3 · level 3

Understand · How do you decide who needs attention, and what tells you the decision was right?12

Q-013
Describe how the solution ensures that each person and team has a behavior scorecard refreshed on a fixed cadence.
Provide: a team scorecard
must · weight 3 · level 2
Q-014
Describe how the solution ensures that repeat clickers and non-reporters are listed as named groups.
Provide: the repeat clicker list with dates
must · weight 3 · level 2
Q-015
Describe how the solution ensures that priorities are set from simulation results and report rates.
Provide: the last incident summary the SOC shared
must · weight 3 · level 2
Q-016
Describe how the solution ensures that the SOC shares human-related incidents with the program after major events.
Provide: a team scorecard
must · weight 3 · level 2
Q-017
Describe how the solution ensures that cohorts that combine threat, access and behavior, for example targeted people who click and hold payment authority, are named, counted and trended.
Provide: the cohort list with current size and trend
must · weight 3 · level 3
Q-018
Describe how the solution ensures that breach scenarios are ranked by the organization’s own incident counts from the last 12 months.
Provide: the breach scenario ranking with SOC incident counts
must · weight 3 · level 3
Q-019
Describe how the solution ensures that each person has a stage from Clear to Confirmed, computed from their active signals.
Provide: the stage distribution for the workforce
must · weight 3 · level 3
Q-020
Describe how the solution ensures that the riskiest cohorts are reviewed with the SOC on a fixed cadence.
Provide: the cohort list with current size and trend
must · weight 3 · level 3
Q-021
Describe how the solution ensures that incident lift is measured for each cohort and sequence: the incident rate inside against the rest of the workforce.
Provide: the lift table for the last four quarters
should · weight 1 · level 4
Q-022
Describe how the solution ensures that cohorts and sequences with no lift after two quarters are retired, and new ones are proposed from incident reviews.
Provide: the sequence detection log
should · weight 1 · level 4
Q-023
Describe how the solution ensures that a detected sequence is routed to the SOC with the person’s context inside its window.
Provide: the list of retired and new cohorts with reasons
should · weight 1 · level 4
Q-024
Describe how the solution ensures that AI use and AI agent cohorts are ranked alongside people cohorts.
Provide: the lift table for the last four quarters
should · weight 1 · level 4

Act · What changes when risk is found, how fast, and who or what makes the change?12

Q-025
Describe how the solution ensures that a risky action (a click, weak MFA, an unsanctioned app) triggers a nudge or follow-up content inside a set number of days.
Provide: the nudge log for the last quarter
must · weight 3 · level 2
Q-026
Describe how the solution ensures that control changes such as an MFA reset or an access review are made by manual request, case by case.
Provide: the share of behavior-triggered content
must · weight 3 · level 2
Q-027
Describe how the solution ensures that behavior-triggered content is a measured share of all content delivered.
Provide: the list of manual control requests and their outcome
must · weight 3 · level 2
Q-028
Describe how the solution ensures that each nudge is logged per person with a timestamp.
Provide: the nudge log for the last quarter
must · weight 3 · level 2
Q-029
Describe how the solution ensures that campaigns and simulations target named cohorts, and the whole-workforce schedule is smaller than a year ago.
Provide: the playbook documents
must · weight 3 · level 3
Q-030
Describe how the solution ensures that playbooks exist as written documents with trigger, audience, action, owner and time limit.
Provide: the time-to-action report per playbook
must · weight 3 · level 3
Q-031
Describe how the solution ensures that time from signal to action is measured per playbook.
Provide: the targeting list of the last campaign
must · weight 3 · level 3
Q-032
Describe how the solution ensures that at least one playbook changes a control (step-up MFA, access review, DLP policy) through a manual request.
Provide: the playbook documents
must · weight 3 · level 3
Q-033
Describe how the solution ensures that playbooks change controls automatically for defined cohorts: step-up MFA, access removal, DLP policy, device quarantine.
Provide: the automation log for the last month
should · weight 1 · level 4
Q-034
Describe how the solution ensures that median time from signal to action is reported against a target the program set.
Provide: the median time-to-action report
should · weight 1 · level 4
Q-035
Describe how the solution ensures that every automated action is logged with the subject, trigger, action and reversal path.
Provide: the reversal list with counts
should · weight 1 · level 4
Q-036
Describe how the solution ensures that an AI agent acting outside its declared scope is paused by a playbook, and its owner is notified.
Provide: the automation log for the last month
should · weight 1 · level 4

Prove · Can you show, with your own numbers, that risk went down?12

Q-037
Describe how the solution ensures that behavior trends are reported quarter over quarter per team.
Provide: the last two quarterly reports
must · weight 3 · level 2
Q-038
Describe how the solution ensures that report rate is reported next to click rate.
Provide: the distribution list
must · weight 3 · level 2
Q-039
Describe how the solution ensures that the CISO receives the report on a fixed cadence.
Provide: the last two quarterly reports
must · weight 3 · level 2
Q-040
Describe how the solution ensures that program reach (people, content, nudges) is reported.
Provide: the distribution list
must · weight 3 · level 2
Q-041
Describe how the solution ensures that stage 3+ people per priority breach scenario are reported with a trend.
Provide: the quarterly report with stage and cohort pages
must · weight 3 · level 3
Q-042
Describe how the solution ensures that cohort sizes are reported against targets the CISO set.
Provide: the crosswalk from metrics to framework outcomes
must · weight 3 · level 3
Q-043
Describe how the solution ensures that time from signal to action is reported per playbook.
Provide: the quarterly report with stage and cohort pages
must · weight 3 · level 3
Q-044
Describe how the solution ensures that program metrics are mapped to NIST CSF 2.0 outcomes or to another framework the organization follows.
Provide: the crosswalk from metrics to framework outcomes
must · weight 3 · level 3
Q-045
Describe how the solution ensures that incident lift of the top patterns is reported each quarter.
Provide: the quarterly executive report
should · weight 1 · level 4
Q-046
Describe how the solution ensures that avoided loss is estimated with a method finance agreed to, and the method is published with the number.
Provide: the avoided-loss method sign-off from finance
should · weight 1 · level 4
Q-047
Describe how the solution ensures that training hours saved by targeting are reported.
Provide: the lift table
should · weight 1 · level 4
Q-048
Describe how the solution ensures that security NPS and perceived friction rate are reported against targets.
Provide: the quarterly executive report
should · weight 1 · level 4

Govern · Who owns human risk, and what decision rights, budget and policy do they hold?26

Q-049
Describe how the solution ensures that a written charter names the owner, scope and reporting cadence.
Provide: the charter
must · weight 3 · level 2
Q-050
Describe how the solution ensures that the GRC lead co-owns the program and maps it to the control framework.
Provide: the AI acceptable-use policy with its acknowledgment rate
must · weight 3 · level 2
Q-051
Describe how the solution ensures that an AI acceptable-use policy is published and acknowledged by the workforce.
Provide: the exception register
must · weight 3 · level 2
Q-052
Describe how the solution ensures that policy exceptions are recorded with an owner and an expiry date.
Provide: the charter
must · weight 3 · level 2
Q-053
Describe how the solution ensures that human risk is owned by CISO staff with the SOC as a standing partner.
Provide: minutes of the last three reviews
must · weight 3 · level 3
Q-054
Describe how the solution ensures that a monthly review includes IT, HR and the SOC, and its decisions are recorded.
Provide: the target list
must · weight 3 · level 3
Q-055
Describe how the solution ensures that each priority cohort has a target approved by the CISO.
Provide: the agent ownership policy
must · weight 3 · level 3
Q-056
Describe how the solution ensures that policy requires a named human owner for every AI agent and service identity.
Provide: minutes of the last three reviews
must · weight 3 · level 3
Q-057
Describe how the solution ensures that a named executive forum (CISO with IT, HR and Finance) holds decision rights over the controls that playbooks change.
Provide: the forum’s terms of reference
should · weight 1 · level 4
Q-058
Describe how the solution ensures that a human risk appetite statement exists and is reviewed each year.
Provide: the risk appetite statement
should · weight 1 · level 4
Q-059
Describe how the solution ensures that each automated action has a privacy review on file, including works-council or employee notice where required.
Provide: the privacy review file
should · weight 1 · level 4
Q-060
Describe how the solution ensures that the AI agent lifecycle (approval, scope, attestation, retirement) is policy with a named owner.
Provide: the forum’s terms of reference
should · weight 1 · level 4
Q-079
Describe how the solution supports human risk ownership.
Provide: minutes of the last three reviews
should · weight 1 · level 3
Q-080
Describe how the solution supports HR data-use agreement.
Provide: the target list
should · weight 1 · level 3
Q-081
Describe how the solution supports person-level data governance.
Provide: the agent ownership policy
should · weight 1 · level 3
Q-082
Describe how the solution supports board reporting.
Provide: minutes of the last three reviews
should · weight 1 · level 3
Q-083
Describe how the solution supports risk register entry.
Provide: the target list
should · weight 1 · level 3
Q-084
Describe how the solution supports consent and privacy basis.
Provide: the agent ownership policy
should · weight 1 · level 3
Q-085
Describe how the solution supports standards crosswalk.
Provide: minutes of the last three reviews
should · weight 1 · level 3
Q-086
Describe how the solution supports NIST CSF tier.
Provide: the target list
should · weight 1 · level 3
Q-087
Describe how the solution supports implementation group.
Provide: the agent ownership policy
should · weight 1 · level 3
Q-088
Describe how the solution supports audit evidence.
Provide: minutes of the last three reviews
should · weight 1 · level 3
Q-089
Describe how the solution supports policy exception.
Provide: the target list
should · weight 1 · level 3
Q-090
Describe how the solution supports insider risk.
Provide: the agent ownership policy
should · weight 1 · level 3
Q-091
Describe how the solution supports third-party risk.
Provide: minutes of the last three reviews
should · weight 1 · level 3
Q-092
Describe how the solution supports learning program.
Provide: the target list
should · weight 1 · level 3

Culture · Do people report, ask for help, and tell you the truth about friction?12

Q-061
Describe how the solution ensures that an annual survey measures attitudes to security.
Provide: the last survey results
must · weight 3 · level 2
Q-062
Describe how the solution ensures that reports of suspicious activity are counted per month, and the report rate is below the click rate.
Provide: the monthly report count
must · weight 3 · level 2
Q-063
Describe how the solution ensures that a help channel exists and each request is logged.
Provide: the help channel log
must · weight 3 · level 2
Q-064
Describe how the solution ensures that people who report are recognized.
Provide: the last survey results
must · weight 3 · level 2
Q-065
Describe how the solution ensures that a quarterly pulse measures security NPS, perceived friction and confidence, with a participation target.
Provide: the pulse results by team
must · weight 3 · level 3
Q-066
Describe how the solution ensures that report rate exceeds click rate across the workforce.
Provide: the champion roster
must · weight 3 · level 3
Q-067
Describe how the solution ensures that each business unit has a named security champion with a monthly brief.
Provide: the request count by quarter
must · weight 3 · level 3
Q-068
Describe how the solution ensures that requests to security before a team builds something are counted per quarter.
Provide: the pulse results by team
must · weight 3 · level 3
Q-069
Describe how the solution ensures that pulse results are joined to behavior results per team, so teams with high friction and low reporting are visible.
Provide: the friction-by-team view next to reporting
should · weight 1 · level 4
Q-070
Describe how the solution ensures that policies are co-created with employee feedback, and the count is tracked.
Provide: the co-created policy list
should · weight 1 · level 4
Q-071
Describe how the solution ensures that role-based guidance for AI use exists for developers, finance and customer-facing teams, with output checking measured in the pulse.
Provide: the role-based AI guidance pages
should · weight 1 · level 4
Q-072
Describe how the solution ensures that targeted people report real phishing inside the time target the program set.
Provide: median time to first report of real phishing
should · weight 1 · level 4

Next step

See each row answered on a demo environment.

Bring the checklist. We score the Living Security Platform against it live, row by row, on the demo environment.

Book a demo

Generated from the HRM Maturity Model 2.0.0 (CC BY 4.0). Methodology.

Vendor checklist and RFP generator

Vendor checklist and RFP questions, written from the framework.

Scored checklist

RFP questions by practice

Get the checklist and questions by email

See each row answered on a demo environment.