How to use this template
This template turns an enterprise search purchase into questions that every vendor answers the same way. It works for per-seat products such as Microsoft 365 Copilot, Glean or Amazon Quick Suite, and for a search system built in your own cloud. Fill in your scope in section 1, keep the scoring rules in section 2 and send sections 3 to 10 as the questions.
Each requirement has an ID so answers can be compared side by side. Ask for evidence with every answer, such as a screenshot, a document, a test result on your own content or a contract clause. Delete the rows that do not apply and add your own, but keep the IDs stable once the RFP is out.
A yes without evidence should score zero. The most useful evidence is a test on your own documents with your own test users, because a vendor's demo content is chosen to look good.
Section 1: Your scope (fill in before sending)
Vendors price and plan from this section, so a vague scope produces a vague quote. One line per item is enough. The examples show the level of detail that helps.
| Item | What to write | Example |
|---|---|---|
| Users in scope | Who will use search in year one and later | 1,200 employees in HR and IT in year one, all 4,000 employees by year three |
| First questions to answer | The group of questions that must work first | HR policy questions answered from the HR SharePoint site and the HR system |
| Source systems | Every system to search, with its owner and approximate size | SharePoint Online with 40,000 files, the ServiceNow knowledge base with 3,000 articles, a network file share with 120,000 files |
| Content that must never appear in answers | Restricted sites, sensitivity labels or folders | Board materials and anything labeled Highly Confidential |
| Identity provider | Where users and groups are managed | Microsoft Entra ID with nested security groups |
| Data residency | Where content, indexes and logs may be stored and processed | EU regions only |
| Languages | Languages of the content and of the questions | English and German |
| Expected usage | Questions per user per day and peak hours | About 3 questions per user per workday, peaking on Monday mornings |
| Timeline | Decision date and target date for first production use | Decision in eight weeks, first group of questions live within a quarter |
| Budget model | Per seat, usage-based, fixed build price or open | Open, compared on three-year cost |
Section 2: How to answer and how we score
Ask vendors to answer every row with one of the codes below, followed by the evidence. Score each section out of 5 by averaging its rows, then apply the weights. The weights are a starting point, so move them to match what matters most to you.
| Code | Meaning | Score |
|---|---|---|
| A | Available today in the product or design being offered, shown with evidence | 5 |
| C | Available with configuration by us or the vendor, with the effort stated | 4 |
| P | Needs a partner or custom work, with the cost and owner stated | 2 |
| R | On the roadmap with a committed date | 1 |
| N | Not available | 0 |
| Section | Weight |
|---|---|
| 3. Connectors and permissions | 20% |
| 4. Security and data residency | 15% |
| 5. Relevance and citations | 20% |
| 6. Admin and analytics | 10% |
| 7. AI features and model choice | 10% |
| 8. Pricing model and total cost | 10% |
| 9. Implementation and acceptance criteria | 10% |
| 10. Exit terms | 5% |
Section 8 scores how clear and complete the pricing answers are. Compare the actual three-year totals side by side after scoring, so a cheap product with weak permissions cannot win on price alone.
Section 3: Connectors and permissions
Permissions decide whether AI search is safe to switch on. Every answer has to respect what the person asking may open in the source system, including access that changed yesterday.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| CP-1 | List the connector for each source system in our scope. For each one, say whether you build and support it, a partner does, or it must be custom built. | Connector list with the support owner for each |
| CP-2 | Are document permissions copied into the index at indexing time, checked against the source when the question is asked, or both? | Architecture description |
| CP-3 | How long does a permission change in a source system take to reach search results and answers? | Measured delay from a test in our tenant |
| CP-4 | Do you support nested groups, sharing links and item-level permissions in each source system? | Test result with our test users |
| CP-5 | How are deleted documents and revoked access removed from the index, from cached answers and from conversation history? | Documented deletion path with timings |
| CP-6 | How often does each connector refresh, and does it crawl incrementally? How do you handle API throttling in the source system? | Refresh schedule for each connector |
| CP-7 | Can administrators exclude sites, folders or sensitivity labels from indexing? | Admin console screenshot |
| CP-8 | What service accounts and permission scopes does each connector need? | Permission list for each connector |
| CP-9 | If we need a connector you do not have, who builds it, who maintains it and what does it cost? | Connector SDK or API documentation and a price |
Section 4: Security and data residency
Ask where every copy of your content goes, including the index, cached answers, logs and the calls to the language model. Each of them is a copy you have to govern.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| SR-1 | Name the cloud provider and regions where our content, index, cached answers and logs are stored and processed, including calls to language models. | Data flow diagram with regions |
| SR-2 | Can the index and all content stay inside our own cloud subscription or tenant? | Deployment options document |
| SR-3 | Are our content, prompts or answers used to train or improve any model, by you or by a model provider? | Contract clause |
| SR-4 | Is data encrypted at rest and in transit? Do you support customer-managed keys? | Security documentation |
| SR-5 | Do you support single sign-on with our identity provider, SCIM provisioning and conditional access? On which plan? | Plan comparison showing each feature |
| SR-6 | What is logged for each question, such as the user, the question, the answer and the sources shown? How long is it kept, and can we export it to our SIEM? | Sample log record |
| SR-7 | Which independent security reports can you share under NDA, such as a SOC 2 Type II report, an ISO 27001 certificate or a penetration test summary? | The reports |
| SR-8 | List your subprocessors, including model providers, and the notice you give before adding one. | Subprocessor list |
| SR-9 | How do you defend against instructions hidden inside indexed documents, and how do you handle personal data in answers? | Design notes and a test result |
Section 5: Relevance and citations
Relevance is the part every demo gets right and many rollouts get wrong. Test it on your own content, with the questions your employees really ask.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| RC-1 | Describe the retrieval method, for example keyword, vector or hybrid search, and any reranking. | Architecture description |
| RC-2 | Does every generated answer link to the document and passage it came from? | Screenshot of an answer with citations |
| RC-3 | What happens when the sources do not answer the question? | Results on our unanswerable questions |
| RC-4 | Run our evaluation set of real questions with known answers. Report how many answers are correct and how many cite the right source. | Scored results on our evaluation set |
| RC-5 | How do you rank the newest version of a document above older copies and duplicates? | Test on our versioned documents |
| RC-6 | Which tuning controls do administrators have, such as synonyms, boosts, promoted results and source weighting? | Admin console screenshots |
| RC-7 | Which languages are supported for content and for questions? Can a question in one language find content written in another? | Language support list and a test |
| RC-8 | Can you search scanned PDFs, tables and text inside images? | Test on our sample files |
Build the evaluation set before any vendor sees it: 50 to 100 real questions, the correct answer and source document for each, and about 20 questions your content cannot answer. Keep a copy and use the same set for every vendor.
Section 6: Admin and analytics
Search improves when content owners can see what people asked and did not find. Ask for the reports, not a description of them.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| AA-1 | What admin roles exist, and can we delegate the administration of a source to its content owner? | Role list |
| AA-2 | Do you report on top questions, questions with no good answer and answer feedback? | Sample report |
| AA-3 | Can content owners see the gaps in their own sources? | Screenshot |
| AA-4 | Do you report active users by department, so we can right-size licenses? | Sample report |
| AA-5 | Can we export analytics through an API? | API documentation |
| AA-6 | How do you announce product and model changes, and can we test them before they reach our users? | Release process description |
Section 7: AI features and model choice
Model choice affects answer quality, data handling and cost. Ask who chooses the model, who can change it and what limits apply to each user.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| AI-1 | Which language models write the answers? Can we choose the model, or use a model deployment in our own cloud? | Model list and configuration options |
| AI-2 | How much notice do you give before changing the default model, and can we stay on the current one while we test? | Contract clause or written policy |
| AI-3 | Which actions can the system take, such as opening a ticket or filling in a form? How is each action confirmed and permission-checked? | Demo in our test tenant |
| AI-4 | Are there per-user limits on AI use, such as weekly caps on reasoning queries or credit allowances? What happens when a user reaches them? | Plan limits in writing |
| AI-5 | Can other applications and agents query the index through an API or MCP server with the same permission checks? How are those calls priced? | API documentation and price |
| AI-6 | Can answers be restricted to approved sources for a given group of questions? | Configuration screenshot |
Section 8: Pricing model and total cost of ownership
Ask for list price and offered price separately, and for every usage meter. Several vendors bill index capacity, AI credits, agent hours or API calls on top of the seat, and those meters are where three-year costs drift.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| PT-1 | State the price per user per month at our user count, the list price it is discounted from, the billing term and any minimum seat count. | Price sheet |
| PT-2 | List every usage meter, such as queries, credits, agent hours, API calls, index size or connector hours, with the included allowance and the unit price above it. | Price sheet |
| PT-3 | Is there a per-query fee for any part of the service? If so, at what volume does it start? | Price sheet |
| PT-4 | Which features need a higher plan or an add-on, such as single sign-on, SCIM, specific connectors, advanced permissions, analytics or API access? | Plan comparison |
| PT-5 | What do implementation services cost, are they fixed price or time and materials, and what do they include? | Statement of work |
| PT-6 | What is the cap on price increases at renewal, and are added seats priced at the same rate? | Contract clause |
| PT-7 | Which base licenses or other products must we already own? | Prerequisite list |
| PT-8 | For a build in our cloud, estimate the monthly cloud bill for search, model usage and hosting from our document and question volumes, with the assumptions shown. | Cost estimate with assumptions |
| Cost line | Year 1 | Year 2 | Year 3 | Assumption used |
|---|---|---|---|---|
| Seats or subscriptions | ||||
| Usage meters such as queries, credits, agent hours and API calls | ||||
| Index or storage | ||||
| Connectors and add-ons | ||||
| Implementation and services | ||||
| Model usage and hosting on our cloud bill, if any | ||||
| Support plan | ||||
| Total |
Before comparing, add your own internal costs to each vendor's table: content and permissions clean-up, plus your team's rollout and admin hours. Our worked estimate at October 2026 list prices, with every assumption shown, is at querynow.com/enterprise-search-tco.
Section 9: Implementation and acceptance criteria
Agree how success will be tested before the rollout or build starts, and sign it. Criteria written after go-live tend to describe whatever was delivered.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| IA-1 | Give the plan to first production use for our first group of questions, with named roles on both sides. | Project plan |
| IA-2 | What must our team provide, such as access, test users and content owners, and how many hours do you expect from us? | Customer responsibilities list |
| IA-3 | Will you sign pass-fail acceptance criteria before the work starts, tested on our evaluation set? | Signed criteria |
| IA-4 | Is any payment tied to passing the acceptance criteria? What happens if a criterion fails? | Contract clause |
| IA-5 | If there is a pilot, state its length, user count, cost and how it converts to a contract. | Pilot terms |
| IA-6 | What support do we get after go-live, including response times, a named contact and the hours covered? | Support terms |
| Criterion | How it is tested | Pass condition |
|---|---|---|
| Answers are correct | Run the agreed evaluation set of 100 real questions | At least 90 answers judged correct by the named content owner |
| Citations support the answer | A reviewer opens every cited link from the evaluation run | At least 95 of 100 citations open a passage that supports the answer |
| No restricted content leaks | A test user without access asks 25 questions whose answers sit in restricted content | 0 of 25 answers contain or cite restricted content |
| Unanswerable questions are declined | Ask 20 questions the content cannot answer | 20 of 20 answers say the sources do not answer the question |
| Permission changes take effect | Remove a test user from a group, then repeat a question | Restricted content stops appearing within the agreed time |
| Response time | Time the evaluation run at the agreed number of concurrent users | 95% of answers start within 5 seconds |
The numbers are placeholders to agree with each vendor, and none of them is a benchmark. Our acceptance criteria template at querynow.com/resources/templates/acceptance-criteria-template explains how to write each row so it can only pass or fail.
Section 10: Exit terms
Exit terms are easiest to negotiate before you sign. Ask what you get back, what gets deleted and who owns what was built for you.
| ID | Requirement or question | Evidence to ask for |
|---|---|---|
| EX-1 | Can we export our configuration, synonyms, analytics and conversation logs in a documented format at no extra cost? Within how many days? | Contract clause and export format |
| EX-2 | Will you delete our content, index, embeddings and logs at termination and confirm it in writing? Within how many days? | Contract clause |
| EX-3 | Who owns custom connectors, prompts, configuration and code built for us? | Contract clause |
| EX-4 | What notice is needed to terminate, and are prepaid fees refunded? | Contract clause |
| EX-5 | What transition help do you offer, and at what rate? | Rate card |
| EX-6 | What notice do you give if the product is retired or merged into another product, or if your company is acquired? | Contract clause |
| EX-7 | For a build in our cloud, is all code in our repository, with infrastructure as code and a runbook our team can operate? | Repository access and runbook |
Before you send it
- Fill in every row of section 1, because vendors quote against it.
- Build and freeze your evaluation set and test users before any demo.
- Set the answer deadline and the date of the test on your content.
- Decide who scores each section, and score before you compare prices.
- Ask each vendor to complete the three-year cost table in section 8 in full, with usage meters priced at your expected volume.
If you include QueryNow, we answer as a builder. We build permission-aware search agents in your own Azure or AWS account, one workflow at a time, in two weeks. You pay $10,000 for a workflow only after it passes the acceptance criteria you signed, and model usage and hosting run on your own cloud bill.