Disaster Recovery & Backup RFP Template Builder

1. Background

[Organisation name] is inviting proposals for the provision of backup, data protection and disaster recovery services. This document sets out our background, the environment to be protected, the scope of services required, the service levels we are buying against, and how responses will be evaluated (reference DR-RFP-2026-001).

The driver for going to market is: Existing contract expiry. We are looking for a provider who can demonstrate recovery, not describe it.

All communication regarding this request must be directed through the primary contact above. Providers must not approach other members of staff in connection with this procurement.

2. Current environment

The figures below describe the estate as currently understood and will be confirmed during due diligence. Vague inputs produce padded prices and later change requests, so where a figure is an estimate we have said so. Providers must state clearly any assumption their pricing depends on.

Questions for providers

1. Describe the due diligence you would carry out to validate these figures, and what you need from us to do it.
2. State anything in the environment above you would treat as out of scope, and why.
3. Confirm how growth in protected data is handled commercially over the contract term.

3. Scope of services

The following services are explicitly in scope and must be priced individually as well as in total.

• Backup as a service - Backup of virtual machines, physical servers and file data, with monitoring and reporting.
• Offsite / immutable copy - A second copy held away from production, immutable and outside the production identity domain.
• Replication for DR - Continuous or scheduled replication of tier one workloads to the recovery target.
• DR as a service (failover capability) - Provider-hosted recovery capacity with a contracted failover capability.
• Runbook design and maintenance - Documented recovery order, dependencies and named owners, kept current.
• DR testing and evidence - Scheduled test failovers with written evidence suitable for audit.
• Microsoft 365 / SaaS backup - Mail, OneDrive, SharePoint and Teams data protected independently of the SaaS platform.
• Invocation and crisis support - Named crisis contacts, declaration process and support during a live invocation.
• 24x7 monitoring of protection jobs - Proactive alerting and remediation of failed jobs, not just a monthly report.

Explicitly out of scope

• Endpoint and remote user protection
• Cyber recovery / clean room
• Exit and data handback
• Application-level remediation and code fixes following a recovery.
• Third-party software licensing not stated in the pricing schedule.

Security and compliance requirements

The provider must comply with the following for the duration of the contract, and supply current certification evidence with their response.

• ISO 27001
• ISO 22301 (business continuity)
• Cyber Essentials Plus
• UK GDPR / Data Protection Act 2018

At least one copy of our data must be immutable for a minimum of 30 days, held outside our production identity domain, and not deletable by any single administrator acting alone.

Questions for providers

1. Confirm, line by line, that each in-scope service is included in your standard offering, or state where it is delivered by a third party.
2. Confirm where our data would be stored, processed and accessed from, including by any subcontractor.
3. Describe how immutability is enforced, who is technically able to shorten a retention lock, and what evidence of that we would receive.
4. Describe your process for recovering into a clean environment after a ransomware event, including how backups are scanned before restore.

4. Service levels

Recovery objectives are set by tier. Tier one covers the systems the business cannot operate without for a working morning; tier two covers everything else in scope. Hours of cover for the service are 24x7x365.

Questions for providers

1. Confirm you can meet each service level above, or propose an alternative with the reasoning.
2. State your service credit regime, including what happens after repeated failures, and whether credits are automatic or must be claimed.
3. Walk through what actually happens when we declare a disaster at 02:00 on a Sunday, naming the roles involved at each step.
4. Give an example of a recovery objective you missed in the last year and what changed as a result.
5. Provide evidence of an actual customer failover or major recovery you have performed, with timings against the contracted RTO.

5. Transition

Transition from the incumbent arrangement must be complete within 8 weeks of contract start. Transition is complete only when a first full protected copy exists for every in-scope workload, runbooks are published, and one successful test failover has been evidenced.

Questions for providers

1. Provide a week-by-week transition plan for an environment of our size, stating exactly what you need from us and when.
2. Describe how you run transition in parallel with the incumbent so we are never unprotected, and who carries the risk during that period.
3. What happens in the first thirty days if you discover the environment is not as documented?
4. Name the individuals who would run transition, their qualifications and what else they are assigned to during that period.

6. Commercial

Pricing must be submitted on the basis of a fixed monthly service charge for the defined scope, with a published rate card for anything outside it. All prices are to be quoted in GBP, excluding VAT, and must remain valid for 90 days from the response deadline. The initial term is 36 months.

Questions for providers

1. State every event that triggers a charge outside the monthly service fee, including invocation, additional tests and data egress.
2. Confirm your indexation or annual uplift mechanism, with a cap.
3. State the cost and timescale of exiting the service and receiving our data back in a usable format.
4. Confirm what is explicitly not included at the quoted price.

7. Response requirements

Responses must be submitted by email to [contact email] no later than 7 October 2026. Late responses will not be considered.

1. Executive summary - maximum two pages.
2. Answers to every numbered question in this document, in order, quoting the question number. Maximum one page per answer.
3. Proposed solution design, including where data is held and how it is protected.
4. Transition plan as required by section 5.
5. Completed pricing schedule from section 6.
6. Named team with qualifications and current assignments.
7. Two references for engagements of comparable size that continue, and two that have ended.
8. Certification evidence for the frameworks in section 3.

Marketing material in place of a direct answer will be scored as no response. Where a question does not apply, say so and explain why.

Terms of this request

• [Organisation name] will not reimburse any cost incurred in preparing a response.
• This document is confidential and must not be shared outside the responding organisation.
• We are not bound to accept the lowest priced or any response.
• Any conflict of interest must be declared with the response.

8. Evaluation criteria

Compliant responses are scored 0 (no response or unacceptable) to 5 (excellent, fully evidenced) against each criterion, then weighted. A score of 4 or 5 requires evidence, not description: named people, real dates, actual test results.

[Organisation name] reserves the right to invite shortlisted providers to a clarification session or a technical deep dive before award, and to require a proof of recovery. Scores from that session will be applied to the technical and service delivery criteria above.