Procurement teams throw around "RFI," "RFP" and "RFQ" as if they're interchangeable — and vendors happily let that slide, since a vague ask is easier to spin. They're not the same document, they don't answer the same question, and using the wrong one at the wrong stage is how a six-week sourcing cycle turns into a four-month one. Here's what each does, in what order, with the questions to put in each.
Three documents, three different jobs
Think of RFI, RFP and RFQ as three filters in a funnel, each narrower than the last. An RFI answers "who's even capable of this?" An RFP answers "who does it best, and how?" An RFQ answers "at what price, exactly?" Run them in order and each stage does less work than the last, because the field keeps shrinking. Skip the RFI, or ask for pricing before scope is defined, and you end up negotiating against vendors you never properly vetted.
RFI — Request for Information
An RFI is a market scan sent to a wide list — 10-25 vendors is normal for a mid-market project — to find out who exists and whether they're worth a formal proposal invite. It's not a commitment on either side. Responses run 5-10 pages, often a questionnaire rather than a narrative, with a fast 1-2 week turnaround.
Use an RFI when the vendor landscape is unfamiliar, or the category is new to your organization (a new SIEM, payroll provider, or cloud region). Skip it with 2-3 known, qualified vendors already in hand — going straight to RFP saves 2-3 weeks.
Example RFI questions:
- What is your core product, and who is your typical customer profile?
- Do you hold SOC 2 Type II, ISO 27001, or equivalent certifications?
- What is your general pricing model (per-seat, usage-based, flat fee)?
- Can you support our top 3-5 required integrations, at a high level?
Security posture is one of the fastest things to filter on here — attaching a SIG or CAIQ-style questionnaire to the RFI cuts vendors that can't answer basic security questions before you spend hours reading a 60-page proposal from them later.
RFP — Request for Proposal
An RFP asks vendors to solve your actual problem, in detail. Send it to the shortlist that survived the RFI — typically 3-7 vendors — and ask for approach, implementation plan, team, references, security architecture, SLA terms, and pricing structure (how pricing works, not a final number). Responses run 30-80 pages; expect 3-4 weeks for vendors to respond, plus 2-4 weeks on your side to read, score and compare.
Use an RFP when "how" matters as much as "how much." Skip the full ceremony for low-complexity purchases where an RFQ alone is enough.
Example RFP questions:
- Walk us through your implementation plan and typical time-to-value for a company our size.
- Describe your data residency, encryption, and breach-notification commitments.
- What does your SLA guarantee, and what are the penalty terms if you miss it?
- How do you handle auto-renewal, termination for convenience, and liability caps?
Response volume is the bottleneck here — reading and normalizing seven 60-page proposals by hand is an 8-16 hour job per cycle. Our step-by-step RFP comparison guide covers how to structure scoring so you're not re-litigating criteria halfway through.
RFQ — Request for Quotation
An RFQ is a price lock. By the time you issue one, you already know what you want and who can deliver it — the only open variable is the number. RFQs are short: a spec sheet plus a pricing table, 1-3 pages, turned around in 3-5 business days since there's no proposal to write, just a form to fill.
Use an RFQ for standardized purchases: hardware refreshes, fixed quantities of a known SKU, or the final pricing step after an RFP has set the winning approach. Never use one as your first move on a complex purchase — locking a number before scope is defined guarantees change orders later.
Example RFQ questions:
- What is your unit price at quantities of 50 / 200 / 500?
- What is your lead time from PO to delivery/activation?
- What payment terms do you offer (net 30/60/90)?
- Does the quoted price include support, or is that a separate line item?
RFI vs RFP vs RFQ at a glance
| Aspect | RFI | RFP | RFQ |
|---|---|---|---|
| Core question | Who can do this? | Who does it best, and how? | At what price? |
| Vendors invited | 10-25 (wide net) | 3-7 (shortlist) | 1-3 (finalists) |
| Response length | 5-10 pages | 30-80 pages | 1-3 pages |
| Turnaround | 1-2 weeks | 3-4 weeks + review | 3-5 business days |
| Commitment level | None | Low-medium | High — near-final |
How the three stages connect in a sourcing process
In a well-run cycle, RFI, RFP and RFQ aren't separate projects — they're one funnel with three checkpoints:
- RFI narrows the field. 15 candidates become 5, reading short questionnaire answers, not proposals — so a wide net is cheap.
- RFP evaluates depth. 5 candidates become 2-3. Approach, security posture, SLA terms and references get compared side by side — the stage that eats the most analyst time when done manually.
- RFQ locks pricing. 2-3 finalists become 1. Scope is already agreed; the RFQ exists purely to get a final, comparable number before contract.
- Negotiation and award. With pricing locked, the remaining work is redlining terms — not re-debating whether the vendor is qualified.
End to end, a mid-market cycle that runs all three stages typically takes 8-12 weeks from first RFI to signed contract. Merging RFI into RFP saves 1-2 weeks but means reading full proposals from vendors who would have been screened out cheaply at the RFI stage.
Common mistakes worth avoiding
- Asking for pricing in the RFP before scope is fixed. Vendors pad "placeholder" numbers to cover ambiguity, so pricing isn't comparable — you'll re-quote at RFQ anyway.
- Treating the RFI as optional. Skip it on an unfamiliar category and your shortlist is a guess — you'll find a disqualifying gap three weeks into RFP review instead of one week into RFI review.
- Sending an RFQ to vendors who skipped the RFP. Fine for commodity purchases; risky where implementation complexity exists, since price without an agreed "how" invites change orders after signing.
Where AI actually helps
RFI and RFP stages generate the most paper, and paper is where AI adds the most leverage. OCR on scanned RFI responses means a badly-scanned questionnaire doesn't sit in a queue waiting for manual re-typing. At the RFP stage, automated red-flag detection scans every proposal for the same toxic patterns — auto-renewal without notice, liability caps under 1x contract value — before a human reads a single page. By the RFQ finalist stage, a structured negotiation playbook keeps pushback consistent across vendors.
Which one do you need right now?
- Use an RFI if you can't yet name 3-5 vendors who could plausibly do this.
- Use an RFP if you know the category but "how" — approach, security, terms — will decide the winner.
- Use an RFQ if scope and vendor are already settled and price is the only open item.
- Use all three for any purchase above your "high-risk vendor" threshold: customer data, core infrastructure, six-figure spend.
For a plain-language reference, see Investopedia's glossary entry on RFPs.