Guide
Online Proctoring RFP Template
12 minute read - Updated: November 2026
Most proctoring RFPs are written from the previous vendor's feature list, which is how institutions end up buying the same blind spots twice. This template is written from the threats an institution faces in 2026 and the questions that separate vendors who can address them from vendors who say they can. Use it as it is, or copy the sections you need into your own procurement document. The requirements are numbered so vendors can answer against them line by line.
How to use this template
Decide the scope first: which exams, which platforms, how many sessions a year, whether interviews or certification exams are in scope. State your learning management system and whether the integration must be LTI 1.3. Set the response format: Yes, Partial or No against each requirement, with a short explanation and evidence (a document, a screenshot or a demo). Score with the sheet at the end. Invite finalists to a scripted demo in which your own staff try to cheat, which tells you more than any written answer.
Section 1: Detection requirements
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 1.1 | Detects desktop AI assistants and copilots running outside the browser during a session. | ||
| 1.2 | Detects overlay windows that are excluded from screen capture or kept always on top. | ||
| 1.3 | Detects remote-control sessions (for example TeamViewer, AnyDesk, Chrome Remote Desktop) and virtual machines. | ||
| 1.4 | Detects additional monitors and reports their presence. | ||
| 1.5 | Detects a second device on the local network or near the test-taker, and states the method. | ||
| 1.6 | Detects browser extensions used for AI assistance and maintains a list that is updated as new tools appear. | ||
| 1.7 | Records tab switching and loss of focus from the exam window. | ||
| 1.8 | Detects a phone or second person in the camera frame when webcam recording is enabled. | ||
| 1.9 | Supports a Prevent mode that stops the session until a restricted tool is closed, and a Detect mode that records the event for review. | ||
| 1.10 | Flags are presented as evidence with timestamps for human review; the system does not issue automatic verdicts or grades. |
Section 2: Identity and impersonation
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 2.1 | Offers identity verification at the start of a session, and states whether it uses face recognition, face detection or document checks. | ||
| 2.2 | Monitors face consistency during the session without storing a biometric template beyond the session, or states its retention. | ||
| 2.3 | States its position on deepfake and voice-clone detection and the limits of that detection. | ||
| 2.4 | Allows the institution to disable identity features and run the session without biometrics. |
Section 3: Integration and administration
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 3.1 | Integrates with [your LMS] through LTI 1.3, with per-quiz or per-course enablement. | ||
| 3.2 | Locks the proctored quiz until a session is running and unlocks it per student. | ||
| 3.3 | Returns results to the instructor inside the LMS (gradebook column or grader panel) without writing grades. | ||
| 3.4 | Provides a REST API and webhooks for assessment platforms that deliver exams outside an LMS. | ||
| 3.5 | Supports course-level defaults and per-student accommodation profiles (extended time, assistive technology). | ||
| 3.6 | Supports in-person computer-based exams and remote exams with the same configuration. | ||
| 3.7 | Requires no test-taker account; the LMS or platform launch identifies the student. | ||
| 3.8 | Provides an instructor view of who has launched, who is in progress and who has finished. |
Section 4: Test-taker experience and accessibility
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 4.1 | States what the test-taker must install, the file size, and supported operating systems and versions. | ||
| 4.2 | States minimum bandwidth and what happens if the connection drops during a session. | ||
| 4.3 | Shows a consent notice before the session stating what is recorded, what is not, and the retention period. | ||
| 4.4 | Provides a practice or device-check session before the first exam. | ||
| 4.5 | Provides a current VPAT for WCAG 2.1 AA and states how screen readers and dictation tools are accommodated. | ||
| 4.6 | Provides a route for a student who declines consent, configured by the institution. |
Section 5: Privacy, security and compliance
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 5.1 | Provides a SOC 2 Type 2 report or states the status and date of the examination. | ||
| 5.2 | States hosting region(s), data residency options and subprocessors. | ||
| 5.3 | States retention defaults and whether sessions with no findings can be deleted immediately. | ||
| 5.4 | Confirms that institution and student data are not used to train models without written authorization. | ||
| 5.5 | Confirms that no video, audio or images are sent to third-party model providers, or states which are. | ||
| 5.6 | Provides a data processing agreement, FERPA terms and, for K-12, a COPPA position. | ||
| 5.7 | Provides a HECVAT (Lite or Full) and the date of the last penetration test. | ||
| 5.8 | States what the software does not do: no keystroke logging, no file reading, no activity outside the session. |
Section 6: Support, implementation and reporting
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 6.1 | Provides an implementation plan with named steps and durations for LMS installation, pilot, training and go-live. | ||
| 6.2 | Provides instructor training and student-facing materials. | ||
| 6.3 | Provides same-day support during the first proctored exams. | ||
| 6.4 | Provides a session report that a reviewer who was not present can read in a few minutes, with evidence attached. | ||
| 6.5 | Provides an appeal-ready export of a session for integrity hearings. | ||
| 6.6 | Exposes session and integrity events to the institution's data platform, or states the roadmap. |
Section 7: Pricing
| # | Requirement | Vendor response (Yes / Partial / No) | Evidence |
|---|---|---|---|
| 7.1 | States pricing per student per year, per exam, and per student per course, and whether a student-pays option exists. | ||
| 7.2 | States whether human review or live intervention is priced separately. | ||
| 7.3 | States implementation and training fees. | ||
| 7.4 | Confirms pricing is fixed for the initial term and how renewal changes are notified. | ||
| 7.5 | States whether the product can be bought alongside an existing proctoring contract for the sessions the current tool cannot cover. |
Vendor questions for the demo
Ask the vendor to run a session in which a member of your staff uses a desktop AI assistant, keeps a phone out of frame, opens a second monitor, and connects through a remote-control tool. Ask to see the report afterward and to explain each flag. Ask what a student sees when a restricted tool is found. Ask what the reviewer sees when nothing is found. Ask how a new AI tool that is not on the vendor's list would be caught.
Scoring sheet
| Section | Weight | Score (0 to 5) | Weighted score |
|---|---|---|---|
| Detection | 30 | ||
| Identity | 10 | ||
| Integration | 20 | ||
| Test-taker experience and accessibility | 15 | ||
| Privacy and security | 15 | ||
| Support and implementation | 5 | ||
| Pricing | 5 |
Adjust weights to your context; the defaults put the weight on the threats that have changed most since most proctoring contracts were signed.
Frequently asked questions
Can we use this template as it is?
Yes. Copy the sections into your procurement document and adjust the LMS name, scope and weights.
Why does detection carry the most weight?
Because the gap between vendors is widest there. Most providers handle browser and webcam threats similarly; few can see desktop AI assistants, overlays and remote control.
Should we require SOC 2 Type 2?
Require the report or a stated examination date. A vendor mid-examination can usually provide the auditor's engagement letter and a Type 1 or bridge letter.
How do we evaluate false positives?
Ask for the review workflow and for a sample report of a session with no findings. A vendor that presents evidence for human review rather than verdicts is easier to defend on appeal.
Does the template cover interviews and certification exams?
Yes. Sections 1, 2, 5 and 7 apply unchanged; replace the LMS items in Section 3 with the platform API items.
See a session, a detection, and a report
A short walkthrough of a live exam, a flagged moment, and the finding your integrity office would receive.