Skip to content
LobbyExpress
Search

Guide

How to write a visitor management RFP

A practical guide to specifying a visitor management system: writing requirements as real scenarios, separating must-haves from nice-to-haves, scripting demos and comparing a shortlist on evidence rather than points.

By LobbyExpress Editorial

Most requests for proposal for visitor management are written in an afternoon, borrowed from the last software purchase and padded with a feature list that every supplier will answer “yes” to. The responses come back looking identical, and the decision ends up being made on price, a slick demo or whoever answered the phone fastest.

A better RFP is not longer. It describes the situations your reception, security and facilities teams actually face, asks suppliers to show how their product handles them, and is honest about which requirements would make you walk away.

This guide sets out how to write one, from the first conversation with the people who run your front desk to the moment you sign.

Start with the people who run the desk

Before drafting anything, talk to the people who will live with the system. That usually means reception staff, the security lead, facilities or workplace management, IT, your data protection officer and whoever owns health and safety. In schools, add the designated safeguarding lead. On industrial sites, add the person who issues permits to work.

Ask each of them the same three questions. What goes wrong at the front desk today? What do you need from visitor records that you cannot get now? What would make you stop using a new system after a month?

The answers become the raw material for your requirements. They also tell you which kind of product you are really looking for, which matters more than most buyers expect.

Six stages of a visitor management procurementA timeline of six numbered stages grouped into three phases. Before going to market: discover, then write requirements. With suppliers: build a long list, run scripted demos, carry out due diligence. Decision: decide using an evidence grid with written reasons.BEFORE THE MARKETWITH SUPPLIERSDECISION123456DiscoverRequirementsLong listScripted demosDue diligenceDecideAsk the peoplewho run the deskScenarios first,then prioritiesFilter by productkind and fitSame script forevery supplierSecurity, data,referencesEvidence grid,written reasons
Most of the work that decides a good outcome happens before any supplier sees the document. Stages 1 and 2 are where buyers most often cut corners.

Write scenarios, not feature lists

A feature list invites a tick. “Contractor management: yes” tells you nothing about whether the product will stop a contractor with lapsed insurance from signing in at a site with nobody on reception.

Instead, describe the situation and ask the supplier to explain, in their own words, how the product handles it. Good scenarios are specific, come from your own discovery conversations and include the awkward edge cases.

Instead of Write
Evacuation reporting: yes/no When the fire alarm sounds, describe how fire wardens get a current list of everyone on site, including if the reception tablet is in the evacuated building.
Pre-registration: yes/no A host invites a group of twelve for a 9am workshop. Show how the group is invited, how they sign in on arrival and what the host sees.
GDPR compliant: yes/no Explain how we would set different retention periods for visitors, contractors and delivery drivers, and how records are deleted at the end of each period.
Offline mode: yes/no Our internet connection drops for an hour during the morning rush. Describe what reception can and cannot do in that hour.

Aim for somewhere between ten and twenty scenarios. Fewer and you miss things; many more and suppliers start answering with boilerplate.

Be strict about what counts as a must-have

The fastest way to ruin an RFP is to mark everything as essential. If forty requirements are “mandatory”, none of them is, and you lose the ability to eliminate products that genuinely cannot do the job.

Use a simple three-tier scheme: must, should and could. Then test every proposed must-have against a hard question: would you walk away from an otherwise excellent product because it lacks this?

Deciding whether a requirement is a must-haveA decision ladder with three questions. If a requirement supports a legal, safety or safeguarding duty, it is a must-have. If not, but you would walk away from a strong product without it, it is also a must-have. If not, but it changes daily work at the desk or for hosts, it is a should-have. Anything else is a could-have.Is it part of a legal, safety or safeguarding duty?Example: an evacuation list, retention controls for personal dataWould you walk away from a strong product without it?Example: an integration your security team depends onDoes it change daily work at the desk or for hosts?Example: host notifications by text or chat messageYESYESYESNONONOMust haveMust haveShould haveCould have — nice to see, never decisive
Run every proposed must-have through these three questions. In most organisations the must-have list ends up short enough to fit on one page, which is the point.

Should-haves are where products genuinely differ, and where most of your comparison will happen. Could-haves are useful tie-breakers but should never decide the outcome on their own.

Know which kind of product you are buying

“Visitor management” covers several kinds of product that overlap but are built for different jobs. A dedicated visitor management system is designed around the front desk. An access control platform with a visitor module starts from doors and credentials. A workplace platform treats visitors as one feature alongside desks and rooms. Vertical products are built for one sector, such as schools or contractor-heavy industrial sites.

Products in the LobbyExpress directory by categoryA horizontal bar chart of the 98 products in the LobbyExpress directory in October 2026. Dedicated visitor management systems: 24. Access control with visitor management: 25. Workplace platforms with visitor management: 24. Vertical-market visitor management: 25. The four categories are almost exactly the same size.Dedicated VMSAccess control with VMSWorkplace platform with VMSVertical-market VMS2425242501020Source: LobbyExpress directory, 98 products, October 2026
The four kinds of product are close to equal in number in our directory. A long list built from a single search for “visitor management” will usually mix all four.

Decide early which of these you are shopping for, or whether you genuinely want to compare across them. If you already run an access control platform, its visitor module may be the obvious candidate; if your priority is the reception experience, a dedicated product may fit better. You can filter the directory by category to build a long list from one kind at a time.

Script the demos

An unscripted demo shows you what the supplier is proudest of. A scripted one shows you what you need to see.

Send every shortlisted supplier the same script at least a week in advance, built from five to eight of your scenarios. Ask them to run it live, in the order you specify, using a test account configured for your organisation rather than a polished sandbox. Invite the people from your discovery conversations, and give each of them two or three scenarios to watch closely.

Keep a few rules:

  • Hold time back for the supplier’s own pitch, but put it at the end.
  • Ask to see failure cases: a rejected contractor, a visitor on a deny list, a lost connection.
  • Ask to see the administrator’s view, not just the visitor’s.
  • Note what was shown live, what was shown on slides and what was only promised.

That last distinction matters. A feature on a roadmap slide is not a feature, and “we can configure that for you” can mean anything from a setting to a paid project.

Compare on evidence, not points

Weighted scoring spreadsheets feel rigorous, but they often hide the decision rather than explain it. A product that is weak on your single most important scenario can still come out on top because it collected points everywhere else.

Instead, build an evidence grid. For each scenario, record whether the supplier demonstrated it, partly demonstrated it or did not show it, and add a sentence explaining why. Then discuss the grid as a group, starting with the must-haves.

Example evidence grid for a three-supplier shortlistAn illustrative grid with five scenarios as rows and three suppliers as columns. Each cell shows a filled circle for shown live, a half-filled circle for partly shown, or an empty circle for not shown. A note beneath says each cell should carry a written sentence rather than a number.EXAMPLESupplier ASupplier BSupplier CFire alarm: list reaches wardens’ phonesContractor with expired insurance arrivesGroup of twelve arrives at onceVisitor asks for their data to be deletedInternet connection drops at receptionShown livePartly shownNot shownEach cell carries one written sentence of evidence, agreed by the panel. No totals.
An illustrative evidence grid. Supplier C’s gap on the deletion scenario would be discussed first, because data deletion is a must-have, regardless of how strong its other answers are.

The grid does not make the decision for you. It makes the reasons visible, so the people who were not in the room can see why one product was chosen, and so you can explain the outcome to the suppliers who lost.

Common pitfalls

  • Copying another organisation’s RFP. Their requirements reflect their buildings, their risks and their politics.
  • Leaving IT and data protection until the end. Single sign-on, data residency, retention and sub-processors can each disqualify a product. Ask early.
  • Ignoring hardware. Kiosks, badge printers, mounts, power and network points all need specifying, and all have lead times.
  • Specifying the past. If your current process is a paper book, do not write requirements that simply reproduce it on a tablet.
  • Skipping references. Ask to speak to a customer of similar size and sector, and ask them what they would configure differently.

Where to go next

If you are unsure which kind of product to shortlist, start with the four kinds of visitor management product, then build your long list from the full directory. If your stakeholders need a primer on what the system is for beyond the check-in screen, share what a visitor management system actually does. More practical buying and set-up guides, including security questions for suppliers and the hardware half of the specification, are collected in our guides section.