School Web Filter RFP Checklist
A web filter touches CIPA compliance, student privacy, teaching time and every device in the district. This checklist gives you requirement language you can paste straight into an RFP or RFI, a scoring grid, and a demo script for finalists.
Nothing here names a product. The requirements describe outcomes, so any bidder can answer them and you can compare answers fairly.
How to use this RFP checklist
Each block below has requirement IDs, a Mandatory or Desired label and a short note on why it matters. Use the copy button to grab a block as plain text.
Trim to fit
Delete rows that do not apply. A district with no take-home devices does not need off-campus requirements to be mandatory.
Set the gates
Keep Mandatory to things you truly cannot live without. Every extra gate shrinks the bidder pool.
Fix the weights
Agree the scoring weights before the bids open, and record them in the RFP so bidders know how they will be judged.
Test finalists
Run the same scripted demo on your own devices for every finalist. Score what you see, not what the proposal says.
Section A: CIPA compliance and policy requirements
These rows make sure the filter supports your CIPA certification and your internet safety policy, not just the network.
A. Compliance and policy
| ID | Requirement | Level |
|---|---|---|
| A1 | The solution shall block or filter visual depictions that are obscene, child sexual abuse material, or harmful to minors, for all district devices and networks used by minors, as required by the Children's Internet Protection Act. | Mandatory |
| A2 | The solution shall block obscene material and child sexual abuse material for adult users, and shall allow an authorized administrator to relax other restrictions for adults engaged in bona fide research or other lawful purposes. | Mandatory |
| A3 | The bidder shall describe how the solution supports the district's annual CIPA certification, including documentation the district can retain to show filtering was in place and working throughout the funding year. | Mandatory |
| A4 | The solution shall enforce search engine safe search and restricted video modes where the platforms support it. | Mandatory |
| A5 | The solution shall allow separate policies by grade band, school, user group and staff role, so local choices beyond the CIPA minimum can differ for elementary, middle and high school. | Desired |
| A6 | The bidder shall describe how the solution supports state law requirements that apply to the district, if any, beyond CIPA. | Desired |
Section B: Coverage, devices and networks
A filter that only sees the core network misses take-home devices, guest Wi-Fi and encrypted traffic. Write coverage requirements for the devices you actually own.
B. Coverage and devices
| ID | Requirement | Level |
|---|---|---|
| B1 | The solution shall filter all district-managed device types in use: list them here (for example managed Chromebooks, Windows laptops, macOS devices, iPads). | Mandatory |
| B2 | The solution shall apply the same policy to district-managed devices on and off the district network, including at home. | Mandatory |
| B3 | The solution shall filter HTTPS traffic in a way that allows category decisions on encrypted sites. The bidder shall describe certificate deployment, any decryption performed, and sites excluded from inspection. | Mandatory |
| B4 | The solution shall filter guest and personally owned devices on district networks without requiring software on those devices. | Desired |
| B5 | The solution shall continue to enforce policy if a student signs out, uses a guest profile, or attempts to remove a browser extension or agent. | Mandatory |
| B6 | The bidder shall state any performance impact on device battery life, browsing speed and network throughput, and the capacity tested. | Desired |
Ready answers for the checklist lines
If our hosted filter is in the running, these are the facts for your sections. A pilot lets you verify them on your own network.
- Coverage: 120M+ categorized domains, 99.99% of the active internet.
- Control: per-school settings, staff PIN, logs.
- Privacy: decides by domain, not a monitoring or classroom screen tool.
Section C: Categories, accuracy and new sites
Category quality is the part of a filter you cannot see in a demo slide. Ask for specifics on how many sites are covered and how quickly new sites are categorized.
C. Categories and accuracy
| ID | Requirement | Level |
|---|---|---|
| C1 | The bidder shall provide its full list of filtering categories with a short definition of each. | Mandatory |
| C2 | The solution shall include categories for VPN, proxy and anonymizer services, and shall block known bypass methods by default for student policies. | Mandatory |
| C3 | The bidder shall state how newly registered and newly active domains are categorized, and how quickly. | Mandatory |
| C4 | The solution shall include a category or categories for AI tools, including AI chat, image generation and AI companion services, so the district can allow approved tools and block others. | Desired |
| C5 | The bidder shall describe how it measures categorization accuracy and whether accuracy results are shared with customers. | Desired |
| C6 | The district shall be able to submit recategorization requests and to override categories locally with allow and block lists. | Mandatory |
Section D: Management, overrides and reporting
The daily experience of teachers and IT staff lives here. Overly rigid management is the biggest source of complaints after go-live.
D. Management and reporting
| ID | Requirement | Level |
|---|---|---|
| D1 | The solution shall synchronize users and groups with the district's directory and apply policy by group automatically. | Mandatory |
| D2 | The solution shall show a clear block page that tells the user why a site was blocked and how to request a review. | Mandatory |
| D3 | The solution shall let designated staff grant time-limited access to a blocked site for a class or group, with the action logged. | Desired |
| D4 | The solution shall provide scheduled reports by school and group, exportable to common formats, suitable for retention as CIPA evidence. | Mandatory |
| D5 | The solution shall support delegated administration, so building staff can manage local allow lists without district-wide rights. | Desired |
| D6 | The bidder shall describe any alerting for safety concerns, which staff receive alerts, and how the district controls this. | Desired |
Try a few on your own test list
Demos go better with tricky domains. These show the labelling you can compare.
| Domain | Categories |
|---|---|
| character.ai | AI / LLM Tools, Web-based Applications |
| canva.com | Web-based Applications, AI / LLM Tools |
| discord.com | Email and Messaging, Social Networking, Gaming |
| twitch.tv | Streaming Media, Gaming |
| photomath.com | AI / LLM Tools, Education/Reference |
| quillbot.com | AI / LLM Tools |
Section E: Student privacy and security
Filter logs are student records in many contexts. Write privacy terms into the RFP rather than negotiating them after award.
E. Privacy and security
| ID | Requirement | Level |
|---|---|---|
| E1 | The bidder shall sign the district's or state's student data privacy agreement, or state any exceptions in its response. | Mandatory |
| E2 | The bidder shall state where data is stored, the default retention period for browsing logs, and how the district can shorten it. | Mandatory |
| E3 | The bidder shall not use student data for advertising, profiling or any purpose other than providing the service to the district. | Mandatory |
| E4 | The solution shall support role-based access to logs, single sign-on and multi-factor authentication for administrators. | Mandatory |
| E5 | The bidder shall describe its security incident notification process and timelines. | Mandatory |
| E6 | The solution should block known malware and phishing domains for all users. | Desired |
Section F: Implementation, support and commercial terms
These rows protect the district after signature: rollout, support hours, exit and price changes.
F. Support and commercial
| ID | Requirement | Level |
|---|---|---|
| F1 | The bidder shall provide an implementation plan with milestones, district responsibilities and a target go-live before the start of the school year. | Mandatory |
| F2 | The bidder shall state support hours, channels and response targets, including coverage during the school day in the district's time zone. | Mandatory |
| F3 | Pricing shall be stated per student, per device or per site, for each year of the term, with any annual increase capped. | Mandatory |
| F4 | The bidder shall describe exit support, including export of policies and reports and deletion of district data at contract end. | Mandatory |
| F5 | The bidder shall provide three references from K-12 districts of similar size, using the solution for at least one school year. | Desired |
| F6 | The bidder shall provide training for IT staff and short guidance for teachers on requesting access and reporting problems. | Desired |
A scoring grid for web filter proposals
Use mandatory rows as pass or fail gates. Score the rest on a 0 to 4 scale, multiply by the weight, and add up. Publish the weights in the RFP.
| Criterion | What evaluators look for | Weight | Share |
|---|---|---|---|
| Coverage and devices (B) | All device types, on and off campus, HTTPS, tamper resistance | 20 | |
| Categories and accuracy (C) | Category depth, new-site speed, bypass blocking, accuracy evidence | 20 | |
| Management and reporting (D) | Group policy, overrides, reports usable as CIPA evidence | 15 | |
| Privacy and security (E) | Privacy agreement, retention, access control, incident process | 10 | |
| Implementation and support (F1, F2, F6) | Realistic plan, school-hours support, training | 10 | |
| Price (F3) | Total cost over the term, increase caps, no hidden add-ons | 25 | |
| Total | 100 |
Answers for sections D and E
VPN/Proxy stays blocked even with a PIN, and the filter decides by domain only.
Finalist demo script: test it on your own devices
Give every finalist the same script a week ahead and run it on district devices with a student test account. Our school web filter test can help build the test list.
Required categories
Visit test pages in adult, gambling, weapons and drug categories as a student. Each should be blocked with a clear block page.
Bypass attempts
Try a web proxy, a VPN extension, a translation-site proxy and an alternate DNS setting. Note what is caught.
Off-campus
Take a device home or onto a phone hotspot. The same student policy should apply within minutes.
Encrypted sites
Check that category blocks work on HTTPS sites, and that excluded sites such as banking or health portals still load.
Teacher override
Have a teacher unblock a video site for one class for one period, then confirm it reverts.
Report export
Export a month of blocked-category activity for one school. Ask: could we file this as CIPA evidence?
AI tools
Allow one approved AI tool and block AI chat in general. Check the approved tool still works.
New sites
Bring a short list of sites that appeared recently. See how many are already categorized.
Red flags in web filter proposals
None of these alone disqualifies a bidder, but each one deserves a follow-up question in writing.
"CIPA certified"
There is no government certification for filters. CIPA compliance is something the district certifies, so ask what the claim actually means.
No category list
A bidder unwilling to share its category list and definitions makes it hard to set local policy or answer parents.
Vague on new sites
Answers like "continuously updated" with no detail on new domains leave a gap students will find.
Unlimited log retention
Keeping every student's browsing forever by default is a privacy risk, not a feature.
Price only for year one
Ask for each year of the term. Steep renewals after a low first year are common in multi-year deals.
No exit terms
Without policy export and data deletion at the end, switching later becomes expensive.
A realistic web filter RFP timeline
Filters are easiest to switch over the summer. Working back from a go-live in early August gives a timeline most districts can hold.
Gather needs
Collect complaints, gaps and device counts from IT, teachers, librarians and counselors. Decide what the new filter must do differently.
Draft and release
Trim this checklist, set weights, add your state's required clauses and privacy agreement, and publish the RFP with a question deadline.
Evaluate and demo
Score written responses, shortlist two or three finalists, and run the demo script on district devices with a student test account.
Award and roll out
Get board approval, sign the privacy agreement, pilot in one school in June, then deploy district-wide before staff return.
RFP lines
How we respond to common requirements
| Requirement | Typical answer | Hosted CIPA filter |
|---|---|---|
| CIPA preset | Configurable | Adult and VPN/Proxy on |
| Off-network devices | Agent | Private encrypted link |
| Overrides | Admin only | Staff PIN, logged |
| Reporting | Basic | Reports, policy record, log export |
| Deployment | Varies | Nothing installed on computers |
Web filter RFP questions
Can we copy these web filter RFP requirements into our bid documents?
Yes. The requirement blocks on this page are written so a district can paste them into an RFP or RFI. Edit them to match your devices, your policies and your state procurement rules, and have your purchasing office review the final text.
Is a web filter eligible for E-Rate discounts?
Content filtering has generally not been an eligible E-Rate service, even though CIPA requires it. Basic firewall services have their own eligibility rules. Check the current Eligible Services List and your E-Rate adviser before you assume any filtering cost is discounted.
How should we weight price in the scoring grid?
Many districts weight price between 20 and 30 percent so that coverage, accuracy and support can decide close bids. Follow any minimum price weighting your state or local rules require.
Should mandatory requirements be scored?
Mandatory requirements work best as pass or fail gates. A bid that fails one is not scored further. Desired requirements are then scored on how well they are met.
How do we test a filter during the evaluation?
Ask each finalist to run a scripted demonstration on your own devices: test sites in each required category, a proxy bypass attempt, an off-campus device, a teacher override and a report export. Score each step the same way for every finalist.
What student privacy terms belong in a web filter RFP?
Ask where data is stored, how long logs are kept, who can access them, whether data is used for anything other than providing the service, and whether the bidder will sign your district or state student data privacy agreement.
We quote per schools and devices, and the reply takes no more than one business day. Pilot a single site and review the blocks and reports before you go further.
Writing a filter RFP this year?
Tell us about your devices, your grade bands and your timeline. We can walk through how our category filtering answers each section of this checklist.
Talk to us about your district