Skip to main content
Marketing11 October 2026

Compare SEO services: 12-point RFP checklist for SMEs

South African SMEs should issue a vendor‑agnostic, deliverables‑first RFP that lists the exact SEO outputs, who owns each task, POPIA‑safe reporting requirements, and a sample 90‑day acceptance table so proposals are compared on work delivered—not vague ranking promises. Use the 12‑point checklist below and treat 30/60/90 as a pilot to verify delivery rather than a guaranteed ranking timeline.

Why deliverables and acceptance criteria beat ranking guarantees

SEO vendors often sell outcomes (“rank #1”) instead of listing what they will actually do. That makes apples-to-oranges comparisons and hides who implements changes. Requesting itemised deliverables, timelines and ownership lets procurement compare proposals on delivered work, reducing procurement risk and creating a verifiable path to acceptance and payment—industry buyer guides recommend a deliverables-first approach when evaluating small business SEO packages (EarlySEO buyer guide).

The 12‑point RFP checklist: what to require and why

For every item below require four fields in the proposal: concrete deliverable, proof to submit, who implements it (vendor / client / third party), and an acceptance criterion you can verify.

  1. Initial technical audit

    • Deliverable: crawl report (XML), prioritized fixes with estimated dev hours and severity labels.
    • Proof: downloadable audit ZIP and before/after screenshots.
    • Who: vendor delivers audit; fixes may be vendor or client depending on contract.
    • Acceptance: audit delivered and top 10 critical fixes scheduled with timestamps.
  2. Indexing & Search Console hygiene

    • Deliverable: Search Console property verification, submitted sitemaps, index coverage fixes.
    • Proof: Search Console screenshots and sitemap submission dates.
    • Who: vendor requests access; client grants property ownership or delegated access.
    • Acceptance: property verified and sitemap submitted within the agreed SLA.
  3. Google Business Profile (GBP) plan

    • Deliverable: verification steps, category & services configuration, photo audit, posting cadence.
    • Proof: live GBP changes or change-log plus post URLs.
    • Who: vendor prepares changes; client approves photos/offers.
    • Acceptance: GBP verified or ownership change request sent within agreed days.
    • Why it matters: local pack visibility depends heavily on GBP signals and reviews (Whitespark local ranking factors).
  4. Content strategy and publishing schedule

    • Deliverable: topic map, content briefs, number of pages/articles per month, editorial owner.
    • Proof: content briefs, staged drafts in CMS, and live URLs.
    • Who: vendor drafts; client approves and publishes (or delegates publishing).
    • Acceptance: agreed number of briefs delivered; first piece published by the pilot date.
  5. On‑page SEO and structured data

    • Deliverable: title/meta updates, header hierarchy, schema markup for products/locations/events.
    • Proof: before/after page source snippets and schema test screenshots.
    • Who: vendor implements or hands over clear CMS update tasks.
    • Acceptance: priority pages updated and schema validated.
  6. Page speed and mobile fixes

    • Deliverable: prioritized performance improvements (server, images, caching, critical CSS).
    • Proof: lab and field metric snapshots (Lighthouse and real‑user metrics).
    • Who: vendor recommends and implements where they control hosting; otherwise provide deployable tickets.
    • Acceptance: agreed dev tickets completed or measurable improvement on agreed metrics.
  7. Link‑earning / authority plan

    • Deliverable: outreach methodology, target placements, sample opportunities, quality standards.
    • Proof: live links with anchor context and referral evidence.
    • Who: vendor manages outreach; client may assist with introductions.
    • Acceptance: minimum verified placements or documented outreach responses.
  8. Local citations & NAP audit

    • Deliverable: citation inventory, corrections applied, quarterly cleanup cadence.
    • Proof: before/after citation lists and snapshots.
    • Who: vendor executes with client approvals.
    • Acceptance: core citation sources corrected and logged.
  9. Reviews & reputation process

    • Deliverable: review capture process, request templates, monitoring cadence.
    • Proof: monitoring dashboard screenshots and first review requests.
    • Who: client collects reviews; vendor automates requests and reporting.
    • Acceptance: documented workflow and first-month activity logged.
  10. Tracking, conversions and POPIA evidence

    • Deliverable: GA4/server-side tagging setup, Search Console filters, event mapping for lead types, call tracking.
    • Proof: read‑only access to analytics, documented event naming, sample report.
    • Who: vendor configures tracking; client retains account or grants managed access.
    • Acceptance: events firing in GA4 and verified in test events.
    • Compliance: require vendor to document consent capture, retention and lawful basis for processing lead data per South African guidance (Information Regulator guidance).
  11. Implementation ownership & publishing SLA

    • Deliverable: CMS editing rights, staging-to-production workflow, number of revision rounds.
    • Proof: published change log, reviewer approvals.
    • Who: explicitly state who will publish and the SLA for vendor updates.
    • Acceptance: first set of agreed updates published within SLA window.
  12. Data & exit terms

    • Deliverable: account ownership clauses, data export on exit (analytics, content, credentials).
    • Proof: sample export files and access transition plan.
    • Who: client retains accounts; vendor documents handover steps.
    • Acceptance: data export delivered and credentials transferred by termination date.
Overhead view of a workspace with notebooks, plant, and highlighter.
Use a clear publishing schedule and content briefs (sample briefs belong in the RFP).

A sample 90‑day plan and acceptance table (use as a pilot)

Treat 90 days as a pilot parameter to test vendor delivery, not a guaranteed ranking horizon—industry guidance shows early technical fixes appear quickly, while meaningful ranking changes often take several months (Search Engine Land guide on SEO timelines). Use the table below during procurement and hold milestone payments until acceptance evidence is supplied.

When Vendor must deliver How you verify
Day 30 (pilot check) Technical audit, Search Console verified, sitemap submitted, GBP ownership requested, tracking events defined Audit ZIP; Search Console screenshots; GBP change log; event test hits
Day 60 Top 10 technical fixes implemented or scheduled; 2 content briefs delivered; first GBP post; citation corrections started Dev ticket list + deploy timestamps; live published pages; GBP post URL; citation change log
Day 90 (acceptance) Agreed high‑impact fixes complete, 4 content items published, tracking validated, sample link placements live Before/after metric snapshots; published URLs; GA4 test events; live links list

Note: The 30/60/90 timings above are a suggested pilot parameter to evaluate delivery; adjust them to your business cycle and seasonality.

POPIA‑safe reporting: what must appear in the RFP

Require vendors to explain consent capture, data retention, and lawful bases for processing lead data. Ask specifically for:

  • Consent UX: cookie banner language, how consent is recorded and stored.
  • Recordkeeping: consent logs with timestamps and source pages.
  • Data sharing: which third parties receive lead data and how transfers are protected.
  • Direct marketing: whether and how the vendor will handle outreach and on which lawful basis.
    Insist on sample consent logs and a brief data flow diagram as proof.

How to score and compare proposals (simple weighted sheet)

Suggested scoring (example weights — adjust to your priorities):

  • Deliverables clarity — weight 30
  • Ownership & access — weight 20
  • POPIA & reporting — weight 15
  • Implementation speed / SLA — weight 15
  • Link & content quality — weight 10
  • Commercial & exit terms — weight 10

Score 0–5 per category, multiply by weight and sum. Use the 90‑day acceptance table to verify actual delivery before releasing milestone payments. Treat this scoring as a procurement tool, not a final performance measurement.

Store window with black owned business sign taped on a window, seen from outside a store.
Local SEO outcomes: GBP and review signals feed footfall and calls—include GBP and review activity in your monthly report.

How Luminum maps to three checklist items

  • Tracking & conversions: Luminum builds connected websites with measurement and lead routing so GA4 events and server‑side attribution are implemented as part of the site solution (Luminum solutions).
  • Implementation ownership & publishing SLA: Luminum’s platform‑first approach bundles delivery with operational handovers so publishing ownership and automated workflows are defined during scoping (pricing & approach).
  • Data & exit terms: Luminum recommends agreeing account ownership and handover details during scoping—use the contact flow to request a free RFP review (contact Luminum).

Appendix: sample monthly report columns, RFP preview & FAQ

Use a one‑page monthly report showing completed work and outcome evidence. Key columns: Completed work (what was delivered), Search Console non‑brand impressions, GA4 conversions (by lead type), GBP actions (posts/reviews), Link placements (live URLs), Next month plan.

Flatlay of business report with colorful charts, a notebook, and a laptop for data analysis on a desk.
Sample one‑page SEO report columns: completed work, Search Console impressions, GA4 conversions, GBP actions, next month plan.
How strict should I be about account ownership?
Require client ownership of analytics, Search Console and GBP. Vendors can be given delegated access, but accounts must be exportable on exit with documented handover steps.
Is 90 days too short to judge SEO?
Use 90 days as a pilot to verify delivery of agreed work (audits, fixes, content, tracking). Ranking changes can take longer, but delivery of work is verifiable within 90 days ([Search Engine Land guide on SEO timelines](https://searchengineland.com/guide/how-long-does-seo-take-to-work)).
What evidence of POPIA compliance should I insist on?
Ask for documented consent capture flows, stored consent logs, the lawful basis for direct marketing, and a list of third parties receiving personal data, with retention schedules and deletion processes ([Information Regulator guidance](https://inforegulator.org.za/wp-content/uploads/2020/07/GUIDANCE-NOTE-ON-DIRECT-MARKETING-IN-TERMS-OF-THE-PROTECTION-OF-PERSONAL-INFORMATION-ACT-4-OF-2013-POPIA.pdf)).
Discuss your project

Need a hand applying this?

Free advice comes standard with every quote.

Platform discovery · Implementation scope · Clear next steps