Choosing a Sitecore partner in the Middle East: an RFP checklist from the partner side

We respond to Sitecore RFPs across the Gulf and Egypt, and the pattern is consistent. The best ones are short, specific and honest about constraints. The worst run to hundreds of questions every partner answers “yes” to, and still miss the few that predict whether a programme will land. With mainstream support for Sitecore XP 10.4 ending in December 2027, many organizations in the region are writing one now. Here is what we would put in it if we sat on your side of the table.

Decide what you are buying

Most RFPs blur three purchases that partners price and staff differently: a platform path (move to SitecoreAI, or upgrade to XP 10.5 and move later), a build (migration, redesign or both) and a run contract (support, optimization and SLAs). Say which are in scope, and whether you will award them together or separately.

Then let partners recommend the path and explain why. How a partner argues for SitecoreAI, or against moving yet, tells you more about their judgement than any capability statement. If you cannot frame the scope at all, run a short discovery or our free Sitecore health check first, and go to market with facts.

Run it in phases

  1. A short RFI with price ranges. Share your estate and budget band, and ask for an indicative range with assumptions. It filters out mismatches before anyone writes a long proposal.
  2. A shortlist of three. Ask each for a focused proposal on a defined scope.
  3. Working sessions. Give each shortlisted partner a real problem from your estate and two hours with your team. You learn more here than from any document.
  4. Compliance and security. Run the full security questionnaire with the finalists only.

One adjustment for the Gulf: if you are a government entity or a regulated business, data residency and accessibility are pass or fail. Put them in the RFI, so nobody reaches the final round on a platform you cannot use.

What a good RFP gives partners

  • Your estate, in facts. Sitecore version and topology, number of sites and languages, content items, templates and renderings, integrations, monthly traffic and peak events. Ten facts beat ten pages of vision.
  • What success looks like. Two or three outcomes you will measure, such as the time it takes to publish a campaign page in Arabic and English, or organic traffic held through cutover.
  • Constraints. Dates you cannot move (a support deadline, a launch, a Ramadan or national day campaign), hosting rules, security reviews and procurement steps.
  • A budget range. A range saves everyone weeks. Without one you receive proposals sized for different projects, and you end up comparing nothing.
  • The decision process. Who scores, on what weights, and when. Partners staff a pursuit better when the path is clear.

Ask fewer, better questions

Before a question goes in, ask whether its answer could change your decision or the price. If not, cut it. Generic capability matrices, unpaid design concepts and questions copied from an RFP for another platform reward the best proposal writers. Ask for a point of view instead: “How would you approach our Arabic search?” tells you far more than “Do you support Arabic search?”

Use answer limits to show what matters. A 200-word limit on company history and no limit on migration method tells partners where to put their best people.

How to verify a Sitecore partner

  • Check the official directory. Sitecore’s partner finder shows each partner’s tier by office, its specialisations, and its certified professionals and completed projects per product. Tiers run Silver, Gold and Platinum, and in August 2026 Sitecore added Diamond as its highest level of recognition.
  • Ask for the right certifications. For SitecoreAI work, look for the SitecoreAI CMS Developer Certification. Sitecore certifications currently do not expire, so ask when each one was earned and on which product.
  • Call the references. Two live sites at your scale, ideally in the region, and the client contacts behind them.

The questions that predict delivery

Delivery proof

  • Who exactly will work on our programme? Names, roles, certifications and time allocation, with the same people in the pitch and on the project.
  • Tell us about a Sitecore project that went over budget or slipped, and what you changed afterwards.

Arabic-first capability

  • Show us an Arabic page you built: right-to-left components, Arabic typography, mixed Arabic and English text, numerals and dates. A mirrored English layout does not count.
  • How do you keep Arabic and English in step through translation, fallback rules and editorial workflow?
  • How do you test Arabic pages for accessibility with assistive technology?
  • How would you approach Arabic on-site search: word forms, diacritics and synonyms?

We wrote up what parity takes in Arabic-first on Sitecore.

Migration method

  • How do you inventory an XP estate, and what would you recommend we retire instead of migrating?
  • Which XP elements will you rebuild (xDB data, custom pipelines, Forms, MVC renderings, personalization rules), and how is each priced? Our view on rules is in Personalization on SitecoreAI.
  • How will you protect SEO: URL inventory, redirect map, metadata and structured data, and crawl checks before and after cutover?
  • What is your cutover and rollback plan?

AI and search

  • Which SitecoreAI agent capabilities would you switch on first, under what governance, and where does AI processing run relative to our data? See Agentic Studio, explained.
  • How will our content be found and cited by AI answer engines as well as by Google? See our approach to AI visibility.

Run and support

  • Map every component that holds personal data (CMS, front-end host, CDN, search, forms, analytics, personalization) to its hosting region. What changes, and who pays, when in-country hosting launches?
  • What do your SLAs cover, how are they measured, what are your support hours across the UAE and Saudi working weeks, and what happens when you miss one?
  • Will we have a named team after go-live, or a ticket queue?

Commercials

  • Fixed price, time and materials, or a hybrid, and why for this scope? How is change controlled and priced?
  • What is excluded? Licences, front-end hosting, translation, content entry and testing tools are the usual surprises.
  • Which legal entity will contract with us, where is the delivery team based, and what do the exit terms cover: IP, documentation and handover?

Gulf-specific must-haves

This is not legal advice, and your legal and security teams own the final call. These are the points we see decide Gulf Sitecore programmes, with what the official sources say.

Data protection

  • UAE. Federal Decree-Law No. 45 of 2021 on personal data protection has been in force since January 2022. It does not cover government data or government entities, or free-zone companies with their own data protection laws, so confirm which regime applies to you before you write requirements.
  • Saudi Arabia. The Personal Data Protection Law entered into force on 14 September 2023, with SDAIA as the competent authority.
  • Qatar. Law No. 13 of 2016 on personal data privacy applies, with guidelines issued in 2021 that expect privacy to be considered when products, systems and services are designed.

Hosting and data residency

  • SitecoreAI runs on Microsoft Azure, and Sitecore’s data processing addendum commits to storing customer data only in the selected region.
  • In February 2026 Sitecore announced dedicated SitecoreAI deployments for the region: delivery from Saudi Arabia’s Eastern Province starting in Q4 2026, and a sovereign UAE instance planned for later in 2026. No Qatar deployment has been announced.
  • The announcements cover SitecoreAI. Sitecore Personalize, for example, lists the US, Ireland and Australia as its data regions, so check the data region of every product in your stack, including search and personalization.
  • For Saudi government agencies, the National Cybersecurity Authority’s 2024 cloud controls moved data localization requirements to the National Data Management Office, and its Essential Cybersecurity Controls require managed security monitoring centres that use remote access to be fully located in the Kingdom. Ask where your partner monitors from.

Accessibility

  • UAE. The National Policy for Digital Accessibility requires public service sites to comply with WCAG 2.1 Level AA, and the UAE Design System 2.0 for federal websites references WCAG 2.2 AA.
  • Saudi Arabia. The Digital Government Authority’s web accessibility guideline requires government entities to meet at minimum WCAG 2.1 Level AA.

Even where accessibility is not mandated for you, write WCAG 2.2 AA into the RFP, and test it in Arabic as well as English.

How to score proposals

Weight evidence over promises. A simple model that works: delivery proof and references 30%, the named team 25%, method (migration, Arabic, SEO and governance) 25%, commercials 20%. Then let the working sessions settle close calls.

Red flags

  • A pitch team you never see again.
  • A price with no list of assumptions.
  • “We support Arabic” with no live Arabic site to show.
  • No clear answer on where your data and your monitoring sit.
  • No answer on what happens to SEO at cutover.
  • AI promises with no governance attached.

Frequently asked questions

Should we ask for a fixed price?

For a defined migration scope, yes, with the assumptions written down. For discovery or experimentation, time and materials with a cap is fairer to both sides.

Which partner tier should we look for?

Tier tells you about a partner’s overall Sitecore business. What predicts your project is the named team, their SitecoreAI certifications and references at your scale. Use the directory to verify claims, and the working session to judge.

Do we need a partner with an office in our country?

For public sector and regulated work it often matters, for contracting, security reviews, monitoring location and working hours. For everyone else, time zone, language and named people matter more than a postal address.

Who sells the SitecoreAI licence?

The licence is a commercial agreement with Sitecore. Ask your partner which SitecoreAI capabilities their plan assumes, so the licence you buy and the work you are quoted match. It is also fair to ask partners to disclose any Sitecore incentives tied to your deal.

Planning a Sitecore RFP? Start with evidence. Our free Sitecore health check gives you a senior read of your estate to put in front of bidders, or talk to the team.

Sources

Tags

What do you think?

Related articles