Vendor management

Vendor Management

Vendor Selection Process

Phase 1 — Requirements Definition

• Define must-have vs. nice-to-have capabilities
• Set budget range (target + ceiling)
• Identify integration requirements (APIs, SSO, data formats)
• Determine compliance requirements (SOC 2, GDPR, HIPAA, FedRAMP)
• List evaluation stakeholders and final decision maker
• Set evaluation timeline with milestones

Phase 2 — Market Research

1. Internal: survey existing vendors for capability expansion
2. Analyst reports: Gartner Magic Quadrant, Forrester Wave
3. Peer network: references from similar companies
4. G2 / Capterra / TrustRadius: user reviews
5. LinkedIn: recent funding, headcount trends = vendor stability signal

Phase 3 — RFP Template

RFP: [Solution Category]
Issued by: [Company]
Due date: [YYYY-MM-DD]
Submission format: PDF or Notion doc

Section 1 — Company overview (max 1 page)
  - Company history, size, funding stage
  - Key customers in our industry vertical

Section 2 — Product/service capabilities
  [List your must-have requirements as yes/no questions]
  [List nice-to-have as feature questions]

Section 3 — Integration
  - API documentation link
  - Available connectors / webhooks
  - SSO protocols supported (SAML, OIDC)
  - Data export formats

Section 4 — Security & compliance
  - SOC 2 Type II report (provide or confirm available under NDA)
  - Pen test results (date of last test)
  - Data residency options
  - Sub-processor list

Section 5 — Pricing
  - Pricing model (per seat / usage / flat)
  - Pricing for our estimated volume
  - Multi-year discount options
  - Implementation / onboarding fees

Section 6 — Support & SLAs
  - Support tiers and channels
  - SLAs (uptime, response times)
  - Dedicated CSM threshold

Section 7 — References
  - 3 customer references in similar industry/size

---

Vendor Scoring Matrix

Scoring Template (customize weights per procurement)

Criterion	Weight	Vendor A	Vendor B	Vendor C
Functional fit	30%	/10	/10	/10
Security & compliance	20%	/10	/10	/10
Integration ease	15%	/10	/10	/10
Total cost of ownership	15%	/10	/10	/10
Vendor stability	10%	/10	/10	/10
Support quality	5%	/10	/10	/10
Implementation timeline	5%	/10	/10	/10
Weighted total	100%	—	—	—

Scoring Rules

• Score 1–10 for each criterion before applying weight
• Score independently per evaluator, then average
• Document rationale for scores ≤ 4 or ≥ 9
• Must-have gaps score 0 regardless of other strengths

---

Contract Negotiation

Key Contract Clauses to Push On

Clause	What to seek
Price lock	0–3% annual increase cap for multi-year deals
SLA credits	≥ 10% credit per month for uptime breach
Data portability	Right to export all data in standard format within 30 days of termination
Termination for convenience	30–90 day notice without penalty
Liability cap	12 months of fees paid (not uncapped)
IP ownership	Customer owns all data and derived outputs
Sub-processor notification	30-day advance notice before adding sub-processors
Audit rights	Right to audit or receive third-party audit reports annually

Negotiation Tactics

1. Always negotiate from a written redline — never verbally
2. Bundle concessions: "We'll accept X if you accept Y"
3. Use competing offer as leverage even if not final choice
4. Separate commercial from legal tracks — run in parallel
5. Push for mutual NDA before sharing sensitive requirements
6. Get implementation scope in the SOW, not MSA — easier to amend

---

SLA Monitoring

SLA Dashboard Metrics

Metric	Calculation	Cadence
Uptime	Available minutes / total minutes × 100	Monthly
MTTR	Sum(resolution times) / # incidents	Monthly
First response compliance	# within SLA / total tickets	Weekly
CSAT	Average satisfaction score from surveys	Quarterly
Renewal health score	Composite of above metrics	Quarterly

SLA Breach Response

1. Log breach immediately in vendor tracker
2. Request incident report within 5 business days
3. Calculate SLA credit owed per contract terms
4. Apply credit to next invoice (track in accounts payable)
5. Escalate to vendor exec if 2+ breaches in rolling 90 days
6. Trigger contract review if 3+ breaches in rolling 6 months

---

Vendor Risk Assessment

Risk Tiers

Tier	Criteria	Review cadence
Critical	Processes core business / holds PII / revenue-critical	Annual + on incident
High	Important ops dependency / limited alternatives	Annual
Medium	Significant tool / easy to replace	Bi-annual
Low	Commodity tool / minimal data	On renewal

Risk Assessment Questionnaire

Financial stability

• Audited financials reviewed (or public company check)
• Years in business ≥ 3
• No news of funding issues or layoffs > 20% in last 12 months

Operational resilience

• Business continuity plan reviewed
• Disaster recovery RTO/RPO documented
• Multi-region / multi-AZ availability confirmed

Security posture

• SOC 2 Type II in-scope for relevant services
• Pen test within last 12 months
• CVE response SLA documented

Concentration risk

• What % of our ops does this vendor enable?
• How quickly can we switch if vendor fails?
• Do we have an exit plan documented?

---

Relationship Management

QBR (Quarterly Business Review) Agenda

1. Prior quarter review (15 min)
   - SLA attainment vs. target
   - Open tickets / escalations resolved
   - Incidents and post-mortem outcomes

2. Product roadmap (15 min)
   - Upcoming releases relevant to us
   - Feature requests we submitted — status

3. Our roadmap (10 min)
   - What we're building that will affect usage
   - Volume projections for next quarter

4. Action items (10 min)
   - Assign owners and due dates
   - Schedule next QBR

Vendor Relationship Health Indicators

• Green: SLA ≥ 98%, CSAT ≥ 4.0, responsive to escalations, roadmap alignment
• Yellow: SLA 95–97%, CSAT 3.5–3.9, delayed responses, minor roadmap gaps
• Red: SLA < 95%, CSAT < 3.5, unresolved escalations, no roadmap transparency

Off-boarding Checklist

• Data export completed and verified
• API keys revoked
• SSO connections removed
• User accounts deprovisioned
• Contract termination notice sent (verify notice period)
• Final invoice reconciled
• Data deletion confirmation received
• Lessons learned documented