IT AI Skill

It Vendor Management

Manage IT vendor relationships including selection, onboarding, contract negotiation, performance monitoring, risk assessment, and offboarding. Use when evaluating IT vendors, negotiating technology contracts, managing vendor SLAs, conducting vendor risk as...

IT Vendor Management

Strategic management of IT vendor relationships from selection through offboarding.

Workflow

  1. Identify vendor need: define requirements, scope, and evaluation criteria.
  2. Market research and RFP: identify 3–5 potential vendors; issue RFP with detailed requirements.
  3. Vendor evaluation: score vendors against criteria (technical, financial, security, cost); shortlist to 2–3.
  4. Proof of concept / pilot: test shortlisted vendors in controlled environment (2–8 weeks).
  5. Negotiation: finalize pricing, SLAs, service credits, exit clauses, data ownership terms.
  6. Onboarding: execute contract, establish communication channels, integrate systems, train team.
  7. Ongoing management: monthly business reviews, SLA tracking, issue escalation, quarterly scorecards.
  8. Risk monitoring: continuous assessment of vendor financial health, security posture, compliance.
  9. Contract renewal/transition: evaluate performance at 60–90 days before renewal; decide renew/re-negotiate/replace.
  10. Offboarding: data retrieval, service transition, knowledge transfer, contract termination.

Vendor Selection Process

VENDOR SELECTION FRAMEWORK
============================

Phase 1: Requirements Definition

  Technical requirements:
    - Functional capabilities (must-have vs. nice-to-have)
    - Integration requirements (APIs, connectors, data format)
    - Performance requirements (latency, throughput, availability)
    - Scalability requirements (user count, data volume, growth rate)
    - Architecture preferences (SaaS, on-prem, hybrid, containerized)
    - Compliance requirements (SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS)

  Business requirements:
    - Budget range (annual and multi-year)
    - Implementation timeline
    - Support requirements (24/7, business hours, time zone coverage)
    - Training requirements
    - Contract terms preference (1, 3, 5 years)
    - Exit strategy requirements

  Scoring criteria (weighted):

    Category              Weight    Score (1–10)    Weighted Score
    ────────────────────  ────────  ─────────────   ──────────────
    Technical fit         30%       [score]         [score × 0.30]
    Cost (TCO, 3-year)    25%       [score]         [score × 0.25]
    Security/Compliance   20%       [score]         [score × 0.20]
    Vendor stability      10%       [score]         [score × 0.10]
    Customer references   10%       [score]         [score × 0.10]
    Support quality        5%       [score]         [score × 0.05]
    ────────────────────  ────────────────────────────────────────
    TOTAL                 100%                      [sum]

Phase 2: RFP Process

  RFP contents:
    1. Company overview and background
    2. Current challenges and pain points
    3. Detailed technical requirements (functional specification)
    4. Integration requirements (existing systems, APIs, data migration)
    5. Security and compliance requirements
    6. Pricing structure request (per user, per GB, flat fee, usage-based)
    7. Implementation timeline expectations
    8. Reference requests (3+ customers in similar industry/size)
    9. Evaluation criteria and process
    10. Response deadline and Q&A process

  RFP evaluation timeline:
    T+0:     RFP issued to vendors
    T+2 wks: Vendor Q&A period
    T+4 wks: RFP responses due
    T+5 wks: Initial scoring and shortlisting (3–5 → 2–3)
    T+6 wks: Vendor presentations/demos
    T+8 wks: Proof of concept / pilot begins
    T+12 wks: Pilot evaluation; final vendor selection
    T+14 wks: Contract negotiation begins
    T+16 wks: Contract execution; implementation kickoff

  Decision matrix (example):

    Criteria               Vendor A    Vendor B    Vendor C
    ────────────────────  ──────────  ──────────  ──────────
    Feature coverage      9/10        8/10        7/10
    Ease of integration   8/10        9/10        6/10
    Security posture      9/10        8/10        8/10
    3-year TCO            7/10        8/10        9/10
    Support quality       8/10        9/10        7/10
    Vendor stability      9/10        9/10        6/10
    Customer references   8/10        7/10        9/10
    ────────────────────  ──────────  ──────────  ──────────
    WEIGHTED TOTAL        8.4         8.4         7.5

    Winner: Vendor A or B (tiebreaker: integration ease → Vendor B)

Contract Negotiation

IT VENDOR CONTRACT KEY TERMS
==============================

Pricing and Payment:

  Pricing models:
    Per user/month:         $5–$500/user/month (most SaaS)
    Per GB/month:           $0.03–$0.50/GB (storage, data processing)
    Per transaction:        $0.001–$0.10/transaction (API calls, payments)
    Flat annual fee:        $50,000–$5,000,000+ (enterprise agreements)
    Usage-based tiered:     Volume discounts at thresholds

  Negotiation targets:
    - Annual commitment discount: 10–20% vs. monthly billing
    - Multi-year commitment: 15–30% discount (3-year vs. 1-year)
    - Volume discount thresholds: negotiate at 25%, 50%, 75%, 100% growth
    - Free tier for PoC/pilot: 30–90 days at no cost
    - Price lock: cap annual increases at 3–5% (not CPI or vendor discretion)
    - Payment terms: Net 30 standard; negotiate Net 60 for large contracts

  Red flags in pricing:
    - Hidden fees (implementation, onboarding, training, support upgrades)
    - Data egress fees (cloud storage: $0.05–$0.12/GB egress)
    - Minimum commitments (minimum user count even if not needed)
    - Auto-renewal without notice (require 60-day notice before renewal)
    - Price increases above CPI without justification

  Typical discount achievable:
    - List price to contract price: 20–40% discount achievable with proper negotiation
    - Enterprise agreements: up to 50% discount for large commitments
    - Open-source alternatives leverage: use as negotiation reference point

SLA Requirements:

  Standard SLA terms:

    Availability:
      Critical service:  99.95% uptime (1.5 hours downtime/month max)
      Important service: 99.9% uptime (4.38 hours downtime/month max)
      Standard service:  99.5% uptime (3.65 days downtime/month max)

    Response times:
      Severity 1 (outage):    15 minutes response, 1 hour resolution target
      Severity 2 (degraded):  1 hour response, 4 hours resolution target
      Severity 3 (minor):     4 hours response, 24 hours resolution target
      Severity 4 (cosmetic):  24 hours response, 5 business days resolution

    Service credits (for SLA breaches):
      99.5–99.9%:  10% of monthly fee
      99.0–99.5%:  25% of monthly fee
      95.0–99.0%:  50% of monthly fee
      < 95.0%:     100% of monthly fee + right to terminate

  Critical contract clauses:

    Data ownership:
      - Customer owns all data, full rights to access and export
      - Data export in standard format (CSV, JSON, API) at any time
      - Data deletion upon contract termination (within 30 days)
      - Data portability: no artificial barriers to data extraction

    Termination for convenience:
      - Either party can terminate with 60–90 days written notice
      - No penalty for termination for convenience after initial term
      - Transition assistance included in termination period

    Termination for cause:
      - Immediate termination for material breach
      - Examples: security breach, repeated SLA failures, bankruptcy
      - 30-day cure period for non-security breaches

    Liability cap:
      - Vendor liability capped at 12 months of fees (negotiate higher for critical vendors)
      - Exceptions: data breach, gross negligence, IP infringement (uncapped)
      - Indemnification for third-party claims

    Subcontracting:
      - Vendor must disclose all subcontractors
      - Customer approval required for critical subcontractors
      - Vendor remains fully responsible for subcontractor performance

Vendor Performance Management

VENDOR PERFORMANCE SCORECARD
==============================

Monthly/Quarterly vendor scorecard:

  Metric                          Target        Actual       Score (1–5)
  ─────────────────────────────  ────────────  ──────────  ─────────────
  Uptime/Availability              ≥ 99.9%      [actual]     [score]
  Ticket response time (P1)        ≤ 15 min     [actual]     [score]
  Ticket resolution time (P1)      ≤ 4 hours    [actual]     [score]
  SLA compliance rate              ≥ 95%        [actual]     [score]
  Bug/issue resolution rate        ≥ 90%        [actual]     [score]
  Feature delivery on time         ≥ 80%        [actual]     [score]
  Customer satisfaction (CSAT)     ≥ 4.0/5      [actual]     [score]
  Security audit score             ≥ 90/100     [actual]     [score]
  Cost vs. budget                  ± 5%         [actual]     [score]
  Escalation frequency             ≤ 2/quarter  [actual]     [score]
  ─────────────────────────────  ──────────────────────────────────────
  OVERALL SCORE                                            [average]

  Scoring:
    5 = Exceeds expectations (consistently above target)
    4 = Meets expectations (within target range)
    3 = Partially meets (occasionally below target, improving)
    2 = Below expectations (frequently below target)
    1 = Unacceptable (consistent failures, immediate action needed)

  Overall rating and actions:

    4.5–5.0: ⭐⭐⭐⭐⭐ Excellent — consider expanded engagement, partner tier upgrade
    3.5–4.4: ⭐⭐⭐⭐ Good — maintain relationship, minor improvement requests
    2.5–3.4: ⭐⭐⭐ Fair — improvement plan required, monthly reviews
    1.5–2.4: ⭐⭐ Poor — formal corrective action, 90-day improvement plan
    1.0–1.4: ⭐ Critical — begin exit planning, source alternatives

Monthly Business Review (MBR) agenda:

  1. Performance review (15 minutes)
     - SLA compliance summary
     - Incident review (count, severity, resolution times)
     - Scorecard scores and trends

  2. Issues and escalations (15 minutes)
     - Open issues status
     - Recent escalations and resolution
     - Customer-reported issues

  3. Roadmap and improvements (15 minutes)
     - Upcoming features/releases
     - Customer-requested features status
     - Innovation and recommendations

  4. Commercial review (10 minutes)
     - Usage and billing verification
     - Growth and expansion opportunities
     - Contract renewal timeline (if applicable)

  5. Action items (5 minutes)
     - Review prior action items status
     - Assign new action items with owners and due dates

Vendor Risk Management

VENDOR RISK ASSESSMENT FRAMEWORK
==================================

Risk categories and assessment:

  1. Financial Risk
     - Annual revenue: > $100M (low), $10–100M (medium), < $10M (high)
     - Years in business: > 10 (low), 5–10 (medium), < 5 (high)
     - Funding status: profitable (low), Series B+ (medium), seed/pre-seed (high)
     - Customer concentration: < 20% from single customer (low), > 50% (high)
     - Credit rating (if public): BBB+ (low), B (medium), below B (high)
     - Assess annually; immediate reassessment on news of funding issues

  2. Security Risk
     - SOC 2 Type II certification: yes (low), Type I only (medium), no (high)
     - Penetration testing: annual, third-party (low), internal only (medium), none (high)
     - Bug bounty program: active (low), none but pen-tested (medium), none (high)
     - Incident history: none in 2 years (low), 1+ in 2 years (medium), major breach (high)
     - Data encryption: at rest + in transit (low), in transit only (medium), none (high)
     - Assess at onboarding and annually

  3. Operational Risk
     - SLA track record: > 99.9% consistently (low), 99.5–99.9% (medium), < 99.5% (high)
     - Incident frequency: < 2/year (low), 2–5/year (medium), > 5/year (high)
     - Geographic redundancy: multi-region (low), single region (medium), single datacenter (high)
     - Business continuity plan: tested annually (low), documented only (medium), none (high)
     - Support model: 24/7 dedicated (low), business hours (medium), async/ticket only (high)

  4. Compliance Risk
     - Relevant certifications: all obtained (low), partial (medium), none (high)
     - Audit results: no findings (low), minor findings (medium), major findings (high)
     - Regulatory changes impact: low (low), moderate (medium), high (high)
     - Data residency compliance: meets all requirements (low), partial (medium), non-compliant (high)

  5. Strategic Risk
     - Vendor lock-in: low (open standards, easy migration) (low), moderate (medium), high (proprietary) (high)
     - Market position: leader (low), challenger (medium), niche/failing (high)
     - Product roadmap alignment: strong (low), partial (medium), misaligned (high)
     - M&A risk: well-funded (low), acquisition target rumors (medium), actively for sale (high)

Risk rating calculation:

  Overall risk = (Financial × 0.20) + (Security × 0.30) + (Operational × 0.20) + (Compliance × 0.15) + (Strategic × 0.15)

  Risk level:
    1–2: Low risk — standard monitoring, annual review
    3–4: Medium risk — quarterly review, mitigation plan
    5–6: High risk — monthly review, contingency planning required
    7–10: Critical risk — immediate action, begin exit planning

  Mitigation strategies by risk level:

    Low risk:
      - Standard contract terms
      - Annual review cycle
      - Standard data backup procedures

    Medium risk:
      - Enhanced SLA terms with higher service credits
      - Quarterly business reviews with risk assessment
      - Maintain data export capability and documentation
      - Identify alternative vendors (keep market knowledge current)

    High risk:
      - Monthly reviews with detailed risk tracking
      - Negotiated lower liability caps waived for critical services
      - Active migration plan to alternative vendor
      - Data duplication (maintain copies outside vendor)
      - Executive sponsorship of vendor risk management

    Critical risk:
      - Begin vendor transition immediately
      - Execute data extraction and migration
      - Legal review of termination clauses
      - Emergency procurement of replacement vendor

Vendor Onboarding and Offboarding

VENDOR ONBOARDING CHECKLIST
============================

Pre-contract (Weeks 1–2):
  ☐ Security assessment completed and approved
  ☐ Legal review of contract terms completed
  ☐ Procurement approval obtained
  ☐ Budget allocated and PO created
  ☐ Stakeholders identified and aligned

Implementation (Weeks 3–8):
  ☐ Project kickoff meeting with vendor
  ☐ Implementation plan with milestones and dependencies
  ☐ Technical integration: API keys, SSO, network access, data connectors
  ☐ Data migration plan (if applicable): scope, timeline, rollback plan
  ☐ User training: admin training (Week 4), end-user training (Week 6)
  ☐ Testing: functional testing, integration testing, UAT (Week 7)
  ☐ Go-live readiness review (Week 8)

Post-launch (Weeks 9–12):
  ☐ Hypercare period: vendor on-call support, daily check-ins
  ☐ Issue log: track and resolve post-launch issues within 48 hours
  ☐ SLA tracking begins (formal MBR at 30 days)
  ☐ User adoption tracking: login rates, feature usage, feedback
  ☐ Lessons learned: document what went well, what to improve for next vendor

Vendor offboarding process:

  Initiation (90 days before contract end or termination):
    1. Executive decision: renew, re-negotiate, or exit
    2. If exiting: notify vendor per contract terms (typically 60–90 days notice)
    3. Begin data extraction: request full data export in machine-readable format
    4. Inventory all vendor dependencies: integrations, APIs, workflows, stored data
    5. Identify replacement vendor or in-house alternative

  Transition (60 days before end):
    6. Data extraction complete: verify completeness and integrity
    7. Alternative solution testing: validate replacement meets requirements
    8. Integration migration: update API endpoints, data flows, workflows
    9. User migration training: train team on new tools/processes
    10. Cutover plan: detailed runbook for transition day

  Cutover (Final 30 days):
    11. Parallel run: operate both systems simultaneously (1–2 weeks)
    12. Validate data consistency between old and new systems
    13. Go-live on new system: redirect traffic, update configurations
    14. Monitor closely: 24/7 monitoring for first week post-cutover
    15. Vendor access revocation: disable API keys, SSO access, network access

  Closeout (After cutover):
    16. Confirm data deletion by vendor (written confirmation)
    17. Final invoice settlement
    18. Lessons learned documentation
    19. Update vendor inventory and procurement records
    20. Archive contract and performance records (7 years minimum)

Integration Points

Edge Cases