--- name: it-vendor-management description: Manage IT vendor relationships including selection, onboarding, contract negotiation, performance monitoring, risk assessment, and offboarding. Use when evaluating IT vendors, negotiating technology contracts, managing vendor SLAs, conducting vendor risk assessments, optimizing vendor spend, handling vendor incidents, or planning vendor transitions. Triggers on phrases like "vendor management", "IT vendor", "vendor selection", "vendor contract", "vendor SLA", "vendor risk", "vendor assessment", "vendor offboarding", "technology partner", "vendor scorecard". --- # IT Vendor Management Strategic management of IT vendor relationships from selection through offboarding. ## Workflow 1. Identify vendor need: define requirements, scope, and evaluation criteria. 2. Market research and RFP: identify 3–5 potential vendors; issue RFP with detailed requirements. 3. Vendor evaluation: score vendors against criteria (technical, financial, security, cost); shortlist to 2–3. 4. Proof of concept / pilot: test shortlisted vendors in controlled environment (2–8 weeks). 5. Negotiation: finalize pricing, SLAs, service credits, exit clauses, data ownership terms. 6. Onboarding: execute contract, establish communication channels, integrate systems, train team. 7. Ongoing management: monthly business reviews, SLA tracking, issue escalation, quarterly scorecards. 8. Risk monitoring: continuous assessment of vendor financial health, security posture, compliance. 9. Contract renewal/transition: evaluate performance at 60–90 days before renewal; decide renew/re-negotiate/replace. 10. Offboarding: data retrieval, service transition, knowledge transfer, contract termination. ## Vendor Selection Process ``` VENDOR SELECTION FRAMEWORK ============================ Phase 1: Requirements Definition Technical requirements: - Functional capabilities (must-have vs. nice-to-have) - Integration requirements (APIs, connectors, data format) - Performance requirements (latency, throughput, availability) - Scalability requirements (user count, data volume, growth rate) - Architecture preferences (SaaS, on-prem, hybrid, containerized) - Compliance requirements (SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS) Business requirements: - Budget range (annual and multi-year) - Implementation timeline - Support requirements (24/7, business hours, time zone coverage) - Training requirements - Contract terms preference (1, 3, 5 years) - Exit strategy requirements Scoring criteria (weighted): Category Weight Score (1–10) Weighted Score ──────────────────── ──────── ───────────── ────────────── Technical fit 30% [score] [score × 0.30] Cost (TCO, 3-year) 25% [score] [score × 0.25] Security/Compliance 20% [score] [score × 0.20] Vendor stability 10% [score] [score × 0.10] Customer references 10% [score] [score × 0.10] Support quality 5% [score] [score × 0.05] ──────────────────── ──────────────────────────────────────── TOTAL 100% [sum] Phase 2: RFP Process RFP contents: 1. Company overview and background 2. Current challenges and pain points 3. Detailed technical requirements (functional specification) 4. Integration requirements (existing systems, APIs, data migration) 5. Security and compliance requirements 6. Pricing structure request (per user, per GB, flat fee, usage-based) 7. Implementation timeline expectations 8. Reference requests (3+ customers in similar industry/size) 9. Evaluation criteria and process 10. Response deadline and Q&A process RFP evaluation timeline: T+0: RFP issued to vendors T+2 wks: Vendor Q&A period T+4 wks: RFP responses due T+5 wks: Initial scoring and shortlisting (3–5 → 2–3) T+6 wks: Vendor presentations/demos T+8 wks: Proof of concept / pilot begins T+12 wks: Pilot evaluation; final vendor selection T+14 wks: Contract negotiation begins T+16 wks: Contract execution; implementation kickoff Decision matrix (example): Criteria Vendor A Vendor B Vendor C ──────────────────── ────────── ────────── ────────── Feature coverage 9/10 8/10 7/10 Ease of integration 8/10 9/10 6/10 Security posture 9/10 8/10 8/10 3-year TCO 7/10 8/10 9/10 Support quality 8/10 9/10 7/10 Vendor stability 9/10 9/10 6/10 Customer references 8/10 7/10 9/10 ──────────────────── ────────── ────────── ────────── WEIGHTED TOTAL 8.4 8.4 7.5 Winner: Vendor A or B (tiebreaker: integration ease → Vendor B) ``` ## Contract Negotiation ``` IT VENDOR CONTRACT KEY TERMS ============================== Pricing and Payment: Pricing models: Per user/month: $5–$500/user/month (most SaaS) Per GB/month: $0.03–$0.50/GB (storage, data processing) Per transaction: $0.001–$0.10/transaction (API calls, payments) Flat annual fee: $50,000–$5,000,000+ (enterprise agreements) Usage-based tiered: Volume discounts at thresholds Negotiation targets: - Annual commitment discount: 10–20% vs. monthly billing - Multi-year commitment: 15–30% discount (3-year vs. 1-year) - Volume discount thresholds: negotiate at 25%, 50%, 75%, 100% growth - Free tier for PoC/pilot: 30–90 days at no cost - Price lock: cap annual increases at 3–5% (not CPI or vendor discretion) - Payment terms: Net 30 standard; negotiate Net 60 for large contracts Red flags in pricing: - Hidden fees (implementation, onboarding, training, support upgrades) - Data egress fees (cloud storage: $0.05–$0.12/GB egress) - Minimum commitments (minimum user count even if not needed) - Auto-renewal without notice (require 60-day notice before renewal) - Price increases above CPI without justification Typical discount achievable: - List price to contract price: 20–40% discount achievable with proper negotiation - Enterprise agreements: up to 50% discount for large commitments - Open-source alternatives leverage: use as negotiation reference point SLA Requirements: Standard SLA terms: Availability: Critical service: 99.95% uptime (1.5 hours downtime/month max) Important service: 99.9% uptime (4.38 hours downtime/month max) Standard service: 99.5% uptime (3.65 days downtime/month max) Response times: Severity 1 (outage): 15 minutes response, 1 hour resolution target Severity 2 (degraded): 1 hour response, 4 hours resolution target Severity 3 (minor): 4 hours response, 24 hours resolution target Severity 4 (cosmetic): 24 hours response, 5 business days resolution Service credits (for SLA breaches): 99.5–99.9%: 10% of monthly fee 99.0–99.5%: 25% of monthly fee 95.0–99.0%: 50% of monthly fee < 95.0%: 100% of monthly fee + right to terminate Critical contract clauses: Data ownership: - Customer owns all data, full rights to access and export - Data export in standard format (CSV, JSON, API) at any time - Data deletion upon contract termination (within 30 days) - Data portability: no artificial barriers to data extraction Termination for convenience: - Either party can terminate with 60–90 days written notice - No penalty for termination for convenience after initial term - Transition assistance included in termination period Termination for cause: - Immediate termination for material breach - Examples: security breach, repeated SLA failures, bankruptcy - 30-day cure period for non-security breaches Liability cap: - Vendor liability capped at 12 months of fees (negotiate higher for critical vendors) - Exceptions: data breach, gross negligence, IP infringement (uncapped) - Indemnification for third-party claims Subcontracting: - Vendor must disclose all subcontractors - Customer approval required for critical subcontractors - Vendor remains fully responsible for subcontractor performance ``` ## Vendor Performance Management ``` VENDOR PERFORMANCE SCORECARD ============================== Monthly/Quarterly vendor scorecard: Metric Target Actual Score (1–5) ───────────────────────────── ──────────── ────────── ───────────── Uptime/Availability ≥ 99.9% [actual] [score] Ticket response time (P1) ≤ 15 min [actual] [score] Ticket resolution time (P1) ≤ 4 hours [actual] [score] SLA compliance rate ≥ 95% [actual] [score] Bug/issue resolution rate ≥ 90% [actual] [score] Feature delivery on time ≥ 80% [actual] [score] Customer satisfaction (CSAT) ≥ 4.0/5 [actual] [score] Security audit score ≥ 90/100 [actual] [score] Cost vs. budget ± 5% [actual] [score] Escalation frequency ≤ 2/quarter [actual] [score] ───────────────────────────── ────────────────────────────────────── OVERALL SCORE [average] Scoring: 5 = Exceeds expectations (consistently above target) 4 = Meets expectations (within target range) 3 = Partially meets (occasionally below target, improving) 2 = Below expectations (frequently below target) 1 = Unacceptable (consistent failures, immediate action needed) Overall rating and actions: 4.5–5.0: ⭐⭐⭐⭐⭐ Excellent — consider expanded engagement, partner tier upgrade 3.5–4.4: ⭐⭐⭐⭐ Good — maintain relationship, minor improvement requests 2.5–3.4: ⭐⭐⭐ Fair — improvement plan required, monthly reviews 1.5–2.4: ⭐⭐ Poor — formal corrective action, 90-day improvement plan 1.0–1.4: ⭐ Critical — begin exit planning, source alternatives Monthly Business Review (MBR) agenda: 1. Performance review (15 minutes) - SLA compliance summary - Incident review (count, severity, resolution times) - Scorecard scores and trends 2. Issues and escalations (15 minutes) - Open issues status - Recent escalations and resolution - Customer-reported issues 3. Roadmap and improvements (15 minutes) - Upcoming features/releases - Customer-requested features status - Innovation and recommendations 4. Commercial review (10 minutes) - Usage and billing verification - Growth and expansion opportunities - Contract renewal timeline (if applicable) 5. Action items (5 minutes) - Review prior action items status - Assign new action items with owners and due dates ``` ## Vendor Risk Management ``` VENDOR RISK ASSESSMENT FRAMEWORK ================================== Risk categories and assessment: 1. Financial Risk - Annual revenue: > $100M (low), $10–100M (medium), < $10M (high) - Years in business: > 10 (low), 5–10 (medium), < 5 (high) - Funding status: profitable (low), Series B+ (medium), seed/pre-seed (high) - Customer concentration: < 20% from single customer (low), > 50% (high) - Credit rating (if public): BBB+ (low), B (medium), below B (high) - Assess annually; immediate reassessment on news of funding issues 2. Security Risk - SOC 2 Type II certification: yes (low), Type I only (medium), no (high) - Penetration testing: annual, third-party (low), internal only (medium), none (high) - Bug bounty program: active (low), none but pen-tested (medium), none (high) - Incident history: none in 2 years (low), 1+ in 2 years (medium), major breach (high) - Data encryption: at rest + in transit (low), in transit only (medium), none (high) - Assess at onboarding and annually 3. Operational Risk - SLA track record: > 99.9% consistently (low), 99.5–99.9% (medium), < 99.5% (high) - Incident frequency: < 2/year (low), 2–5/year (medium), > 5/year (high) - Geographic redundancy: multi-region (low), single region (medium), single datacenter (high) - Business continuity plan: tested annually (low), documented only (medium), none (high) - Support model: 24/7 dedicated (low), business hours (medium), async/ticket only (high) 4. Compliance Risk - Relevant certifications: all obtained (low), partial (medium), none (high) - Audit results: no findings (low), minor findings (medium), major findings (high) - Regulatory changes impact: low (low), moderate (medium), high (high) - Data residency compliance: meets all requirements (low), partial (medium), non-compliant (high) 5. Strategic Risk - Vendor lock-in: low (open standards, easy migration) (low), moderate (medium), high (proprietary) (high) - Market position: leader (low), challenger (medium), niche/failing (high) - Product roadmap alignment: strong (low), partial (medium), misaligned (high) - M&A risk: well-funded (low), acquisition target rumors (medium), actively for sale (high) Risk rating calculation: Overall risk = (Financial × 0.20) + (Security × 0.30) + (Operational × 0.20) + (Compliance × 0.15) + (Strategic × 0.15) Risk level: 1–2: Low risk — standard monitoring, annual review 3–4: Medium risk — quarterly review, mitigation plan 5–6: High risk — monthly review, contingency planning required 7–10: Critical risk — immediate action, begin exit planning Mitigation strategies by risk level: Low risk: - Standard contract terms - Annual review cycle - Standard data backup procedures Medium risk: - Enhanced SLA terms with higher service credits - Quarterly business reviews with risk assessment - Maintain data export capability and documentation - Identify alternative vendors (keep market knowledge current) High risk: - Monthly reviews with detailed risk tracking - Negotiated lower liability caps waived for critical services - Active migration plan to alternative vendor - Data duplication (maintain copies outside vendor) - Executive sponsorship of vendor risk management Critical risk: - Begin vendor transition immediately - Execute data extraction and migration - Legal review of termination clauses - Emergency procurement of replacement vendor ``` ## Vendor Onboarding and Offboarding ``` VENDOR ONBOARDING CHECKLIST ============================ Pre-contract (Weeks 1–2): ☐ Security assessment completed and approved ☐ Legal review of contract terms completed ☐ Procurement approval obtained ☐ Budget allocated and PO created ☐ Stakeholders identified and aligned Implementation (Weeks 3–8): ☐ Project kickoff meeting with vendor ☐ Implementation plan with milestones and dependencies ☐ Technical integration: API keys, SSO, network access, data connectors ☐ Data migration plan (if applicable): scope, timeline, rollback plan ☐ User training: admin training (Week 4), end-user training (Week 6) ☐ Testing: functional testing, integration testing, UAT (Week 7) ☐ Go-live readiness review (Week 8) Post-launch (Weeks 9–12): ☐ Hypercare period: vendor on-call support, daily check-ins ☐ Issue log: track and resolve post-launch issues within 48 hours ☐ SLA tracking begins (formal MBR at 30 days) ☐ User adoption tracking: login rates, feature usage, feedback ☐ Lessons learned: document what went well, what to improve for next vendor Vendor offboarding process: Initiation (90 days before contract end or termination): 1. Executive decision: renew, re-negotiate, or exit 2. If exiting: notify vendor per contract terms (typically 60–90 days notice) 3. Begin data extraction: request full data export in machine-readable format 4. Inventory all vendor dependencies: integrations, APIs, workflows, stored data 5. Identify replacement vendor or in-house alternative Transition (60 days before end): 6. Data extraction complete: verify completeness and integrity 7. Alternative solution testing: validate replacement meets requirements 8. Integration migration: update API endpoints, data flows, workflows 9. User migration training: train team on new tools/processes 10. Cutover plan: detailed runbook for transition day Cutover (Final 30 days): 11. Parallel run: operate both systems simultaneously (1–2 weeks) 12. Validate data consistency between old and new systems 13. Go-live on new system: redirect traffic, update configurations 14. Monitor closely: 24/7 monitoring for first week post-cutover 15. Vendor access revocation: disable API keys, SSO access, network access Closeout (After cutover): 16. Confirm data deletion by vendor (written confirmation) 17. Final invoice settlement 18. Lessons learned documentation 19. Update vendor inventory and procurement records 20. Archive contract and performance records (7 years minimum) ``` ## Integration Points - **Procurement systems** (Coupa, SAP Ariba, Workday Procurement): Vendor master data, PO management, contract lifecycle, spend tracking - **Contract management** (Icertis, Conga, DocuWare): Central repository for all vendor contracts; renewal reminders; clause library - **Vendor risk platforms** (ProcessUnity, Varrisor, VendorToolkit): Automated vendor risk assessment; continuous monitoring; compliance tracking - **IT asset management** (ServiceNow, Snipe-IT): Link vendor contracts to assets; track license counts and renewal dates - **Financial systems** (SAP, Oracle, NetSuite): Vendor payment processing; budget tracking; invoice reconciliation - **Security platforms** (SailPoint, Okta, OneTrust): Vendor access management; third-party risk assessment; compliance evidence collection - **Project management** (Jira, Asana, Monday): Track vendor implementation projects; milestone tracking; issue management - **Communication tools** (Slack, Teams): Vendor collaboration channels; incident communication; business review scheduling ## Edge Cases - **Vendor goes bankrupt or ceases operations**: Immediate activation of contingency plan; data retrieval within 30 days per contract; emergency procurement of replacement (expedited, may cost 20–50% premium); migrate data and re-integrate within 60–90 days; consider buying vendor's assets if strategic - Pre-mitigation: maintain data exports quarterly; document all integrations; keep alternative vendor shortlist updated - During crisis: freeze all new vendor dependencies; accelerate migration of critical services; executive-level vendor communications - Timeline: 30–90 days to full migration (depending on complexity) - **Vendor acquired by competitor**: Assess strategic implications immediately; review contract terms (acquisition clause); negotiate with new parent company; evaluate whether combined entity creates monopolistic pricing power; consider accelerated migration if competitive concerns arise - Contract review: check change-of-control clause (typically requires customer consent for material changes) - Pricing impact: acquisitions often lead to 10–30% price increases within 12–24 months - Data privacy: ensure acquired vendor maintains same security standards; request new SOC 2 report - **Vendor lock-in** (proprietary data formats, deep integration, switching costs > 6 months): Mitigate proactively: maintain data in standard formats; use abstraction layer for integrations; document all custom configurations; negotiate data portability clauses; budget annual exit cost estimate; conduct annual "day in the life of migration" exercise - Lock-in score: assess annually on 1–10 scale (technical, contractual, operational, financial dimensions) - Lock-in > 7: begin reduction plan within 6 months; invest in standardization and documentation - Budget: allocate 1–2% of annual vendor spend as "exit fund" for critical vendor relationships - **Global vendor management** (vendors operating across multiple countries): Handle multi-jurisdictional compliance (GDPR, CCPA, local data laws); negotiate global master agreement with country-specific addendums; manage currency and tax implications; coordinate regional vendor relationships under unified strategy; track vendor's geopolitical risk exposure - Master Services Agreement (MSA): global terms with local Statement of Work (SOW) per region - Data residency: ensure vendor infrastructure in each region meets local requirements - Multi-language support: vendor support available in all operating languages - Currency: negotiate in stable currency (USD/EUR); hedge if necessary - **Open-source vendor management** (commercial support for open-source software): Understand support model (subscription for support, not for license); evaluate vendor's commitment to upstream project; assess community health (contributor count, issue resolution time); ensure vendor cannot fork and abandon community version; check license compliance (GPL, Apache, MIT) - Examples: Red Hat (RHEL), SUSE, MongoDB Atlas, Elastic, Confluent - Risk: vendor diverges from community version (MongoDB → SSPL license change) - Mitigation: maintain ability to run community version; track license changes - **Startup/vendor partnership** (early-stage vendor with high potential but higher risk): Smaller contracts with shorter terms (6–12 months instead of 3 years); milestone-based payments; enhanced due diligence on financial runway; require customer references aggressively; negotiate favorable terms as early adopter (pricing discounts, feature influence, dedicated support); maintain exit strategy despite partnership enthusiasm - Typical startup vendor discount: 30–50% off list price for early commitment - Risk monitoring: track funding rounds, employee count, product milestones quarterly - Partnership benefit: influence product roadmap; dedicated engineering support; co-marketing opportunities