Vendor Evaluation overview

On-demand governance workflow triggered when the organisation considers adopting a new third-party vendor, software product, or managed service. A cross-functional evaluation team including procurement, legal, security, and the sponsoring business unit assesses the vendor against defined criteria covering capability fit, financial stability, security posture, compliance certifications, and contract terms. Security reviews the vendor's SOC 2 or equivalent reports, and legal negotiates acceptable data processing agreements. Evaluation results are documented in a vendor assessment report, a recommendation is made, and the final decision is escalated to the appropriate approval authority. Approved vendors are onboarded into the vendor register.