Vendor management

Define requirements before looking at options

Written before any demo: what the vendor must do, the volume and service level required, what must integrate with what, and the constraints that are genuinely non-negotiable.

Requirements written after seeing a product describe that product. This is the most common way selections are decided before they are run.

Separate must-have from nice-to-have and weight them in advance. Weighting after scoring is how a preferred vendor wins a process designed to be objective.

Evaluating

• Reference checks with customers of your size and use case. A reference running a tenth of your volume tells you nothing about whether it scales.
• Test the actual failure modes, not the demo path. What happens when data is malformed, volume spikes, or an integration times out?
• Assess the vendor, not just the product — financial stability, roadmap direction, support responsiveness, and whether you are a meaningful customer to them. Being a rounding error to your critical supplier is a risk in itself.
• Total cost including your side: implementation, integration, migration, training, and the ongoing effort to operate it. License cost is frequently the smaller half.

Terms that matter operationally

Beyond the legal review: service levels with real remedies, support response times by severity, data export in a usable format on demand, notice periods that give you time to migrate, and price protection at renewal. The absence of the last two is what makes exit expensive later.

Managing

• One named owner on your side. Vendors without an internal owner drift and renew automatically.
• Review on a schedule against the service levels, with evidence. Vendor-supplied performance reports mark their own work.
• Log issues. At renewal, a documented pattern is leverage; a recollection is not.
• Diarize renewals well before the notice deadline. Auto-renewal past an unnoticed deadline is the most common and most avoidable vendor loss.

Concentration and exit

Know which vendors you could not operate without and what happens if one fails, is acquired, or triples its price. For each, know the exit path and roughly what it costs — an exit plan that has never been thought through is not an option, it is a hope.

Maintain your own copy of your data continuously where the vendor holds anything critical.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Never

• Sign before you know what leaving costs — data export, notice period, transition support.
• Let the vendor write the requirements you evaluate them against.
• Reach a renewal date without having started the renewal. The auto-renew clause is their leverage.
• Concentrate a critical dependency on one vendor without saying so out loud and pricing the risk.