A practical IT procurement process for businesses
A sound IT procurement process defines the business need, sets measurable requirements, checks security and vendor risk, compares full lifecycle cost, tests the preferred option, records approval, and plans renewal or exit before a contract is signed.
Match the procurement process to the decision risk
Not every purchase needs an RFP. Use a short documented check for low-risk, reversible purchases and a fuller review when the decision is difficult to undo or exposes important systems and data.
Standard, low-risk purchases
Confirm the business owner, approved specification, budget, compatibility, seller, warranty or support, asset record, and renewal or replacement date. This can suit ordinary accessories, approved device models, and small additions to an established platform.
High-impact or hard-to-reverse decisions
Expand the review when a purchase stores sensitive data, connects to identity or finance systems, creates administrator access, affects many users, requires migration, introduces a long contract, changes a critical workflow, or would be costly to exit.
Escalation rule: if the team cannot explain who owns the outcome, what evidence proves the choice, what the full lifecycle costs, and how the business can exit, pause the purchase and resolve those questions first.
The cheapest quote can become the most expensive system
Technology purchases affect more than the budget. A new application may receive customer information, connect to Microsoft 365, create administrator access, require staff training, duplicate an existing tool, or become essential to daily operations. A laptop or firewall may need compatible warranties, management, security, and replacement planning.
Procurement gives those decisions a consistent path. It reduces shadow IT, duplicate subscriptions, unsafe vendors, contract surprises, unsupported hardware, and systems that cannot export their data. The process should be proportional: a keyboard needs little review, while a cloud platform holding sensitive records needs much more.
A practical IT procurement workflow
Describe the business problem
Name the sponsor, affected users, current pain, desired outcome, timeline, sensitivity, budget range, and what happens if nothing changes. Do not start with a preferred brand.
Check what you already own
Review existing licences, hardware, contracts, integrations, support capacity, and renewal dates. The best procurement may be consolidating or configuring an existing platform.
Separate must-have from nice-to-have
Write measurable functional, technical, security, privacy, accessibility, support, migration, reporting, and exit requirements. Rank them before demonstrations begin.
Create a defensible shortlist
Compare credible options, compatibility, vendor stability, implementation partners, references, support coverage, and roadmap fit. Record why candidates were included or rejected.
Assess vendor and supply-chain risk
Identify data access, sub-processors, remote connections, hosting location, security controls, vulnerability handling, incident notice, recovery, certifications, ownership, and concentration risk.
Calculate lifecycle cost
Include purchase or subscription, implementation, migration, support, add-ons, storage growth, training, administration, renewal, taxes, currency, warranty, disposal, and exit.
Test with real work
Use representative users, files, devices, integrations, security controls, and failure scenarios. Score the results against the requirements and record who accepts residual risk.
Own the full lifecycle
Document configuration, assets, licences, owners, support, backups, renewal notice, access reviews, vendor reviews, replacement timing, data export, and secure disposal.
Score value, risk, and fit together
Set weights before vendors present. Adjust them to the actual business case rather than copying this example unchanged.
| Category | Example weight | Evidence to review |
|---|---|---|
| Functional fit | 25% | Requirements test and user pilot |
| Security and privacy | 20% | Controls, architecture, reports, contract, data flow |
| Total lifecycle cost | 20% | Three-year or five-year model with assumptions |
| Integration and operations | 15% | Technical proof, admin effort, monitoring, support |
| Vendor and service resilience | 10% | Ownership, continuity, recovery, incident history, references |
| Exit and portability | 10% | Export test, deletion terms, transition support, lock-in |
A weighted score supports judgment; it does not replace it. A vendor that fails a mandatory security, legal, compatibility, or continuity requirement should not win because it scores well elsewhere.
Compare vendor evidence without hiding mandatory failures
Use the worksheet to define requirements before demonstrations, record each vendor's evidence, apply your own weights and preserve the reason for the final decision.
Mark requirements that cannot be traded away
Use mandatory gates for legal, security, compatibility, accessibility, continuity or budget constraints. A failed gate stays visible even if the weighted total is high.
Score what was demonstrated or documented
Record the document, test, contract clause or pilot result behind each score. Leave unknowns open rather than treating a sales statement as verified evidence.
Record ownership and residual risk
Name the approver, unresolved assumptions, accepted risks, renewal checkpoint and exit trigger. The template supports review; it does not make the decision.
Download the IT procurement evaluation worksheet (CSV)
The file contains no macros or formulas and sends no data to North Star. Open it locally, adapt the criteria and keep sensitive vendor evidence in an approved system rather than the public worksheet.
Build the cost model before comparing prices
Total lifecycle cost = acquisition + implementation + migration + integration + training + operations + support + growth + renewal + exit - credible savings.
- Model every required licence, minimum seat count, add-on, and premium support tier.
- Include internal staff time and external professional services.
- State currency, tax, term, expected growth, renewal assumptions, and inflation assumptions.
- Price backup, security, identity, device management, storage, logging, and compliance needs separately when they are not included.
- Estimate the cost of downtime, failed migration, manual workarounds, and delayed adoption.
- Include data export, contract termination, replacement, and secure disposal.
For Microsoft and Google licensing examples, compare our Google Workspace pricing guide and Office 2021 versus Microsoft 365 guide. They show why the sticker price alone is not the buying decision.
Questions every critical technology vendor should answer
- What data and systems can the vendor, its staff, and its sub-processors access?
- Where is data stored, processed, backed up, and supported from?
- How are data and administrative connections encrypted and authenticated?
- Does the service support multi-factor authentication, single sign-on, least privilege, and useful audit logs?
- How are vulnerabilities received, prioritized, patched, disclosed, and communicated?
- What incident notification timeline and cooperation obligations are written into the contract?
- How are continuity, disaster recovery, backups, and restoration tested?
- Can the business export all required data in a usable format, and how is remaining data deleted?
- What happens if the vendor is acquired, changes hosting, removes a feature, raises prices, or ends the service?
The Canadian Centre for Cyber Security recommends knowing which vendors access data and support critical functions, maintaining a third-party inventory, classifying vendors by criticality, setting minimum security requirements, and re-evaluating suppliers regularly.
Use the same governance, then change the evidence
Standardize the fleet
Check warranty, lifecycle, repairability, approved sellers, delivery, spares, device management, security features, compatibility, disposal, and the operational cost of supporting too many models.
Map data and contract risk
Check licences, data flow, identity, integrations, backup, retention, privacy, accessibility, support, service levels, renewal, price protection, portability, deletion, and the effort to administer the platform.
Bring these six inputs to a procurement review
A useful review can start before a shortlist is complete. Document what is known, label assumptions, and record unanswered questions instead of waiting for a perfect specification.
Problem and outcome
What needs to change, who is affected, how success will be measured, and what happens if the organization does nothing.
Users, data, and access
Who will use or administer the system, which information it will handle, and which business systems it must connect to.
Must-have requirements
The measurable functional, technical, security, privacy, accessibility, support, reporting, and portability requirements that cannot be traded away.
Budget and timing
The available budget range, decision date, implementation window, contract deadline, renewal date, and any operational blackout periods.
Current environment
Existing licences, devices, contracts, integrations, standards, support resources, and tools that might already meet the need.
Decision ownership
Who sponsors the purchase, validates technical fit, reviews risk and terms, approves the budget, and owns the service after deployment.
Check the current vendor guidance
These sources provide risk-management guidance, not legal advice or a universal procurement policy. Adapt the process to your organization, contracts, data, and regulatory obligations.
- Canadian Centre for Cyber Security: supply-chain security for small and medium organizations
- Canadian Centre for Cyber Security: supply-chain risk management controls
- NIST SP 800-161 Rev. 1 Update 1: cybersecurity supply-chain risk management
- Government of Canada Digital Accessibility Toolkit: accessibility in ICT procurement
Questions Canadian teams ask
What is an IT procurement process?
An IT procurement process is the repeatable path used to define a need, evaluate options, assess security and vendor risk, compare full lifecycle cost, approve a purchase, deploy it, and manage renewal or retirement. It applies to hardware, software, cloud services, and outsourced technology.
Who should approve an IT purchase?
The business owner should approve the need and budget, IT should approve architecture, support, and security, privacy or legal reviewers should assess data and contract obligations when needed, and procurement or finance should confirm commercial terms. Higher-risk systems need more review than ordinary accessories.
How should a business compare software vendors?
Use weighted criteria tied to requirements. Score functional fit, security, identity integration, data location, privacy, implementation, support, resilience, exit options, contract terms, and total cost. A pilot with real users is more reliable than a sales demonstration.
What costs are often missed in IT procurement?
Common omissions include implementation, migration, training, integrations, premium support, backup, storage growth, identity add-ons, contract minimums, currency, taxes, renewal increases, device management, staff administration, and the cost to export or replace the system later.
What security questions should be in software procurement?
Ask how data is encrypted, where it is stored, which sub-processors receive it, whether MFA and single sign-on are supported, what logs are available, how vulnerabilities are handled, how quickly incidents are reported, how data is exported and deleted, and how service continuity is tested.
How often should vendors be reviewed?
Review critical vendors at least on a defined recurring schedule and whenever the service, ownership, data use, contract, integration, security posture, or business criticality changes. Renewal should be a decision point, not an automatic payment event.
Making a high-impact technology purchase?
Bring the problem, users, current environment, timing, budget range, and known constraints. North Star can help turn those inputs into requirements, compare options, model lifecycle cost, assess technical risk, and define the implementation path.
Review an IT procurement decisionSee Vendor Management