4.6: The Vendor Evaluation Worksheet

The Vendor Evaluation Worksheet

Everything in this module, compressed onto pages you can bring to a vendor call. The worksheet is a standalone page, styled for printing — print it to PDF, or keep it open in a tab during evaluations.

What’s in it, and why

Section 1 — Scope and stakes. What the vendor touches, which blast-radius tier it lands in (lesson 4.3), and what leaving in 90 days would take. Filling in the tier before the sales calls anchors how much diligence the rest deserves — a Tier 3 annoyance doesn’t need the full treatment; a Tier 1 dependency needs every line.

Section 2 — The SOC 2 pass. The four reads from lesson 4.1: scope, exceptions, carve-outs, CUECs. One line each. The CUEC line has a second box — who on our side confirmed we actually do these — because that’s the half everyone skips.

Section 3 — Questions that can’t be faked. The lesson 4.4 list with space for answers. The worksheet works because answers get written down: vague answers look vague on paper in a way they don’t sound in a demo.

Section 4 — Contract terms. Pilot with defined success criteria, termination for convenience, quality SLA, breach notification window, data return. Checkboxes, plus a “traded away because” line — sometimes you’ll concede a term deliberately, and the record of why is what makes the next renewal smarter.

Section 5 — Decision. Who decided, what tipped it, revisit date. Three lines. When the renewal or the incident arrives, this box is the difference between institutional memory and archaeology.

Make it repeatable

For a one-off purchase, the printed sheet is enough. If vendor review is becoming a recurring workflow — quarterly renewals, procurement gating — our tool Vesta runs this same structure as a repeatable process instead of a stack of PDFs.

One module down in Act 3. Next: the decisions nobody wants to practice — incidents.