Vendor Selection Scorecard

Template Overview

Selecting third-party software vendors, infrastructure providers, or hardware suppliers without a standardized rubric often results in decisions driven by charismatic sales pitches rather than technical merit. The Vendor Selection Scorecard establishes a weighted decision matrix covering architectural fit, data security compliance, pricing transparency, API reliability, and exit-strategy risks.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Vendor Evaluation: [Procurement Category / Need]"
date_initiated: [YYYY-MM-DD]
lead_evaluator: "[[Lead Architect / Engineering Lead]]"
procurement_owner: "[[Head of Procurement / Finance]]"
budget_ceiling_annual: "$[Amount]"
evaluated_vendors: ["[[Vendor A]]", "[[Vendor B]]", "[[Vendor C]]"]
tags: [procurement, vendor-selection, rfp, enterprise-architecture, evaluation]
---

# Vendor Selection Scorecard — [Procurement Category]

## 1. Business Requirements & Selection Objectives
- **Target Capability Needed:** `[e.g., Enterprise Notarization & Code Signing Infrastructure]`
- **Primary Business Driver:** Accelerate automated macOS release builds while maintaining air-gapped cryptographic security.
- **Mandatory Disqualifiers:** Any vendor lacking SOC 2 Type II compliance or requiring cloud upload of private signing keys is immediately disqualified.

## 2. Weighted Criteria Matrix
*Weights must sum to 100%:*
- **Security & Cryptographic Isolation:** 30% Weight
- **Performance & Build Pipeline Latency:** 25% Weight
- **Cost & Pricing Predictability:** 20% Weight
- **Developer Ergonomics & API Quality:** 15% Weight
- **Vendor Viability & Exit Portability:** 10% Weight

## 3. Side-by-Side Vendor Scoring Table
*Scores rated 1 (Unacceptable) to 5 (Exemplary):*
| Evaluation Category | Weight | Vendor A (CloudSign Pro) | Vendor B (HardwareHSM Corp) | Vendor C (Self-Hosted Vault) |
|---|---|---|---|---|
| Security & Key Sovereignty | 30% | 3 (Keys in vendor cloud) | 5 (FIPS 140-3 Hardware HSM) | 4 (Self-managed YubiKey) |
| Latency & Throughput | 25% | 4 (Sub-2s cloud signing) | 4 (Sub-3s network HSM) | 2 (Manual engineer tap) |
| Cost & Commercial Terms | 20% | 2 ($24k/yr + per-sign fees) | 3 ($12k/yr fixed hardware) | 5 ($200 one-time hardware) |
| API & CI/CD Integration | 15% | 5 (Native GitHub Action) | 4 (PKCS#11 CLI runner) | 3 (Custom bash scripting) |
| Portability & Lock-In Risk | 10% | 2 (Proprietary vendor API) | 4 (Standard PKCS#11) | 5 (100% open-source) |
| **Weighted Composite Score** | **100%** | **3.35 / 5.0** | **4.15 / 5.0** | **3.70 / 5.0** |

## 4. Deep-Dive Vendor Pros and Cons
### Vendor B: HardwareHSM Corp (Selected Recommendation)
- **Strengths:** Hardware security module keeps private keys mathematically air-gapped; complies with strict Apple notary guidelines; predictable annual pricing.
- **Weaknesses:** Initial physical setup requires 2 weeks of lead time to ship enterprise HSM cards to datacenter.

### Vendor A: CloudSign Pro (Disqualified)
- **Fatal Flaw:** Requires uploading root cryptographic private keys to multi-tenant cloud servers. Violates core data sovereignty principles.

## 5. Final Recommendation & Procurement Next Steps
- **Selected Vendor:** **Vendor B (HardwareHSM Corp)**
- [ ] Submit procurement purchase order request to finance department.
- [ ] Schedule technical integration kickoff with security architecture team.
- [ ] Draft Master Services Agreement (MSA) redlines with legal counsel.

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Vendor Evaluation: Edge CDN & Static Hosting"
date_initiated: 2026-10-09
lead_evaluator: "[[David Chen]]"
procurement_owner: "[[Helena Vance]]"
budget_ceiling_annual: "$10,000"
evaluated_vendors: ["Cloudflare Workers", "AWS CloudFront", "Vercel"]
tags: [procurement, vendor-selection, rfp, enterprise-architecture, evaluation]
---

# Vendor Selection Scorecard — Edge CDN & Static Hosting

## 1. Selection Objectives
- Deliver 884+ static canonical pages with sub-50ms global latency and zero server cold starts.
- Native Git-driven deployments with instant rollback capability.

## 2. Scores Summary
- **Cloudflare Workers:** 4.8 / 5.0 (Global edge coverage, zero cold starts, $5/mo base tier).
- **AWS CloudFront:** 3.9 / 5.0 (Reliable, but complex IAM and slower edge cache invalidation).
- **Vercel:** 3.4 / 5.0 (Excellent DX, but bandwidth overage pricing is unpredictable).

## 3. Decision
- Selected **Cloudflare Workers** as primary global edge hosting provider.

When to Use and When to Avoid

When to Use

• Use during major enterprise software, cloud infrastructure, or hardware procurement decisions.
• Use to establish an objective, auditable justification for executive leadership and procurement boards.
• Use to compare competitive vendor bids during formal RFP processes.

When to Avoid

• Avoid using for small, inexpensive developer tools costing under $50/month.
• Avoid using when only one single vendor is technically capable of providing the solution.

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Analyze the vendor selection scorecard:
1. Calculate the weighted composite scores for all evaluated vendors to verify mathematical accuracy.
2. Highlight potential hidden risks (vendor lock-in, price escalation clauses, compliance gaps).
3. Draft a 1-page executive summary justifying the recommended vendor to the Chief Financial Officer.
Output in structured Markdown.

Your data remains securely on your Mac with zero cloud exposure.