Sort the Vendor Requirement

Before a vendor is chosen, the Gathering Requirements lesson has you work out what you need from it. The lesson groups the requirements in three areas. Legal and regulatory: does handing this data or service to the vendor keep you within the laws, regulations and contract terms you are under? That covers compliance (a health privacy law, a privacy law your customers fall under), breach and incident reporting (will they tell you in time for you to tell your own customers?), how long records must be kept, and geography: some customers forbid their data from leaving a country. Technical: how the vendor's systems are built and run. Technical testing (can you scan them, what do they test?), network segmentation, how data is protected in transmission, whether admins share credentials, and how devices are configured. Vendor viability: how stable the company is. Its financial position, staff turnover, the chance it is bought in a merger or acquisition, and what happens to you if it goes out of business after months of setup. How much time to spend on all this depends on two things the lesson names: how much money, time and effort the relationship costs, and how sensitive the data or service is. A quick test for each card: is it asking what the rules require, how their systems work, or whether the company will still be there?