Josh More - Assessing vendors: a hands-on guide to assessing infosec and IT vendors

It always irritates me when a book starts with a justification of its own existence, so it somewhat surprises me to be starting this book in this manner. However, we face many issues today that must be addressed. Vendor selection processes fail when an organization keeps a wrong vendor too long and fails to adapt to changing circumstances. These processes fail when a needed vendor is not selected because the selection process becomes bogged down in trivialities. They fail when mature organizations select immature vendors who are simply unable to provide what they promise.

Vendor management is something of a black art in the IT industry. Those who are most successful either dont follow a process or keep their processes secret. Some people seem to intrinsically know which vendors are worth working with and which ones are not. They know how to choose technologies without getting bogged down in analysis and without escaping to a level of superficiality that would come back to bite them, two very common sources of vendor management failure.

As people observed how some organizations were highly successful in managing their vendors, bringing their projects to completion within their budget, and others were failing to implement technology profitably (or at all), vendor management requirements began to be included in various standards and regulations. The assumption seems to be that if regulations and standards such as HIPAA or PCI require that people pay attention to vendors, these failures will just work themselves out. Sadly, that does not seem to be the case.

Thats why this book exists.

After first trying to find a workable vendor assessment process and then slowly building one of my own, it is time for me to let others in to the secret. I have, like many others in this industry, been forced to implement technologies based on other peoples mid-guided decisions. Ive made my own poor decisions and gotten myself and others stuck in the process. Ive tried to make better decisions by putting increasing analytics around the process only to find the analysis process itself cause us to miss the project timeline. Finally, after over a decade, Ive pieced together an approach that balances the need to find a good enough technology (product or service) without expending too many resources (time or money) getting there. I hope that my process will be of use to you.

All robust information assurance processes and regulations aside, successful vendor management involves a wide range of skills, from technical assessment to business communication to negotiation and covers many issues outside the scope of this book. Instead of trying to cover the world, this book focuses largely on the initial assessment process, with a goal to select a vendor to solve a specific problem that the organization is experiencing, improving an existing process or adding new capabilities. This book will touch on most of the skills needed to create a vendor management program, but will not delve very deeply into the continued operation aspects of such a program.

So why is vendor assessment needed?

Vendors engage in sales processes a whole lot more often than individuals do so they have a lot more practice at it. This results in a situation that is heavily tilted against buyers. Marketers are experts in manipulating how products are positioned and, because no product is perfect, there are many pressures against letting buyers run truly independent tests. Simultaneously, buyers must do more with less, so products positioned as time savers are more likely to be purchased.