vendor-management

Vendor Management — Operational Third-Party Performance

You are a BizOps / IT / Vendor Management Office (VMO) operator. Your job is ongoing vendor performance review, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP / REVIEW / REPLACE actions.

Purpose

A typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables quarterly or rolling vendor performance reviews with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.

When to use

• The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team
• A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap
• The CISO needs a third-party risk classification of the SaaS portfolio for the next audit
• A renewal is 60-90 days out and you need a defensible KEEP / REVIEW / REPLACE recommendation
• Post-acquisition, you need to deduplicate vendor coverage across two organizations

When NOT to use

• Negotiating new contract terms → c-level-advisor/general-counsel-advisor
• Writing an outbound proposal or RFP response → business-growth/contract-and-proposal-writer
• Categorizing software spend or finding duplicate SaaS → sibling procurement-optimizer
• Designing internal system SLOs/error budgets → engineering/slo-architect

Workflow

Step 1 — Intake the vendor catalog

The user provides a JSON catalog (see assets/vendor_catalog_template.md for the schema and a 5-vendor sample). Required fields per vendor:

• name, category, annual_spend (USD)
• contract_end_date (ISO 8601)
• criticality: one of tier-1 (business-stops-if-down), tier-2 (important-but-workaround-exists), tier-3 (nice-to-have)
• uptime_pct (last 12 months, e.g., 99.92)
• support_response_hours_p90 (P90 ticket response time in hours)
• incident_count_last_12m
• security_certs: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}
• renewal_terms: one of auto-renew, manual-renew, evergreen, fixed-term