Governance / 02

Secure IT procurement

Connect business need to contract terms, total cost and a safe exit.

This work is currently open on this device. Sign in to save it and continue on another device.

Procurement, engineering and security contribute different evidence to one decision. The lowest licence price does not explain operation, integration, data migration and exit costs. Define requirements and acceptance tests before comparing suppliers on the same scope. ENISA’s July 2026 guidance focuses on healthcare; this general workflow does not extend its scope into a universal obligation.

Map the process

0 / 5 steps reviewed.

Step 1 / 5

Define the need

Have the owner record the use case, data class and outage tolerance. Explain why the current solution is insufficient and what success means. Include security requirements in the bid scope rather than a last-minute questionnaire.

Expected evidence

Requirements and acceptance criteria

One control, three perspectives

Can we operate the product securely?

Run pilot access and logging tests.

Acceptance test output

Evaluate evidence

Claim: The service supports a safe exit.

Weak support

A brochure says “leave at any time”.

Stronger support

What evidence would you request before closing this claim?

Decision desk

A low-price SaaS bid omits exit terms and log access.

How do you proceed?

Cost desk

Undiscounted planning estimate in one currency. Excludes taxes, exchange rates and price escalation. Do not treat missing costs as zero; enter 0 only when genuinely free.

CurrencyPeriod (years)Annual licenceAnnual supportOne-off setupOne-off migrationOne-off exit

Planned total—

Enter all costs and a whole-number period from 1 to 20 years.

Worked example

This record is fictional. Do not treat sample results as evidence for your own work.

Requirement	Owner	Bid scope	Evidence	Gap	Decision	Acceptance test	Exit condition
BUY-001	Example service owner	SaaS + support	Fictional pilot report	Permission export missing	Conditional; not accepted	Restore with permissions pending	Data + permissions + deletion record

Closure checklist

0 / 4

Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.

Requirements defined before bidding.Cost periods and assumptions match.Critical gaps have owners.No closure before exit and acceptance testing.

Take it to work

Files in the selected language. The workbook includes blank records, a worked example and a checklist.

Complete workpackZIP · EN Editable workpaperXLSX · EN Printable workpaperPDF · EN Blank record templateCSV · EN Full guide and scenarioMD · EN

Keep learning

Explore related Academy courses

Sources and edition

Checked: 2026-10-21 · Edition 2026.10