Make the shortlist defendable.

Download the provider scorecard

Download the free CSV worksheet. Open it in Excel, Google Sheets or another spreadsheet. It has blank columns for three providers, evidence links and unresolved questions. No registration required.

This is a procurement aid, not an audit or certification. Adapt it to the project and have the people responsible for operations, security and purchasing review the criteria.

1. Write the decision brief

Record the business outcome, current environment, project owner, budget range and required delivery date. State the scope each proposal must include, including migration and ongoing operations.

• Outcome: what must improve, and how will you measure it?
• Dependencies: which applications, locations, identities and data flows must work together?
• Acceptance: who tests the service, against what criteria, before handover?
• Ownership: who responds after launch, including outside business hours?

2. Separate requirements from preferences

Mandatory requirements are gates. A provider that cannot meet one needs an explicit exception from the accountable owner; a high score elsewhere does not cancel the gap.

Examples include a supported integration, a contractual delivery date or access to specific security evidence. Ask for written confirmation and the scope it covers. A logo, presentation or generic assurance is not proof that your service meets the requirement.

3. Set weights and score the evidence

Choose weights that total 100 before reviewing responses. For a starting discussion, try delivery fit 25, security and data handling 20, operating support 20, total cost 20 and exit flexibility 15. These are suggested weights, not an industry benchmark.

Use 0 for a confirmed failure, 1 for a major gap, 2 for a partial fit, 3 for a fit supported by evidence, 4 for a useful improvement and 5 for a material advantage you can verify. Leave unverified items blank and resolve them before making the decision.

For each criterion, weighted points = weight × score ÷ 5. Sum the weighted points only when every required score is complete. Keep evidence references alongside the numbers so another reviewer can reproduce the result.

4. Compare the whole commitment

• Delivery: scope, dependencies, migration responsibility, acceptance criteria and escalation owner.
• Security: data access, subcontractors, incident notification and evidence applicable to the contracted service.
• Support: coverage hours, response commitments, escalation path and work excluded from the monthly fee.
• Cost: recurring fees, usage assumptions, implementation, integration, training and renewal changes.
• Exit: notice periods, export formats, transition support, fees and ownership of configuration and data.

Ask each provider to correct omissions in writing. Record assumptions separately from commitments, and compare the same term, usage and scope.

5. Match the scorecard to the service

For managed IT, emphasize service ownership and escalation. For cybersecurity, review the control coverage and incident responsibilities. For cloud and infrastructure, test migration, recovery and operating assumptions.

A facility decision needs additional detail. Use the ColoHunter colocation checklist for power, cooling, connectivity and site access questions. ColoHunter is a NexusLink company.

Turn the comparison into a decision

Write down why the selected provider fits, which risks remain, who accepts them and when those risks will be reviewed. Keep the completed scorecard with the agreed scope.

Start a conversation with NexusLink if you need help defining the requirement or finding providers. See how NexusLink is paid before engaging us, or return to all buying guides.