IT procurement: how an enterprise buys technology

The IT procurement process, from requirements to renewal

US bank regulators set out the life of a supplier relationship in their June 2023 interagency guidance. It has five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. The guidance applies to every stage, not only the purchase.²

Requirements and the market scan come first. The UK government's purchasing guidance tells buyers to work out as much of the full cost of building or buying as they can. They then set the most they will spend for the business outcome they want, survey what the market offers, and plan the product's life through upgrades and retirement.⁵

Evaluation tests the shortlist on real work. The same guidance suggests a trial on a small scale. The buyer tries to solve one small but hard problem, tests integration with current systems, checks the product with its users and confirms it meets accessibility rules.⁶

Negotiation usually starts from the supplier's standard contract. The interagency guidance says a buyer can ask for changes, extra provisions or addenda. Where its negotiating power is limited, the buyer should understand the limits and risks that result, and decide whether the residual risk is acceptable.⁷

At renewal, the UK guidance has commercial and technical teams keep working together on the ongoing value of each contract. It also says contracts cannot be extended automatically unless there are extenuating circumstances.^8,9

Who owns the decision: IT, procurement or the business

In US federal agencies, the CIO approves IT acquisitions. OMB requires it under FITARA. GAO checked in January 2018. Only 11 of 96 IT contracts it sampled at 10 agencies had been reviewed and approved by the CIO. The 85 contracts not reviewed had a total possible value of about $23.8 billion.¹⁰

Procurement staff run the process. The US Bureau of Labor Statistics says purchasing managers coordinate buyers and develop the organization's procurement policies and procedures. Buyers weigh price, quality, availability, reliability and technical support when they choose a supplier.^1,11

Accountability stays with the organization that buys. The interagency guidance says a bank's use of third parties does not diminish its responsibility to meet its legal and safety requirements. It carries that responsibility to the same extent as if it did the work in-house.¹²

Our pages on it procurement

• Source-to-Pay (S2P) Software and Procurement PlatformsBuyer Guide
• SaaS Management & OptimizationBuyer Guide
• Contract Lifecycle Management (CLM) SoftwareBuyer Guide
• RFP questions: commercialRFP questions
• RFP questions: legal contracting ipRFP questions
• RFP questions: migration exitRFP questions
• RFP questions: third party supply chainRFP questions
• Choose and buy technologyJob
• RFP questions by categoryPage
• Vendor selection and RFP readiness checklistFree tool
• Vendor RFP outlineFree tool
• SaaS contract red flags checklistFree download
• TCO / ROI BuilderBuild-vs-buy total cost of ownership over several years, with NPV and break-even.
• SaaS Sprawl DetectiveDuplicate, underused and shadow-IT SaaS subscriptions.
• SaaS license waste calculatorFree tool
• Third-party risk management and vendor securityArticle
• Technology vendor managementArticle
• Choosing a mobile procurement solutionArticle

Build vs buy, and when to run a formal RFP

The UK purchasing guidance lists when building makes sense:

• The user need is unique or rare.¹³
• Few suppliers can meet the requirements.¹³
• Commercial products cannot be scaled, adapted or integrated to meet core needs.¹³
• The organization must own the technology to keep modifying it.¹³
• The capability and resources to manage the project are in place.¹³

Buying fits when a commercial product meets most needs through configuration, with little customization. The guidance warns that even small modifications to off-the-shelf software can remove most of the benefits of using it. It advises changing settings instead, so the supplier still supports new versions.¹⁴

Bank regulators scale the depth of review to the risk. The interagency guidance says due diligence should match the risk and complexity of the relationship. Third parties that support critical activities get more of it.¹⁵

Public buyers use dollar thresholds. The US Federal Acquisition Regulation sets the micro-purchase threshold at $15,000 and the simplified acquisition threshold at $350,000. Simplified acquisition procedures are the methods in FAR Part 13.¹⁶

The UK guidance sends buyers to existing frameworks and approved sourcing routes, such as the Digital Marketplace, to avoid long and expensive procurement processes.¹⁷

Software and SaaS contract terms that matter

The US General Services Administration rewrites standard software terms for federal orders. Its acquisition manual deems set language part of the commercial supplier agreement for anything bought under a GSA contract, notwithstanding the agreement's other terms. The interagency guidance lists what a sound bank contract covers.^2,18

Third-party risk management: the interagency guidance, DORA and NIST SP 800-161

The Federal Reserve, the FDIC and the OCC issued their interagency guidance on third-party relationships in June 2023. It counts outsourced services and independent consultants as third-party relationships. A relationship can exist without a contract or payment.^2,31

The guidance expects a bank to keep a complete inventory of its third-party relationships and to assess the risk of each one periodically.³²

The EU's Digital Operational Resilience Act has applied since January 17, 2025. Every financial entity in scope must keep a register of its contractual arrangements with ICT third-party service providers. Supervisors collect the registers, and the European Supervisory Authorities use them to designate critical ICT providers for EU-level oversight.³

NIST SP 800-161 Revision 1 covers cybersecurity supply chain risk management. It was published in May 2022 and updated in November 2024. It guides organizations in identifying, assessing and mitigating cyber risk in the products and services they acquire, through C-SCRM strategies, policies, plans and risk assessments.⁴

SaaS spend and cloud waste: 2026 figures

Zylo's 2026 index also found that 61% of IT leaders had cut projects because of unplanned SaaS cost increases. Zylo builds the index on the SaaS licenses, spend and usage data it manages for customers.³⁸

Where IT procurement goes wrong

• Nobody counts licenses after the purchase. In January 2024, GAO found that none of nine US agencies with large IT budgets had fully determined whether their five most widely used software licenses were over- or under-purchased. GAO names two controls: track the licenses in use, and compare that inventory with purchase records. It made 18 recommendations to the nine agencies.^39,40
• IT buying happens where IT cannot see it. The 22 agencies in GAO's 2018 review identified $14.7 billion of IT contract obligations for fiscal 2016. GAO found another $4.5 billion they had not identified.⁴¹
• A bought product gets customized. The UK guidance says changes, customizations and workarounds can raise costs, make maintenance harder and restrict future upgrades.⁴²
• There is no exit plan. The interagency guidance puts contingency plans for moving the work to another provider, or back in-house, in the planning stage, before any contract is signed.⁴³
• An AI service locks the buyer in. OMB's April 2025 memo lists the protections US agencies can require: knowledge transfer, data and model portability, and rights to the code and models a vendor produces under the contract.³⁰