Vendor Selection: Structured Process for Outsourcing

A structured vendor selection process is a systematic approach to evaluating and choosing outsourcing partners based on defined criteria. It includes requirements analysis, market screening, RFI/RFP procedures, due diligence, scoring and contract negotiation. This process matters because poor vendor choices lead to performance gaps, compliance violations and financial losses. In regulated industries like financial services, regulators such as BaFin require a traceable, risk-based selection decision under MaRisk AT

9 and DORA.

The most important selection criteria are: technical and professional competence (industry experience, reference projects, certifications), information security (ISO 27001, TISAX, data protection compliance), financial stability (credit rating, ownership structure), scalability and resource availability, cultural fit and communication capability, and ESG criteria. In regulated industries, additional requirements apply: DORA-compliant contract clauses, MaRisk AT

9 documentation and business continuity concepts.

MaRisk AT

9 requires financial institutions to conduct risk analyses before outsourcing, maintain adequate governance and control rights, and develop exit strategies. Since January 2025, DORA tightens these requirements for ICT third-party service providers: financial entities must maintain an information register, comply with detailed monitoring and reporting obligations, and conduct resilience testing. Contracts with ICT providers must include DORA-compliant SLAs, KPIs, audit rights and termination clauses.

Due diligence examines the vendor across multiple dimensions: financial stability (annual reports, credit ratings), compliance and certifications (ISO 27001, SOC 2, GDPR), technical capability (infrastructure, disaster recovery plans, recovery tests), references (client interviews, case studies) and legal aspects (subcontractors, liability, data processing agreements). For regulated entities, due diligence under MaRisk and DORA is mandatory and must be fully documented.

A vendor scoring model objectifies the evaluation through weighted criteria and standardized rating scales. Typical categories include: price (20‑30%), technical competence (25‑35%), security and compliance (15‑25%), scalability (10‑15%) and cultural fit (5‑10%). Each shortlisted candidate is assessed by a cross-functional team (IT, business, compliance, legal, data protection). The result is a transparent, traceable decision basis that withstands regulatory scrutiny.

Cloud service providers present unique challenges: data localization (EU data centers, Schrems II compliance), shared responsibility models, vendor lock-in risks, multi-cloud capability and exit strategies. Regulatory requirements include DORA provisions for critical ICT third-party providers, BaFin guidance on cloud outsourcing and EBA guidelines. Minimum certifications such as C5, ISO

27017 and SOC

2 Type II are expected baseline requirements.

ADVISORI guides you through the entire selection process: from requirements definition through market analysis, RFI/RFP creation, due diligence to contract negotiation. Our consultants bring experience from regulated industries (banking, insurance, financial services) and deep knowledge of MaRisk, DORA, BAIT and EBA guidelines. We develop tailored scoring models, conduct risk analyses and ensure the selection decision withstands BaFin regulatory audits.