Select partners professionally. Minimize risks. Secure long-term success.
Professional vendor selection with proven processes: from requirements analysis through due diligence and scoring to contract negotiation.
Professional service provider selection is the foundation for successful outsourcing. Through structured processes, due diligence reviews, and detailed risk analyses, you minimize risks and maximize the value of your service provider relationships.
Our service provider selection offering encompasses the development of tailored selection processes, the conduct of due diligence reviews, the assessment of risks and compliance aspects, and support with decision-making and contract negotiation.
3 service modules
Bookable individually or as an end-to-end programme.
Conducting thorough due diligence reviews for comprehensive evaluation of service providers.
Identification, assessment, and management of risks in the service provider relationship.
Comprehensive management of third-party and fourth-party relationships in the supply chain.
5 phases
Our approach to service provider selection is structured, comprehensive, and tailored to your individual requirements.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Careful selection of the right service providers is one of the most important success factors for outsourcing. Those who invest time and resources here save enormous costs later and avoid risks that can jeopardize entire business models.
Sound service provider selection is not a one-time task but an ongoing process. Particularly for critical outsourcing arrangements, service providers should be regularly reassessed and selection criteria adapted to changing requirements.
7 QUESTIONS, BRIEFLY ANSWERED
A structured vendor selection process is a systematic approach to evaluating and choosing outsourcing partners based on defined criteria. It includes requirements analysis, market screening, RFI/RFP procedures, due diligence, scoring and contract negotiation. This process matters because poor vendor choices lead to performance gaps, compliance violations and financial losses. In regulated industries like financial services, regulators such as BaFin require a traceable, risk-based selection decision under MaRisk AT 9 and DORA.
The most important selection criteria are: technical and professional competence (industry experience, reference projects, certifications), information security (ISO 27001, TISAX, data protection compliance), financial stability (credit rating, ownership structure), scalability and resource availability, cultural fit and communication capability, and ESG criteria. In regulated industries, additional requirements apply: DORA-compliant contract clauses, MaRisk AT 9 documentation and business continuity concepts.
MaRisk AT 9 requires financial institutions to conduct risk analyses before outsourcing, maintain adequate governance and control rights, and develop exit strategies. Since January 2025, DORA tightens these requirements for ICT third-party service providers: financial entities must maintain an information register, comply with detailed monitoring and reporting obligations, and conduct resilience testing. Contracts with ICT providers must include DORA-compliant SLAs, KPIs, audit rights and termination clauses.
Due diligence examines the vendor across multiple dimensions: financial stability (annual reports, credit ratings), compliance and certifications (ISO 27001, SOC 2, GDPR), technical capability (infrastructure, disaster recovery plans, recovery tests), references (client interviews, case studies) and legal aspects (subcontractors, liability, data processing agreements). For regulated entities, due diligence under MaRisk and DORA is mandatory and must be fully documented.
A vendor scoring model objectifies the evaluation through weighted criteria and standardized rating scales. Typical categories include: price (20‑30%), technical competence (25‑35%), security and compliance (15‑25%), scalability (10‑15%) and cultural fit (5‑10%). Each shortlisted candidate is assessed by a cross-functional team (IT, business, compliance, legal, data protection). The result is a transparent, traceable decision basis that withstands regulatory scrutiny.
Cloud service providers present unique challenges: data localization (EU data centers, Schrems II compliance), shared responsibility models, vendor lock-in risks, multi-cloud capability and exit strategies. Regulatory requirements include DORA provisions for critical ICT third-party providers, BaFin guidance on cloud outsourcing and EBA guidelines. Minimum certifications such as C5, ISO 27017 and SOC 2 Type II are expected baseline requirements.
ADVISORI guides you through the entire selection process: from requirements definition through market analysis, RFI/RFP creation, due diligence to contract negotiation. Our consultants bring experience from regulated industries (banking, insurance, financial services) and deep knowledge of MaRisk, DORA, BAIT and EBA guidelines. We develop tailored scoring models, conduct risk analyses and ensure the selection decision withstands BaFin regulatory audits.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance