How the calculation works
Each vendor gets a score from 1 (poor) to 5 (excellent) on six criteria, and each criterion gets a weight from 0 to 5:
- Weighted score = Σ (weight × score) ÷ Σ weight, over the criteria with a weight above 0.
The result is on the same 1-to-5 scale as the scores. A criterion with weight 0 is left out of the score. Vendors are ranked on the score rounded to two decimals; equal scores tie. A vendor only counts once every weighted criterion has a score.
The six criteria are the same for every category: requirements fit, pricing and total cost, contract terms and exit, service levels and support, security and compliance, and implementation and migration. The questions under each criterion change with the category. The default weights are 5, 4, 4, 4, 3 and 3 in that order: a starting point we chose, not a standard.
Worked example
An SD-WAN evaluation scores three vendors at the default weights (total weight 23):
| Criterion (weight) | Vendor A | Vendor B | Vendor C |
|---|---|---|---|
| Requirements fit (5) | 4 | 5 | 3 |
| Pricing and total cost (4) | 3 | 4 | 5 |
| Contract terms and exit (4) | 4 | 3 | 4 |
| Service levels and support (4) | 4 | 4 | 3 |
| Security and compliance (3) | 3 | 4 | 3 |
| Implementation and migration (3) | 4 | 3 | 3 |
- Vendor A: 5×4 + 4×3 + 4×4 + 4×4 + 3×3 + 3×4 = 85; 85 ÷ 23 = 3.70.
- Vendor B: 5×5 + 4×4 + 4×3 + 4×4 + 3×4 + 3×3 = 90; 90 ÷ 23 = 3.91.
- Vendor C: 5×3 + 4×5 + 4×4 + 4×3 + 3×3 + 3×3 = 81; 81 ÷ 23 = 3.52.
Vendor B leads at 3.91, ahead of Vendor A at 3.70. Vendor C has the best price score but the weakest fit, and fit carries the most weight.
The categories
Each list has 12 questions, two per criterion, written from the buyer’s side: what to ask so the answers can be compared and held to in the contract.
- SD-WAN: site hardware, failover behavior, per-site pricing, adding and closing sites. See SD-WAN.
- UCaaS: license tiers, number porting, emergency calling, exporting recordings. See Unified Communications as a Service.
- Contact center (CCaaS): channels, integrations, seasonal seats, PCI DSS in recordings. See Contact Center as a Service.
- MDR: data sources, response actions, response times, who staffs the SOC. See Managed Detection and Response.
- SASE: components, points of presence, encrypted traffic inspection, VPN migration. See Secure Access Service Edge.
- Colocation: power per cabinet, carriers in the building, escalators, remote hands. See Colocation.
- Dedicated internet access: building access and construction, SLA and repair time, DDoS, IP addresses. See Dedicated Internet Access.
- Backup and disaster recovery: recovery points and times, immutability, restore tests, getting data back. See Disaster Recovery as a Service and Backup as a Service.
- Public and managed cloud: the cost breakdown, commitment exposure, shared responsibility, migration plan. See Public Cloud.
Running the RFP
Send every vendor the same questions and the same deadline, and ask for answers in writing. Agree the weights and what each score means before the answers arrive, and have each person score on their own before you compare. Hold the winner to its answers: the SLA, SLA credits, renewal and exit terms belong in the contract, not only in the proposal. Before signing, put the notice date in the contract renewal calculator.
