Buy technology with a decision trail—not demo momentum.

Can the workflow be demonstrated?

Use realistic roles, records, permissions, exceptions, approvals, reporting, and failure conditions. Document what is product behavior versus configuration, customization, roadmap, or third-party dependency.

Can the claim be evidenced?

Ask for architecture, policy, test, report, configuration, log, contract, or other evidence appropriate to the claim. “Supported” should not be the end of due diligence.

Can the organization leave safely?

Test export completeness, data meaning, attachments, history, configuration, integration knowledge, transition access, deletion evidence, and practical migration time.

1. Record the gate before the score

For each mandatory requirement, define the pass condition before reviewing vendor evidence. “Supports SSO” is not a gate. “Demonstrates SAML or OIDC federation with the agency identity provider, role mapping, deprovisioning behavior, and privileged-account handling” is closer to one.

When a mandatory gate fails, record whether the result is disqualification, a documented exception, or a condition that must be closed before award. Do not quietly convert a failed gate into a low weighted score after proposals arrive.

2. Grade the evidence, not the confidence

Separate a vendor statement from inspectable support. A live demonstration, configuration export, independent assessment, sample audit event, tested recovery result, contract commitment, or representative migration output generally tells you more than a slide or an unchecked questionnaire response.

Record what was actually reviewed, its date, any scope limitation, and whether the evidence applies to the service and deployment model being purchased.

3. Make exceptions expire

If leadership accepts a gap, capture the affected requirement, consequence, compensating control, accountable owner, approval authority, due date, and the event that forces reconsideration. Examples include renewal, a major release, a material architecture change, a missed remediation date, or a security incident.

An exception without an owner and review trigger is not risk acceptance; it is forgotten work.

4. Carry unresolved claims into implementation

Not every claim can be proven during source selection. Convert unresolved but acceptable items into explicit implementation acceptance criteria. The project plan should identify who will test them, what evidence will count, when the test occurs, and what happens if the criterion fails.

This prevents a procurement assumption from silently becoming a production dependency.

Implementation gate

Confirm named owners, environments, configuration decisions, migration scope, integration dependencies, security responsibilities, accessibility test cases, training, support routing, and rollback expectations before the schedule hardens around assumptions.

Production gate

Require representative workflow UAT, defect disposition, access validation, migration reconciliation, monitoring, backup/recovery evidence, incident contacts, operational documentation, and explicit business acceptance. High-severity unresolved conditions should have a written launch decision.

Early-life review

Within the first operating cycle, compare promised behavior with production evidence: support response, failed workflows, recurring defects, administrative burden, performance, accessibility issues, integration failures, security findings, and user workarounds. Convert surprises into owned remediation work.

Evidence before preference

• Define the problem before selecting the product category.
• Use the same critical scenarios and evidence requests across vendors.
• Distinguish current capability from roadmap, customization, and partner dependency.
• Record assumptions and unresolved questions beside the score.

Lifecycle before launch

• Include implementation, migration, training, support, recovery, and change ownership.
• Test accessibility in the workflows people actually need to complete.
• Understand operational burden and administrative responsibilities.
• Negotiate portability and exit while the buyer still has leverage.