Contracts & Procurement
Due diligence before contracting with a technology vendor
What an agency should verify about a vendor's registration, insurance, security, and capacity before award.
Before award, an agency should confirm that a vendor can legally be paid, is insured, can meet the security requirements of the work, and has the capacity to deliver. Most of this is routine; skipping it is how agencies end up with an unpaid invoice, an uninsured breach, or a project staffed by nobody.
Registration and eligibility
Vendor registration in the agency's system with current tax information. Where federal funds are involved, a Unique Entity ID and confirmation that the vendor is not suspended or debarred. Business license where the agency requires one.
Certifications, if claimed
Small business, disabled veteran, or other certifications should be verified through the certifying program, not accepted from the proposal.
Insurance
Certificates showing the coverage and limits the contract requires, typically general liability, professional liability, cyber liability, and workers' compensation, with the agency named as additional insured. Cyber liability is essential for any vendor handling agency data.
Security posture
A security questionnaire proportionate to the data involved, and evidence for the important answers. For sensitive data, ask about background screening of staff, encryption, multi-factor authentication, incident response, and any independent assessments. Verify authorization claims through official program listings.
Capacity and staffing
Who will actually do the work, their experience, and their availability. A proposal staffed with resumes the vendor cannot deliver is a common failure.
References
Call them. Ask about schedule, quality, responsiveness, and what they would do differently.
Financial stability
For larger contracts, evidence the vendor can carry the work between invoices.
Conflicts
Confirm the vendor did not help write the solicitation and has no other conflict under the agency's rules.
New vendors
A vendor new to a particular agency is not disqualified; the questions above apply equally, and the experience of its staff and its other work count. HQT answers all of these questions on request.