IT Procurement: A Step-by-Step Process for Software, SaaS and Cloud

IT procurement is how an organization buys hardware, software, SaaS, cloud services and IT services. It follows the general procurement process, but technology adds its own problems: tools bought on a credit card, subscriptions that renew themselves, vendors that hold your data and license terms that set what you pay later.

What IT procurement covers

• Hardware: laptops, phones, servers, storage and network equipment.
• Software licenses and subscriptions: perpetual licenses, often with paid maintenance, or term subscriptions for software you install.
• SaaS: applications the vendor hosts and runs.
• Cloud services: infrastructure and platform services billed by usage or against a committed spend.
• IT and managed services: consulting, implementation, support and outsourced operations.
• Telecom: internet circuits, mobile plans and voice services.

Who is involved

• The business owner needs the technology and owns the requirement and, later, the renewal decision.
• IT checks fit with existing systems and plans deployment and support.
• Security and privacy review how the vendor protects your data and access.
• Procurement chooses the sourcing route, negotiates and keeps the contract record.
• Finance confirms the budget and tracks recurring and usage-based charges.
• Legal reviews the agreement, the data processing terms and any online terms.

The IT procurement process, step by step

1. Take in the request

Start every purchase as a request in one place, such as a service desk form: what’s needed, for whom, why, the expected cost and what data it will touch. SaaS can arrive as a free trial or a credit card purchase that IT hears about once the tool is in use. Treat that as a request too: clicking “I agree” may have accepted the vendor’s terms, and company data may already be in the tool.

2. Check what you already own

Search your asset and contract records for unused licenses, a tool that already does the job, or an edition upgrade that adds the missing feature.

3. Write the requirements

List what the technology must do and the conditions it must meet: users, volumes, integrations, security, data location and support. The requirements gathering guide shows how to collect them.

4. Choose the sourcing route

Ask for quotes, or send resellers an RFQ, when the product is chosen and only price and terms differ. Send an RFI when you don’t know the market, and an RFP when solutions differ and you’ll judge them on more than price; the free RFP template is a starting point. Or buy through an existing contract or reseller agreement that already covers the need. RFP vs RFQ vs RFI compares the documents, and your policy may require a more formal route above values it sets.

5. Review security and privacy

Start before you choose, while a finding can still change the decision, and scale it to the data, access and criticality involved. For a high-risk vendor, ask for a SOC 2 Type II report or ISO/IEC 27001 certificate covering the service, plus a completed security questionnaire. The vendor security assessment guide explains what to ask for and how to read it.

6. Review architecture and integration

IT checks single sign-on (SAML or OIDC), user provisioning (SCIM), the APIs or connectors for each system it must exchange data with, and where the product is hosted. Ask who builds and maintains each integration through upgrades; custom work may not appear in the license quote.

7. Evaluate and run a proof of concept

Score proposals against weights set in advance, as the RFP evaluation criteria guide describes, and run scripted demos with your own data. Run a proof of concept when a demo can’t prove a requirement that matters, such as an integration with your systems. The vendor selection guide covers due diligence.

8. Negotiate

Negotiate the contract terms below as well as the price. Where your rules allow it, keep a runner-up in the process until terms are agreed.

9. Sign the contract and place the order

Expect several documents: the license or subscription agreement, an order form, service levels, a data processing agreement where personal data is involved and, for services, a statement of work. Check the order form against what you negotiated, then raise the purchase order.

10. Deploy and update the asset records

Record the asset or license, the contract, the owner, the license metric and quantity, the renewal date and the notice deadline. Here IT procurement hands over to IT asset management; for a tool to track it, see the ITAM software RFP template.

11. Manage the renewal

Decide before the notice deadline, while you can still switch or renegotiate.

What to check for each type of purchase

Contract terms that matter most

Settle these while you still have alternatives, and have legal review the wording.

• License metric and true-ups. Define exactly what counts toward the unit you pay for, such as whether inactive users do. A true-up is a periodic count in which you pay for use above what you licensed; agree how often, at what price, and whether quantities can go down.
• Renewal price caps. Cap increases at renewal, and check whether the cap covers every renewal or only the first.
• Service levels and credits. Read how availability is measured, what’s excluded and how credits are claimed. Check whether credits are your only remedy.
• Data processing agreement. Where the vendor processes personal data for you, the agreement sets out how the data may be used, the sub-processors and where the data is held. Privacy laws that apply to you may require one.
• Security commitments. Include the controls or independent reports the vendor will maintain, notice of incidents affecting your data within a defined time, and notice before sub-processors change.
• Data return and exit. State what data you get back, in what format, how long it stays available after termination, the transition help, and confirmed deletion afterwards.
• Auto-renewal and notice periods. An auto-renewal clause renews the contract unless you give notice by a set date. Record that date, not only the renewal date.

Renewals and SaaS sprawl

Because SaaS is easy to buy, it spreads: duplicate tools in different teams, licenses for people who have left, renewals for products nobody opens.

• Keep a renewal calendar. List every contract with its owner, renewal date and notice deadline, fed by step 10 and by card and expense data. Set reminders early enough to negotiate or run a competition.
• Review usage before each renewal. Compare paid licenses with active users in single sign-on logs or the vendor’s admin reports, and ask the owner whether the tool is still needed.
• Consolidate duplicate tools. Where teams pay for tools that do the same job, pick one, move the others to it as contracts end, and block new purchases of the rest at intake.

Renewal is also the time to recheck the vendor’s security; the vendor risk management guide describes ongoing reviews. The vendor scorecard template rates a supplier’s performance against its contract.

Public-sector IT procurement

Public bodies, and organizations spending public or grant money, buy under rules set by law, regulation and policy that vary by jurisdiction, agency and purchase value. Check with your procurement office or counsel.

• Existing and cooperative contracts. A statewide contract, another agency’s contract or a cooperative contract may let you buy without your own solicitation. Confirm that your rules and the contract’s terms allow it.
• Click-through terms. Trials and online sign-ups can include terms a public body may not be allowed to accept, such as open-ended indemnities. Route them through procurement first.
• Federal grant money. For recipients and subrecipients that follow the federal procurement standards (states and Indian Tribes generally use their own policies, per 2 CFR 200.317), 2 CFR 200.318(d) requires procedures that avoid buying unnecessary or duplicative items. 2 CFR 200.318(e) encourages state and local intergovernmental agreements or inter-entity agreements for common or shared goods and services, and says documented actions of this kind meet the competition requirements of 2 CFR part 200.
• Public notice. Solicitations may have to be advertised; the state procurement portals directory lists where each US state posts them.

2 CFR references are to eCFR as of November 2026. This isn’t legal advice.

Common mistakes

• Treating a free trial as harmless. It may already hold company data under terms nobody reviewed.
• Comparing first-year prices. Compare the full term, with renewal increases, usage growth and exit costs.
• Signing without exit terms. Data export and transition help are hardest to win after signature.

When a purchase needs an RFP, start from the free RFP template, or find one for your category among the IT RFP templates.

Frequently asked questions

What is IT procurement?

IT procurement is how an organization buys technology: hardware, software, SaaS, cloud services, IT and managed services, and telecom. It runs from the first request through security review and contracting to deployment and renewal. It follows general procurement but adds checks for data, integration and recurring costs.

What are the steps in the IT procurement process?

Take in the request, check what you already own, write requirements and choose a sourcing route. Then review security, privacy and integration, evaluate with a proof of concept where needed, negotiate, sign and order. Finish by recording the asset and managing the renewal.

What is the difference between IT procurement and IT asset management?

IT procurement decides what to buy, from whom and on what terms. IT asset management tracks what you own once it arrives: each device and license, who uses it and when it renews or reaches end of life. The two meet when a request is checked against what you own, and when a purchase is recorded.

Who should be involved in IT procurement?

The business owner who needs the technology, IT, security and privacy, procurement, finance and legal. Small purchases can combine roles, but a low price shouldn’t mean skipping security or contract review.

How do you manage SaaS renewals?

Keep one calendar of every subscription with its owner, renewal date and notice deadline. Before each renewal, compare paid licenses with active users and ask the owner whether the tool is still needed. Act before the notice deadline, so there’s time to cut licenses, negotiate or switch.