IT vendor shortlisting guide. Last reviewed:
The fastest way to shortlist IT vendors is to decide what disqualifies a vendor before you look at any of them. Agree your must-have requirements, build a longlist from the whole market, remove anyone who fails a must-have, then score the remainder against weighted criteria. Done in that order, a shortlist of three to five credible providers is achievable in a few weeks, without endless demonstrations or budget spent on vendors who were never a fit.
Why shortlisting wastes time and money
- Requirements arrive late. Teams meet vendors before agreeing what they need, so every demonstration resets the criteria.
- The longlist is too narrow. It contains only the vendors the team already knows, so stronger options are never considered.
- No disqualifiers. Without hard must-haves, every vendor stays in contention and the evaluation grows.
- Demonstrations replace evidence. Polished demonstrations are compared instead of written responses against the same criteria.
A six-step shortlisting method
- Define requirements with MoSCoW. Separate must-haves from should-haves and nice-to-haves using MoSCoW prioritisation. Write each must-have so it can be answered yes or no.
- Build a market-wide longlist. Include established vendors, Australian specialists, managed service options and newer entrants. Aim for eight to fifteen names.
- Apply the must-have filter. Remove any vendor that cannot meet a must-have, such as Australian data residency, a required certification or integration with a core system.
- Run light due diligence. Check financial stability, local support, references in similar organisations and security posture. The guide to vendor due diligence covers what to check.
- Score against weighted criteria. Use the same scoring scale for every vendor, agreed before responses arrive. See structured vendor comparison methods.
- Confirm the shortlist. Invite three to five vendors to a detailed response, scripted demonstration or proof of concept.
Criteria that separate a shortlist from a longlist
| Criterion | What to test | Typical weighting |
|---|---|---|
| Functional fit | Must-have and should-have requirements met | 30 to 40% |
| Commercials | Whole-of-life cost and pricing flexibility | 20 to 25% |
| Delivery and support | Australian capability, service levels, references | 15 to 20% |
| Security and compliance | Certifications, data residency, alignment with your obligations | 10 to 20% |
| Vendor viability | Financial stability and product direction | 5 to 10% |
Adjust the weightings to the purchase. A cybersecurity service may weight security and delivery higher. A commodity platform may weight commercials higher.
Protecting your budget during shortlisting
- Do not fund a proof of concept until a vendor has passed the must-have filter.
- Script demonstrations around your own use cases, not the vendor’s preferred story.
- Ask for indicative pricing early, so a vendor that cannot meet the budget does not progress.
- Keep a written record of why each vendor was removed. It protects the decision if it is challenged later.
How CYBORIUM shortlists vendors
CYBORIUM runs independent vendor evaluations across cybersecurity, AI and enterprise IT. Requirements are defined with you, the longlist covers the whole market, and every provider is scored against the same evidence. CYBORIUM does not sell, deliver, operate or invoice technology, and the service carries no fee to your organisation. See procurement as a service.
Frequently asked questions
How many IT vendors should be on a shortlist?
Three to five. Fewer than three gives you little competitive tension. More than five usually means requirements were not specific enough and the evaluation effort grows without improving the decision.
What is the difference between a longlist and a shortlist?
A longlist is every credible provider that could meet the need. A shortlist is the small group that passed your must-have requirements and initial checks, and is invited to a detailed response, demonstration or proof of concept.
How long should vendor shortlisting take?
With clear requirements, moving from longlist to shortlist typically takes two to four weeks. Most delays come from requirements that change after vendors have been approached.
Should we rely on analyst reports to shortlist vendors?
Analyst reports are a useful input but they rarely reflect Australian delivery capability, local support or your specific requirements. Use them to build the longlist, then test fit against your own criteria.
Can an independent adviser help shortlist vendors?
Yes. A vendor-neutral adviser brings current market knowledge, removes bias from existing relationships and can shorten the process, provided the adviser does not resell or deliver the technology being evaluated.
Related guidance: evaluating vendors without bias, writing a technology RFP, strategic sourcing fundamentals.
