| Total Cost of Ownership |
TCO evaluation period |
36–60 months |
Five-year financial model covering acquisition, installation, software, energy, facilities, maintenance, migration, and disposal. |
Use the same lifecycle period and workload assumptions for every bid so that purchase price is not treated as the only cost. |
| Total Cost of Ownership |
Core TCO components |
Hardware + software + power and cooling + support + labor + downtime risk |
Itemized quotation, licensing schedule, power-efficiency data, maintenance terms, and implementation plan. |
Require all recurring fees, subscription renewals, expansion charges, and data-migration costs to be disclosed separately. |
| Total Cost of Ownership |
Energy and facility assumptions |
Use measured or manufacturer-rated power under the planned workload |
Power draw at idle, typical, and maximum utilization; rack density; cooling requirement; operating-temperature limits. |
Calculate annual energy cost using the customer’s electricity tariff and the site’s power usage effectiveness where available. |
| Performance |
Workload-based capacity |
Documented benchmark for the intended workload |
Independent benchmark results or acceptance-test data for virtualization, database, storage, AI, or high-performance computing workloads. |
Prefer workload-specific results over general processor, memory, or storage specifications. |
| GB Standards |
Network and information security compliance |
GB/T 22239-2019 alignment where applicable |
Cybersecurity classified protection assessment or equivalent control-mapping document, system security architecture, and remediation records. |
Confirm the applicable protection level and whether the proposed infrastructure supports the required identity, access-control, audit, and boundary-protection controls. |
| GB Standards |
Classified protection assessment support |
Support for GB/T 28448-2019 assessment activities |
Assessment-ready configuration records, asset inventories, security policies, logs, test reports, and corrective-action procedures. |
Select a supplier that can provide evidence in the format required by the customer’s assessment and audit process. |
| GB Standards |
Personal information protection |
GB/T 35273-2020 control alignment where personal information is processed |
Data-flow diagrams, collection and retention policies, access records, deletion procedures, and incident-response documentation. |
Verify data minimization, purpose limitation, access authorization, retention, and cross-environment data-transfer controls. |
| Security |
Security management certification |
ISO/IEC 27001 certification or equivalent independently verified controls |
Current certificate scope, statement of applicability, audit status, vulnerability-management process, and incident-response plan. |
Check whether the certificate covers the proposed manufacturing, cloud, support, and managed-service activities rather than an unrelated entity. |
| Security |
Hardware and firmware assurance |
Secure boot, signed firmware, vulnerability disclosure, and controlled update process |
Platform security architecture, firmware-signing policy, bill of materials where available, patch advisories, and security-support lifecycle. |
Require a defined process for vulnerability notification, severity classification, patch delivery, rollback, and end-of-support communication. |
| Security |
Data protection |
Encryption in transit and at rest, role-based access, and auditable administration |
Encryption design, key-management procedure, privileged-access controls, log-retention policy, and independent penetration-test summary. |
Ensure cryptographic controls can be integrated with the customer’s identity provider, key-management platform, and security monitoring system. |
| Support Coverage |
Service availability |
24×7 support for business-critical infrastructure |
Support organization chart, escalation matrix, service-hours definition, local contact channels, and ticket-management process. |
Confirm whether 24×7 coverage applies to all components, software, firmware, and third-party dependencies or only to selected products. |
| Support Coverage |
Severity-one response |
Contractual response target commonly set at 30–60 minutes |
Service-level agreement defining severity criteria, response time, restoration target, escalation path, and service credits. |
Evaluate restoration and workaround commitments in addition to the initial response time; require measurable service-level reporting. |
| Support Coverage |
Spare parts and field service |
Regional parts availability with defined replacement targets |
Spare-parts locations, logistics process, technician coverage, replacement-time commitment, and business-continuity plan. |
Prioritize coverage near critical sites and verify support availability during weekends, public holidays, and emergency events. |
| Lifecycle Management |
Product support lifecycle |
Published support period with advance end-of-sale and end-of-support notices |
Lifecycle policy, firmware-support dates, upgrade paths, compatibility matrix, and migration assistance terms. |
Reduce future switching costs by requiring a documented upgrade route for compute, storage, network, and management software layers. |
| Interoperability |
Open integration capability |
Standard APIs, documented interfaces, and support for common enterprise protocols |
API documentation, interoperability test results, management-platform compatibility list, and exportable configuration formats. |
Favor solutions that avoid proprietary lock-in and can integrate with existing monitoring, identity, backup, and security-operation tools. |
| Implementation |
Deployment and acceptance |
Formal acceptance test completed before production handover |
Project plan, installation checklist, configuration baseline, performance test, failover test, documentation package, and training records. |
Make payment milestones dependent on documented acceptance criteria, security hardening, operational handover, and knowledge transfer. |
| Recommended Scoring |
Weighted decision model |
TCO 25% · Performance 20% · Security 20% · GB compliance 15% · Support 15% · Implementation 5% |
Scoring workbook with normalized scores, mandatory pass/fail requirements, evidence references, and approval history. |
Set security, regulatory, and support requirements as mandatory gates before applying commercial scoring. |