# Stage 6: How do you complete security, commercial and contractual diligence?

**Evaluate the proposed service, its delivery partners and your own operating design together.** The bank third-party lifecycle guidance is a useful organising reference for banking buyers; use your own supplier-risk process for applicability and depth. ([occ.gov](https://www.occ.gov/news-issuances/bulletins/2024/bulletin-2024-11.html?utm_source=openai))

### What security evidence should you request?

Use the following proposed request list, tailored to the information you will store:

- Service and data-flow architecture, including subprocessors.
- Hosting, support-access and cross-border processing arrangements.
- Relevant independent assurance reports and the scope they actually cover.
- Identity federation, provisioning, MFA and privileged-access design.
- Record, attachment, search, reporting and API permission behaviour.
- Encryption and key-management responsibilities.
- Logging, monitoring and incident-notification arrangements.
- Backup, restoration and disaster-recovery evidence.
- Vulnerability management and material-change notification.
- Data return, deletion, retention and legal-hold treatment.
- AI subprocessors, data-use terms, retention and opt-out controls where applicable.

Do not equate a successful user-interface permission test with safe bulk-export permissions. IBM’s OpenPages 9.1 Data Export documentation warns that the specified administrative export permission can export data regardless of role-based security and other listed access settings. Verify the exact deployment and constrain export authority accordingly. ([ibm.com](https://www.ibm.com/docs/en/openpages/9.1.x?topic=ci-exporting-openpages-data-be-used-by-other-applications&utm_source=openai))

### How do you compare enterprise GRC software pricing?

**Normalise the commercial unit before comparing the dollar amount.** Ask each supplier to price the same modules, entities, environments, interfaces and user actions.

Public sources illustrate why a universal per-user assumption is unsafe:

- LogicGate describes pricing by Applications and Power Users; its pricing page says Standard and External user licences are included without additional charge. Optional capabilities and services are additional components. ([logicgate.ai](https://www.logicgate.ai/platform/pricing/?utm_source=openai))
- IBM publishes OpenPages starting figures for different deployment and edition options, but the headline pricing page does not state the billing period beside those figures. It also flags edition-specific limitations and additional-cost AI capabilities. Do not annualise a headline amount without written clarification. ([ibm.com](https://www.ibm.com/products/openpages/pricing))

Build a licence matrix using actions, not job titles:

| User or system activity | Question for the supplier |
|---|---|
| Build forms and workflows | Which administrative entitlement is required? |
| Assess risks or perform tests | Which full-use entitlement is required? |
| Submit evidence occasionally | Is this included, separately licensed or restricted? |
| Approve an exception | Does approval change the required licence? |
| View dashboards or export data | Are viewing and exporting treated differently? |
| Complete an external questionnaire | How are external identities and access licensed? |
| Run integrations | Are service accounts, API calls or connector transactions charged? |
| Use AI | Is charging by module, user, consumption or another measure? |

Request written answers for sandbox access, storage, attachment limits, content subscriptions, premium support, integrations, overages, affiliate use, acquisitions, expansion and renewal increases.

### How much does a DIY GRC implementation cost?

**There is no defensible universal total in the public evidence reviewed. Build a bottom-up model using your quotes and workload.**

The following is a **synthetic financial scenario**, not a price benchmark, quotation or forecast. It assumes a 36-month software term, six months of implementation and stabilisation within that term, and 30 subsequent months of steady-state administration. Attributable selection labour is included as an acquisition cost. All values are USD.

| Cost line | Explicit illustrative assumption | Three-year amount |
|---|---|---:|
| Core subscription | $150,000 in year one; assumed 5% annual increase | $472,875 |
| Targeted external assistance | 300 hours × assumed $200/hour | $60,000 |
| Internal selection and delivery | 2,800 hours × assumed fully loaded $85/hour | $238,000 |
| Training budget | Assumed one-off allowance | $10,000 |
| Additional integration/content/environment charges | Assumed $12,000 annually, not included in core subscription | $36,000 |
| Legacy overlap | Six months × assumed $5,000/month | $30,000 |
| Steady-state administration | 100 hours/month × 30 months × assumed $85/hour | $255,000 |
| **Modelled ownership cost** | **External expenditure plus internal labour** | **$1,101,875** |

The model contains **$608,875 of external expenditure** and **$493,000 of internal labour**. Existing salaries are not necessarily incremental cash expenditure; backfill or new hiring may be. Keep those views separate in the approval pack.

The apparent precision comes from arithmetic, not certainty. Taxes, an optional exit, additional modules and unquoted overages are excluded and must be separately resolved. Do not enter missing costs as zero.

For one published training reference, Learning Tree lists a three-day ServiceNow GRC/IRM implementation course at **$2,700**, including an exam voucher. That is a course price—not a complete training programme or proof of implementation competence. ([learningtree.com](https://www.learningtree.com/courses/servicenow-grc-irm-implementation-training/))

### Which assumptions should you stress-test first?

| Change to the synthetic model | Additional cost |
|---|---:|
| 20% more internal selection/delivery hours: 560 × $85 | $47,600 |
| 50 additional administration hours per month for 30 months | $127,500 |
| Six additional months of retained legacy access at $5,000/month | $30,000 |

Also test licence expansion, a delayed integration and additional migration rehearsals using supplier-specific rates. Show contingency separately from expected expenditure, and assign each uncertainty an owner who can reduce it.

Do not assume that deleting the external-assistance line produces an equivalent saving. Re-estimate the internal work and capability needed to replace that assistance.

### What should the contract and statement of work contain?

Take this proposed checklist to procurement and counsel:

- Exact products, editions, deployment, user rights and environments.
- Deliverables mapped to requirements and acceptance tests.
- Migration objects, attachments, history, exclusions and reconciliation duties.
- Named buyer dependencies and dates.
- Integration responsibilities across supplier, partner and source-system owner.
- Configuration documentation and rights to use custom deliverables.
- Change-control rules, rates and approval authority.
- Support coverage, response expectations and escalation.
- Security, privacy, incident and subprocessor arrangements.
- Renewal, uplift, expansion and notice provisions.
- Export format, access period, assistance rates and deletion arrangements.
- Remedies and responsibilities if acceptance is not achieved.

For banking buyers, the 2023 interagency guidance explicitly addresses orderly transition, return or destruction of data, and allocation of transition and termination costs. These are procurement issues to resolve before dependency grows. ([occ.gov](https://www.occ.gov/news-issuances/federal-register/2023/88fr37920.pdf))

**Exit gate:** no unresolved critical security issue; a funded operating model; understood licence rights; and an agreed delivery and acceptance boundary.