A public sector security tool purchase usually runs through eight stages: define the need, pick a buying route, send requirements, review security and privacy, pilot, approve, contract, and onboard. Exact steps, thresholds and timing differ by entity, so ask the buyer's procurement office for their rules. This is a planning guide, not legal advice.
The eight stages
| Stage | What happens | What to prepare |
|---|---|---|
| 1. Need | A team states the problem and who owns it | One page: problem, users, data touched |
| 2. Route | Procurement picks a route: own bid, quote, or an existing cooperative contract | Ask which route applies |
| 3. Requirements | Questions and documents requested from vendors | Standard security packet |
| 4. Review | Security, privacy and accessibility checks | Named reviewers, written answers |
| 5. Pilot | A limited trial on non-sensitive work | Success measures set in advance |
| 6. Approval | The person or board with authority signs off | A short decision memo |
| 7. Contract | Terms, security exhibits, data terms | Exit and deletion terms |
| 8. Onboarding | Accounts, training, integrations | Owner and support contact |
Stage notes
Route. Some public bodies buy through cooperative contracts, where one lead entity ran the competition. NASPO ValuePoint describes this as pooling buying power through a single solicitation. Others run their own bid. See what cooperative purchasing is.
Vendor registration. Federal work may need SAM.gov registration, while other buyers use their own vendor portals. See do you need SAM.gov registration.
Review. The Department of Education's student privacy office recommends having policies to evaluate and approve online services, naming who has authority to enter agreements, and using a written contract where possible. It recommends free tools take the same path. See free scanners and approval.
Pilot. A pilot is cheaper than a wrong purchase. Use a non-sensitive project, fix the success measures first, and write down what data the tool can see.
Where delays usually come from
- A security questionnaire that arrives late in the process.
- No named owner who can answer vendor questions.
- Unclear authority: nobody knows who may sign.
- Accessibility or privacy review started at the end.
- Contract terms on data deletion argued after the pilot.
Start the review stage in parallel with requirements, not after.
A one page checklist for the requester
- Who owns this tool after it is bought?
- What data can it see?
- Which buying route applies?
- Who reviews security, privacy and accessibility?
- Who signs?
- What does the pilot need to prove?
- What does exit look like?
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are tracked and assigned, since your pilot success measures will rely on that view.
Quick check
Do all public buyers follow the same steps?
No. Thresholds, routes and approvals differ by entity. Ask procurement for the written rules.
When should security review start?
At the requirements stage, in parallel with other work, not after the pilot.
Sources
- NASPO ValuePoint: Why Cooperative Purchasing
- SAM.gov: Entity Registration
- U.S. Department of Education PTAC: Protecting Student Privacy While Using Online Educational Services
Last reviewed: 19 October 2026.
