Five groups usually approve a security tool purchase: the technical sponsor, the security or risk team, legal, procurement or finance, and an executive with budget authority. Each asks a different question. If you answer all five in one short document, approval moves faster than if each finds out separately.
The five approvers
Technical sponsor. Usually an engineering or security lead who wants the tool. Their question: will this work in our pipeline without slowing everyone down? They own the pilot results.
Security or risk team. Their question: what does this vendor do with our data, and what access does the tool need? They want the access scopes, hosting location, subprocessors and incident history, and they may ask for an independent audit report.
Legal. Their question: what are we agreeing to? They read liability, data use, termination and data return. If the tool touches personal data, they will ask for a data processing agreement.
Procurement or finance. Their question: is this budgeted, and are we buying it the way company policy says? They check approval thresholds, quotes and payment terms.
Executive sponsor. Their question: what risk or cost does this remove, and who is accountable? Give them one paragraph, not the pilot report.
One page that answers all five
Write a single page with these headings:
- The problem in one sentence.
- What we tested, for how long, and the result against the success criteria agreed before the pilot.
- What the tool can access, with the narrowest scopes that worked.
- Where data goes and who the vendor's subprocessors are, as stated by the vendor.
- Contract points we want changed, in priority order.
- Who owns the tool, who owns the renewal date.
Common mistakes
- Treating the sponsor as the buyer. The sponsor starts the process. They rarely finish it.
- Skipping the owner for renewals. A tool with no named owner auto renews or lapses unnoticed.
- Letting the vendor run your internal process. Vendors can supply documents. They should not decide who approves.
- Asking for sign off on a verbal summary. Approvers need something written they can forward.
What to do if you do not know the approvers
Ask procurement one question: "Who has to approve a purchase of this kind and size?" The answer differs by company and changes with the amount, so do not assume it from a previous purchase. Then ask the vendor for its standard documents so legal and security can read them in parallel.
Quick check
Does the security team need to approve every tool?
Any tool that reads source code, secrets or personal data should have a security review. A tool with no access to either may need less, but that is your policy to set.
Who should own the renewal?
The technical sponsor, with a calendar date set at signature. See the post on notice dates for how to set it.
Last reviewed: 19 October 2026.
