4. Identify the risks to security and vulnerability involved with each of the products. Is your firm willing to put proprietary information into the hands of external service providers over the Internet? Is your firm willing to expose its important operations to systems controlled by other firms? What are the financial risks facing your vendors? Will they be here in three to five years?

What would be the cost of making a switch to another vendor in the event the vendor firm fails?