How should we run the evaluation meeting?

Have the IT owner and one business or procurement reviewer score independently first. Compare differences and write the reason for each final rating. The vendor may correct facts but should not assign its own final score.

Use the same scenario, asset counts and evidence requests for each finalist. Separate present capability from roadmap promises. Where a reference customer is available, ask about comparable workload and escalation, with permission, rather than assuming all references validate the same environment.

For assurance documents, inspect the scope and limitations. AICPA's SOC 2 framework is not a basis for automatically awarding full points to a logo. For product terms, read the actual service supplement: Arctic Wolf's published MDR terms illustrate that product-level limitations can matter beyond the headline description.