Free service guide · PDF

The IT Procurement and Vendor Management Toolkit

Templates, checklists and a 90-day plan to standardize devices, control software spend and take charge of your vendors.

A one-page device standard and the security baseline every device needs before it ships
The fields your asset register and renewal calendar should track, and why each one matters
A step-by-step license and SaaS true-up you can run every quarter
A vendor contact sheet, an escalation ladder and an offboarding routine for remote staff

11 pages25-item checklist30/60/90-day plan

Cover of The IT Procurement and Vendor Management Toolkit

Get your free copy

Instant PDF download. No sales pitch inside.

Cover and two sample pages of The IT Procurement and Vendor Management Toolkit, a free 11-page PDF guide from Alpiba with a 25-point checklist — A look inside: the cover and two pages from the 11-page PDF.

What's inside

Inside the guide.

Procurement problems rarely look urgent. A laptop bought in a hurry, a subscription nobody cancelled, an internet contract that renewed on its own: each is small, and together they cost real money and leave security gaps. This toolkit gives you the structure to stop the drift, whether you run IT yourself, have an in-house IT person or work with a provider.

Work through it in order. Start with the device standard and the asset register, because everything else depends on knowing what you have. Then run your first license true-up, build the vendor contact sheet and tighten offboarding. Finish with the checklist and the 90-day plan, which turn these steps into a habit rather than a one-off cleanup. Alpiba runs this lifecycle for its managed IT clients, but every template here works just as well on your own.

Write a one-page device standard
Build the asset register and renewal calendar
Run a quarterly license and SaaS true-up
Manage vendors with a contact sheet and escalation ladder
Tighten offboarding and device retirement
The checklist25 items in 5 groups
Questions to ask any IT provider10 questions
Your 30/60/90-day plan3 phases, step by step
Plain-English glossary8 terms

Read Part 1 free

The opening chapter of the guide, in full. The rest of the guide, the checklist and the 90-day plan are in the PDF.

Write a one-page device standard

A device standard says which models you buy for which roles, how they're configured and who approves exceptions. Keep it to one page so people actually use it, and revisit it twice a year as models and prices change.

What each profile in your standard should define
Field	What to decide
Profile name	A plain label such as Standard, Performance, Shared or Field
Who gets it	The roles or job titles that receive this profile by default
Approved models	One or two current business-class models, plus an approved alternative if supply runs short
Warranty	A term that matches how long you'll keep the device, with on-site or advance replacement for critical roles
Accessories	The standard dock, monitor, headset and charger, so every desk matches
Approver	Who signs off on purchases and on any exception to the standard

Every profile shares one security baseline. No device should reach an employee until each of these is true:

Registered to the company and enrolled in device management
Full-disk encryption on, with recovery keys stored centrally
Endpoint protection installed and reporting
Operating system and apps fully updated
Local admin rights removed from the everyday user account
Remote lock and wipe tested and working

Get the full guide

A preview

A sample from the guide.

Here's the first checklist group and a few of the questions. The full guide has all 25 checklist items, 10 questions and the 90-day plan.

Standards and buying

One-page device standard written, with profiles by role
Business-class models only, with warranties matched to the refresh plan
Named approver for purchases and exceptions
Standard accessories defined for every desk
Standard reviewed within the last six months

Questions to ask any IT provider

1How do you choose the models and suppliers you recommend, and will you show us competing quotes?
2What security baseline is applied before a device ships, and how do you verify it?
3Can you ship configured devices straight to remote employees, and how are they tracked?
4What does your asset register record, and do we own it if we part ways?

+ 6 more questions in the full guide

Get the full guide Related: IT Procurement & Vendor Management

IT Procurement & Vendor Management at a glance. Included: Hardware recommendations, Sourcing & ordering, Device setup & deployment, License management, Renewal tracking and Vendor escalations. How it works: Discovery & Analysis, Solution Design, Implement and Protect & Optimize. — IT Procurement at a glance: what is included and how we roll it out.

Your first 30 days

Where to start this month.

The guide's 30/60/90-day plan begins with these steps. Assign an owner to each and review progress every two weeks.

1Build the asset register from admin consoles, invoices and a walk around the office
2List every contract and subscription with its renewal and notice date
3Write the first version of the device standard and security baseline
4Create the vendor contact sheet for internet, key software and SaaS

Key terms in plain English

Asset register: A running list of every device and key system you own, who has it, where it is and the dates that matter for warranty, support and replacement.
End of support: The date a manufacturer stops releasing security updates for a product. The device may still work afterward, but it's no longer protected against new vulnerabilities.
License true-up: A reconciliation of the software licenses you pay for against the people actually using them, used to remove waste and correct plan tiers.
Notice period: The window before a contract renews in which you must cancel or renegotiate. Miss it and many contracts renew automatically for another term.
Zero-touch provisioning: Setting up a new device through cloud policies, so it can ship straight to an employee and configure itself securely at first sign-in.
Letter of authorization: A signed document that lets a named provider deal with a vendor, such as an internet carrier, on your behalf.
Shadow IT: Apps and services used for work without IT's knowledge, often paid for on personal or department cards.
Certificate of destruction: A record from a recycler or destruction service confirming that a device's storage was wiped or physically destroyed.