It must also include factors such as technology direction, the strength of the vendor, impact on existing systems, data security, access control, backup/recovery, and any potential disruptions to the operations of the business if there were a service interruption.