Post-Merger Vendor Rationalization and Three-Year Security Budget
You are CISO of a global retailer that has just acquired a 40-country competitor. Combined security vendor count is 312, annual security spend is $18.2M, and 22% of contracts overlap in function across endpoint, SIEM, vulnerability management, and DLP. Forty-seven contracts renew within 60 days; 12 have auto-renewal clauses with 30-day notice. The CFO wants a 15% reduction in vendor spend by year-end and a three-year roadmap. The acquired company uses a different cloud provider and has 1,100 employees in regions where your current vendor does not provide support. The integration team wants to standardize on your existing stack immediately. Business units are lobbying to keep their preferred tools. You have 10 weeks to present to the board.
1. How would you structure the vendor rationalization without disrupting operations?
Read the worked answer
Start with a complete inventory of the 312 vendors: function, contract value, renewal date, data access, criticality, regional support, and exit terms. Classify vendors into strategic, tactical, and exit categories. Identify the 22% functional overlap, but do not standardize immediately. The integration team's urgency is understandable, but immediate standardization can break regional support and create outages.
For the 47 contracts renewing within 60 days, triage by notice date. Send non-renewal or extension notices where appropriate to avoid auto-renewal, and negotiate short extensions for vendors that need further assessment. Use clear criteria for business units: regulatory requirement, unique capability, integration cost, and total cost of ownership. For the acquired company's regions, keep local vendors where your current stack lacks support. Create a vendor management office with legal, procurement, and security representation. Present a 90-day stabilization plan, a 12-month consolidation plan, and a three-year optimization roadmap.
2. Build a defensible three-year budget and savings case.
Read the worked answer
Baseline the $18.2M by category, contract, and business unit. Separate run spend from change spend. Model savings realistically: functional overlap may yield 8% to 12% in the first year after integration costs, not 15% immediately. Include termination fees, migration costs, dual-running costs, training, and regional support gaps. Present three scenarios: conservative, target, and aggressive, with risks for each.
The three-year roadmap should be: year one stabilize and avoid auto-renewals; year two consolidate overlapping tools and renegotiate strategic vendors; year three optimize and reinvest in gaps such as cloud security and regional coverage. Show the CFO the net savings after integration costs and the risk of cutting too fast. Use a benefits tracker with owners and quarterly reporting. If the CFO insists on 15% by year-end, identify which reductions require risk acceptance and which would reduce capability. The board should see both the savings and the residual risk.
3. What vendor risk and contractual issues must be addressed for the acquired company's region?
Read the worked answer
Address data residency and local regulatory requirements first. Confirm where data is stored, processed, and supported. Assess subcontractor chains and fourth-party risk. Review right-to-audit, incident notification, termination assistance, data return, and security addendum clauses. For the acquired company's cloud provider, evaluate concentration risk and exit options.
Do not force standardization where your current vendor lacks regional support; that could create compliance and operational risk. Negotiate assignment and change-of-control clauses to cover the acquisition. Require local support SLAs and language coverage. For any vendor retained, conduct due diligence proportional to data sensitivity. Document risk acceptance where contracts cannot be amended before renewal. The board should see a vendor risk heat map by region and function, not just a savings chart.