Selecting a Student Records System on TCO and Weighted Criteria

Vendor A - five-year TCO (KES):

Item	Amount
Licences	3,500,000
Servers/hardware	1,200,000
Implementation	900,000
Support, escalating 8%: 500,000 + 540,000 + 583,200 + 629,856 + 680,244	2,933,300
ICT officer, 400,000 × 5	2,000,000
Total	10,533,300

Vendor B - five-year TCO (KES):

Item	Amount
Implementation	600,000
Training	150,000
Subscription, 4,200 × 120 = 504,000 in year 1, escalating 10%: 504,000 + 554,400 + 609,840 + 670,824 + 737,906	3,076,970
Total	3,826,970

B costs about KES 6.7 million less over five years - roughly 64% lower.

Weighted scores (weight × score, summed):

• Vendor A: (0.30 × 4) + (0.25 × 2) + (0.20 × 4) + (0.15 × 4) + (0.10 × 3) = 1.20 + 0.50 + 0.80 + 0.60 + 0.30 = 3.40
• Vendor B: (0.30 × 3) + (0.25 × 5) + (0.20 × 5) + (0.15 × 3) + (0.10 × 5) = 0.90 + 1.25 + 1.00 + 0.45 + 0.50 = 4.10

Vendor B leads on the model as specified, by 0.70 points, with its advantages concentrated in cost, support and speed of implementation. Two cautions on the arithmetic itself: the 1–5 scale is ordinal, so a 0.70 difference is directional rather than a precise measure; and the TCO score of 2 assigned to A should be checked against the calculation, since the model should be scoring the computed TCO, not an impression of it.

Recommendation: Vendor B, conditional on the safeguards below. The cost gap (about KES 6.7 million over five years) is large enough that A would have to be clearly superior on functionality and security to justify it, and it is not: A scores only one point better on functionality and one on security, while losing on support and speed.

But the highest score is not automatically the right decision. The model is only as good as the scores behind it, and two of B's weaknesses are material rather than cosmetic.

Data protection. Marks, fee balances, names and national identity numbers are personal data under the Data Protection Act, 2019. Placing them on servers in Ireland is a cross-border transfer, which the Act permits only where the destination has adequate safeguards or another specified condition is met - so the institute must:

• register with the Office of the Data Protection Commissioner as a data controller if it has not already done so;
• carry out a data protection impact assessment before go-live, because processing examination records at this scale, with fee consequences, is high risk;
• sign a written data processing agreement with B covering purpose limitation, security, breach notification, sub-processors and audit rights;
• establish the lawful basis and retention period for results, and document the cross-border transfer justification;
• require encryption in transit and at rest, role-based access, and audit logs of who changed a mark.

If B cannot evidence these, the 15% security weight was too low and the ranking should be revisited.

Connectivity and power. A 2 Mbps upload is adequate for marks entry, which is low-volume, but not for bulk uploads of scanned scripts, and a 10 Mbps contended link with frequent outages turns a cloud system into an unavailable system. The institute must budget for a second internet link with automatic failover, an LTE backup router, UPS coverage for the network cabinet, and an offline-capable client so staff can continue entering marks during an outage and synchronise afterwards. Those costs belong in B's TCO - adding, say, KES 1.2 million over five years still leaves B far cheaper.

Data ownership and export. The contract must state that the institute owns all student data and that on termination the vendor returns it in a documented, machine-readable format (CSV plus a database dump) and then deletes it, with a certificate of destruction. Without this, the institute is locked in: leaving means abandoning years of academic records.

Exit assistance and notice. A minimum notice period (say 90 days) and a defined transition-assistance period, priced in advance, so the vendor cannot hold the migration to ransom at renewal.

Service level agreement. Uptime measured monthly, with service credits, and defined restoration targets. At results publication time an outage is not an inconvenience; it is a reputational and possibly regulatory event.

Security and breach notification. Named breach notification within a short period (24–72 hours) to allow the institute to meet its own obligations under the Data Protection Act, a right to audit or to receive independent assurance reports, prior approval of sub-processors, and a liability cap that does not leave the institute bearing all the loss for a vendor breach.

Price review. A cap on annual escalation (for example at the rate of inflation) rather than an open-ended "may increase". The TCO assumed 10%; an uncapped clause could double the five-year figure.

Acceptance and staged payment. Payment tied to acceptance criteria - a pilot of one faculty's results reconciled line by line against the existing spreadsheets, with zero unexplained variances - rather than to a signature date.

Continuity of the vendor. Change-of-control provisions, source code or data escrow where practical, and evidence of financial standing, because a small vendor failing would strand the institute mid-year.

Implementation scope in writing. Data migration of the last five years of results, user training for at least the three examinations staff plus the ICT officer, and configuration of role-based access, all as priced deliverables and not as change requests.