BLUETEAM ACADEMY — EFFICIENT SECURITY VENDOR SELECTION Practice workbook · security-vendor-selection-v1 · English Use fictional or sanitised information. This local workbook is not automatically saved to your academy account. Submit your responses in the module exercises for a retained learning record. Written work is retained, not independently graded. CASE DATA — FICTIONAL, NOT MARKET BENCHMARKS Northstar: 600 employees, 800 endpoints, two security analysts. Monitoring contract expires in 120 days. Initial sample: 20 cases, median 42 minutes to assemble an investigation; eight lack the necessary identity event. Controlled target: reconstruct agreed cases within 15 minutes, with supporting source events and usable export. Mandatory gates: G1 approved identity integration/access; G2 complete usable case export; G3 approved processing/support-access arrangement. Apex fails G2. Beacon and Cedar pass all gates in the final packet after documented retests; go-live acceptance remains a separate decision. Weights: workflow 35%, integration/operability 25%, assurance 20%, cost predictability 20%. Rating scale 0–5. Beacon ratings: 4,3,4,3. Cedar: 3,4,3,5. Alternative sensitivity weights: 45,25,20,10. Calculate each contribution as rating / 5 * weight. Do not silently change the approved baseline. Costs in EUR thousands, three years, undiscounted and excluding tax/financing: Beacon Cedar Annual subscription 48 60 Annual internal effort 30 18 One-time implementation 18 8 Exit estimate 12 5 High-use extra/year 24 6 Verify other migration, integration, retention and support exclusions before a real purchase. These are fictional inputs, not quotations. Pilot: 10 injected relevant cases, 9 detected, 1 missed, 3 additional false alerts. Calculate precision and recall; state dataset limits. A supplier engineer pre-labelled one demonstration and repaired the collector: distinguish assisted and unassisted results. MODULE 1: Define the outcome / Organise the decision / Compare real alternatives Draft Northstar’s decision charter in 150–250 words: define the service problem using the case evidence, one measurable outcome, three accountable roles, the improve-versus-buy alternatives, and a decision deadline that leaves time for transition. Do not name a preferred vendor yet. TEMPLATE Problem and consequence [Your response] Measurable outcome [Your response] Roles and decision authority [Your response] Improve / buy / bridge alternatives [Your response] Decision and transition dates [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 2: Convert needs into tests / Separate gates and preferences / Control scope and changes Create five numbered requirements for Northstar. Include at least two mandatory gates and two preferences. For each, state the business purpose, a measurable acceptance test, evidence needed and accountable owner. Rewrite one vague supplier feature claim as an outcome requirement. TEMPLATE ID | business purpose | gate or preference | test | evidence | owner [Your response] Baseline approval and change process [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 3: Anchor the ratings / Calculate the weighted result / Challenge a fragile winner Calculate Beacon and Cedar’s baseline scores from the module data, then calculate the workflow-heavy scenario. Write a moderation note explaining why the ranking changes, which assumption matters and what approval would be needed to revise the official weights. Include the four contribution values for each baseline total. TEMPLATE Criterion | weight | Beacon rating | contribution | Cedar rating | contribution [Your response] Evidence status and moderation reason [Your response] Sensitivity and decision implication [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 4: Scope the assurance / Trace access and dependencies / Close risk with evidence Prepare a supplier assurance register with four rows: report scope, support privilege, subcontractor dependency and recovery. For each, name the claim, evidence needed, current gap, responsible owner and condition for closure. Use fictional references and do not upload confidential supplier reports. TEMPLATE Claim | relevant scope | evidence | gap | owner | closure condition [Your response] Shared dependencies and access restrictions [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 5: Pre-register the experiment / Measure assisted and unassisted work / Test the uncomfortable cases Write a six-test proof-of-value protocol: two target scenarios, one benign case, one missing-data case, one operator handover and one full export. For each, define success, evidence, assistance rules and a stop condition. Calculate precision and recall for 9 detections, 1 miss and 3 false alerts; state why production results may differ. TEMPLATE Test ID | requirement | dataset | expected result | operator | assistance | evidence [Your response] Stop conditions and cleanup [Your response] Precision / recall and limits [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 6: Normalise the cost boundary / Calculate and stress the model / Separate price from value Prepare a three-year comparison for Beacon and Cedar. Show subscription, internal effort, implementation and exit separately, then calculate the high-usage scenario. State the largest drivers, two excluded costs to verify, and one negotiation request tied to each vendor’s exposure. TEMPLATE Cost item | unit | quantity | term | Beacon | Cedar | source / assumption [Your response] Base and high-usage totals [Your response] Exclusions and negotiation requests [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 7: Make acceptance explicit / Allocate ongoing responsibilities / Prove the exit route Write a pre-signature checklist covering acceptance, privileged support, service measurement, significant changes and exit. Add a closure owner and evidence for each. Draft a five-step transition sequence with a rollback point; avoid asserting legal rights that have not been agreed. TEMPLATE Condition | owner | due date | acceptance evidence | approval [Your response] Response vs restoration vs resolution [Your response] Export, transition sequence and rollback [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ====================================================================== MODULE 8: Write the selection memo / Release through delivery gates / Measure value after purchase Capstone: write a 300–500 word selection memo using the final Northstar packet. Include rejected and eligible options, both cost scenarios, the official score and its sensitivity, your recommendation, two pre-go-live conditions, residual-risk ownership and a 30/60/90-day review. Refer to evidence IDs and explain one alternative. This written work is retained for review; automated grading covers the separate scenario checks. TEMPLATE Decision requested and recommendation [Your response] Eligibility and rejected options [Your response] Score, sensitivity and cost boundary [Your response] Residual risks, conditions and approver [Your response] 30 / 60 / 90-day review and handover [Your response] SELF-REVIEW - Refer to the case evidence and state its limits. - Explain the trade-off and a plausible alternative. - Identify an owner, approval boundary and verification step. ======================================================================