FAQ · Long-form · Organized by role
Everything you'd want to know before engaging us.
Most questions we get cluster by role. We've organized this FAQ that way. Start with the general section below if you've never worked with a technology advisor. Jump to your role if you have a specific question in mind.
General
The questions everybody asks first.
What does The Cardinal Source actually do?
We are an independent technology sourcing advisory firm. We benchmark, source, and negotiate technology contracts on behalf of mid-market and multi-location operators. We work in telecom, cloud, contact center, network, security, and connectivity. The supplier you sign with pays us a residual commission. You don't pay us anything.
If I don't pay you, who does?
The supplier you eventually sign with pays us a residual commission, calculated as a share of monthly recurring contract value. That commission is built into the supplier's pricing whether you use an advisor or not. Going direct doesn't save you the commission. It just routes it to the supplier's direct sales team instead of an advisor working for you.
Doesn't that mean you're incentivized to push us to the highest-commission vendor?
In theory, yes. In practice, no. The reason is reputation. We publish our supplier pool, our scoring rubric, and our commission economics openly. If we were known for pushing buyers to high-commission vendors that didn't fit, we'd stop getting referrals and stop getting buyers in the door. The economics of repeat referrals dwarf the variance in any single deal's commission rate. Our incentive is to get you to the right vendor fast enough that you tell three peers about us.
How is this different from a consulting firm?
Consulting firms charge by the hour and walk away when the contract closes. We get paid only after you sign, and we stay through implementation. Our deliverables are templated and fixed-scope. Theirs are billable and open-ended. If we're not the right vendor for you, we walk away with zero compensation. A consulting firm walks away with the retainer.
How is this different from a vendor's direct sales team?
A vendor's direct sales team sells exactly one product — theirs. We sell access to 470+ vendors across the categories we cover. If you call the RingCentral rep, they recommend RingCentral. If you call us, we run RingCentral against eight comparable vendors, score them against your specific business context, and tell you which one wins for your situation.
How long does an engagement take?
Tier 1 contract benchmark: ten minutes of your time plus five business days for us to return the benchmark. Tier 2 vendor shortlist: about one hour of your time (a 45-minute scoping call plus reviewing the deliverable). Tier 3 sourcing engagement: 30 to 90 days end-to-end, with about four to six hours of your team's time across that window.
What's "The Cardinal Method"?
Our four-stage sourcing framework. North Star defines the outcome. East Wind surveys the categories. South Spine scores the vendors against a published rubric. West Frontier negotiates and commits. Open the full Method →
What's "The Cardinal Index"?
Our proprietary data engine. It cross-references your specific requirements against historical performance data on every vendor in our active supplier pool. We pull from our own engagements, the advisor network we partner with, the technology distributors we source through, and outside industry research. Open the Index →
Who's in your supplier pool?
470+ vendors across UCaaS, CCaaS, SD-WAN, SASE, MSSP-managed security, connectivity, cloud, and contact-center AI. The full list is published. See the pool →
FAQ for the CIO
What a CIO needs to know.
My team can run our own RFP. Why would I bring in an advisor?
Two reasons. First, your team will write the RFP from the questions they already know to ask, which means you'll get a vendor recommendation shaped by your blind spots. We've run the same RFP across dozens of comparable buyers. We know which questions get vendors to disclose what they actually do versus what they claim. Second, the residual commission is in the pricing whether you bring us in or not. You're paying for vendor sourcing either way. The only question is whether you're paying an advisor working for you or an account exec working for the vendor.
What do you do that I can't get from a Gartner Magic Quadrant?
A Magic Quadrant tells you how 12 analyst-firm researchers ranked a vendor on two abstract axes. It doesn't tell you whether the vendor delivered on the implementation commitments they made to a 30-clinic veterinary group last year. The Cardinal Index does. The data is in front of you. The reasoning is on the page.
How do you handle confidentiality during an engagement?
Mutual NDA at the start of any Tier 2 or Tier 3 engagement. Your contract data, infrastructure inventory, and integration requirements stay between us and the buyer team you designate. We share vendor-facing requirements only with the vendors we shortlist, and only the requirements they need to respond to. We never share your company name with vendors until you've authorized it.
Will you replace my in-house IT team?
No. We source contracts. We don't manage your systems. After the contract closes, we stay through implementation oversight to make sure the supplier's professional services team delivers what was negotiated. Once you're live, we step back. Your team — or an MSP partner if you need one — runs the day-to-day.
What technologies do you not source?
We don't source ERP, CRM, vertical-specific software (PMS, EHR, DMS, AMS), endpoint security, productivity suites (Microsoft, Google), or hardware. We source the services layer. We'll point you to the right partner for everything we don't do and stay out of their margin.
How do you handle existing vendor relationships?
Your incumbent stays your incumbent unless we find a better answer. The Method's first stage explicitly evaluates whether to renew, renegotiate, or RFP. Sometimes the right answer is renegotiate with the incumbent at better terms. If that's the answer, that's what we recommend. We don't replace incumbents to chase commission.
What's your turnaround on a vendor shortlist?
Tier 2 vendor shortlist: written deliverable within five business days of the scoping call. Tier 3 sourcing engagement: the Cardinal Method shortlist is in your hands by Day 14. Total engagement runs 30 to 90 days from intake to signed contract.
FAQ for the IT Director
What an IT Director needs to know.
My CFO already pushed back on this. How do I justify bringing in an advisor?
The strongest justification is "this costs us zero and removes vendor-driven bias from the recommendation." If your CFO is worried about cost, the cost is zero. If they're worried about extending the timeline, the Method is fixed at 30 to 90 days. If they're worried about losing internal control, the buyer team still owns the decision — we just hand you three options with the scoring math on the page so the decision is defensible.
Will you talk to my vendors directly?
Yes, with your authorization. The Cardinal Method makes us your single point of contact during the RFP. You stop being the punching bag for vendor account execs. Every vendor question routes through us. You only meet vendors at the demo stage, after we've filtered the noise out.
What information do you need from me to start?
A contract or invoice for the category you're sourcing, a list of your locations, employee count, integration requirements (which existing systems need to talk to the new technology), regulatory environment, and decision timeline. About 30 minutes of intake conversation. The rest we pull or research.
How do you keep my information secure?
Contract data is stored encrypted in our engagement systems. Access is limited to the named advisors on your engagement. We do not share contract details with any vendor without your explicit written authorization. After engagement close, contract data is retained for three years for legal and tax compliance, then deleted. Anything submitted via the Tier 1 benchmark is deleted after the benchmark is delivered unless you progress to a Tier 2 or Tier 3 engagement.
What if my favorite vendor isn't in your pool?
We tell you. If the right answer for your specific situation is a vendor we don't source, we say so and point you in the right direction. That happens occasionally — for example, vertical-specific software we don't carry, or an emerging vendor not yet on the major distributor networks. We'd rather lose the commission than send you to the wrong answer.
FAQ for the CFO
What a CFO needs to know.
What's the actual financial impact of engaging The Cardinal Source?
Industry benchmarks suggest mid-market operators recover 10 to 30 percent of annual telecom and connectivity spend through proper sourcing and contract negotiation. Multi-location operators sit at the higher end of that range. Your number is what we put on the page when we benchmark your specific contracts in the Tier 1 process. Free.
Is the commission you get from the supplier a markup I'm paying?
No. The commission is built into the supplier's pricing whether an advisor is involved or not. If you go direct, the commission is paid to the supplier's internal sales rep. If you engage us, the same commission is paid to us. The buyer's price is the same. The only thing that changes is whether the commission funds an advisor working for you or an account exec working for the vendor.
What can I take to my board to defend this decision?
Three things. The Cardinal Method scoring rubric applied to your specific business context with weights you can see. The Cardinal Index comparable-engagement data behind each vendor's score. And the Decision Memo — a 3-page board-ready document with commercial terms, implementation plan, residual disclosure, and risk register. That's the defensible package.
What's your fee structure if we don't sign with any of your recommended vendors?
Zero. If the three vendors we shortlist don't include a winner you're willing to sign with, we walk away with no compensation. No kill fee. No discovery invoice. No retainer to recover. The only way we earn anything is if you sign a contract with a supplier we recommended.
How do you handle the commission disclosure for our compliance requirements?
Every engagement includes a residual commission disclosure in the Decision Memo. We tell you the specific supplier paying us, the commission rate, and the projected commission value over the contract term. Your compliance, audit, and procurement teams have everything they need to document the relationship.
Do you provide tax or accounting advice on the technology spend?
No. We're a sourcing advisory firm, not a tax advisor or accountant. We'll help you understand the difference between CapEx and OpEx treatment for various contract structures, but you should validate the tax implications with your accounting firm.
FAQ for the COO
What a COO needs to know.
How much of my team's time does this take?
Tier 3 sourcing engagement: about four to six hours of your team's time across a 30 to 90 day engagement. That's the intake conversation, two or three milestone reviews, and the vendor demo sessions you choose to attend. Everything else is on our side.
What happens if my business changes during the engagement?
M&A, leadership changes, vertical shifts — all of these change the right vendor answer. The Cardinal Method is built to absorb context changes mid-engagement. Whatever you tell us during intake can be updated. The Index re-runs the scoring against the new context. The shortlist updates accordingly. We're not running a static document. We're running an analysis.
Will the vendor we choose actually deliver what they promised?
This is the question every COO eventually asks. Three answers. First, the Cardinal Index filters out vendors with a track record of failing comparable buyers — we don't put a vendor on your shortlist if they've consistently underdelivered for buyers like you. Second, our contracts include negotiated SLAs and milestone-based payment terms wherever the vendor allows. Third, we stay through implementation oversight, so when the vendor's PS team starts cutting corners, we're there to push back.
What if my locations have different needs?
Most multi-location operators have inherited a patchwork of vendors and contracts. The Sourcing Brief stage explicitly maps this current state and identifies whether the right answer is one vendor across all locations, two vendors split by geography or function, or a hybrid. We don't force standardization. We recommend the configuration that solves for your specific operational complexity.
How does this affect my existing technology partners?
Depends on the partner. Your MSP, your reseller, your VAR — these all play different roles in your existing stack. We don't displace good partners. We replace the ones that are mispriced or no longer fit. If your existing partner is the right answer at the right price, we recommend keeping them.
FAQ for VP Procurement
What a procurement lead needs to know.
How does your process integrate with our existing procurement workflow?
We work alongside it, not around it. The Cardinal Method produces formal RFP-equivalent deliverables — Sourcing Brief, Benchmark, Scorecard, Decision Memo — that slot into your procurement-approval workflow. Your procurement team owns the final vendor selection. We provide the analysis they would otherwise have to produce themselves.
What do you do that our procurement team can't?
Three things. First, we run sourcing across dozens of comparable mid-market buyers every quarter, which means our vendor knowledge is fresher than any internal team's. Second, the Cardinal Index aggregates historical performance data your procurement team doesn't have access to. Third, we negotiate against suppliers daily — we know which contract clauses are negotiable, which terms get dropped under pressure, and where suppliers are most likely to concede.
Do you have a vendor diversity or supplier diversity reporting capability?
Yes. The Cardinal Index tracks supplier diversity status (woman-owned, minority-owned, veteran-owned, small business) on every vendor in our active pool. If supplier diversity is a weighted factor in your scoring rubric, we can apply it. We can also produce supplier-diversity reporting for your engagement.
Can we have you produce a fixed RFP document for our internal evaluation team?
Yes. Tier 2 produces a written 3-vendor shortlist with reasoning. Tier 3 produces the full RFP-equivalent deliverable set. Both are designed to integrate with internal procurement-led decision-making.
What's your standard contract structure with the supplier?
We are typically named as the "Agent of Record" on the buyer's master services agreement with the supplier. This documents our role and establishes the commission relationship. The buyer's contract is still directly with the supplier. We do not interpose ourselves between the buyer and the supplier on the underlying service obligations.
FAQ for the CISO
What a CISO needs to know.
How does security get weighted in your scoring rubric?
Security weighting varies by industry context. For healthcare and regulated buyers, HIPAA and BAA compliance run 25 percent of the scoring weight. For financial services, SOC 2 Type II, FFIEC examiner readiness, and PCI compliance run a combined 35 to 45 percent depending on the engagement. For retail, PCI gets 25 percent on its own. The full weights are published in the Method documentation.
Do you source MSSP and managed security services?
Yes. Our active pool includes 30-plus MSSPs across enterprise security operations, incident response, threat detection, vulnerability management, and compliance-focused security operations. The list is published with the rest of the supplier pool.
How do you handle the security review of recommended vendors?
Every vendor we shortlist for an engagement goes through a security review pulled from the Cardinal Index: current SOC 2 attestation status, recent breach history, third-party penetration test status, data residency, encryption posture, and any open vulnerabilities relevant to your industry. The review is included in the Vendor Scorecard.
What's your data handling during the sourcing process?
Buyer-side data — contracts, infrastructure inventory, integration requirements — is encrypted at rest in our engagement systems. Vendor-side data is shared on a need-to-know basis per the engagement NDA. We do not retain uploaded contracts longer than three years from engagement close. Tier 1 benchmark submissions are deleted after the benchmark is delivered.
Can you include security-specific requirements in the RFP?
Yes. Your security team writes the security requirements section. We integrate it into the sourcing brief and require vendor responses against it. The Cardinal Method explicitly accommodates buyer-supplied security requirements as a scoring dimension.
FAQ for suppliers and partner advisors
For vendors and advisor partners.
I'm a supplier. How do we get added to your active pool?
Email our contact form with the technology category you'd like to be evaluated for, the distributors you work through, and three reference customers we can contact. We add vendors to the pool quarterly. The bar is real customer references and product-market fit for at least one of our covered verticals.
I'm an independent advisor. Can I partner with you?
Yes. We partner with independent advisors who carry their own deals through to close and want access to The Cardinal Index, our research, and our brand for deals where they need a more institutional presence. Reach out through the contact form. We onboard advisor partners as roles open.
I'm a press contact or journalist. How do I reach you?
Press inquiries go through the contact form with "Press" in the subject. We respond within 48 hours to credentialed journalists.
Question we haven't answered? Send it to the contact form — we add new questions to this FAQ as they come in.
Start an engagement →