Use a weighted scoring matrix tied to your documented requirements so the decision holds up to audit instead of looking like you picked a favorite. Build it before responses land, with criteria weighted by importance: regulatory and security fit, functional fit, TCO, implementation, vendor stability, risk.
then have evaluators score independently first and calibrate as a group to kill bias, model tco across the full contract term not just price, and verify certs against the actual reports plus reference calls. document why each score was given, thats what makes it audit-ready. for regulated finance id make compliance pass/fail so a cheap non-compliant vendor cant win on price