CGEIT: Certified in the Governance of Enterprise IT

Security and privacy requirements for processing PII need to be specified in the RFP so every prospective provider can demonstrate compliance and can be evaluated against the same mandatory criteria. Those requirements can then be made contractual; defining them only while developing SLAs occurs after provider selection.