Glossary term
TCO modelling
Also: Total Cost of Ownership, TCO analysis
A structured estimate of the full lifetime cost of a vendor decision, including licence, implementation, integration, operation, change management and exit cost. List price is usually 20 to 40 percent of real TCO; modelling exposes the rest.
List price is the easiest number in a vendor decision and the least informative. A useful TCO model includes: licence over the contract term, implementation and onboarding, integration cost into the existing stack, ongoing operation (FTE, tooling, support escalation), change management for end users and the cost of exit at contract end.
Exit cost is the most often overlooked dimension. DORA Art. 28 explicitly expects documented exit strategy for critical ICT third-party providers; modelling exit cost early makes the dealbreaker visible before signature rather than after.
In practice
In a weighted vendor matrix, TCO is typically one of five to eight criteria, but it interacts with almost all others (data residency, exit rights, support model). Treating it as a stand-alone number hides the real cost structure.
Related terms
Vendor matrix
A structured comparison of vendor options across weighted criteria, showing scores, evidence per cell and an aggregate result. A good vendor matrix separates dealbreakers from weighted criteria and makes every score traceable to a source.
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).
TIA
Assessment of the protection level in the recipient country for data transfers to third countries after Schrems II. Required under SCC, BCR, and Art. 49 derogations. Output: decision whether the transfer may proceed without, with, or not at all.
TISAX
Audit standard and exchange platform of the German automotive association (VDA) for information security. ISA catalogue is the assessment grid, ENX operates the platform.
TPRM
Discipline and tool category for governing risks from external providers (SaaS, cloud, outsourcing, advisory). Mandatory under DORA Art. 28-30 for financial entities and NIS2 Art. 21 (d) for essential/important entities.
Trade-off analysis
The explicit documentation of what each option gives up to deliver its strengths. Good trade-off analysis makes the cost of the winning option as visible as its benefits, and shows how robust the choice is to changes in weights.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).