Abstract: A framework defines a minimum set of requirements that all entities within an organization must adhere to when acquiring an information technology (IT) product. The framework has a first policy that each entity of the organization must follow the framework, a second policy defining a business process that each entity must follow when acquiring an IT product, a third policy defining a set of tools for being employed to implement the business process of the second policy; and a fourth policy defining additional requirements specific to one or more of the entities within the organization, where the additional requirements for each entity are defined by such entity.