Guide

DAM requirements checklist: 260 requirements by domain

Short answer

A DAM requirements checklist lists every capability a DAM must provide, grouped by domain and prioritised as must, should, could or won't. The DAMSelection checklist holds 260 requirements in five domains and marks 45 as default must-haves. Buyers use it as a completeness check against their own validated needs, then convert the remaining must-haves into scripted demo scenarios.

What the checklist is for

The DAM requirements checklist is a reference list that buyers use to cross-check their own requirements for gaps before vendors see them.

The checklist belongs to Checkpoint 2 of the Selection Route. In the PIMvendors method, requirements start with the people who do the work. Teams collect needs in workshops, write them as user stories and validate them with the people who raised them. The checklist then shows what the workshops missed.

DAMSelection assessment: a checklist copied straight into an RFP produces identical answers from every vendor. Every vendor marks 260 lines as supported. The value of the checklist lies in the cross-check and in the priorities.

Three uses make the checklist worth the time:

  • Gap check: catch capabilities nobody raised, such as rights expiry, export or audit logs.
  • Priority check: force a decision on every line, including what the DAM will not do.
  • Scenario check: confirm that every must-have appears in at least one scripted scenario.

The five domains

The DAMSelection DAM requirements checklist splits 260 requirements into five domains of 52 lines each, and each domain has a natural validator inside the organisation.

DomainWhat it coversWho validates itScenario that tests it
Asset managementIngest, formats, versions, renditions, duplicates, archiveDAM manager, creative studioOnboard a product shoot
Metadata and searchSchema, vocabularies, taxonomies, search, AI taggingDAM manager, digital librarianFind the right asset fast
Workflow and rightsApprovals, review, usage rights, expiry, audit trailBrand, legal, packagingExpire a licensed image everywhere
Distribution and integrationPortals, sharing, CDN, API, connectorsTechnical evaluator, e-commerce, PIM ownerPull assets through the API
Security and platformIdentity, permissions, hosting, certification, supportIT security, procurementEvidence in the security review

Requirement IDs in the Requirements Builder start with a domain letter. A stands for asset management, M for metadata and search, W for workflow and rights, D for distribution and integration and S for security and platform. Keep the IDs when you add your own lines, so vendor answers map back to the list.

How to use the checklist

DAM teams use the checklist in eight steps, starting from their own validated needs and ending with a scenario map.

  1. Collect needs per user group in workshops and write them as user stories.
  2. Map each user story to one or more checklist lines, by ID.
  3. Walk through every domain and flag lines that no story covers.
  4. Ask the validator of each domain to accept, change or reject each flagged line.
  5. Add organisation-specific lines: industry rules, named integrations, languages and volumes from the content audit.
  6. Set a MoSCoW priority on every line, including the default lines you keep.
  7. Link every must-have to the scripted scenario or document that proves it.
  8. Export the final list for the RFP and the scoring matrix.

Step 3 usually adds 10 to 30 lines to a workshop list, as a DAMSelection rule of thumb. Rights, export and administration lines are the most common gaps.

Prioritise with MoSCoW

MoSCoW prioritisation sorts each DAM requirement into must, should, could or won't, and the must category should hold only lines whose absence would stop the project.

PriorityMeaning in a DAM selectionHow it scores
MustWithout it, the DAM cannot go live for its main use casePass or fail gate per vendor
ShouldImportant, with a workaround available for a periodWeighted in the scoring matrix
CouldUseful, adds value when two vendors are closeTie-breaker
Won'tOut of scope or an anti-pattern to excludeStated in the RFP, never scored

Fact: DSDM, the project framework that defined MoSCoW, recommends typically no more than 60% Must Have effort in a project. A selection list needs a tighter rule, because each must-have becomes a gate that can remove a vendor. The DAMSelection default marks 45 of 260 lines as must, about 17%.

DAMSelection default priorityLinesShare
Must4517%
Should16664%
Could4417%
Won't52%

DAMSelection rule of thumb: keep musts under one third of the final list. Write every must-have so that a vendor can fail it. A must-have that every vendor passes on paper carries no selection value.

Test each candidate must-have with three checks:

  • Absence stops go-live for the main use case.
  • No workaround exists for the first year.
  • A demo, proof of concept or document can prove the line.

A line that fails any check becomes a should.

Won't-haves name the anti-patterns

DAM won't-haves record what the organisation explicitly excludes, and the DAMSelection checklist uses one won't line per domain for a common anti-pattern.

DomainDAMSelection won't-haveReason to exclude it
Asset managementNative editing of design files inside the DAMCreative tools own editing; the DAM owns versions
Metadata and searchFree-text keywords as the primary findability methodFree text breaks filters; controlled vocabularies work
Workflow and rightsRights stored only in free-text notesRights need structured fields to drive expiry
Distribution and integrationManual file transfer as the main distribution methodPortals, links and APIs replace manual transfer
Security and platformShared administrator accountsShared accounts break the audit trail

Stating won'ts in the RFP saves demo time. Vendors stop presenting features the buyer has ruled out.

From requirement to scenario

DAM must-haves become testable when the team groups them into scenarios, each following one real task from start to finish.

DAMSelection assessment: nobody can demonstrate 260 separate lines in two hours. A scenario covers five to ten related lines in one flow, so the panel sees how the lines work together.

Worked example: the licence expiry scenario covers six checklist lines.

Checklist lineDomainDAMSelection default priority
Record usage rights per asset: channels, regions, periodsWorkflow and rightsMust
Expiry dates with automatic status changeWorkflow and rightsMust
Warnings before expiry to asset ownersWorkflow and rightsShould
Block download of expired assetsWorkflow and rightsShould
Track where an asset is in use downstreamWorkflow and rightsShould
Share links with expiry, password and download controlsDistribution and integrationMust

Build a coverage matrix with requirement IDs as rows and scenarios as columns. Every must-have needs at least one mark. Must-haves without a mark either need a new scenario or a document as proof. The demo script guide shows how to write each scenario.

Add industry lines

DAM requirements checklists need industry lines on top of the five generic domains, because regulation and product structure differ by sector.

IndustryLines to addTypical priority
ManufacturingRelation to SKU and product family from the PIM, technical document types, dealer visibilityMust for the PIM relation
RetailRelation to SKU, season, shot type, colourway, target marketplacesMust for the SKU relation
Consumer goodsArtwork versions per market, regulatory approval status, retailer deliveryMust for artwork versions
Fashion and apparelStyle number, collection, model release per shootMust for model releases
Pharma and life sciencesReview number, approved claims, review expiry dateMust for review expiry
Media and publishingCredit line, syndication rights, event dateMust for syndication rights

The lines come from the industry extensions of the Metadata Model Builder. The industry fit pages explain each sector's scenarios.

Match each line to its evidence

Each DAM requirement needs one type of evidence, and the evidence type decides when and how the team checks it.

Evidence typeSuitsChecked at
Scripted demoFunctional lines: ingest, search, workflow, portalCheckpoint 5
Proof of conceptAdoption, integration and performance linesCheckpoint 5
DocumentCertifications, sub-processors, data processing termsCheckpoint 6 security review
Reference callSupport quality, upgrade effort, real admin effortCheckpoint 6
Contract clauseExport on termination, service levels, AI use of assetsCheckpoint 7

Security and platform lines rarely show in a demo. The security requirements guide lists the documents to request. Functional lines need measurable conditions, explained in the functional requirements guide.

Use the Requirements Builder

The Requirements Builder holds all 260 DAMSelection requirements with their default priorities, and it exports your edited list as a CSV file.

  1. Filter by domain to review one domain with its validator.
  2. Filter by priority to review all must-haves together.
  3. Change the priority per line to match your scope.
  4. Export the list, which carries ID, domain, requirement and your priority.

Add four columns in the spreadsheet after export: source user story, validator, scenario or evidence type, and vendor response. The same sheet then feeds the RFP and the scoring matrix.

Checklist by domain

DomainRequirementsMust-havesExample requirement
Asset management528Ingest files by drag and drop, bulk upload, watched folder and API
Metadata and search5211Configure custom metadata fields per asset type without code
Workflow and rights527Configurable approval workflows with multiple steps
Distribution and integration528Branded portals for internal and external users
Security and platform5211SAML or OIDC single sign-on

Frequently asked

How many requirements should a DAM RFP include?

A DAM RFP should include the prioritised must-haves and shoulds that matter for scoring, usually far fewer than 260 lines. Send scenarios for the functional must-haves and ask direct questions only for lines a demo cannot prove, such as certifications, hosting regions and export terms.

What are must-have DAM requirements?

Must-have DAM requirements are capabilities whose absence stops go-live for the main use case and that have no workaround for the first year. Typical must-haves cover bulk ingest, configurable metadata, controlled vocabularies, faceted search, usage rights with expiry, single sign-on and full data export.

Is the DAMSelection checklist enough on its own?

The DAMSelection checklist works as a completeness check, so pair it with requirements from your own workshops. Organisation-specific lines on integrations, industry rules, languages and volumes always need adding. A checklist used without validated needs produces generic answers that every vendor marks as supported.

How do you prioritise DAM requirements?

Prioritise DAM requirements with MoSCoW: must, should, could and won't. Keep musts under one third of the list, write each must so a vendor can fail it, and link it to the scenario or document that proves it. Shoulds carry weight in scoring and coulds break ties.

Who should validate the DAM requirements?

Each domain needs a validator who uses or governs that part of the DAM. The DAM manager validates asset management and metadata, brand and legal validate workflow and rights, the technical evaluator validates distribution and integration, and IT security validates security and platform. The decision owner approves the final priorities.

Sources

Run your selection with PIMvendors

Vendor-neutral DAM selection with scripted demos on your own assets.

Book a selection call