They are not very complicated.
Start with automatic network scans – you need to know what sits within the network.
Then, make sure your staff is fully aware on how to submit new technology.
Finally, make sure you have well documented the process of exception of running the whole evaluation process.
Simple and effective.