Enterprise procurement
You are not here to be persuaded. You are here to find out whether this vendor can be contracted safely, what happens if it fails, and whether your organisation could get its state back. Those answers are on this page rather than behind a call.
A business sponsor has already decided. They have a deadline, a demo they liked, and an expectation that this is a formality. Your job is to establish whether the vendor is contractable, whether the obligations can be met, and what the organisation is exposed to if the relationship ends badly.
The vendor’s website will not help. It is written for the sponsor. The security page describes an architecture, the pricing page describes tiers, and the information you need — insurance, subprocessors, the DPA, the exit terms, what happens on a breach — is behind a form that routes to a salesperson who will want a call first.
So you send the questionnaire, wait nine days, and receive a document assembled by somebody who has not read your questions closely. Then you do it again for the next thirty vendors.
Nearly every vendor makes procurement evidence expensive to obtain, which converts your review into a negotiation instead of an assessment.
Gating the DPA, the subprocessor list and the exit terms behind a sales conversation is a deliberate design. It works because it delays your objection until after the sponsor is committed, which is the point in the process where an objection costs the most to raise.
This page exists to remove that. The artefacts below are available on request without a qualification call, and the terms that usually get discovered late — exit, data return, breach notification, subprocessor change — are stated here rather than found in an addendum.
Where something does not exist yet, it says so. A SOC 2 Type II attestation is in progress and no report exists; we hold neither a FedRAMP authorization nor a FedRAMP certification. You would find that out eventually. Finding it out on the first page is worth more to both of us than finding it out in week six.
Time from request to a usable set of artefacts — measured by elapsed days, against your own baseline for comparable vendors.
How many rounds a security questionnaire takes — measured by return trips before the answers are usable.
Whether compliance status is legible without interpretation — measured by each framework marked held, in progress, operating, applicability-gated or designed for.
How late a blocking issue surfaces — measured by stage at which a disqualifying fact is discovered — first page is the target.
Whether exit is assessable before signature — measured by existence of an export and reconstitution procedure you can read now.
that we will pass your review. Several organisations should decline on the compliance status alone, and that is a legitimate outcome rather than a failure of the page.
Implementation expectations are part of the purchase and are frequently understated. The honest version: a first bounded scope needs somebody who owns the process, somebody who can grant authority, and access to the systems that hold the relevant state. It does not need a migration.
Identity integrates with your identity provider rather than creating a parallel user store. Evidence can stream to your SIEM. Where an integration does not exist for a system you depend on, that is named during scoping with the work required, rather than discovered during implementation.
Support model, escalation path and named contacts are part of the contract rather than a page in a portal.
A vendor page that lists frameworks without status is asking you to assume. Every line we publish carries its actual status, and nothing is marked held.
That is a shorter list than several competitors will show you. It is shorter because it is annotated rather than because the architecture is thinner, and you are entitled to check whether the longer list distinguishes its held certifications from its intentions.
Request what applies to your review rather than the whole set. A tenant-isolation question and a data-residency question need different documents, and receiving both wastes the reviewer’s time in a way that reads as thoroughness and functions as noise.
Where a document does not exist yet, we will say so on the first response rather than the third.
A first engagement bounded to one queue, workflow or department — small enough that ending it early costs your organisation a scope rather than a migration.
The strongest procurement position is taken before signature, and the exit terms are worth the most to you at exactly the moment they cost us the most to make specific. Ask for the export and reconstitution procedure first.
Then bound the first engagement so that failure is survivable. A bounded scope is not a lack of ambition; it is what makes the second decision an assessment rather than a hostage negotiation.
And state what would make you stop, before starting. Written down in advance, it is a criterion. Raised afterwards, it is a dispute.
It is shorter because every line is annotated with its actual status and nothing is marked held. Before comparing lengths, check whether the other list separates held certifications from in-progress assessments from architectural intentions. If it does not, you are comparing an annotated list to an unannotated one, which is not a comparison.
Then it is a hard gate, and you should say so now rather than spend six weeks on an evaluation that cannot conclude. The attestation is in progress and the observation window has to run; no amount of contracting language substitutes for the report. If a bounded, low-sensitivity first scope is possible under your policy, that is the conversation. If not, decline — we would rather that than a deal that stalls in your review.
The artefacts are available without a qualification call, which usually removes the slowest part. What we will not do is compress the applicability conversation, because that is where BAAs, residency and framework obligations get decided, and getting those wrong creates a contract amendment later that costs both sides more than the weeks it saved.
Governed business state, workflows, history, evidence, receipts, configuration and audit records are designed to export in open or documented forms, and the architecture includes reconstitution testing so an export is not a pile of vendor-specific files nobody can read. Ask for that procedure before signature — it is the request that tells you most about a vendor, precisely because it is the one they gain nothing by answering well.