Passing enterprise procurement without a big ops team

The first serious enterprise deal usually stalls in the same place. Not on price, not on the product, but on a security questionnaire, a data processing schedule, or a request for something the company has never had to produce before. The deal does not die; it just stops moving, sometimes for a quarter, while a founder assembles answers between other commitments.

What makes this frustrating is that the underlying position is often fine. The company does handle data sensibly. It just cannot show it on demand, in the form the buyer's process requires.

What procurement is actually checking

A buyer's procurement and risk functions are not assessing whether you are impressive. They are discharging an obligation: to be able to demonstrate, later and to someone else, that they took reasonable care before letting a supplier near their data, their customers or their systems.

That reframing is useful, because it tells you what they need from you. Not sophistication, but evidence, in a form they can file. A modest control that is written down, owned by a named person and consistently followed will clear review more easily than a genuinely better practice that exists only in someone's head.

Start before you have the deal

The worst time to build this is while a buyer waits. The work is not large, but it is slow when done reactively, because each answer needs a decision the company has not yet made, and those decisions get made badly under deal pressure.

Assembled ahead of time, it is a contained piece of work. Assembled during a live opportunity, it becomes the reason a quarter slips.

What to have ready

• A current data map. What personal or customer data you hold, where it lives, who can reach it and why. Most questionnaire answers derive from this, and without it every one is researched from scratch.
• Access control you can describe. How someone gets access, how it is reviewed, and what happens the day someone leaves, which is the question that catches people out.
• Your own supplier list. Buyers increasingly assess your vendors as an extension of you. Know who processes data on your behalf and under what terms.
• Named ownership. Somebody who owns security decisions and can answer questions with authority. It does not need to be a full-time role. It does need to be a real one.
• The contract positions you have already agreed. Liability, data processing, notification periods, exit. Knowing your default position and where you can move turns a fortnight of internal debate into a same-day answer.

Procurement rarely rejects a small supplier for being small. It stalls on suppliers who cannot answer consistently, because inconsistency reads as risk.

Handling the questionnaire itself

Answer plainly, and never overstate. A control you do not have, described as though you do, is the one thing that turns a routine review into a genuine problem. It will be tested at some point.

"Not yet, and here is our timetable" is an acceptable answer far more often than founders expect. Reviewers work with maturity ranges every day. What they cannot work with is an answer that contradicts one you gave three questions earlier.

Who owns this

In a small company this lands on whoever is nearest, which usually means a founder or an engineer with other priorities. That works once. By the third enterprise conversation it is a recurring tax on the people least able to absorb it.

The fix is not a compliance department, and it is not certification either — see security foundations before ISO 27001. It is deciding, once, what your positions are, writing them down where anyone can find them, and giving one person the authority to answer on the company's behalf. Do that and enterprise procurement stops being an event and becomes a form you fill in.