What enterprise procurement asks, and what most agencies cannot answer

A bank does not buy software the way a founder does. The person who wrote the brief, liked the work and wants it built is rarely the person who decides. Between that conversation and a signature sit information security, legal, data protection and procurement — four functions with their own forms, their own veto and no interest whatsoever in the design. Agencies lose enterprise work at this stage far more often than they lose it on the proposal, and usually without ever being told that is what happened.

It begins with a security questionnaire, and its purpose is not to catch you out. It is to establish that software is produced here by a process rather than by talent. How is code reviewed before it merges. How are dependencies scanned and how quickly is a critical advisory patched. Where do secrets live, and can a departing engineer still reach production on Monday. Who is called at two in the morning, and within how long. These are answerable in a page if the answer is true, and unanswerable in twenty if it is not.

Then identity, which is where most projects quietly discover they were scoped wrong. An enterprise does not want another set of credentials; it wants its own directory, through SAML or OpenID Connect, with the roles it already maintains. Alongside it sits the audit trail: who did what, to which record, when, and what the value was before. That is not a log file. It is a product feature with a schema, a retention policy and a screen, and it costs a fraction of what it costs to retrofit into a system that was built assuming one kind of user.

Data protection arrives next, and arrives in writing. Under Article 28 GDPR the supplier is a processor and the contract is not optional: documented instructions, a named list of sub-processors, notice before that list changes, where the data physically sits, how long it is kept, how it is deleted and how the client audits any of it. An agency that has never produced a data processing agreement will be asked for one in week two of the legal review, and will spend a month producing something a lawyer then rejects.

Continuity is the question behind every other question: what happens to us if this supplier disappears. It is answered by where the repository lives and whose organisation owns it, by whether the infrastructure runs in the client's own cloud account, by whether the documentation would let a competent third party take over, and by how many people understand the system rather than one. We publish our answer to this in advance on what you own, because it is easier to be believed in a procurement review when the position was already public before the review began.

The commercial layer is the least discussed and the most decisive. Liability caps, which a large buyer will want above the contract value and a small supplier cannot responsibly give. Professional indemnity insurance, named and current. Company identifiers — VAT number, commercial registry entry — that let the vendor be onboarded at all. And payment terms of sixty or ninety days, which decide whether an agency of eight people can take the work regardless of whether it wants it. A supplier who has thought about none of this is not rejected for being small. It is rejected for being unonboardable.

All of which sounds like an argument for hiring the largest firm available, and it is the opposite. Large suppliers answer these questions with volume: a hundred-page security appendix that commits to nothing specific, an architecture diagram drawn for the pitch, a named team that changes twice before delivery. A small supplier can answer each question in three sentences that are true, and can be held to them. The advantage is not the size. It is that the same people who answer the questionnaire are the ones who will write the code.

The practical conclusion is unglamorous. Prepare the pack once — an architecture summary, a security and development process note, a data processing agreement, a sub-processor list, an exit and handover plan — and keep it current. It takes a week. After that it is attached to every proposal rather than assembled in a panic during a review, and it is the difference between being the interesting option and being the one that clears legal.