US enterprise procurement: what mid-market sellers miss
The five questions in every US enterprise procurement playbook that mid-market vendors fail.
Selling SaaS or services into US enterprise — Fortune 1000, late-stage Series D+, public companies — is qualitatively different from selling into mid-market. The sales cycle is longer, the procurement gauntlet is wider, and the questions are different. Mid-market vendors who try to sell into US enterprise without adapting often lose deals at the procurement stage, frequently after winning the technical evaluation.
This post is the five questions we see in every US enterprise procurement playbook that mid-market vendors most often fail. Not because the answers are hard, but because the answers must be ready, in writing, with evidence.
Question 1: SOC 2 Type II report, dated within the last 12 months
The most common procurement disqualifier. Mid-market vendors often have SOC 2 Type I (point-in-time attestation) but not Type II (operating-effectiveness over a period). Or they have Type II from 18 months ago that has expired. Either is a procurement red flag.
The fix: continuous SOC 2 readiness, with a rolling Type II report from a recognised audit firm. The cost ($25K–$60K/yr depending on auditor and scope) is meaningful but small relative to lost enterprise deals. Vendors that try to win enterprise deals without it are leaving revenue on the table.
Question 2: Data residency and the sub-processor list
US enterprise buyers — particularly in financial services, healthcare, and government-adjacent — increasingly require:
- A US-only data residency option. The data the vendor processes must live in US AWS / GCP / Azure regions only. EU regions or “we use AWS, location varies” is increasingly disqualifying.
- A written sub-processor list. Every third-party your service depends on. With names, locations, what data each touches, and what contractual terms govern them.
- A 30-day notification clause for new sub-processors. Buyers want the right to object before you add a new dependency.
Mid-market vendors often have one or two of these but not all three. All three is increasingly the standard for US enterprise procurement above $200K ACV.
Question 3: The questionnaire
US enterprise procurement teams send security questionnaires. The shorter ones are 80 questions; the longer ones are 400+ questions. The questions cover information security, data privacy, business continuity, vendor risk management, and incident response.
Three patterns of failure on the questionnaire:
- No prior questionnaires reused. The first vendor questionnaire takes 40+ hours to complete. The second takes 4 hours, if you maintain a “questionnaire library” of canonical answers. Vendors that don’t maintain the library spend disproportionate effort per deal.
- Aspirational answers. Marking “yes, we do that” when the actual answer is “we plan to” gets caught in the audit step, and the deal dies. Honest answers, with documented current state and committed remediation timelines, do better than optimistic ones.
- No designated owner. When the questionnaire is everyone’s job, it is no one’s job. Mid-market vendors at $5M+ ARR should have a named owner for security and compliance — often a security engineer or a fractional CISO.
Question 4: The MSA (Master Services Agreement)
US enterprise customers send their MSA. They expect mid-market vendors to redline reasonably and sign within 2–4 weeks. Mid-market vendors that need 6+ weeks of legal back-and-forth signal that they don’t have an enterprise-ready legal function.
The fix: maintain a “redlined positions” library. Standard positions on liability cap, indemnification, term, termination, IP, data protection. Your counsel marks up the customer’s MSA in 24–48 hours using the library, not from scratch. The redline cycle compresses from weeks to days.
Question 5: Implementation and support SLAs
US enterprise customers want implementation timelines, support response SLAs, and uptime SLAs in writing. Mid-market vendors often don’t have these formalised.
What enterprise expects:
- Implementation timeline: typically 30–90 days from contract signature to production use. Documented as a milestone schedule.
- Support SLA: P1 response within 1–4 hours, P2 within 1 business day, with named escalation paths.
- Uptime SLA: 99.9% or higher, with credits for breach. Measured from external monitoring, not vendor self-reporting.
Vendors that improvise these per-deal lose negotiating leverage. Vendors that have them documented as standard with optional add-ons (24/7 support, white-glove implementation) close faster.
What this all costs to get right
The full enterprise-readiness investment for a $5M–$20M ARR mid-market SaaS:
- SOC 2 Type II: $25K–$60K/yr
- Sub-processor management + documentation: ~10 hours of legal + ops time per quarter
- Questionnaire library + dedicated owner: ~$80K–$120K/yr loaded cost for a part-time dedicated function
- MSA redline library + counsel relationship: $15K–$30K one-time, plus per-deal legal costs
- SLA documentation + monitoring: $5K–$15K one-time, plus monitoring costs
Total: ~$150K–$250K/yr in incremental cost. The break-even is roughly two won enterprise deals at typical mid-market ACV. Most vendors who make the investment are net-positive within 12 months.
The vendors that don’t make the investment lose those deals to enterprise-ready competitors, often without ever knowing why.
Read more: /markets/united-states · /sectors/b2b-saas · /strategy/