Enterprise Procurement & Legal Review Mapping Survey

Welcome, and thank you for participating! This survey explores how organizations evaluate and purchase enterprise software and services. It should take approximately 13 minutes. Your participation is entirely voluntary, and you may stop at any time. There are no right or wrong answers — we are interested in your honest experiences. All responses are confidential and will be reported only in aggregate.

Are you currently involved in evaluating, selecting, or approving enterprise software or service vendors at your organization?

• Yes, it is a primary part of my role
• Yes, I participate occasionally
• No, I am not involved in vendor evaluation

When did you last evaluate a new enterprise software or service vendor?

• Within the last 3 months
• 3–6 months ago
• 7–12 months ago
• More than 12 months ago
• I haven't evaluated a new vendor

At approximately what spend level does a formal procurement process begin at your organization? (USD or local equivalent)

• No threshold — always formal
• Under $25,000
• $25,000–$100,000
• $100,001–$250,000
• $250,001–$1,000,000
• Over $1,000,000
• Varies by category

In the last 12 months, which issues have blocked or significantly delayed a deal at your organization? Select all that apply.

• Unfavorable liability or indemnity terms
• Data residency or transfer restrictions
• Subprocessor limitations
• Audit or assessment rights
• Termination for convenience
• SLA/uptime penalties
• Insurance requirements
• Intellectual property ownership
• Auto-renewal or pricing terms
• Export control restrictions
• Accessibility compliance (e.g., WCAG/VPAT)
• None of the above
• Other (please specify)

Which security or privacy frameworks/certifications does your organization look for when evaluating vendors? Select all that apply.

• SOC 2 Type II
• ISO/IEC 27001
• ISO/IEC 27701
• HIPAA
• PCI DSS
• FedRAMP (where applicable)
• CSA STAR
• GDPR compliance documentation
• None specifically required
• Other (please specify)

Based on your responses in this survey, please describe the one or two hurdles that most often slow your procurement approvals.

Which industry best describes your organization?

• Technology
• Financial services
• Healthcare
• Government / public sector
• Education
• Manufacturing
• Retail / consumer
• Media / telecom
• Energy / utilities
• Professional services
• Transportation / logistics
• Construction / real estate
• Nonprofit
• Other (please specify)

Thank you for completing this survey! Your input helps us better understand enterprise procurement processes. Your responses will remain confidential and be reported only in aggregate.

What typically initiates a new vendor evaluation at your organization? Select all that apply.

• New business need or initiative
• Renewal or competitive benchmark
• Cost reduction mandate
• Risk/compliance change
• Executive directive
• Integration or consolidation requirement
• Current vendor performance issues
• Other (please specify)

How many distinct stakeholders typically participate from initial discovery through contract signature?

• 1–2
• 3–5
• 6–10
• 11–15
• 16 or more

Rank the following contract clauses from most to least difficult to finalize (drag the most contentious to the top).

1. Indemnification
2. Limitation of liability
3. Data processing / DPA terms
4. Security exhibits / appendices
5. Service levels and credits
6. Insurance requirements

Rank the following trust assets by how much they influence your approval decision (drag the most influential to the top).

1. Third-party security certifications (e.g., SOC 2, ISO 27001)
2. Named customer references
3. Published case studies or testimonials
4. Independent analyst reports
5. Vendor financial stability documentation
6. Transparent pricing and contract terms

We'd like to understand your procurement experience in a bit more depth. An AI moderator will ask you a couple of follow-up questions based on your earlier responses.

Approximately how many employees does your organization have?

• Fewer than 500
• 500–999
• 1,000–4,999
• 5,000–9,999
• 10,000–49,999
• 50,000 or more

Which teams are commonly involved in a typical vendor evaluation? Select all that apply.

• Business owner/requestor
• Procurement
• IT/Architecture
• Information Security
• Legal
• Finance
• Data Privacy/Compliance
• Risk Management
• Executive sponsor
• Data/Analytics
• Other (please specify)

About how many calendar days does legal review typically add to the buying cycle?

• 0–7 days
• 8–14 days
• 15–30 days
• 31–60 days
• 61–90 days
• More than 90 days

To what extent are named customer references required during your vendor evaluation process?

In which region is your organization primarily headquartered?

• North America
• Latin America
• Europe
• Middle East
• Africa
• Asia
• Oceania

For a typical purchase, how often is a formal RFP or RFI required?

What pilot or trial approach does your organization typically require before purchasing? Select all that apply.

• None; we can decide without a pilot
• Self-serve free trial
• Vendor-guided free trial
• Paid pilot
• Limited-scope paid project
• Other (please specify)

What is your typical annual purchasing authority? (USD or equivalent)

• Under $25,000
• $25,000–$100,000
• $100,001–$250,000
• $250,001–$1,000,000
• Over $1,000,000
• Prefer not to say

For a typical purchase, how often is a security or InfoSec assessment required?

Which of the following conditions are immediate deal-breakers for your organization? Select all that apply.

• No third-party security certification
• Refusal to sign a DPA or equivalent
• Data stored in a disallowed region
• No audit or assessment rights
• Uncapped or imbalanced liability
• Non-negotiable standard terms
• No named customer references
• Unclear or unpredictable pricing
• Vendor financial instability
• Accessibility non-compliance (e.g., WCAG/VPAT)
• None of the above
• Other (please specify)

How many years have you been involved in enterprise vendor evaluations?

• Less than 1 year
• 1–3 years
• 4–7 years
• 8–12 years
• More than 12 years

For a typical purchase, how often is a formal legal/contract review required?

Overall, how would you describe your organization's risk tolerance when adopting new vendors?

For a typical purchase, how often is a data privacy impact assessment required?

For a typical purchase, how often is executive sign-off or board approval required?