Enterprise Procurement & Legal Review Mapping Survey

Welcome, and thank you for participating! This survey explores how organizations evaluate and purchase enterprise software and services. It should take approximately 13 minutes. Your participation is entirely voluntary, and you may stop at any time. There are no right or wrong answers — we are interested in your honest experiences. All responses are confidential and will be reported only in aggregate.

Are you currently involved in evaluating, selecting, or approving enterprise software or service vendors at your organization?

• Yes, it is a primary part of my role
• Yes, I participate occasionally
• No, I am not involved in vendor evaluation

When did you last evaluate a new enterprise software or service vendor?

• Within the last 3 months
• 3–6 months ago
• 7–12 months ago
• More than 12 months ago
• I haven't evaluated a new vendor

What typically initiates a new vendor evaluation at your organization? Select all that apply.

• New business need or initiative
• Renewal or competitive benchmark
• Cost reduction mandate
• Risk/compliance change
• Executive directive
• Integration or consolidation requirement
• Current vendor performance issues
• Other (please specify)

At approximately what spend level does a formal procurement process begin at your organization? (USD or local equivalent)

• No threshold — always formal
• Under $25,000
• $25,000–$100,000
• $100,001–$250,000
• $250,001–$1,000,000
• Over $1,000,000
• Varies by category

How many distinct stakeholders typically participate from initial discovery through contract signature?

• 1–2
• 3–5
• 6–10
• 11–15
• 16 or more

Which teams are commonly involved in a typical vendor evaluation? Select all that apply.

• Business owner/requestor
• Procurement
• IT/Architecture
• Information Security
• Legal
• Finance
• Data Privacy/Compliance
• Risk Management
• Executive sponsor
• Data/Analytics
• Other (please specify)

For a typical purchase, how often is a formal RFP or RFI required?

For a typical purchase, how often is a security or InfoSec assessment required?

For a typical purchase, how often is a formal legal/contract review required?

For a typical purchase, how often is a data privacy impact assessment required?

For a typical purchase, how often is executive sign-off or board approval required?

In the last 12 months, which issues have blocked or significantly delayed a deal at your organization? Select all that apply.

• Unfavorable liability or indemnity terms
• Data residency or transfer restrictions
• Subprocessor limitations
• Audit or assessment rights
• Termination for convenience
• SLA/uptime penalties
• Insurance requirements
• Intellectual property ownership
• Auto-renewal or pricing terms
• Export control restrictions
• Accessibility compliance (e.g., WCAG/VPAT)
• None of the above
• Other (please specify)

Rank the following contract clauses from most to least difficult to finalize (drag the most contentious to the top).

1. Indemnification
2. Limitation of liability
3. Data processing / DPA terms
4. Security exhibits / appendices
5. Service levels and credits
6. Insurance requirements

About how many calendar days does legal review typically add to the buying cycle?

• 0–7 days
• 8–14 days
• 15–30 days
• 31–60 days
• 61–90 days
• More than 90 days

Which security or privacy frameworks/certifications does your organization look for when evaluating vendors? Select all that apply.

• SOC 2 Type II
• ISO/IEC 27001
• ISO/IEC 27701
• HIPAA
• PCI DSS
• FedRAMP (where applicable)
• CSA STAR
• GDPR compliance documentation
• None specifically required
• Other (please specify)

Rank the following trust assets by how much they influence your approval decision (drag the most influential to the top).

1. Third-party security certifications (e.g., SOC 2, ISO 27001)
2. Named customer references
3. Published case studies or testimonials
4. Independent analyst reports
5. Vendor financial stability documentation
6. Transparent pricing and contract terms

To what extent are named customer references required during your vendor evaluation process?

What pilot or trial approach does your organization typically require before purchasing? Select all that apply.

• None; we can decide without a pilot
• Self-serve free trial
• Vendor-guided free trial
• Paid pilot
• Limited-scope paid project
• Other (please specify)

Which of the following conditions are immediate deal-breakers for your organization? Select all that apply.

• No third-party security certification
• Refusal to sign a DPA or equivalent
• Data stored in a disallowed region
• No audit or assessment rights
• Uncapped or imbalanced liability
• Non-negotiable standard terms
• No named customer references
• Unclear or unpredictable pricing
• Vendor financial instability
• Accessibility non-compliance (e.g., WCAG/VPAT)
• None of the above
• Other (please specify)

Overall, how would you describe your organization's risk tolerance when adopting new vendors?

Based on your responses in this survey, please describe the one or two hurdles that most often slow your procurement approvals.

We'd like to understand your procurement experience in a bit more depth. An AI moderator will ask you a couple of follow-up questions based on your earlier responses.

Which industry best describes your organization?

• Technology
• Financial services
• Healthcare
• Government / public sector
• Education
• Manufacturing
• Retail / consumer
• Media / telecom
• Energy / utilities
• Professional services
• Transportation / logistics
• Construction / real estate
• Nonprofit
• Other (please specify)

Approximately how many employees does your organization have?

• Fewer than 500
• 500–999
• 1,000–4,999
• 5,000–9,999
• 10,000–49,999
• 50,000 or more

In which region is your organization primarily headquartered?

• North America
• Latin America
• Europe
• Middle East
• Africa
• Asia
• Oceania

What is your typical annual purchasing authority? (USD or equivalent)

• Under $25,000
• $25,000–$100,000
• $100,001–$250,000
• $250,001–$1,000,000
• Over $1,000,000
• Prefer not to say

How many years have you been involved in enterprise vendor evaluations?

• Less than 1 year
• 1–3 years
• 4–7 years
• 8–12 years
• More than 12 years

Thank you for completing this survey! Your input helps us better understand enterprise procurement processes. Your responses will remain confidential and be reported only in aggregate.