Security and procurement checklist
A security and procurement checklist lists everything a buyer's security, legal, procurement and finance teams will ask for before they sign. Sending it all up front stops a deal that's been won from stalling for six weeks in review.
- Who owns it
- Your security lead and AE own it. The buyer's procurement contact confirms what they need.
- When to use it
- As soon as the buyer says they're likely to go ahead
- When you hear "it just needs to go through procurement"
- For any buyer with a security team
The template
Security
- SOC 2 Type II report or ISO 27001 certificate, under NDA
- Latest penetration test summary
- Completed security questionnaire (theirs, or a standard one such as CAIQ or SIG Lite)
- Data flow: what data you hold, where it's stored and for how long
- List of subprocessors
- Incident response and breach notification policy
Legal
- Master services agreement or terms
- Data processing agreement
- Order form with term, price and renewal terms
- Insurance certificates (professional indemnity and cyber)
Procurement
- Supplier set-up form
- Company number, VAT number and registered address
- Bank details on letterhead
- Modern slavery, sustainability or diversity statements if asked
Finance
- Purchase order number
- Billing contact and invoice address
- Payment terms agreed
What good looks like
- It's sent before they ask, not after
- Every item has a named owner on your side
- The steps are on the close plan with dates
- Common security answers live in a trust centre, not in someone's inbox
In a Deal Room
In a Deal Room the checklist sits under the close plan, documents are shared behind the buyer's sign-in, and you're told when their security team opens them. Our fractional trust and assurance consultants can answer the questionnaire with you.