the-procurement-gauntlet

The Procurement Gauntlet Skill

The first enterprise deal doesn't die in the demo — it dies eleven weeks later in a vendor-risk spreadsheet. This skill runs the gauntlet early: security questionnaire, legal redlines, compliance checks, and procurement's favorite question ("what happens to our data when you die?") — producing the findings memo their team would write, so yours can prepare the artifacts before the clock is running on a real deal.

What This Skill Produces

• The findings memo — security / legal / compliance / vendor-viability, graded as an enterprise reviewer grades
• The stall-risk ranking — which findings add weeks, which add clauses, which kill
• The debrief — the artifact checklist to build now, ordered by deals-unblocked-per-effort

Required Inputs

Ask for these if not provided:

• The product's honest posture: hosting/architecture, auth (SSO?), data handled (PII? whose?), certifications held or in progress, backup/DR reality, team size
• The paper on hand — security page, DPA template, terms, subprocessor list, insurance
• The target buyer — regulated industry? company size? geography (data-residency expectations)?
• The skeletons — the honest gaps; the simulation is only as useful as this disclosure

Framework: The Four Desks

1. Security desk: SSO/SAML (its absence is the #1 mid-market deal-stall), encryption at rest/in transit, access controls and audit logs, pen-test recency, incident-response plan, subprocessor inventory. Certifications are graded as they actually work: attestation reports open doors; "in progress" opens conversations with a date attached.
2. Legal desk: liability caps vs their paper, data-processing terms, breach-notification windows (they'll want faster than yours says), IP/indemnity, and the audit-rights clause your template doesn't have.
3. Compliance desk: data residency, retention/deletion on request, regulated-data handling if applicable — answered by the buyer's industry, not in the abstract.
4. Vendor-risk desk: the mortality questions — company viability, escrow/continuity, "what happens to our data if you shut down," insurance certificates, references at similar scale.

Grading: ✅ pass · 🟡 pass-with-clause (adds negotiation) · 🟠 stall (adds weeks + an artifact) · 🔴 gate (deal waits until fixed).

Output Format

Vendor Assessment: [product] — simulated for [buyer type]

> Simulation — a plausible enterprise review, not a prediction or legal advice.

Findings

| # | Desk | Finding | Grade | What it does to the deal |

|---|---|---|---|---|

The Stall Forecast

[Realistic procurement timeline for this posture: n–n weeks, driven by findings #…]

Debrief — out of character

| Artifact to build | Unblocks | Effort | Order |

|---|---|---|---|

[Typically: SSO, the security one-pager, subprocessor list, DPA template, IR plan summary, continuity statement]

The honest positioning line for sales: [how to state current posture without overclaiming — overclaiming discovered in review kills deals harder than gaps do]

Quality Checks

• [ ] Every finding traces to the disclosed posture — gaps disclosed get graded, gaps invented don't exist
• [ ] Grades carry deal consequences, not abstract severity
• [ ] The artifact list is ordered by deals-unblocked-per-effort
• [ ] Certifications-in-progress are treated as dated conversations, not passes or failures
• [ ] The positioning line lets sales tell the truth survivably

Anti-Patterns

• [ ] Do not grade against a Fortune-50 bar for an SMB product — calibrate to the stated buyer
• [ ] Do not treat certification as binary salvation — many deals close on posture + roadmap + honesty
• [ ] Do not let the simulation recommend overclaiming — review teams verify, and discovered overclaims are 🔴
• [ ] Do not omit the mortality questions — vendor-viability stalls surprise founders most
• [ ] Do not stay in character in the debrief