What Enterprise Buyers Actually Check Before Signing a Vendor Contract

If you sell B2B software in Europe, your deal will pass through a security review before it closes. The question isn't whether — it's how prepared you are when it happens. This article walks through what enterprise procurement teams, CISOs, and DPOs actually evaluate, in what order, and where most vendors lose time. It's written for the vendor side, but the checklist works both ways.

TL;DR

European enterprise buyers evaluate vendors across eight areas before signing: certifications, data processing agreements, subprocessor transparency, data residency and sovereignty, incident response, access controls, business continuity, and regulatory alignment. ISO 27001 is the baseline — not SOC 2. Most deals don't stall because the vendor lacks security; they stall because the evidence is scattered across PDFs, emails, and sales calls. A trust center structures this evidence so buyers can self-serve, and your deal closes weeks faster.

Why This Article Exists

Most guides to vendor security assessment and vendor risk assessment are written for US buyers evaluating US vendors. They lead with SOC 2, mention GDPR as a footnote, and assume the buyer will send a 200-question spreadsheet.

European enterprise procurement works differently. ISO 27001 is the expected baseline, not SOC 2. GDPR Article 28 creates specific contractual requirements that US frameworks don't address. NIS2 and DORA add supply chain obligations that didn't exist two years ago. And increasingly, European procurement teams expect to find this information themselves — not wait for a sales rep to send it. The era of the 200-question security questionnaire as the sole vendor onboarding gate is ending; buyers want to self-serve the initial assessment and only send a questionnaire for the gaps.

This article reflects how European enterprise buyers actually evaluate vendors in 2026 — the real vendor due diligence checklist your prospects are using, whether they send it to you or not. If your third-party risk management (TPRM) process is built around US frameworks, this is where the gaps show up.

The Vendor Security Assessment: Eight Areas Enterprise Buyers Evaluate

1. Certifications and Audit Reports

What they look for: ISO 27001 certificate (current, not expired), scope of certification (does it cover the product you're selling, or just corporate IT?), Statement of Applicability (SoA), and most recent surveillance or recertification audit results.

Why it matters: In European enterprise procurement, ISO 27001 is table stakes. It's the certification that procurement teams recognise, that aligns with GDPR's requirement for "appropriate technical and organisational measures" (Article 32), and that maps to NIS2's risk management expectations. SOC 2 is useful supplementary evidence — especially for US-facing sales — but it doesn't replace ISO 27001 in European procurement.

Where vendors lose time: The certificate exists, but it's not publicly accessible. The buyer asks for it, the sales rep asks the security team, the security team sends a PDF, the buyer's DPO asks follow-up questions about scope. Three weeks pass. If the certificate and its scope were visible in a trust center, the buyer would have checked this on day one — before the first call.

What good looks like: Certificate visible with expiry date and scope description. SoA available under access control (often NDA-gated). Latest audit summary accessible to qualified buyers without a sales call.

2. Data Processing Agreement (DPA)

What they look for: A GDPR-compliant DPA covering all Article 28(3) requirements: processing purpose and duration, data categories, processor obligations, subprocessor clauses, audit rights, deletion and return obligations, and breach notification commitments.

Why it matters: No DPA, no deal. This isn't negotiable in European enterprise procurement. Controllers are legally required to have a binding agreement with every processor. But beyond the existence of the DPA, buyers evaluate its quality — is it a standard template that covers the basics, or does it reflect how you actually handle data?

Where vendors lose time: The DPA is available, but only upon request. Or it's embedded in general Terms of Service and the buyer's legal team has to extract the relevant clauses. Or it was last updated before NIS2 came into force and doesn't address supply chain notification obligations.

What good looks like: Standard DPA downloadable from your trust center or legal page. Clean structure that maps to Article 28(3) requirements. Version-dated so buyers can verify currency. Supplementary terms available for specific regulatory requirements (DORA, healthcare).

3. Subprocessor Transparency

What they look for: A current list of all subprocessors, including name, purpose, data categories processed, hosting location, and country of incorporation. Change notification process. Objection rights.

Why it matters: This is where European procurement has diverged significantly from US practice. Under GDPR Article 28(2), controllers must be informed of subprocessor changes and have the opportunity to object. Under NIS2 Article 21(2)(d), entities must manage supply chain security. A static subprocessor list buried in a PDF appendix to the DPA doesn't meet either requirement operationally.

Where vendors lose time: The subprocessor list exists but hasn't been updated in months. Or it lists company names without data categories or hosting locations. Or there's no mechanism for change notifications — the buyer discovers changes during their annual review. Enterprise DPOs flag all of these during procurement.

What good looks like: Publicly accessible subprocessor page. Structured data: name, purpose, categories, location, transfer mechanism. Automated change notifications with defined notice period. This is one of the highest-value pages in any trust center.

4. Data Residency and Sovereignty

What they look for: Where is data stored? Where is it processed? Is the vendor subject to non-EU legal access (CLOUD Act, FISA 702)? What's the legal entity structure — EU-incorporated or US-headquartered with an EU subsidiary?

Why it matters: "EU-hosted" is not the same as "EU-sovereign." A US-headquartered company hosting data in Frankfurt is still subject to the CLOUD Act, which means US authorities can compel access to that data regardless of where it physically resides. For trust center data specifically — which may contain penetration test results, security architecture details, and compliance evidence — this matters more than most vendors realise.

European enterprise buyers increasingly distinguish between data residency (where data is physically stored) and data sovereignty (which legal jurisdiction governs access to it). The Schrems II ruling made this distinction legally relevant. NIS2 implementation across EU member states is making it operationally relevant.

Where vendors lose time: The vendor says "EU-hosted" but can't answer detailed questions about corporate structure, subprocessor jurisdiction chains, or transfer impact assessments. The buyer's legal team escalates, and the deal pauses for two weeks while someone assembles the documentation.

What good looks like: Clear statement of hosting location, processing location, and corporate jurisdiction. Transfer impact assessment available for any US-based subprocessors. Data flow diagram showing where personal data moves and under what legal basis.

5. Incident Response and Breach Notification

What they look for: Documented incident response plan. Defined notification timelines (GDPR: 72 hours to supervisory authority; NIS2: 24-hour early warning). Communication process to affected customers. Evidence of past incident handling (if applicable).

Why it matters: Every European regulation now includes incident notification requirements, and the timelines are getting shorter. GDPR Article 33 requires 72-hour notification to authorities. NIS2 requires a 24-hour early warning. DORA requires initial notification within four hours for major ICT incidents. Buyers need confidence that their vendor can meet these timelines — not just in policy, but in practice.

Where vendors lose time: The incident response plan exists but hasn't been tested. Or it covers notification to authorities but not customer-facing communication. Or the buyer asks "have you had any security incidents in the last 24 months?" and the vendor takes a week to respond because no one has prepared the answer.

What good looks like: Incident response process documented and accessible (often NDA-gated in a trust center). Clear customer notification timeline defined. If you've had incidents, a brief, honest summary of what happened and how you responded builds more trust than silence.

6. Access Controls and Authentication

What they look for: SSO support (SAML/OIDC). Role-based access control (RBAC). Multi-factor authentication. Privileged access management. Audit logging and who-did-what trail.

Why it matters: Enterprise security teams evaluate whether your product can integrate with their identity infrastructure. SSO isn't a nice-to-have — it's a security requirement that determines whether your product can be approved for use. If you charge extra for SSO (the "SSO tax"), expect enterprise buyers to notice. RBAC and audit logging matter because enterprise customers need to demonstrate to their own auditors that access to your platform is properly controlled.

Where vendors lose time: SSO is available but only on the enterprise tier, and the buyer is evaluating your mid-market plan. Or RBAC exists but isn't documented — the buyer's security team has to schedule a demo call to understand permission models. Or audit logs exist but aren't exportable for the buyer's SIEM integration.

What good looks like: SSO included at the plan level your enterprise buyers evaluate. RBAC model documented. Audit log capabilities described with export options. All of this can be documented once in a trust center rather than explained on every sales call.

7. Business Continuity and Disaster Recovery

What they look for: Business continuity plan (BCP). Disaster recovery plan (DRP). Recovery time objective (RTO) and recovery point objective (RPO). Backup strategy and testing frequency. Geographic redundancy.

Why it matters: NIS2 explicitly requires business continuity management with backup and disaster recovery (Article 21(2)(c)). DORA requires ICT business continuity management and operational resilience testing. Even without regulatory requirements, enterprise buyers need assurance that a vendor outage won't disrupt their operations.

Where vendors lose time: BCP and DRP exist but are internal documents that were never prepared for external sharing. The buyer requests them, and someone has to create an externally appropriate version. Or RTO/RPO figures are defined but not tested — and the buyer's auditor asks for test evidence.

What good looks like: Summary of BCP/DRP approach, RTO/RPO commitments, and backup strategy available in trust center (detailed plans often NDA-gated). Evidence of testing documented. Uptime history or status page linked.

8. Regulatory Framework Alignment

What they look for: Which regulatory frameworks does the vendor actively support? Is it just SOC 2 and ISO 27001, or does the vendor understand NIS2, DORA, GDPR Article 28, and industry-specific requirements? Are policies and controls mapped to these frameworks?

Why it matters: This is where US-built vendors consistently underperform in European procurement. The vendor has SOC 2 Type II and ISO 27001 — great. But the buyer is a financial services company under DORA, and they need to know how the vendor's controls map to DORA's ICT risk management requirements. Or the buyer is in critical infrastructure under NIS2, and they need supply chain security documentation that SOC 2 doesn't address.

Where vendors lose time: The vendor's compliance page lists certifications but doesn't map controls to EU regulatory frameworks. The buyer's compliance team has to manually assess how the vendor's controls address their specific regulatory obligations. This is skilled work that takes time — and it happens for every deal.

What good looks like: Control mapping available for relevant EU frameworks. NIS2, DORA, and GDPR Article 28 addressed explicitly — not just as a line item, but with enough detail for a compliance team to evaluate. Trust center structured around the frameworks your buyers actually care about, not just the ones your auditor assessed.

The Pattern: Why Deals Stall

If you look across all eight areas, the pattern is the same: the vendor has the security — they just can't prove it efficiently.

The evidence exists, but it's in the wrong format, in the wrong place, or requires the wrong person to retrieve it. A PDF in a Dropbox folder. An incident response plan in an internal wiki. A subprocessor list in a DPA appendix. A certification on the wall of the CTO's office.

Every time a buyer asks for evidence and the answer is "let me check with our security team," the deal timeline extends by a week. Multiply that across eight evaluation areas and multiple stakeholders (procurement, legal, security, DPO, business owner), and you have the anatomy of why enterprise deals take 90 days instead of 30.

This is a presentation problem, not a security problem. The vendors who close fastest aren't necessarily the most secure — they're the ones who make their security posture the easiest to evaluate.

What a Trust Center Changes

A trust center is a structured, externally accessible space where you publish exactly the evidence enterprise buyers need — in the format they expect, with the access controls that match the sensitivity level.

Public tier: Certifications, compliance overview, subprocessor list, data residency information, regulatory framework support. This is what buyers check before they even talk to sales.

Authenticated tier: SoA, detailed security controls, DPA, vendor risk questionnaire responses. Available to buyers who identify themselves. No sales call required.

NDA-gated tier: Penetration test results, incident response plans, detailed architecture documentation, BCP/DRP details. Available after click-to-sign NDA, fully logged and traceable.

This isn't about making everything public. It's about removing the bottleneck of manual evidence sharing so the buyer can evaluate at their pace, your security team isn't fielding the same requests for every deal, and the sales cycle compresses from months to weeks.

The Practical Checklist

Use this to audit your own vendor evaluation readiness:

Area	What Buyers Expect	Orbiq Trust Center Feature
Certifications	ISO 27001 certificate, scope, SoA accessible	Public + NDA-gated document layers
DPA	Downloadable, current, Article 28-compliant	Document library with version control
Subprocessors	Public list with categories, locations, notifications	Structured subprocessor page + change alerts
Data residency	Hosting location, jurisdiction, transfer mechanisms	Public compliance overview
Incident response	Documented process, notification timelines	NDA-gated documentation
Access controls	SSO, RBAC, audit logs documented	Product security documentation
Business continuity	BCP/DRP summary, RTO/RPO, test evidence	NDA-gated documentation
Regulatory alignment	Control mapping to NIS2, DORA, GDPR	Framework-aligned trust center structure

Frequently Asked Questions

Is ISO 27001 really required, or is SOC 2 sufficient for European enterprise deals?

For most European enterprise procurement, ISO 27001 is the expected baseline. SOC 2 is a US-developed framework that European procurement teams are less familiar with and may not accept as equivalent. Some European companies — particularly those with US operations — accept SOC 2 as supplementary evidence, but it rarely replaces ISO 27001 in European evaluations. If you're choosing one certification to prioritise for EU market entry, ISO 27001 is the right answer.

How long does a typical vendor risk assessment take?

It varies enormously — from one week to six months. The main variable isn't the complexity of the review; it's how accessible the vendor's evidence is. Vendors who publish their security posture in a trust center consistently report shorter review cycles because buyers can self-serve the initial evaluation before involving their security team for deeper review.

What's the minimum we need to have ready for enterprise procurement?

ISO 27001 certificate (current), GDPR-compliant DPA, current subprocessor list, clear data residency documentation, and an incident response process. These five items address the most common blockers. Everything else is important but rarely the reason a deal stops entirely.

Do buyers actually use trust centers, or do they still send questionnaires?

Both. Security questionnaires aren't disappearing, but the process is changing. Buyers increasingly check a vendor's trust center first and only send a questionnaire for gaps they couldn't verify independently. A well-structured trust center can reduce questionnaire scope by 60-80%, which saves time for both sides.

How does NIS2 change what enterprise buyers evaluate?

NIS2 adds supply chain security as an explicit requirement (Article 21(2)(d)). This means enterprise buyers under NIS2 now have regulatory obligation to evaluate their vendors' security posture, subprocessor chains, incident response capabilities, and business continuity measures. The evaluation isn't optional anymore — it's auditable. Vendors who make this evaluation easy gain a measurable advantage in NIS2-affected procurement cycles.

Key Takeaways

ISO 27001 is the European enterprise baseline — SOC 2 supplements but doesn't replace it in EU procurement
Deals stall on evidence access, not security gaps — the vendor usually has the security, just not the presentation
Subprocessor transparency is now a regulatory requirement — GDPR Article 28 and NIS2 both demand ongoing visibility
Data sovereignty matters more than data residency — "EU-hosted" by a US company isn't sufficient for many European buyers
A trust center compresses deal cycles — buyers who can self-serve the initial evaluation close weeks faster

See How Orbiq Handles This

Orbiq is built to be the trust center European enterprise buyers actually want to evaluate. Public certification layer, NDA-gated sensitive documentation, structured subprocessor pages, and framework-aligned compliance evidence — all in one place.

→ View our Trust Center (see what your buyers will see)

→ See Pricing

→ Start Free

Sources

ISO/IEC 27001:2022 — International standard for information security management systems.
Regulation (EU) 2016/679 (GDPR) – Article 28 — Processor obligations, including DPA requirements and subprocessor authorisation.
Regulation (EU) 2016/679 (GDPR) – Article 32 — Security of processing, including requirement for appropriate technical and organisational measures.
Directive (EU) 2022/2555 (NIS2) – Article 21 — Cybersecurity risk-management measures, including supply chain security.
Regulation (EU) 2022/2554 (DORA) – Article 28 — ICT third-party risk management for financial entities.
CJEU – Schrems II (Case C-311/18) — Ruling on EU-US data transfers, relevant to data sovereignty assessment.

What Enterprise Buyers Check Before Signing a Vendor Contract | Security Checklist