Enterprise Readiness

Phase 15 · Document 08 · Startup Playbook Prev: 07 — Sales Engineering · Up: Phase 15 Index

Table of Contents

1. Why This Matters
2. Core Concept
3. Mental Model
4. Hitchhiker's Guide
5. Warmup Readings
6. Deep Readings and External References
7. Key Terms
8. Important Facts
9. Observations from Real Systems
10. Common Misconceptions
11. Engineering Decision Framework
12. Hands-On Lab
13. Verification Questions
14. Takeaways
15. Artifact Checklist

1. Why This Matters

The pilot succeeded (07), the champion is sold, the economic buyer says yes — and then the deal hits procurement, security review, and legal, and stalls for months or dies. Enterprise readiness is the set of capabilities and artifacts that get you through that gauntlet: SOC 2, a DPA, SSO/RBAC, SLAs, deployment options, and a completed security questionnaire. For AI startups this is doubly hard: you face the normal enterprise-SaaS bar plus AI-specific scrutiny (where does our data go? do you train on it? how do you prevent the model leaking our data?, Phase 14). The crucial strategic insight: enterprise readiness is a sales accelerant, not just a compliance cost — having SOC 2, a DPA, and SSO ready unblocks deals your competitors are stuck on, and the slow items (SOC 2 Type II) must be started long before the deal that needs them.

2. Core Concept

Plain-English primer: clear the gauntlet that gates every enterprise deal

Enterprise buyers can't just swipe a card — they run a procurement gauntlet designed to manage risk: security review, legal/contract negotiation, IT integration requirements, and procurement process. Enterprise readiness means you have the capabilities and the paperwork to pass each gate quickly. The companies that breeze through win deals; the ones who scramble (starting SOC 2 after the buyer asks) lose months and often the deal. Much of this builds directly on the security/privacy/governance controls from Phase 14 — enterprise readiness is largely packaging those controls as buyer-facing evidence.

PILOT WON [07] → THE GAUNTLET: security review · legal/contracts · IT/integration · procurement → CONTRACT
   gates: SOC 2 / security questionnaire · DPA / data terms · SSO/RBAC · SLA/support · deployment model · AI-specific data scrutiny [14]
   ready = pass each gate FAST (sales accelerant). scramble = months lost / deal dies. start the SLOW items (SOC 2 Type II) EARLY.

The enterprise-readiness checklist (what they require)

1. Security & compliance certifications — the SOC 2 report is the most common gate (Type II takes months of evidence — start early, Phase 14.07); ISO 27001, HIPAA/BAA, etc. as the industry demands. Plus a completed security questionnaire (see below).

2. Data protection — a DPA (Data Processing Agreement), your sub-processor list (incl. your model provider), data-retention terms, and crucially the AI data answers: do you train on our data? where is it stored? how long? can we get ZDR/residency? (Phase 14.02). These AI-specific questions are now standard.

3. Identity & access — SSO (SAML/OIDC, integrate with Okta/Entra) and SCIM provisioning are near-mandatory for enterprise; RBAC (role-based access control) so admins control who sees/does what (Phase 14.04). "SSO tax" is real — enterprises expect it.

4. Tenant isolation — proof that one customer's data can't leak to another, including the AI-specific channels (shared vector index, prompt cache, co-mingled fine-tunes, Phase 14.04). Enterprises will ask.

5. Audit logs — admin-visible, exportable audit trails of who did what (and what the AI did) for the customer's own compliance (Phase 14.06).

6. Reliability & support — an SLA (uptime commitment, e.g., 99.9%), support tiers/response times, status page, incident communication, and DR/BCP. Enterprises buy a dependable vendor, not just software.

7. Deployment model — how/where it runs, often a deal-decider for sensitive data (next section).

Deployment models (the data-control spectrum)

Where the software (and the data) runs is frequently the gate for regulated/large enterprises:

• Multi-tenant SaaS — your cloud, shared infra (pooled, Phase 14.04). Cheapest/fastest; fine for many buyers.
• Single-tenant / dedicated — isolated instance per customer (their own DB/infra); stronger isolation, higher cost.
• VPC / customer-cloud deployment — runs in the customer's cloud account (their AWS/Azure/GCP) so their data never leaves their boundary; common ask for sensitive data.
• On-prem / air-gapped — runs entirely inside the customer's environment, no external calls; required by defense/healthcare/finance — and a major driver of self-hosted/open-weight models (Phase 6) since you can't call a public API.

The trade-off: more isolation = more enterprise deals unlocked but more cost/ops and a harder architecture (on-prem means no managed APIs, Phase 6). Offer the minimum isolation that wins the deal, and architect so you can move up the spectrum.

The security questionnaire (the recurring tax)

Enterprises send a security questionnaire (SIG, CAIQ, or a custom spreadsheet of 100–300 questions) covering your security posture, data handling, sub-processors, and increasingly AI-specific items (model providers, training-data use, prompt-injection/output controls, Phase 14.01/14.05). Maintain a reusable, current answer bank (and a Trust Center/SOC 2 to deflect many questions) so each questionnaire takes hours, not weeks. This is where having actually built the Phase 14 controls pays off — you answer truthfully and fast.

Readiness is a sales accelerant, started early

The strategic framing: enterprise readiness sells. A buyer choosing between you and a competitor will pick the one who's SOC 2-certified, has a DPA ready, supports SSO, and answers the security questionnaire in a day. Conversely, the slow items have long lead times — SOC 2 Type II needs months of evidence, penetration tests must be scheduled — so a founder targeting enterprise must start these before the deal that needs them (Phase 14.07). Right-size to your buyers: don't build air-gapped on-prem for SMBs, but have SOC 2/DPA/SSO ready the moment you go upmarket.

Build on Phase 14, package for buyers

Most of enterprise readiness is Phase 14 controls turned into buyer-facing evidence: the audit logs (14.06), tenant isolation (14.04), data handling (14.02), guardrails (14.05), and compliance (14.07) become the SOC 2, the DPA, the questionnaire answers, and the Trust Center. Do the controls (Phase 14), then package them (this doc).

3. Mental Model

   AFTER the pilot [07] comes THE GAUNTLET: security review · legal/contracts · IT/integration · procurement → contract.
   ENTERPRISE READINESS = capabilities + paperwork to pass each gate FAST. it's a SALES ACCELERANT, not just compliance cost. slow items (SOC2 Type II) START EARLY.

   CHECKLIST (mostly Phase 14 controls PACKAGED as buyer-facing evidence):
     SECURITY/COMPLIANCE — SOC 2 (Type II = months [14.07]) · ISO/HIPAA-BAA as needed · security QUESTIONNAIRE
     DATA — DPA + sub-processor list + retention + AI ANSWERS (train on our data? where? how long? ZDR/residency?) [14.02]
     IDENTITY — SSO (SAML/OIDC) + SCIM + RBAC [14.04] ("SSO tax" expected)
     ISOLATION — prove no cross-tenant leak incl. AI channels (vector index/cache/fine-tunes) [14.04]
     AUDIT LOGS — admin-visible/exportable who-did-what (+ what the AI did) [14.06]
     RELIABILITY — SLA (uptime) + support tiers + status page + DR/BCP
     DEPLOYMENT MODEL — the data-control gate ↓

   DEPLOYMENT SPECTRUM (isolation ↑ = more deals, more cost/ops): multi-tenant SaaS → single-tenant/dedicated → VPC/customer-cloud → ON-PREM/AIR-GAPPED
     (air-gapped → no public API → drives SELF-HOSTED/open-weight models [6]). offer the MINIMUM isolation that wins the deal; architect to move up.
   SECURITY QUESTIONNAIRE (SIG/CAIQ, 100–300 Qs + AI items [14.01/14.05]) = recurring tax → keep a reusable ANSWER BANK + Trust Center/SOC2 → hours not weeks.
   ★ DO the controls [Phase 14] → PACKAGE them as evidence (this doc). RIGHT-SIZE to your buyers; start slow items before the deal needs them.

Mnemonic: after the pilot comes the gauntlet — security, legal, IT, procurement. Enterprise readiness (SOC 2, DPA, SSO/RBAC, isolation, audit logs, SLA, the right deployment model) is Phase 14's controls packaged as buyer-facing evidence. It's a sales accelerant, so start the slow items early and right-size to your buyers.

4. Hitchhiker's Guide

What to look for first: do you have the deal-blockers ready — SOC 2 (or in progress), a DPA, SSO, and clear AI-data answers? And what deployment model does your target buyer require? Those gate enterprise revenue.

What to ignore at first: building air-gapped on-prem or full ISO 27001 before you have enterprise demand. Right-size: get SOC 2/DPA/SSO ready as you go upmarket; add heavier isolation when a deal requires it.

What misleads beginners:

• Starting SOC 2 when the buyer asks. Type II takes months — start early or lose the deal (Phase 14.07).
• Treating readiness as pure cost. It's a sales accelerant that unblocks deals competitors are stuck on.
• No AI-data answers. "Do you train on our data / where does it go?" is now standard — have ZDR/residency/DPA answers (Phase 14.02).
• Skipping SSO/RBAC. Near-mandatory enterprise expectations ("SSO tax").
• Re-answering questionnaires from scratch. Keep an answer bank + Trust Center so it's hours, not weeks.
• Over-isolating. Air-gapped on-prem for an SMB is wasted effort — offer the minimum isolation that wins.

How experts reason: they treat enterprise readiness as Phase 14 controls packaged as evidence and as a sales accelerant, start the slow items (SOC 2 Type II, pen-tests) early, prepare the deal-blocker kit (SOC 2, DPA, SSO/RBAC, isolation proof, audit logs, SLA), have crisp AI-data answers, maintain a questionnaire answer bank + Trust Center, and offer the minimum deployment isolation that wins while architecting to move up the spectrum (incl. self-hosting for on-prem, Phase 6). They right-size to their buyers.

What matters in production: the deal-blocker artifacts exist and are current; AI-data questions have ready answers; the deployment model fits the buyer; questionnaires turn around fast; and the slow certifications were started ahead of need.

How to debug/verify: can you produce SOC 2 (or status), a DPA, and SSO today? Do you have one-line answers to "do you train on our data / where is it stored / ZDR / residency?" Can you complete a security questionnaire in a day? Does your deployment model match your target buyer? Did you start the slow items early?

Questions to ask: is the deal-blocker kit (SOC2/DPA/SSO/RBAC/isolation/audit/SLA) ready? what deployment model does this buyer need? are AI-data answers crisp? is there an answer bank + Trust Center? did I start SOC 2 Type II early enough? am I right-sized (not over-building)?

What silently stalls/kills enterprise deals: late SOC 2, missing DPA/AI-data answers, no SSO, weak isolation proof, slow questionnaire turnaround, and a deployment model that doesn't fit the buyer.

5. Warmup Readings

6. Deep Readings and External References

7. Key Terms

8. Important Facts

• After the pilot comes the gauntlet (security, legal, IT, procurement); enterprise readiness is the capabilities + paperwork to pass it fast — a sales accelerant, not just cost.
• The deal-blocker kit: SOC 2, DPA + sub-processor list, SSO/RBAC, tenant-isolation proof, audit logs, SLA — mostly Phase 14 controls packaged as evidence.
• SOC 2 Type II takes months of evidence — start early, before the deal that needs it (Phase 14.07).
• AI-specific data answers are now standard — "do you train on our data? where stored? how long? ZDR/residency?" (Phase 14.02).
• SSO (SAML/OIDC), SCIM, and RBAC are near-mandatory for enterprise ("SSO tax") (Phase 14.04).
• Deployment spectrum: multi-tenant SaaS → single-tenant → VPC/customer-cloud → on-prem/air-gapped — more isolation unlocks more deals but costs more; air-gapped drives self-hosted/open-weight models (Phase 6).
• The security questionnaire (SIG/CAIQ, 100–300 Qs + AI items) is a recurring tax — keep a reusable answer bank + Trust Center so it's hours, not weeks (Phase 14.01/14.05).
• Do the controls (Phase 14), then package them; right-size to your buyers — don't over-build, but be ready as you go upmarket.

9. Observations from Real Systems

• SOC 2 is the most common enterprise gate — startups that started Type II late stalled six-figure deals for months; those who started early closed faster (Phase 14.07).
• AI-data questions now headline enterprise reviews — "do you train on our data / where does it go?" is asked in nearly every deal; ZDR/DPA/residency answers unblock them (Phase 14.02).
• On-prem/air-gapped requirements drive open-weight adoption — defense/health/finance buyers who can't send data to a public API force self-hosted models (Phase 6).
• A Trust Center + answer bank turns questionnaires from weeks to hours — and signals maturity that itself helps close (07).
• Enterprise readiness as accelerant is real — repeatedly, the SOC 2 / SSO / DPA-ready vendor beats a slightly better product that isn't ready.

10. Common Misconceptions

11. Engineering Decision Framework

ENTERPRISE READINESS (package Phase 14 controls as buyer evidence; it's a sales accelerant):
 1. START EARLY: SOC 2 Type II (months [14.07]) + schedule a pen-test — before the deal needs them.
 2. DEAL-BLOCKER KIT: SOC 2 (or status) · DPA + sub-processor list · SSO(SAML/OIDC)+SCIM+RBAC · tenant-isolation proof [14.04] · audit logs [14.06] · SLA + support.
 3. AI-DATA ANSWERS (crisp): do you train on our data (no)? where stored? retention/ZDR? residency? [14.02].
 4. DEPLOYMENT MODEL: offer the MINIMUM isolation that wins the deal (SaaS → dedicated → VPC → on-prem); architect to move up. on-prem/air-gapped → self-host [6].
 5. QUESTIONNAIRE: maintain a reusable answer bank + a Trust Center (SOC2/policies) → turn around in hours, incl. AI items [14.01/14.05].
 6. RIGHT-SIZE: match the bar to your buyers; don't over-build, but be ready as you go upmarket. Run readiness in PARALLEL with pilots [07].

12. Hands-On Lab

Goal

Build your enterprise-readiness kit: a deal-blocker checklist with current status, crisp AI-data answers, a chosen deployment model per buyer tier, and a reusable security-questionnaire answer bank.

Prerequisites

• Your product and target buyer tiers (02/07); the Phase 14 controls you've implemented.

Steps

1. Deal-blocker checklist: list SOC 2 (status), DPA, SSO/SCIM, RBAC, tenant-isolation proof, audit logs, SLA — mark ready / in-progress / missing (Phase 14).
2. AI-data answers: write one-line answers to "do you train on our data? where stored? retention? ZDR? residency?" (Phase 14.02).
3. Deployment model: for each buyer tier, pick the minimum isolation that wins (SaaS / dedicated / VPC / on-prem); note the architecture/self-hosting implication for on-prem (Phase 6).
4. Questionnaire answer bank: draft answers to ~15 common SIG/CAIQ items + 5 AI-specific items (injection/output/data, Phase 14.01/14.05).
5. Trust Center outline: list what you'd publish (certs, policies, sub-processors, status) to deflect questions (07).
6. Start-early plan: identify the slow items (SOC 2 Type II, pen-test) and when to start them relative to your enterprise pipeline (Phase 14.07).

Expected output

An enterprise-readiness kit: a status-marked deal-blocker checklist, crisp AI-data answers, a deployment-model-per-tier plan, a questionnaire answer bank, a Trust Center outline, and a start-early plan for slow items — turning readiness into a sales accelerant.

Debugging tips

• If SOC 2 is "we'll start when asked," you'll lose deals — schedule Type II now.
• If you can't answer "do you train on our data?" in one line, write it (it's asked every deal).

Extension task

Map each questionnaire/AI answer to the Phase 14 control that backs it — exposing any control you claim but haven't built.

Production extension

Adopt a compliance-automation tool for continuous evidence (Phase 14.07); stand up the Trust Center; run readiness in parallel with pilots (07); architect the VPC/on-prem deployment path (self-hosting, Phase 6).

What to measure

Deal-blocker readiness (ready/in-progress/missing), questionnaire turnaround time, AI-data answer completeness, deployment-model fit per tier, slow-item lead time.

Deliverables

• A deal-blocker checklist (SOC2/DPA/SSO/RBAC/isolation/audit/SLA) with status.
• Crisp AI-data answers + a deployment-model-per-tier plan.
• A security-questionnaire answer bank + a Trust Center outline + a start-early plan.

13. Verification Questions

Basic

1. What is the enterprise "gauntlet" and why does readiness accelerate sales?
2. What's in the deal-blocker kit?
3. Why must SOC 2 Type II be started early?

Applied 4. What AI-specific data questions do enterprises ask, and how do you answer them? 5. Walk the deployment spectrum from SaaS to air-gapped and the trade-offs.

Debugging 6. A deal stalls in security review for months. What was likely not ready? 7. You get a 200-question security questionnaire per deal. How do you make it fast?

System design 8. Design the enterprise-readiness plan for an AI product going upmarket to regulated buyers.

Startup / product 9. Why is enterprise readiness a sales accelerant, and how do you right-size it to your buyers?

14. Takeaways

1. After the pilot comes the gauntlet — enterprise readiness (the capabilities + paperwork to pass it) is a sales accelerant, not just compliance cost.
2. Prepare the deal-blocker kit — SOC 2, DPA, SSO/RBAC, isolation proof, audit logs, SLA — mostly Phase 14 controls packaged as evidence.
3. Start the slow items early (SOC 2 Type II = months) and have crisp AI-data answers (train/store/retention/ZDR/residency) (Phase 14.07/14.02).
4. Offer the minimum deployment isolation that wins (SaaS→dedicated→VPC→on-prem); air-gapped drives self-hosted models (Phase 6).
5. Keep a questionnaire answer bank + Trust Center and right-size to your buyers — turn the recurring security tax into hours, not weeks.

15. Artifact Checklist

• A deal-blocker checklist (SOC2/DPA/SSO/RBAC/isolation/audit/SLA) with status.
• Crisp AI-data answers (train/store/retention/ZDR/residency).
• A deployment-model-per-buyer-tier plan (incl. on-prem/self-host path).
• A security-questionnaire answer bank + a Trust Center outline.
• A start-early plan for slow items (SOC 2 Type II, pen-test).

Up: Phase 15 Index · Next: 09 — Fundraising and Technical Demo