Navigating Procurement, Security, and Legal

Why the back office exists

A common engineer reaction to procurement, security, and legal: “this is bureaucratic overhead that slows real work down.” That reaction is wrong, and treating it as right is one of the most reliable ways to lose engagements.

The back office exists because every customer organization — especially every large or regulated one — has experienced harm from a vendor that wasn’t vetted properly. Procurement exists because someone, somewhere, was sold software that didn’t deliver. Security exists because someone was breached. Legal exists because someone was sued. These functions are scar tissue around real injuries.

A senior FDE engages with the back office the way a senior surgeon engages with hospital procedures: with respect for the reasons, fluency in the process, and a goal of getting their patient through cleanly. The work is faster, not slower, when you treat the back office as colleagues rather than obstacles.

The three gauntlets

Most enterprise engagements pass through three distinct back-office processes, each with its own pace and personalities.

Gauntlet 1 — Procurement

The customer’s buying process. Vendor onboarding, purchase orders, payment terms, financial-risk checks, sometimes vendor-diversity requirements.

Pace: weeks to months
People: procurement officer, sometimes a category manager, sometimes finance
Typical artifacts: vendor onboarding form, W-9, banking details, insurance certificates, references, financials, MSA or order form
Failure mode: the engagement is technically ready in week 2 but cannot legally start until procurement signs off in week 8

Gauntlet 2 — Security review

The customer’s review of your security posture. Often the slowest gauntlet, especially for new vendors.

Pace: 2-12 weeks
People: InfoSec lead, security architect, sometimes a third-party assessor (BitSight, SecurityScorecard)
Typical artifacts: vendor security questionnaire (CAIQ, SIG, custom), SOC 2 / ISO 27001 reports, pen test summary, architecture review, sometimes a live workshop
Failure mode: the questionnaire arrives in week 1 and sits with the FDE’s company for 6 weeks because nobody owns answering it

Gauntlet 3 — Legal

The contract negotiation. Master agreement, statements of work, data processing addenda, business associate agreements (HIPAA), specialized clauses for regulated industries.

Pace: 2-8 weeks for first MSA; days to weeks for subsequent SOWs
People: customer’s general counsel or procurement attorney; your company’s contracts team
Typical artifacts: MSA, SOW, DPA, BAA (HIPAA), security addendum, specific industry addenda (FedRAMP, ITAR, etc.)
Failure mode: legal redlines bounce for weeks because neither side is willing to make a first concession, and the engagement starts without a signed contract — or doesn’t start

These three usually run in parallel, but coordinate in non-obvious ways: a procurement issue can pause legal; a security finding can force a contract amendment; a legal redline can require a security control.

What FDEs actually do here

You are not the procurement officer. You are not the lawyer. You are not the security architect on your side (usually). What you are is the person on the ground who can:

Translate. The customer’s procurement officer doesn’t understand your platform; your contracts team doesn’t understand the customer’s quarter-end. You sit between.
Sequence. You know which technical milestones depend on which back-office gates. You can keep both timelines synchronized.
Escalate calmly. When a step has stalled, you raise it on your side without alarming the customer’s side.
Document. You produce the customer-specific artifacts (architecture diagrams, data-flow maps, integration inventory) the back-office processes need.

The senior FDE move is to recognize this is part of the job, build relationships with the back-office leads early, and not treat the work as someone else’s problem.

Security questionnaires

You will fill out — or your company’s security team will, with your help — a security questionnaire on most engagements. Common ones:

CAIQ (Cloud Security Alliance) — broad, cloud-oriented, ~280 questions
SIG / SIG Lite (Shared Assessments) — comprehensive, ~700 questions in full
Custom — the customer’s own spreadsheet, often a 200-row mishmash of best-of and odds-and-ends

A few patterns that make the questionnaire move faster:

Maintain a master answer set

Your company should have a master answer set covering the common questions. As an FDE, you contribute by tagging which of those answers a specific customer accepted as-is, which needed amendment, and which were rejected — feeding back into the master so the next customer is easier.

Don’t answer questions you’re answering wrong

A common mistake: filling in every cell with optimism. “Yes, we encrypt at rest and in transit, with key rotation every 90 days.” Then in week 6, the customer’s audit finds a service that doesn’t, and now they don’t trust any of your answers.

Honest is better than perfect. “No, this control is not in place; we have a compensating control of X” is a defensible answer. Lying is not.

Engage with the customer’s security architect personally

The questionnaire is filtered through the architect. A 30-minute call with them at the start clarifies which questions matter, which are perfunctory, and what their actual concerns are. You will often resolve 40% of the questionnaire’s friction in that one call.

Surface compensating controls explicitly

A “no” with a compensating control is rarely a deal-breaker. A “no” with no explanation is. If your platform doesn’t do X, name what it does instead that achieves the underlying concern.

Don’t promise what’s not on the roadmap

A customer will sometimes try to use the questionnaire to extract a future commitment. “Will you have ISO 27001 by year-end?” — answer only what is funded and committed. Future-tense promises in questionnaires bind your company.

Reading a contract

You are not negotiating the contract. But you should be able to read the parts that affect you — the SOW, mainly — and recognize the patterns.

A typical FDE engagement has two contract layers:

Layer 1 — The Master Service Agreement (MSA)

The umbrella contract between your company and the customer. Covers:

Confidentiality — who can see what, for how long
Intellectual property — who owns what is created during the engagement
Indemnification — who pays if something goes wrong
Limitation of liability — capped damages
Termination — when and how the relationship can end
Governing law — which jurisdiction’s law applies

MSAs are negotiated once and reused for many SOWs. They take weeks the first time, hours the subsequent times.

Layer 2 — The Statement of Work (SOW)

The specific agreement for this engagement. Covers:

Scope — what you will build
Deliverables — what artifacts the customer receives
Timeline — phases, milestones
Pricing and payment terms — fixed fee, T&M, or hybrid
Acceptance criteria — what counts as “done”
Specific exclusions — what is not in scope
Change-control process — how scope changes are added

The SOW is where you, as FDE, have the most visibility and influence. You should read every SOW you work under, line by line, before it is signed.

Things to look for as an FDE

Specific clauses worth your attention:

Acceptance criteria. Vague criteria (“the system is delivered”) become disputes. Specific criteria (“Maria uses the morning view for 4 of 5 weekdays during cutover week”) are signable.
Exclusions. What did the contract say you won’t do? When the customer asks for the excluded thing in week 5, you need to know.
Change-control. How do scope additions get added? If “by email” — fine. If “by a CCB that meets monthly” — plan around it.
Travel and expenses. Who pays for your on-site time? What’s reimbursable, what isn’t?
IP ownership of customer-specific work. The Northbound morning view is built on your platform but is configured for them. Who owns the configurations? Who can re-use them?

The DPA, BAA, and friends

A growing list of mandatory addenda for regulated work.

DPA (Data Processing Addendum) — required under GDPR when personal data is processed. Defines you as the processor, the customer as the controller, the lawful basis, the cross-border arrangements.
BAA (Business Associate Agreement) — required under HIPAA when PHI is involved. Imposes specific safeguards, breach notification timelines (60 days), and a chain of liability.
Security addendum — customer-specific security requirements; often references SOC 2, ISO 27001, or specific controls
FedRAMP authorization — required for US federal work; a process, not a single document
CJIS, ITAR, NIST 800-171 — regulated-industry-specific

Each addendum imposes specific technical and operational requirements on your engagement. Some are already met by your company’s general posture; some require engagement-specific work.

As an FDE, you should at minimum know which addenda apply to your engagement and which technical controls each requires. You don’t need to know every clause, but you need to know whether your build needs to do X for compliance, or whether your company’s baseline already does X.

Pricing structures and what they mean for you

A short orientation. Each structure shapes how the engagement is run.

Fixed fee

A single price for a defined scope. The customer likes this — predictable cost. Your company sometimes likes it — predictable revenue. The FDE often does not — scope is rigid; iteration is constrained; out-of-scope requests trigger change-control.

Time and materials (T&M)

You bill for hours worked. Most flexible, but customer feels they have less control over total spend.

Outcome-based

The fee depends on outcomes — for Northbound, perhaps a base fee plus a bonus tied to the on-time delivery target being hit. Most aligned with the customer’s interests but hardest to structure cleanly.

Subscription

A recurring license, often paired with services. The FDE engagement is service work funded by the subscription budget.

As an FDE, you should know which structure your SOW uses, because it affects how you handle scope creep, change requests, and the cadence of customer-side approvals.

Building relationships with the back office

The biggest lever you have is the relationships you build with the back-office leads on the customer side.

Procurement

Meet the procurement officer in week 1. Bring coffee. Ask what their process looks like.
Send your onboarding paperwork the same week. Don’t wait.
Be the person who responds to procurement emails the same day. You will stand out.

Security

Schedule a 30-minute kickoff with the InfoSec lead in week 1, separate from the kickoff with IT.
Bring an architecture diagram. Walk through it. Invite their questions.
Send them your SOC 2 / ISO certifications and your pen test summary unsolicited. Pre-empt the questionnaire’s existence.
Treat their questions as design input, not obstacles. Sometimes their concerns surface real issues in your design.

Legal

You will not have a personal relationship with the customer’s legal team usually. Build a strong one with your own contracts team.
Make your contracts team’s job easier by giving them the technical context they need: “we’re an embedded engagement, single-tenant, no data leaves the customer’s cloud, here’s the integration list.”
Don’t argue redlines through the lawyer; argue them with the customer’s technical or business sponsor first, and let the lawyer encode the agreed position.

The pattern across all three: treat them as colleagues working on your side of a shared problem. Most customer-side back-office leads have been treated as obstacles their whole careers. The FDE who shows up respectful and prepared is the FDE who gets fast service.

The classic delays and how to break them

Specific patterns that delay engagements, with the move that breaks each.

Delay 1 — The unowned security questionnaire

The questionnaire arrives in week 1 and sits with your company’s security team for 6 weeks because nobody owns answering it.

Break: As FDE, take ownership of the customer-facing tracker on the questionnaire. You don’t write the answers, but you make sure the right person on your side has each section, with a deadline. You send the weekly “here’s where we are” update to the customer’s security lead.

Delay 2 — The MSA stuck on a single redline

Two paragraphs of indemnification language are in dispute. Both sides’ lawyers won’t move. The engagement is technically ready but cannot start.

Break: Bring the sponsors into the conversation, not the lawyers. “Both sides want this engagement to start Monday. The remaining language affects X. Can the two of you agree on the intent, and we’ll let the lawyers draft to that intent?” Often the business sponsors will close the gap in a 15-minute call that the lawyers have been unable to close in three weeks.

Delay 3 — The procurement onboarding loop

Procurement keeps asking for one more document. Each request takes a week. Six weeks later you’re still in onboarding.

Break: Ask procurement, in week 1, for the complete list of artifacts they will need. Get it in writing. Submit them all at once. When they come back with “one more thing,” reference the original list and ask politely whether anything else is missing.

Delay 4 — The IT change-advisory board (CAB)

Your iteration 7 deployment needs CAB approval. CAB meets the second Tuesday of the month. You missed last Tuesday; next meeting is in three weeks.

Break: Know the CAB calendar from week 1 of the engagement. Sequence iterations around it. Be on the agenda before you need to be.

Delay 5 — The pre-existing vendor blacklist

Six weeks in, you discover your platform is on a customer-internal blacklist from an unrelated incident three years ago.

Break: In week 1, ask procurement: “Is there a vendor risk-rating I should be aware of for our company?” Surface the issue before it becomes a sunk-cost surprise.

Common failure modes

Treating the back office as out of scope

You ignore procurement, security, and legal as “not engineering.” They will not ignore you. They will block your work, slowly, until you engage.

Promising the back office can be skipped

A sponsor says “don’t worry about security review, I’ll handle it.” Politely insist on engaging anyway. Sponsors lose battles with InfoSec all the time, and you’re the one left holding the bag in week 8.

Letting your own back office stall

Sometimes the delay is on your side — your contracts team is slow, your security questionnaire owner has left the company. Your customer will not distinguish “us” from “you.” Be the FDE who escalates inside their own company when needed.

Renegotiating in panic

When a back-office gate blocks the engagement, the temptation is to make concessions to unblock. Don’t. Bring it through a calm decision process — usually a memo to the right exec on your side — rather than agreeing to whatever is on the table in the moment.

Skipping the relationships

You can technically navigate the gauntlets without meeting any of the people. You’ll do it slowly and miserably. Build the relationships in week 1; everything moves faster after.

Closing — Phase 6 complete

Across Phase 6 you have learned the off-keyboard work that the technical work depends on. Executive communication earns continued sponsorship. Procurement, security, and legal navigation earn the right to deploy.

These are the skills senior FDEs differentiate on. Most engineers can ship code. The ones who can ship code, brief executives, navigate the back office, and produce the next renewal are the ones who get the hardest engagements and the most impact.

You have, by the end of Phase 6, every skill the rest of the course required. The final exercise — the capstone — puts them together.

Key terms to remember

The three gauntlets — procurement, security, legal — each with its own pace and personalities
Security questionnaire — CAIQ, SIG, custom; engaged with honestly, supported with compensating controls
MSA / SOW — the umbrella contract and the engagement-specific agreement
DPA / BAA — addenda required under GDPR / HIPAA respectively
Pricing structures — fixed fee, T&M, outcome-based, subscription; each shapes the engagement
Change-control — the customer’s process for adding to or modifying the SOW
Vendor onboarding — the procurement-side artifacts and process
Relationships first — the back office moves faster for the people they recognize and trust

What’s next

The course material is complete. The remaining work is the capstone — a full 6-week simulated FDE engagement with Northbound Freight that exercises every skill across the entire course, end to end. It is the artifact you take to an interview. It is also the test of whether all the discipline above is now yours, or just words on a screen.

Course Content