MEDDPICC paper process: examples from buyers’ supplier rules
MEDDPICC’s paper process maps the steps from a buying decision to signature. Security, privacy, accessibility, legal review and supplier setup can affect that path, but their timing depends on the buyer. Establish what each review requires, what it blocks and who can confirm its completion.
Before you put a signature date in the forecast, ask what the customer must approve and what each approval allows to happen next. Access to data, system connections, sign-on, payments or AI features can bring different reviews into the purchase. Confirm which ones apply, prepare the required evidence and agree an owner and a date for each.
What the paper process is in MEDDPICC
The paper process maps the steps from the customer’s buying decision to signature. MEDDPICC is a variant of the third-party MEDDICC framework.
Like every qualification element, the paper process is an evidence claim: qualification examines the evidence behind each answer, who at the customer confirmed it and what remains an assumption.
Check when each review starts as well as what it blocks. The University of Arkansas recommends requesting its reviews at the start of the quote process. Symantec’s 2016 supplier guidance describes monitoring after an agreement is executed, when SOC 2 or ISO 27001 evidence may be collected. For each review, ask who owns it and how long it takes.
What starts a supplier review
Data access, connections and intended use can trigger a supplier review.
Pandora runs a cyber security assessment when a supplier “has access to Pandora’s personal or business data” or “is connected to our systems or network”. Regeneron asks every new supplier for background due diligence and financial details, and may require cybersecurity and privacy assessments when the services involve its IT data or personal data. Microsoft sets a supplier’s requirements from its data processing profile: whether it processes personal or confidential data, whether it delivers software as a service, and whether it provides AI systems.
Universities are large software buyers, and several publish their pre-purchase requirements in detail. Montclair State University requires a review for software that uses its single sign-on, handles non-public data, processes payments, syncs with its systems, includes AI features or is used widely on campus. Its individual-use exemption from security review covers accounts created directly on a vendor’s site without NetID login, system integration or University data. Confirm the exemption with the university before relying on it.
Kent State University reviews a product that students or staff must use, one used by more than 100 people, one that costs more than $2500 per contract year or one that touches protected data.
Before the decision, describe how the product would be used at this customer: the data, system connections, sign-on, payments, AI features, number of users and annual contract cost. Use those answers to ask which reviews apply, who runs them and whether an existing approval can be used.
Which step each review must come before
At several buyers the review has to finish before legal review, a purchase order or a pilot can start.
The University of Arkansas is explicit about the order: “HECVATs and VPATs must be obtained and reviewed before legal review or a Workday requisition.” Montclair State University tells its staff: “Do not sign contracts, make payments, or launch trials/pilots until official approval is granted.” A proof of concept on the customer’s own data can therefore wait for the same review as the purchase. If your deal depends on one, ask what the pilot agreement has to settle and when the review must be done.
Microsoft’s purchasing tools check that a supplier in scope is approved “prior to allowing an engagement to move forward”. Enbridge assesses a supplier’s information security “prior to providing you with access to Information and Technology Assets”.
| Buyer | What starts the review | What the supplier provides | Must be finished before | Time the document states |
|---|---|---|---|---|
| Microsoft | What starts the review Personal or confidential data; software as a service; AI systems | What the supplier provides Attestation; SaaS: ISO 27001 or contract-specified alternative; AI: Section K assessment or ISO 42001 | Must be finished before The engagement begins; new purchase orders | Time the document states Attestation due within 90 days; review time not stated in this document |
| Pandora | What starts the review Access to its data, or a connection to its systems or network | What the supplier provides A security questionnaire | Must be finished before The onboarding continues | Time the document states Not stated in this document |
| Röchling | What starts the review Access to data it owns or controls | What the supplier provides A signed confirmation of compliance; an NDA in the contract | Must be finished before Access to its networks, systems or data | Time the document states Not stated in this document |
| University of Arkansas | What starts the review Every software and hardware purchase, renewals included | What the supplier provides A HECVAT and a VPAT or ACR for each product | Must be finished before Legal review and the purchase requisition | Time the document states 1 to 2 weeks, longer in busy periods |
| Montclair State University | What starts the review SSO, non-public data, payments, integrations, AI or widespread campus use | What the supplier provides HECVAT 4 or qualifying 3.x; VPAT | Must be finished before Purchase, renewal, pilot, signing, payment | Time the document states 5 to 10 business days after complete vendor documents are submitted |
| Kent State University | What starts the review Required use, more than 100 users, more than $2500 per contract year, protected data | What the supplier provides A HECVAT less than 12 months old and a VPAT | Must be finished before Contract or use | Time the document states 10 business days from receipt of both |
| University of Toledo | What starts the review Hardware, software or services; regulated data; cloud hosting | What the supplier provides A HECVAT 4 and technical documents | Must be finished before The purchase | Time the document states 4 to 12 weeks on average |
What you will be asked to bring
Expect a questionnaire, evidence the buyer can check, and at some buyers an accessibility report or a signed confirmation.
A HECVAT is a security questionnaire written for higher education. The University of Arkansas asks for one alongside a VPAT or Accessibility Conformance Report “for each individual product being purchased”. Arkansas permits alternative documents, or review requests without attachments when neither the forms nor alternatives are available. Kent State University asks for a HECVAT “less than 12 months old”.
Montclair asks for HECVAT 4, while accepting a 3.x file completed for another university within the last 2 years.
UC Irvine asks for the supplier’s security policy, privacy policy, a third-party security review such as a SOC Type II report, and/or a HECVAT self-assessment.
For software as a service, check the contract’s certification requirement. Microsoft names ISO 27001 or another applicable certification for the service itself: “Please do not submit a datacenter certification.” A supplier of AI systems provides independent assurance, either an assessment against the AI section of Microsoft’s requirements or ISO 42001. Microsoft also expects suppliers to pay for that assessment.
Some buyers also require a signed confirmation. Röchling requires a signed confirmation of compliance “before the respective company has access to Group’s networks, systems or data”, and any alternative to one of its requirements must be approved in advance. Regeneron asks every new supplier for contacts, payment details, tax IDs and insurance certificates.
Kent State University warns its own staff: “Your sales representative may not know what these documents are, so suggest they speak with a technology/development team member.” Know what each document is, which version the customer asks for, and who in your company completes it, before the customer asks.
How long the reviews take
Confirm the review time with its owner, including when the clock starts.
Montclair State University states 5 to 10 business days “once all completed vendor documents are submitted”. Kent State University asks for 10 business days “upon receipt of the HECVAT and VPAT”. Those periods start when the buyer receives the required documents, so schedule preparation and submission separately. The University of Toledo gives an average of 4 to 12 weeks and says completeness, complexity and vendor responsiveness affect the time. The University of Arkansas says a review can take 1 to 2 weeks, with longer waits “during busy purchasing periods such as July or the start of semesters”.
Legal review can run alongside security work. UC Irvine notes that a supplier’s counsel reviewing and negotiating the university’s purchasing documents can add several weeks. It asks the supplier to submit security documents in parallel so the internal reviews can begin.
Keep submission deadlines and approval validity separate from review time. Microsoft gives suppliers enrolled in SSPA 90 days from the request to submit their self-attestation; its SSPA team is not authorised to extend that deadline. Arkansas treats its reviews as valid for 12 months. Montclair’s security approvals are valid for 2 years, with a new review on renewal only if the vendor changed, AI features were added or the data classification increased.
Paper process questions to ask the customer
Ask which reviews this purchase triggers, who runs each one, what it needs from you, what it must come before and how long it takes.
Which reviews will this purchase go through: security, privacy, accessibility, legal, supplier setup, any other?
Which of them does our product trigger, given the data it holds, the systems it connects to and how people sign in?
Who runs each review, and who on your side asks for it to start?
What does each review need from us, and in which version?
What must each review be finished before: legal review, the purchase order, a pilot, access to your systems?
Who is authorised to sign the agreement, and what must be completed before they can?
Where are your current supplier requirements, and what review time and start point do they state?
Is there an earlier approval of our product, and when does it expire?
For each review, note what you know, how you know it, who at the customer confirmed it and what is still an assumption. Record the published requirement separately from the expected completion date for this purchase. Ask the review owner to confirm the date and what will show approval. Until they do, mark those parts of the plan as unconfirmed.
Put each review into the mutual action plan
Each review becomes a line in the mutual action plan, with an owner at the customer, an owner on your side and a date.
Write each review as its own line in the mutual action plan, with the step it must come before, so that a late review moves the dates that depend on it.
Name an owner on your side as well. Regeneron requires every new supplier to appoint an Onboarding Owner, a person who “Takes accountability for timely completion of onboarding requirements”, and who has the influence to escalate inside their own company when requirements are not being met. A seller can name that person before any buyer asks.
Sources
- What is Paper Process? MEDDICC, undated.
- Supplier Security & Privacy Assurance (SSPA) Program Guide v12. Microsoft Procurement, March 2026.
- Information security in onboarding process. Pandora, undated.
- Regeneron Supplier Onboarding Process Information. Regeneron, June 2024.
- Baseline Information Security Requirements for Suppliers, ISMS-REQ-15 v1.1. Röchling, 2022.
- Third Party Information Security Guidelines. Enbridge, undated.
- Supplier Management Process. Symantec, hosted by Broadcom, 2016.
- Cybersecurity (HECVAT) and Accessibility (VPAT) Requirements for Technology Purchases. University of Arkansas, undated.
- Vendor Risk Review (HECVAT/VPAT). Montclair State University, undated.
- Pre-Purchase Product Review. Kent State University, undated.
- IT Security Assessments. University of Toledo, October 2025.
- UCI Campus Software Procurement Process. UC Irvine Procurement Services, undated.
Facts last checked on 27 October 2026.