MEDDPICC Paper Process: Map Signature Before Verbal Yes

The paper process is the “P” in MEDDPICC: every step between a buyer saying “we pick you” and a countersigned contract. That means security review, legal redlines, procurement approval, vendor onboarding and signature. The MEDDICC framework describes it as the steps that follow the decision process, detailing how you go from decision to signature. You map it early, you name an owner for each step, and you write it down in your CRM with dates.

This guide shows what belongs in a paper process, how it differs from the decision process, the questions that surface it on a call, and how to document it so your forecast reflects reality instead of optimism.

TL;DR

• The paper process covers everything from verbal agreement to signed contract and payment: security, legal, procurement, vendor setup, signature.
• The decision process is how the buyer chooses. The paper process is how the buyer buys. Track them as two separate fields.
• Start asking about paper in discovery or the second call, not after the demo. Run gates in parallel instead of in sequence.
• A paper process entry is only real with named owners, steps and turnaround times. “Legal is reviewing” is not an entry.
• Build a readiness kit (security overview, DPA, subprocessor list) before you need it.

Table of Contents

• What the paper process actually covers
• Paper process vs. decision process
• How long the paper process takes
• Start earlier than feels natural
• Questions that surface the paper process
• The decision process email follow-up
• How to document it in your CRM
• Build a readiness kit before you need it
• Common failure modes
• Our perspective
• Get paper process questions in the call, not after it
• FAQ
• Sources

What the paper process actually covers

Most reps hear “paper process” and think “contract.” The contract is one step. The full path usually looks like this:

• Security review: a questionnaire, a SOC 2 report request, a penetration test summary, a data flow diagram.
• Privacy and data protection: a data processing agreement (DPA), a subprocessor list, sometimes a privacy impact assessment.
• Legal review: NDA, master services agreement (MSA) or order form, redlines and fallback language.
• Procurement: vendor evaluation, pricing approval, budget confirmation, purchase order creation.
• Vendor onboarding: forms such as a W-9, insurance certificates, banking details.
• Signature and payment: who signs, in which tool, and what triggers the first invoice.

This list matches the checked breakdown of the paper process used in our research, which also notes that the stage is transactional: its job is to secure the signature and collect payment, not to re-sell the product.

Not every deal has every gate. A seed-stage buyer with 40 employees may need one founder signature and a card on file. A 5,000-person company may need all six. The skill is finding out which gates apply to this buyer, early.

Paper process vs. decision process

These two letters get confused constantly, and the confusion costs deals. The distinction is simple.

MEDDICC’s own page on the decision process frames it as the steps the buyer follows to make a decision, with technical validation as one part. The paper process begins where that ends. In practice they overlap: the best reps ask about both in the same conversation. If you want to sharpen the first half, our MEDDPICC discovery questions guide covers all eight pillars.

Why the “P” got its own letter

MEDDIC dates back to PTC in the 1990s. According to MEDDICC, it was pioneered by Dick Dunkel and John McMahon, and the paper process was later formalized as its own pillar. The reason was practical: strong deals kept going quiet in legal and procurement after the technical and business wins. Giving the step its own letter makes it something a manager can inspect.

How long the paper process takes

Plan on weeks, not days, for larger buyers. Our research cites these ranges:

• Procurement delays of 3 to 6 weeks on deals over $50,000 at companies with 1,000+ employees.
• Security reviews of 4 to 8 weeks at firms with 10,000+ employees.
• Architecture reviews of 1 to 2 weeks, legal and procurement redlines of 2 to 8 weeks, and formal RFPs of 6 to 10 weeks.

Those figures come from a 2026 enterprise sales benchmark write-up and a paper process close guide from the same publisher. They are secondary sources, so treat them as planning ranges, not guarantees. Your own closed-won deals are a better benchmark once you have a dozen.

The bigger lever is sequencing. The same enterprise sales guide reports that running gates in parallel from the start can bring the timeline to roughly 28 to 30 days, versus 68 to 137 days when each gate waits on the last. Even if your numbers differ, the logic holds: nothing about the NDA depends on the security questionnaire, so do not queue them.

Start earlier than feels natural

The most common mistake is raising paper after the verbal yes. By then the buyer has mentally moved on, your champion has less leverage, and the quarter-end is close.

A better rhythm:

1. Discovery call: ask who else has to approve a purchase like this, and whether the company has bought software recently. Past purchases reveal the real process.
2. Second call: ask directly about security review, legal and procurement. This is where the research suggests best-in-class teams begin paper discovery.
3. After the demo: send the readiness kit and propose a joint timeline.
4. At verbal commitment: confirm each owner and date, and kick off every gate that can run in parallel.

Asking early also helps you multi-thread. The security analyst and procurement lead are people you would otherwise never meet. Each one is another relationship that can stall your deal or push it forward.

Questions that surface the paper process

Ask these conversationally. A champion who feels interrogated will go vague.

• “Walk me through what happened the last time you bought a tool like this, from decision to first invoice.”
• “Who reviews vendor security, and do they work from a questionnaire, a SOC 2 report, or both?”
• “Will legal use our paper or yours? Who is the attorney, and how long do redlines usually take?”
• “Does procurement need to approve this, or does it fall under a spend threshold?”
• “What has to exist before a purchase order or invoice can be created? W-9, insurance certificate, vendor registration?”
• “Who signs, and what is their calendar like in the last two weeks of the quarter?”
• “If we want to be live by your target date, what is the latest we could sign?”

The last question works because it makes the buyer reverse-engineer the timeline from go-live. Our research describes this as mapping backward from the client’s desired start date, with a named owner per gate (NDA, MSA, security, procurement).

For a deeper bank of procurement-specific prompts, see our procurement questions for SaaS reps, mapped to MEDDPICC.

The decision process email follow-up

A call surfaces the paper process. An email locks it in. Send it within a day of the conversation where paper came up. It does three things: confirms what you heard, names owners, and gives the buyer something to correct.

Here is a structure you can adapt:

Subject: Path to signature for [Company]

Hi [Name],

Thanks for walking me through how [Company] approves new vendors. Here is what I captured, so we can hit your [go-live date] target:

1. Security review: [Name, title], using [questionnaire or SOC 2 report]. We will send our security overview and DPA today. Expected turnaround: [X days].
2. Legal: [Name], using [your paper or ours]. Expected turnaround: [X days].
3. Procurement: [Name], needs [W-9, insurance certificate, vendor form]. Expected turnaround: [X days].
4. Signature: [Name], via [tool].

If we start security and legal this week in parallel, we can sign by [date]. Is anything missing or out of order?

The closing question matters. Corrections from your champion are the most accurate paper process data you will get.

How to document it in your CRM

The weak entry is the one most CRMs contain: “Legal reviewing.” It tells a manager nothing. The research behind this guide calls it the vague owner trap. A real entry needs the specific attorney, the security analyst and the procurement lead, plus expected turnaround for each.

A workable minimum for the paper process field:

Why bother? Research from enterprise sales practitioners argues that treating procurement as a single stage rather than a project plan with dependencies is a leading reason deals stall at the finish. A dedicated, inspectable field also lets a VP of Sales separate a deal that is stuck from one moving through a slow but predictable gate. Forecast dates then come from the buyer’s process, not rep optimism.

Managers can audit quickly: open ten late-stage deals and check whether each lists named procurement contacts and documented lead times. If the field says “close by Friday” with no names, the date is a hope.

Our 8-field MEDDPICC template shows how to set up the CRM fields with evidence requirements for each. If you want to see where a live deal stands first, the free MEDDIC scorecard is a quick way to score it.

Build a readiness kit before you need it

Slow answers to security requests read as risk. The research we reviewed notes that procurement teams often interpret slow documentation as a warning sign, whatever the product’s real quality. A readiness kit fixes that. Keep these in a shared folder, current and ready to send:

• A one- to two-page security overview
• Your DPA template and subprocessor list
• A data flow description
• Your standard MSA or order form, plus a list of acceptable fallbacks
• A completed W-9 and certificate of insurance
• Answers to the 30 questions every security questionnaire seems to ask

What if you do not have SOC 2 yet?

Many seed and Series A companies do not. That is not automatically a blocker. A compliance guide on SOC 2 for enterprise clients suggests first clarifying what the customer actually needs, since some accept Type 1, some require Type 2, and some will take a completed questionnaire, trust center access or a written update on your audit timeline. Ask early, so you learn which one applies before the deal is at risk.

Common failure modes

Waiting for the verbal yes. Paper started at the verbal yes is paper started late. Raise it in call two.

One contact. Your champion rarely controls legal or procurement. Get introduced to the owners.

Sequential gates. If security finishes before legal begins, you have doubled your timeline for no reason.

Letting the buyer “drive.” Buyers rarely know the fastest path. Guide with a proposed timeline and let them correct it, instead of asking “what do you need from us?”

Ignoring the signer’s calendar. An executive on vacation for the last week of the quarter is a paper process risk.

Closed-won without payment. The paper process ends at collected payment, not only at signature. Confirm what triggers the first invoice.

Our perspective

We build software for founder-led teams at seed and Series A, and we see the same pattern in how those teams treat paper. The founder runs a great discovery call, hears real enthusiasm, and moves on. Paper comes up two weeks later, when the champion has to forward a security questionnaire to someone the founder has never met.

The fix is not a better contract template. It is asking about paper while the buyer is still talking. The questions are easy to know and hard to remember in the moment, especially when you are also listening, demoing and reading the room. That gap is why we built OffBook to coach during the call rather than summarize it afterward. A recap tells you that you never asked who the security reviewer was. A live cue lets you ask while the buyer is still on the line.

Our advice for early-stage teams: pick three paper process facts you must have before a deal reaches commit (security owner, legal owner, signer) and treat any deal missing one as unqualified for forecast purposes. It is a small rule, and it removes most end-of-quarter surprises.

— Neil

Get paper process questions in the call, not after it

OffBook listens to your video calls and shows live on-screen cues, including qualification gaps to close, structured around MEDDIC and MEDDPICC. No bot joins the meeting. It also builds pre-call briefs on the people and companies you are about to meet. The Power plan is $59 per month, or $590 per year, and the Team plan is $1000 per year per seat. See OffBook pricing or read how AI call coaching for sales works.

FAQ

What does paper process mean in MEDDPICC?

It is the series of steps from the buyer’s decision to a signed contract. That includes security review, legal redlines, procurement approval, vendor onboarding and final signature. You document it by naming each owner, step and expected turnaround.

What is the difference between the decision process and the paper process?

The decision process is how the buyer evaluates and chooses, including technical validation and the business case. The paper process is what happens after they choose: the administrative and legal path to signature. Track them in separate fields because they involve different people and fail in different ways.

When should I ask about the paper process?

As early as the second call, and sometimes in discovery by asking how the buyer bought their last tool. Waiting until after the verbal yes leaves you with less leverage and a shorter runway to quarter-end. Ask, then send a written timeline the buyer can correct.

How do I document the paper process in my CRM?

Create a field or table with one row per gate: security, legal, procurement, signature. For each, record the named owner, the document required, the date requested and the expected completion date. Avoid free-text entries like “legal reviewing,” which hide the information a manager needs to trust the forecast.

Does a small startup deal need a paper process?

Yes, but a lighter one. A small buyer may need only a founder signature and a payment method, so a single question (“What has to happen on your side for us to sign and start?”) is enough. For larger or regulated buyers, map every gate.

Sources

• MEDDICC: What is Paper Process
• MEDDICC: Decision Process
• How To Document MEDDPICC Paper Process For Enterprise Deals
• Enterprise Sales in 2026: Process, Benchmarks & Templates
• MEDDPICC Paper Process: Tactical Close Guide (2026)
• SOC 2 for Enterprise Clients: What to Expect in 2026

Recommended

• MEDDPICC Discovery Questions: 8 Pillars B2B Reps Can Score Live
• 60 MEDDPICC Qualification Questions: Stage Sequencing & Champion Check
• 8 Field MEDDPICC Template for Founder Led SaaS: Evidence & CRM Setup
• Procurement Questions SaaS Reps Can Copy, Mapped to MEDDPICC