Partner Vetting Questions Founders Skip

Partner vetting at mid-market is a short list of questions you ask before the kickoff, not a merger binder. Who owns the login. How you leave with a dump. Whether MFA is extra. Whether patches install without a war room. Founders skip those and regret it the night the vendor stops answering email. Write the answers on one page. Sign after.

I run Kief Studio with Brian. Two people, Shrewsbury, Massachusetts, building since 2012. If we were sitting with the vendor PDF and last year's invoice, I would not start with culture fit. I would start with the questions CISA already wrote for software buyers, then add the three ownership lines from our retainer work.

What partner vetting at mid-market actually is

On 6 August 2024, CISA and the FBI released Secure by Demand. The guide is for customers, not manufacturers. Ask whether MFA is default and free. Ask how patches install. Ask if there is a public vulnerability disclosure program. Ask if SSO is extra. CISA Secure by Demand: questions for software vendors is the longer walkthrough on this site.

Founders skip that list because the demo was smooth and the Slack channel felt friendly. Friendliness is not a restore. A partner who cannot answer those questions in writing is selling a relationship. You are buying work that has to survive a Saturday.

Mid-market here is the $0 to $50M band we actually serve. You do not have a procurement team. You have a founder, maybe an ops lead, and a calendar that is already full. The vetting has to fit on one page. If it needs a law firm to start, you will not start.

Questions founders skip, and why they hurt later

Who holds the registrar, the host invoice, and the deploy keys. Mix those three and you discover the gap when the freelancer is on a plane. Site, host, and login are three papers. A partner who wants all three in their name is not a partner. They are a landlord with a nicer deck.

Can you leave with a dump in a week: content, images, customer records, DNS zone, certificate contacts. Time it. Put the hours on the page. A partner who has never run that drill is asking you to trust a story. What it costs to leave HubSpot or Webflow is the same drill on a named platform.

What happens when someone on their side leaves. Named people, not a shared webmaster mailbox. A revoke date. If the only login is a personal Gmail, you are one job change away from a locked dashboard. I have sat in that meeting. It is not theoretical.

A Massachusetts operator I will not name paid for a "full stack partner" and got a designer, a host login on a personal Gmail, and a plugin list in a Notion page the designer owned. MFA was extra. Patches were "as needed." The Saturday the card on the registrar expired, nobody in the company could prove they owned the name. That is partner vetting you skipped, coming due. The CISA questions would have caught MFA. The ownership list would have caught the registrar. Together they take twenty minutes.

Ask for artifacts, not adjectives. CISA names a few: an SBOM if they ship software, a public VDP URL, a patch path in one sentence. For a studio or a host, add the last restore date and the named human on the 2am path. "We take security seriously" is not an artifact. A URL is an artifact. A date is an artifact. The longer CISA walkthrough is on this site if you want the full buyer list.

Do not let the demo pick the partner

I study behavioral psychology. Defaults decide more than decks. The first vendor in the room gets a lift they did not earn. Default bias in design decisions is the sibling. Put the questions in writing before the Zoom. Score the answers after, not during the charm.

Richard Thaler and Cass Sunstein, in Nudge (Yale, 2008), called this choice architecture: there is no neutral setup. The order of the cafeteria line changes what people eat. The order of the vendor list changes who you hire. Write the criteria first. Then invite the room.

A one-page partner sheet

Eight lines. MFA default, or extra. Patch path, in one sentence. Public VDP, yes or no, with a URL. SSO cost. Registrar in your name. Last restore date. Named operator, not a mailbox. Exit dump, tested, with hours. If four of eight are shrugs, keep walking.

What is included in managed hosting is the hosting version of the same sheet. One vendor versus four is why you do not want four half-answers. Coordination cost shows up on Tuesday night, when each vendor thinks the other one has the certificate mail.

At Kief Studio we will not recommend a product without context: stack, host, budget including labor, culture, roadmap, skills, root cause, hardware. Ground truth on this site is that sentence. A guess with branding on it is not advice. ltfi.ai is the hire, not a SKU you install. kief.dev is the engineering square. I write the questions. Brian designs the box they describe, on briansgagne.com.

Related reading

• CISA Secure by Demand: questions for software vendors
• Who owns the site, the host, and the login
• What is included in managed hosting
• Decision architecture beats sales tactics
• Vendor consolidation in regulated industries
• One vendor versus four

Frequently Asked Questions

What is partner vetting at mid-market?

A one-page list you fill before you sign: MFA, patches, VDP, ownership, restore, exit. It is operational due diligence, not a merger process.

Where do I start if I have no security team?

Start with CISA Secure by Demand (August 2024). Then add registrar, restore date, and named operator. That is enough to reject a bad fit.

Should I pick the vendor with the best demo?

No. Write the criteria first. Demos reward charm. The Saturday restore rewards a named person and a date.

What if the partner will not put answers in writing?

Walk. A partner who cannot write MFA, patch path, and exit is asking you to fund a story.

Does this replace a lawyer?

No. I am not your counsel. I am telling you the failure modes I see when the questions never get asked.