> Like many businesses, my org requires some paperwork ("telecom approval") in order to buy computing hardware, which is basically a short questionnaire that I assume to check off some "we're not actively trying to backdoor you" boxes. I've had vendors get this turned around in I'm not in this industry but do sell into regulated industries with vendor diligence practices.
I would check your assumption that it's just "checking off some boxes" -- often questionnaires can be hundreds of pages long, and require you to sometimes get esoteric certifications or attestations. The questions are often very sophisticated meaning that not just anyone can fill them out. Big companies have dedicated roles for this type of thing (a lot of CISO at SME is filling out these papers) where the person is specialized in filling out these papers. Also, there is a knack to these types of forms -- you have to be able to hold two opposing ideas in your mind to do this effectively, A) this is important to do quickly and well to enable us to make sales to this company, and B) this paperwork is bullshit and you should focus on checking the boxes versus worrying about, e.g., truly enforcing a floppy disk security policy at your firm (yes, most of these questionnaires get added to over the years and never pared down, so you often have to answer questions about comically obsolete or irrelevant technologies). There's a big catch because often someone skilled enough to answer these questions would be better served actually doing things, e.g. writing code, and the people who can fill out these questions but not skilled enough to do the actual things are a weird middle-ground of mediocre that is hard to find.
Really big companies often solve this by just paying overskilled people to do this for a few years, which is expensive and soul-destroying for the skilled person (I had a CTO quit in large part because of having to do paperwork). And after a vendor is already established with a company, the requirements for updating it year over year are really light, so it's actually not as hard for established companies to maintain versus new vendors.