There were several great presentations on this yesterday... I hope you caught them. Adam Carson did a great job covering this in depth; try to catch him today if you didn't hear that. I also tried to cover this on the Web Practitioner panel. I have some blog thoughts here.

The bottom line is that from a technical perspective you need to be able to integrate... at a minimun with AAA (authentication, authorization, audit) services. You probably also need to have a story around records management (archivability, retention).

But I think the bigger issues are just around process understanding. Some vendors out here get what it's like to bring this stuff into a large enterprisey setting, some do not. You need to understand the implementation issues as well as the decision making process, and have a different story than you have for the consumer space.