In our experience, F500 companies are generally the most interested in following a vendor registration process correctly, including contract review, documents, NDA, etc. By regulation, all third parties are required to follow it even if it delays the project and employees are aware of that. If they're not following it now, for sure they will do it after your pilot and that would definitely slow the payment process afterwards.
So I'd recommend you touch the subject rather sooner than later
In my experience, you should never make paper/legal work a precursor. The three steps of winning a tech B2B deal are: Awareness, evaluation, closure. Your goal is to keep moving the sales process along to the closure stage. I would spend all my energy in getting through the evaluation as quickly as possible with the best possible results.
If they haven't demonstrated in your past meetings that IT is important to them and haven't asked for the security review yet, then just go to discussing the contract. If it's important to them, they'll ask for it. For a pilot, I've found it depends on the customer, some care, some don't (ie more conservative industries like aerospace/defense etc would care more than others). If you want the quickest way and they haven't brought it up yet and you feel it won't come up during contract review, I would just go straight for asking to start the contract review