Answer with specific statements about practices you actually run on client projects, attach a sample of evidence, and say plainly where a control is partial or planned. Agencies are small, and clients mostly want to see that someone is in charge, not that you copied an enterprise policy.
What the questions are really testing
Supply chain questionnaires usually ask about five things: how you track third-party code, how you find and fix known vulnerabilities, who has access to the client's systems, how you protect build and deploy pipelines, and what you do when something goes wrong. A short, honest answer to each beats a long, vague one.
A reusable answer bank
Keep a living document with answers you can verify. For each, note the source of truth and the owner.
| Question topic | A true, specific answer looks like | Evidence |
|---|---|---|
| Dependency tracking | Lockfiles are committed and we generate a dependency inventory per release | Sample inventory file |
| Vulnerability handling | Dependencies are checked on every pull request and on a weekly schedule | Screenshot of the config |
| Access | Client repos use named accounts with MFA, and access is reviewed at the end of each engagement | Access list with date |
| Pipelines | Production deploys run from CI with environment secrets and a required reviewer | Workflow file |
| Incidents | Written runbook, named lead, client notified through an agreed channel | The runbook |
| Frameworks | We follow practices aligned with NIST SSDF where they fit our size | Mapping table |
Only claim practices that are true today. If you are aligned with a framework, say aligned and show the mapping. Do not say certified or compliant unless an independent party has said so about you.
Handling a gap
"No" with a plan is a legitimate answer.
Good: "We do not yet generate build provenance. We commit lockfiles, build in CI and store build logs. We plan to add provenance attestations in Q1."
Weak: a vague yes that falls apart on the first follow-up question.
Practical steps
- Read the whole form before answering. Group duplicate questions.
- Route each section to the person who knows: delivery lead, hosting engineer, whoever manages accounts.
- Answer in the first person plural and in plain words.
- Attach evidence, not policies. Policies describe intent. Evidence shows practice.
- Date the response and keep a copy.
- Review with someone who was not involved in writing it.
- Update the answer bank afterwards, so next time takes an hour instead of a week.
Common traps
- Describing subcontractors' controls as your own.
- Copying answers from a larger vendor's public page.
- Saying "all" or "never" about anything. Those words fail under audit.
- Claiming that automated tooling covers everything. Say what it covers.
For roles and handoffs inside the answering process, see who owns security questionnaires.
Quick check
Do we need an SBOM to answer?
Often not, but being able to produce one on request strengthens your answers on dependency tracking.
Can we say we follow NIST SSDF?
Say you align certain practices with it, and show which. NIST publishes it as a framework of practices, not a certification.
Sources
Last reviewed: 19 October 2026.
