Keep a short answer for each recurring question and a link to the evidence behind it. The ten below cover most questionnaires. Adapt every line to what you actually do, and delete any line you cannot support.
Why a cheat sheet helps
Questionnaires repeat. If sales, support and engineering each answer from memory, the replies drift apart, and customers notice. A shared sheet keeps statements consistent and makes it obvious where a practice is missing.
The ten questions
| Question | One line reply pattern |
|---|---|
| Do you use open source? | Yes, with a per-release inventory and a review process. |
| Do you have a policy? | Yes, titled X, reviewed on date; summary available. |
| How do you inventory components? | Generated from the build, includes transitive dependencies. |
| Which licenses do you allow? | Permissive by default, copyleft reviewed before use. |
| How fast do you patch? | Tiered by exposure and severity, exceptions recorded. |
| What about end of life components? | Detected, each given a plan, decisions logged. |
| How do you vet new dependencies? | Documented review recorded in the pull request. |
| Do you scan for malicious packages? | Lockfiles, review and provenance checks, no claim of full detection. |
| Can we have your SBOM? | Yes, per release, in a standard format, under agreed terms. |
| Who owns this? | A named role, reviewed yearly. |
Deeper posts for each
- Do you use open source
- Usage policy
- Inventory
- GPL and AGPL
- Patch speed
- End of life
- Vetting
- Malicious packages
- Component list
- Ownership
Rules for keeping the sheet honest
- Date it. Every line carries a last verified date.
- Assign it. One owner updates it after process changes.
- Link evidence. Each line points to an artifact.
- Mark gaps. A line you cannot support is marked "in progress", with a date.
- Review after audits. What an assessor found belongs in the sheet.
NIST SP 800-218 offers a shared vocabulary for these practices, such as reviewing third party components, verifying them over their life cycle, and responding to vulnerabilities. Using that vocabulary helps because many buyers already read their requirements through it.
Tone
Short, specific and calm. Skip adjectives like "strong" or "industry leading". If a customer wants detail, give it with evidence. If you do not know, say you will find out and reply by a date, then do.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the inventory and check which of the ten answers it can back with data on its own.
Safeguard supports SBOM and dependency scanning, plus compliance and evidence automation, which helps keep the sheet's links current.
Quick check
Should sales reps use the sheet directly?
Yes for first replies, with engineering reviewing anything beyond the sheet before it goes out.
How often should the sheet be refreshed?
After any process change and at least every quarter.
Sources
Last reviewed: 19 October 2026.
