Customers ask seven things about your software supply chain: which components you ship, how you find and fix vulnerabilities in them, how you protect the build, whether you can share an SBOM, how you vet new dependencies, how you disclose problems, and who else touches their data. Each has a short, checkable answer.
The seven question groups
Most security questionnaires hide these inside a long list. Once you see the groups, you can prepare one answer per group and reuse it.
| Group | What the buyer is really asking | Evidence that settles it |
|---|---|---|
| Inventory | Do you know what is inside your product? | Current SBOM or dependency report |
| Vulnerability handling | How fast do you find and fix flaws in components? | Policy with timelines, sample ticket history |
| Build integrity | Can someone tamper with what you ship? | Pipeline description, signing or provenance records |
| Dependency intake | How do you decide what to add? | Written intake rules, review records |
| Disclosure | How do people report problems, and how do you tell customers? | Disclosure policy, notification commitment |
| Licenses | Can we legally use what you ship? | License report, policy |
| Third parties | Who else handles our data? | Subprocessor list |
Why buyers ask now
Public guidance has pushed these questions into procurement. NIST describes its Secure Software Development Framework (SP 800-218, February 2022) as a core set of high-level secure development practices, and CISA's secure software attestation form is based on it. CISA also states that agencies may ask producers for a current SBOM on request. In the EU, the Commission says Cyber Resilience Act reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and the main obligations from 11 December 2027. Buyers who sell into those markets pass the questions down to you.
How to answer well
Lead with the fact, then the evidence, then the limit. "We generate an SBOM for every release in CycloneDX format and can share it under NDA" is better than "we follow best practices". If a control is partial, say which part. The yes, no or partial pattern is covered in yes, no, partial: how to choose questionnaire answers.
Keep one owner per group. Inventory and vulnerability handling usually belong to engineering. Disclosure and notification belong to security. Subprocessors belong to legal or privacy. A shared library makes the work faster; see build a security questionnaire answer library.
What to avoid
Do not claim a framework alignment you cannot demonstrate. "Aligned with SSDF" invites a follow-up asking for a mapping. Do not promise fixed fix times for every severity if you have never measured them. Do not send a raw scanner export as an answer to an inventory question.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the inventory view and look at how direct and transitive components are listed. That is the artifact most inventory questions are asking for.
Quick check
Do all customers ask for an SBOM?
No. Many ask only whether you can provide one. Be ready to share it, and decide in advance whether that is under NDA or on request.
Is a supply chain question the same as a vendor risk question?
They overlap. Vendor risk asks about the companies you use. Software supply chain asks about the code and build you ship. Buyers often send both.
Safeguard produces SBOMs and dependency scans, reachability analysis and compliance evidence that map to these groups. You can try a free scan at gold.safeguard.sh/scan.
Sources
- NIST SP 800-218 SSDF
- CISA secure software development attestation form
- European Commission, Cyber Resilience Act
Last reviewed: 19 October 2026.
