Supplier security questionnaires: what large customers will ask for and how to prove it

The first to ask you about the CRA won't be a surveillance authority — it'll be your customer. Large firms and public procurers push security requirements down to suppliers through questionnaires and contract terms. And the good news is that what they want largely overlaps with what the regulation itself asks of you. Let's go through what they ask and how to back it up.

Why this comes before fines

Fines are distant and hypothetical; losing the deal is immediate and concrete. When a large customer can't get an SBOM or a vulnerability-reporting contact from you, they simply pick a supplier who has them. So for a small company it's more practical to look at the CRA through the lens of "what will my customer want" than through the lens of penalties.

What the questionnaires typically ask

The same set of questions recurs across industries. You already know most of them from the other articles:

1. An SBOM. "Provide a list of the product's components." — how to build one.
2. A vulnerability disclosure channel (VDP). "Where do we report a security problem to you?" — security.txt and a channel.
3. Advisories. "How do you publish fixed vulnerabilities?" — advisories.
4. The support period. "How long will you ship security updates?" — support period.
5. Vulnerability response. "How fast do you respond and how can you evidence it?" — a triage process and a record of it.
6. CRA readiness. "Are you ready for the CRA?" — what self-assessment means and which class you're in.

The difference between "saying" and "proving"

The key word in questionnaires is evidence. Anyone can write "yes, we track vulnerabilities"; showing an audit trail — when you learned of a problem, how you assessed it, when you fixed and published it — is what convinces a customer. The ability to evidence is most often exactly what small companies lack when they do the work but never record it systematically.

What a good answer looks like

The difference between a weak and a strong answer in a questionnaire:

1. Weak: "Yes, we track vulnerabilities and respond to them." — a claim with no evidence.
2. Strong: "Yes. We keep an SBOM (CycloneDX) per version, compare it daily against OSV/KEV/EPSS, and prioritise critical findings. A link to our reporting channel and the last three advisories is attached; we can export the response audit trail on request."

The second answer promises nothing extra — it just shows that what you do for the CRA anyway is evidenced. And evidence is exactly what convinces a customer and sets you apart from a competitor who merely nods at the same question.

The sooner, the cheaper

A questionnaire arrives unexpectedly and with a deadline. If you hunt for inputs only then, it costs stress and often the deal. If you have them ready as a by-product of ordinary CRA work, the answer is a matter of minutes and one link. Put differently: the same effort you invest in the CRA (SBOM, channel, advisories, audit trail) pays off twice — once towards an authority, once towards a customer.

How to prepare: one place with the evidence

Instead of hunting for information across emails and spreadsheets for every questionnaire, it pays to have one place where, per product, you keep together: the current SBOM, a link to the reporting channel and advisories, the declared support period, and a record of vulnerability responses. Such a page is sometimes called a "trust page" — for the customer it's a shortcut instead of ten questions, for you one link instead of filling forms repeatedly.

Public tenders and larger buyers

In public procurement and at large firms, a security questionnaire tends to be a condition of participation, not a "nice to have". Increasingly it also includes a direct question about CRA readiness — and "we're working on it" is weaker than an evidenced status. This is exactly where having the inputs at hand pays off: there's nothing worse than losing a deal over a missing SBOM you could generate with a single command.

FAQ

1. Must we send an SBOM to anyone who asks? Towards the CRA the SBOM is provided to an authority on request; towards a customer it's a contractual matter — but once you have it, sharing is easy.
2. What if we have no audit trail? Start keeping one now — even a few months of response history is a better answer than nothing. It's about evidence the process runs.
3. Is a "trust page" mandatory? It's not a duty under the regulation, but a practical way to answer repeated questionnaires with a single link.

Bottom line

The real CRA pressure on small companies comes first from customers, not an authority. And the good news is that what they ask for in questionnaires — an SBOM, a reporting channel, advisories, a support period, evidence of responses — is largely the same obligations the regulation asks of you. So it isn't "extra" work: the same effort pays off twice, once towards an authority and once towards a customer. The decisive word is evidence: anyone can write "yes, we track vulnerabilities", but showing an audit trail convinces. So it pays to have one place where, per product, you keep the current SBOM, the channel, advisories, the support period and a response log — and answer ten questions with one link instead of hunting through emails. Whoever has the inputs ready doesn't lose deals over a missing document they could generate with a single command.

Key point

The real CRA pressure on small firms comes first not from an authority but from customers. The good news is that what they ask for in questionnaires — an SBOM, a reporting channel, advisories, a support period, evidence of responses — is largely the same set of duties the regulation requires of you. So you're not doing "extra" work: the same effort pays off twice, once towards the authority and once towards the customer. The decisive word is evidence: anyone can write "yes, we track vulnerabilities", but an audit trail convinces. So it pays to have one place where, per product, the current SBOM, channel, advisories, support period and response log sit together — and to answer ten questions with one link instead of digging through emails. Whoever keeps the materials ready on an ongoing basis doesn't lose deals over a missing document that a single command can produce.

How CRAguard helps

CRAguard creates this evidence as a by-product of ordinary work: a versioned SBOM, a hosted reporting channel and advisories, a support-period record, and an exportable audit trail of vulnerability responses. When a questionnaire arrives, most answers are already evidenced, no hunting required. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Annex I, Art. 13, Art. 14) and the European Commission's guidance of 27 July 2026. The content of specific supplier questionnaires is set by the customer, not the regulation.