Field guide
Turn a supplier questionnaire into an evidence review
Create a small review record that connects a supplier claim to evidence, limitations and a decision.
Choose the decision first
Begin with one purchase decision: whether a named service is suitable for a defined use. Write the data involved, the access the supplier needs and the effect of an interruption. Use that description to select questions. A broad questionnaire with no decision attached leaves the reviewer with answers but no way to judge what matters.
Use a record with an owner
For each important claim, record the evidence requested, the evidence received, its date, the service it covers, the remaining limitation and the person responsible for follow-up. Link to a controlled evidence location rather than copying confidential records into a public spreadsheet. Ask for a redacted example or a supervised walkthrough when raw operational data would expose staff or customers.
Separate a policy from an operating result
Fictional example: a supplier states that privileged access is reviewed. A policy explains the intended interval and responsible role. A dated, redacted review record demonstrates that a review occurred for the covered service. The reviewer notes whether the evidence answers the question and records any exclusions. Neither document alone establishes that every account is correctly configured.
Record what remains unanswered
An unanswered question should produce a visible action. State the missing evidence, the reason it matters and the person who will resolve it. If the team accepts a limitation, record who is authorised to accept it and the conditions of that acceptance. Do not silently change an unknown status to a positive answer to finish the questionnaire.
Close the review with a usable handover
Finish with the service decision, unresolved items, evidence location and next review trigger. Hand the record to the service owner and check that they can find the supporting material. The supplier assessment supports procurement and ongoing oversight; the worksheet is an editorial working aid and does not confer certification. NIST's due-diligence guide is a separate primary reference for ICT supply-chain assessments.
Sources and method
Primary references checked 4 November 2026. The workflow and fictional examples are original editorial guidance; they are not a quoted standard or an endorsement.