Answer security questionnaires

Customers, distributors and buyers increasingly send a security questionnaire before they buy a product: do you have an SBOM, how fast do you fix vulnerabilities, do you have a disclosure policy, how long will it get security updates. Questionnaires proposes the answers from what Provetry already records about the product, and from the answers you gave before. It is part of the paid plans.

1. Open Questionnaires, under Report. Choose the product the questionnaire is about, give it a name, who sent it, a due date if you like, and the language of the answers (English, French or German).
2. Paste the questions, one per line. A column copied from a spreadsheet works; for a row of several cells, the cell that ends with a question mark is taken. Numbering is removed, repeats are dropped, 400 questions at most.
3. Click Propose answers. Each question gets:
   • Recorded in Provetry: a dated answer from today’s records of the product, when the question is about its SBOM, the vulnerability watch, correction times, the disclosure policy, the support period, reporting to ENISA, security advisories (CSAF, VEX) or the technical documentation and EU declaration of conformity. Only what the records show is said; what is missing is said as such (“Not yet: …”), with a note asking you to check it. If your library holds an earlier answer to a close question, it is shown beside it;
   • From your library: on other subjects, an answer you kept from an earlier questionnaire, to a close question (the original question is shown);
   • To answer: nothing proposed (for example MFA, backups or training, which Provetry does not see). Questions about your company’s own servers, laptops or network get no answer from the product’s records.
4. Read and correct every answer, then Save the answers. Tick Keep in my library for the answers you want proposed next time; it is ticked by default for the answers you write. An answer recorded by Provetry is kept only once you have edited it, since it holds today’s figures for this product.
5. Send them: Copy the answers column (one line per line you pasted, blank where a line was not a question, so it lines up) and paste it next to the questions in the customer’s spreadsheet, or Download (.csv). Mark the questionnaire as done when it is sent.

The answer library (link at the top of the page) lists the answers you kept, how often they were reused, and lets you add, edit or remove them.

Proposed answers are drafts for you to check, never a statement by Provetry, and nothing is sent to anyone. Questions and answers are stored encrypted; viewers can read them but not change them. Deleting a questionnaire keeps the answers you saved to the library.