What if the questionnaire asks something that is not in our file

No match in the file: three reasons, three next steps

A question without a match usually means one of three things: the subject is there but worded differently, the subject was never filled in because there is no source for it, or the question is specific to that one customer and does not belong in a generic supply chain file. The system does not suggest anything here if there is no source behind it — there is no yes, no guess, no automatically filled answer. You see the question as an open item, and you assess whether it is a matter of rewording or of actually providing something new.

When matching, the first check is often which question the actual wording conceals. "Do you have a BCP" and does the organisation have a plan to continue operations during a serious disruption are the same question in two different forms — that often resolves itself as soon as you look at the corresponding file field. If it is a subject that is structurally missing — for example a customer asking whether you use AI systems while that field has never been filled in — then that is a signal that the file is empty on that point, not that the answer is "no". Empty and "no" are not the same; that distinction is precisely why there is no automatic yes.

Why nothing is suggested here: no source, no answer

The reason an unanswered question remains open is independent of which standard is behind it — VSME, ISO/IEC 27001 Annex A or the ten measures of Article 21(2) of the NIS2 Directive all call for concrete evidence or a concrete fact, and without that fact in the file there is nothing to show. That applies equally to basic data: if the answer to something like the registration number is not there, then that comes directly from the Business Register and filling it in is often a matter of recording that information once. What you yourself provide to fill the gap, and whether that happens, is up to you.