Two customers ask almost the same thing but worded slightly differently

Two formulations can refer to the same answer

Usually the answer is: the same source data, two different question formulations. Customer A asks "Do you have an ISMS compliant with ISO 27001?", customer B asks "Have the ten measures from Article 21(2) of the NIS2 Directive been implemented?" These are not two questions requiring two answers — they are two entry points to the same underlying fact: do you have information security in order, and with what evidence do you demonstrate that. One portal asks for the certificate, the other for the coverage of the measures themselves. If you have an ISO/IEC 27001 certificate, it typically covers the ten measures of Article 21(2) largely, because the Annex A control measures of the standard have considerable overlap with what the Directive requires. That is no guarantee of complete coverage point by point, so it remains useful to check per measure whether there is a gap.

Where it does differ: some customers want the source document (the certificate, the evidence itself), others want only a yes/no with explanation. That does not affect the answer, but the form in which you deliver it. The same pattern applies to sustainability lists: one customer asks about "VSME indicators", the other about "CSRD reporting", and for a non-listed company that is not itself subject to CSRD, the answer is often based on the same VSME basic module figures, just presented differently. Check in case of doubt whether the underlying question really touches the same fact — for example, whether the company uses AI systems in its service provision is independent of how another portal asks about "automated decision-making" — before you blindly copy the same answer.

Where the evidence comes from in overlapping questions

The overlap between ISO/IEC 27001 and NIS2 follows from the Annex A measures of the standard and Article 21(2) of Directive (EU) 2022/2555; the overlap between VSME and CSRD follows from the EFRAG VSME basic module as a voluntary standard alongside the reporting obligation of Directive (EU) 2022/2464. Basic data such as the registered address or the registration number come anyway from one source, the Trade Register Act 2007, regardless of how a portal asks about it.