customer asks for supporting documents for the answers to the questionnaire

Supporting document corresponds to the type of answer

What you provide depends on what is precisely asked: a factual fact, a policy choice or a demonstrable measure. For identity and scope questions — the statutory name, the registration number or the number of employees — the supporting document is straightforward: an extract from the Trade Register is sufficient, because that data is legally recorded there. For a question about ISO 27001 it is different: often not the entire management system is requested, but the certificate itself or a statement of which measures from Annex A have been implemented. For NIS2 questions about article 21(2), the evidence is usually a description per measure — for example how incident handling or access control is arranged — not a separate certificate, because NIS2 itself has no certification scheme.

For sustainability questions from the VSME base module or from the CSRD, "evidence" is usually not a separate document but the underlying calculation or source of a figure: the energy contract behind a consumption figure, the supplier list behind a supply chain statement. If you do not have the requested supporting document, the most honest answer is to set your answer to "no" or "not applicable" instead of providing a document that does not cover what was asked — the system therefore never suggests a "yes" without a source in the file attached to it.

Where the burden of proof per question comes from

What supporting document is logical follows from the source of the question: the Trade Register Act 2007 for the basic data, EFRAG VSME and Directive (EU) 2022/2464 for sustainability figures, ISO/IEC 27001 Annex A for information security measures, and article 21(2) of Directive (EU) 2022/2555 for the ten NIS2 measures. Each source determines its own type of evidence; there is no overarching standard that says what "sufficient evidence" is for all questionnaires combined.