we have multiple subsidiaries do I have to fill in the questionnaire separately for each company

Usually per legal entity, not per group

In most cases, each company completes the questionnaire separately, because the requesting party tests the legal entity with which it has a contract. Each company has its own registration in the trade register, its own registration number and usually its own business address. An answer that is correct for the parent company — for example, about the number of employees or annual turnover — does not automatically apply to the subsidiary. If the subsidiary completes the list itself with its own customer, then its own figures apply, not those of the group.

There is one important nuance: in CSRD reporting (Directive 2022/2464) and in the VSME standard of EFRAG, reporting is often done at group level, with a consolidated overview of the entire chain of subsidiaries. If a customer specifically asks for sustainability reporting according to CSRD or VSME, then the answer may indeed be at group level — check whether the questionnaire explicitly asks for that, or for the situation of the individual company. For questions about information security (ISO/IEC 27001, NIS2), the scope is often at the entity that provides the service, because it concerns the systems and processes that actually run at that company. One chain file with the separate facts per subsidiary is helpful here: you record separately for each subsidiary what is true, and the system uses the correct set for each questionnaire.

Why this differs per regulation

The Trade Register Act 2007 registers each business separately, with its own number — that is the starting point that most purchasing portals follow. CSRD (Directive 2022/2464) and the VSME basic module of EFRAG, by contrast, do have a consolidated reporting form at group level. NIS2 (Directive 2022/2555, Article 21(2)) and ISO/IEC 27001 focus on the organisation that actually manages the service or system, which is usually the individual company. Which level applies is thus not fixed in one law, but follows from the question itself — look at what is literally being asked about the sector or scope of the reporting.