can I attach a certificate or policy document as an attachment to an answer

Adding supporting documents is usually possible

Yes, in almost every portal you can upload an attachment to an answer: a certificate, a policy document or a screenshot of a system setting. For a question about ISO/IEC 27001, this is often the certificate itself, possibly with the scope statement, so the customer can see which parts of the organization fall under it. For a question based on the ten measures of Article 21(2) of the NIS2 Directive, a certificate is usually not required — the customer is more likely to ask for a policy document, such as an incident response plan or an access policy. Our supply chain file links the supporting document to the answer, but we do not assess whether that specific document meets what the customer wants to see.

If you don't have the requested document, there are usually two routes: explain the answer in free text ("policy is under development, ready in the third quarter") or leave the answer as "no" or "n/a". Which route is appropriate depends on what the customer does with the question — you can only see that in the customer's own portal, not with us. For questions related to continuity, for example whether there is a plan for business operations in the event of a serious disruption, the same logic applies: an attachment is strong substantiation, but not a mandatory part of the answer itself.

Where this comes from: EFRAG VSME and NIS2 Article 21

The VSME basic module of EFRAG is set up as a voluntary reporting standard for non-listed SMEs and specifies for each section what substantiation is customary, without making an attachment mandatory. Article 21(2) of Directive (EU) 2022/2555 (NIS2) lists the ten measures on which a customer can follow up, but does not prescribe a form of evidence — each customer determines that themselves in their own portal. For a question about information security, the answer may also depend on in which countries the enterprise has establishments, because some customers expect a separate supporting document per location. Our system stores the document in the file so that it can be used again for the next list; what exactly needs to be done with it in the customer's portal is up to that customer.