Do all our locations have one shared file or each their own

One supply chain dossier, multiple location profiles

The answer: the dossier works together, but not as a single pool of answers for everyone. In practice, you set up one supply chain dossier for the whole organization, and within it you specify per location what deviates. The location address of the enterprise and the countries where the company has establishments are thereby the first split: some questionnaires explicitly ask about the situation at one location, not about the group as a whole.

What is shared: governance answers, the ISO 27001 certificate if it was issued at the level of the legal entity, and the CSRD/VSME figures if those are reported on a consolidated basis. What often differs per location: the number of employees at that site, local certifications, and sometimes the scope of information security measures if not every location falls within the same ISO scope. You therefore fill in the group-wide part once, and add a layer per location where the questionnaire specifically asks for it.

Why this difference exists: registration versus reporting scope

This follows from how registration and reporting are legally separated. The Trade Register Act 2007 registers locations as separate units under one enterprise — which is why a client sometimes asks per location number instead of per Chamber of Commerce main registration. CSRD (Directive 2022/2464) and the VSME standard of EFRAG report at the level of the reporting entity, usually the group, so those figures are by definition consolidated and cannot be split per location. NIS2 (Directive 2022/2555, Article 21(2)) and ISO/IEC 27001 Annex A depend on the scope that the organization itself has established for the management system: if that scope covers one location, the certificate does not automatically apply to the others. This is why the answer to this question is not uniformly "together" or "separately", but depends on which part of the dossier you are looking at.