each customer sends a different questionnaire how do I keep track of this

One supply chain file, ten fixed building blocks

The solution is not to maintain multiple formats, but to maintain one underlying structure that remains the same under each format. Each client packages their questionnaire differently — one calls it a "supplier security assessment", another a "third party risk questionnaire" — but the content almost always comes down to the ten measures of Article 21(2) NIS2, or to the Annex A controls of ISO/IEC 27001 if the client uses that standard as a framework. Risk policy, incident response, continuity, supply chain security, vulnerability management: these ten topics recur under varying headings, in varying order, with varying scoring (yes/no, 1-5, text box). Whoever documents their answers by topic rather than by client format only needs to identify which heading belongs to which topic when a new questionnaire arrives — not reformulate the answer from scratch.

In practice, this means that for each building block you write one good answer once, with supporting evidence, and then reuse that answer. For access control and asset management it is often a policy document plus a screenshot of the rights structure; for the procedure review of security measures it is the latest internal audit report. Once that file is complete, a new client questionnaire is mainly about identifying and copying, not researching anew.

Why the ten measures are the common denominator

Article 21(2) of Directive (EU) 2022/2555 lists ten categories of measures that an entity must take — from risk analysis policy to cryptography to human behaviour — and this list is in practice the basis on which most of the client's procurement questionnaires are built, even if the client itself does not refer to NIS2. ISO/IEC 27001 Annex A covers largely the same topics with more detail per measure, which explains why a format that refers to one framework can be translated to the other without much difficulty.