United States / Guides / The CDP supply-chain questionnaire: what your enterprise customer sent you
United States · guideThe CDP supply-chain questionnaire: what your enterprise customer sent you
The short answer
CDP's Supply Chain program lets member companies — more than 270 corporate buyers including Walmart, Microsoft, and Nike — request environmental disclosure directly from their suppliers, because a buyer's Scope 3 supply-chain emissions typically run many times larger than its own direct operations. A US small or midsize supplier that gets this request almost always qualifies for CDP's SME questionnaire rather than the full corporate version: ten integrated modules on governance, strategy, and risk, plus a climate change module asking for an emissions inventory, targets, and reduction initiatives, plus a small set of questions shown only to organizations responding to a customer request. The 2026 cycle opens the response window the week of June 15, closes the scoring deadline the week of September 14, and closes the window for unscored responses and amendments the week of October 26 — all fixed by CDP, though the customer that sent the request often sets its own earlier internal deadline. A first-year responder can honestly answer governance and strategy questions from what already exists internally, estimate Scope 1 and 2 emissions from utility bills and vehicle fuel records, and leave third-party verification and full Scope 3 mapping for a later cycle without it counting against the ability to submit a response at all — a blank field just reads as non-disclosure rather than a wrong answer.
Key facts — verified dates on each
Who sends this request, and why
CDP itself is the nonprofit that runs the questionnaire; the party actually asking a supplier to fill it in is one of CDP's Supply Chain members — a large corporate buyer that has joined the program to get visibility into its own value chain. CDP's current count puts membership at more than 270 corporate buyers, including household names like Walmart, Microsoft, and Nike, and in the 2025 cycle those members collectively requested disclosure from roughly 45,000 suppliers.
The reason a customer bothers is straightforward: for most companies, the emissions generated by their supply chain (their Scope 3, Category 1 purchased goods and services) dwarf what they emit directly running their own offices and facilities. CDP frames it as "environmental risk is financial risk" and cites supply-chain emissions running on average many times higher than a company's own operational footprint. A CDP Supply Chain request is that buyer's attempt to get standardized, comparable environmental data from the vendors whose emissions actually make up most of its footprint — the same reason procurement teams increasingly build a CDP response, or an equivalent like an EcoVadis scorecard, into vendor onboarding and renewal decisions.
Membership at the buyer level runs in tiers — Standard, Lead, and Premium, differentiated by how many suppliers a member can request disclosure from — but none of that tiering changes what shows up in a supplier's inbox: a standard CDP questionnaire request, with a Supply Chain module layered on top because the request traces back to a specific customer relationship rather than to CDP's investor-signatory program.
Which questionnaire a US supplier actually fills in
CDP runs two versions of its corporate questionnaire. The full corporate questionnaire is built for large organizations and carries sector-specific datapoints; the SME questionnaire is shorter, simplified, and built for exactly the kind of company most often on the receiving end of a customer request. Eligibility is set by size: an organization with more than 1,000 total employees or more than US$250 million in annual revenue can only use the full questionnaire, while anyone below that line is eligible for the SME version (and can still opt into the full one if it prefers). CDP reports that over 12,500 SMEs disclosed through the SME route in its first year and around 11,000 in the following cycle — a route CDP built specifically because smaller organizations have different reporting capacity than a multinational.
The one exception: organizations requested through the separate RE100 initiative are not eligible for the SME questionnaire regardless of size. Outside of that, most US SMBs answering a customer's CDP request will be working from the SME version, and everything below describes that version's structure.
The SME questionnaire's ten modules
The SME questionnaire runs through ten modules, numbered 14 through 23 in CDP's system (the full corporate questionnaire uses modules 1 through 13, and the SME numbering picks up from there). Seven of those modules are always shown to every SME discloser; the issue-specific environmental-performance modules are shown only for the issues the organization chooses to disclose on during questionnaire setup, except climate change, which every discloser sees by default.
Every SME discloser sees: an introduction module capturing basic organizational details and, if relevant, the commodities the company produces or sources; identification, assessment and management of environmental risks and opportunities; disclosure of those risks and opportunities; a governance module covering board- and management-level oversight of environmental issues; a business strategy module; a consolidation-approach module setting the boundary the response is reported against; and a sign-off module closing the response. All SME disclosers are also shown the climate change environmental-performance module, since climate is the one issue area presented to every discloser by default.
Two further modules — Forests and Water security — are new for 2026 and only appear if the organization opts into disclosing on them during setup; a company that produces or sources timber, cattle, palm oil, soy, coffee, cocoa, or rubber is the intended audience for the Forests module, and organizations for whom water security is relevant to their operations or supply chain are the intended audience for the Water module. Neither module's 2026 disclosures are scored, which matters for a first-year responder deciding where to spend limited preparation time: climate change is both the module every discloser sees and the one that carries a score.
On top of that structure, the SME questionnaire adds a small set of questions that appear only for organizations "responding to a request from CDP Supply Chain members" — this is the Supply Chain layer referenced in the questionnaire's own documentation, and it is why a supplier disclosing because a customer asked will see a slightly longer questionnaire than an SME disclosing purely to CDP's general investor-facing program.
Governance, targets, and emissions: what the climate module actually asks
The SME Environmental Performance — Climate Change module is where most of the substantive work sits. It requests information across six areas: the organization's emissions methodology and any exclusions from its reporting boundary; a Scope 1, 2, and 3 emissions inventory; a breakdown of emissions by business activity; energy-related activities; emissions reduction targets; and emissions reduction initiatives already underway. This mirrors — in simplified form — the structure of CDP's full corporate climate questionnaire, which follows the same broad arc of governance and strategy first, then quantified emissions data, then targets and verification.
The governance and strategy modules that precede it are where a first-year responder's existing operations usually already have an honest answer available: who at the company (by role, not name — CDP explicitly asks for positions, never individual names) has oversight of environmental issues, whether climate risk has been discussed at board or management level, and what the business strategy says about environmental factors, even if that strategy is informal. These questions do not require a formal sustainability program to answer truthfully; they require an accurate description of whatever oversight already exists, however thin.
For SMEs responding specifically to a Supply Chain member's request, CDP adds targeted follow-on questions once climate, forests, or water content is in scope — for climate this generally means additional detail tied to the requesting customer's own reporting needs, and for forests or water it means questions on certified commodity volumes, land-use emissions, or the supplier's facility-level impact on that specific customer's supply chain. These customer-specific add-ons are the clearest sign, inside the questionnaire itself, that a response is being read by a specific procurement relationship and not only by CDP's general dataset.
Scoring basics: what a first-year SME response is actually being measured against
CDP scores every questionnaire response on a four-level scale that runs from D- up to A: Disclosure (D-/D) simply confirms the organization is being transparent about the issue and provided the requested information; Awareness (C-/C) measures how thoroughly the organization has evaluated how the issue intersects with its business; Management (B-/B) measures whether the organization is taking coordinated action; and Leadership (A-/A) is reserved for organizations demonstrating best-practice transparency and performance, including — for the Climate Change A List specifically — verifying at least 70% of Scope 1, 2, and 3 emissions to a CDP-approved standard. A minimum score at one level is required before a response is assessed on the next, so a thin governance answer caps the score regardless of how strong the emissions data underneath it looks.
For a first-year SME responder, two things matter more than the letter grade itself. First, CDP has historically kept smaller, first-time disclosers' shorter-form scores private between the disclosing company and the requesting customer rather than publishing them, and SME responses are not eligible for CDP's public A List — the SME methodology is explicitly not comparable to the full corporate scoring track. Second, CDP added an SME-specific "A score" pathway for climate change in the 2026 cycle for SMEs that demonstrate leading action, which gives smaller companies a real ceiling to grow toward without requiring the same evidence base a multinational would need. Either way, the practical reality is that a first response with modest but honest disclosure is a starting point CDP's own scoring language treats as a legitimate first step, not a failure.
Every question in the questionnaire is scored for disclosure regardless of level, and CDP is explicit that a blank field is read as non-disclosure — so leaving something out is scored differently than answering it honestly with an estimate and a documented assumption. Numeric fields left blank because no measurement has been made should stay blank with an explanation in the accompanying "please explain" or "comment" field, rather than filled with a guessed number; comment-column text itself is not scored, which is exactly where a first-year responder should put caveats and context that would otherwise weaken a scored answer.
The 2026 disclosure calendar
CDP publishes the same calendar to every discloser regardless of whether the request came from a Supply Chain member or CDP's general investor program. For the 2026 cycle: requesting members can start creating and submitting their supplier lists the week of April 27; the response window for organizations to actually complete and submit a questionnaire opens the week of June 15; the scoring deadline — the last date a response can be submitted and still be eligible for a CDP score — falls the week of September 14; and the final deadline to submit any unscored response or make amendments to an already-submitted one is the week of October 26, after which the questionnaire closes for edits.
A supplier working from a customer's Supply Chain request should not assume the CDP-published calendar is the whole story. The requesting customer frequently sets its own internal deadline ahead of CDP's scoring cutoff, both to leave time to review supplier responses before its own reporting cycle and because a supplier response submitted after the customer's internal date may not be usable in that customer's own disclosure even if it is still technically within CDP's window. Confirming the specific date the requesting customer expects a response by — not just CDP's published dates — is worth doing before treating September or October as the real deadline.
What a first-year responder can honestly answer, and what to leave for next year
CDP's own guidance for completing a response rests on five reporting principles borrowed from the Greenhouse Gas Protocol: relevance, completeness, consistency, transparency, and accuracy. None of those principles require perfection in year one — they require that whatever is disclosed is true, that gaps are disclosed rather than papered over, and that assumptions are documented. That framing gives a first-year responder a workable line between what to answer now and what to defer.
Reasonably answerable in a first year: governance and oversight questions (who owns environmental issues internally, by role), a business strategy answer describing whatever environmental considerations already factor into planning, an emissions methodology statement even if simple, and a Scope 1 and Scope 2 inventory estimated from records the business already keeps — utility bills for purchased electricity, fuel receipts or mileage logs for owned vehicles, and facility square footage or headcount as a reasonable allocation basis where direct metering isn't available. CDP explicitly permits estimated data as long as the uncertainty is explained in the accompanying text field rather than presented as measured fact.
Reasonably deferred to a later cycle: a full Scope 3 inventory across all fifteen GHG Protocol categories (most first-year responders reasonably start with the one or two categories most material to their business, typically purchased goods and services, and note the rest as not yet quantified), third-party verification of any emissions figure, and a formal science-based target. None of these are required to submit a scoreable response — the scoring language treats disclosure itself, even a modest one, as the legitimate starting point of a multi-year "environmental journey," and CDP's own copy-forward feature exists specifically so that each year's response builds on the last rather than starting from zero.
The records that make next year's response faster
Because CDP lets a returning discloser copy forward the previous year's answers and update them rather than starting from a blank questionnaire, the single highest-value habit a first-year responder can build is keeping the source records behind this year's numbers rather than just the numbers themselves. That means retaining, in a form that can be handed to whoever prepares next year's response: the utility bills and fuel records used to estimate Scope 1 and 2 emissions, the methodology and any exclusions noted in the emissions inventory answer, whatever documentation supports the governance and strategy answers (board minutes, an internal policy, an org chart showing who owns the issue), and a copy of the submitted response itself with its comment-field caveats intact.
Two details from CDP's own reporting guidance are worth building into that recordkeeping habit specifically because they cause avoidable rework: values of zero in a numeric field are read as "measured and zero," not as "not measured" — so a field that genuinely has no data should stay blank with an explanation rather than be filled with a zero — and any bespoke internal acronym used in a text answer needs its meaning spelled out in the response itself, since CDP's scoring reviewers only see what is in the questionnaire, not a company's internal shorthand. Getting both right the first time avoids having to explain a confusing prior-year answer when it copies forward.
The figures, and when we checked them
These numbers change by year or by notification. Each one shows the date we last verified it against the source — if that date looks old, check the source before relying on it.
Questions on this
Who is actually asking a US supplier to fill out a CDP questionnaire?
Not CDP directly in the first instance — a CDP Supply Chain member, which is a corporate buyer (CDP counts more than 270 of them, including companies like Walmart, Microsoft, and Nike) that has joined CDP's program specifically to request environmental disclosure from its own suppliers.
Does a small US supplier fill out the same questionnaire as a Fortune 500 company?
Usually not. CDP runs two versions: the full corporate questionnaire, mandatory above 1,000 employees or US$250 million in revenue, and a shorter SME questionnaire for organizations below that line. Most small and midsize suppliers answering a customer request use the SME version, which has fewer and simplified datapoints and no sector-specific questions.
What does the SME questionnaire actually cover?
Ten modules. Seven are shown to every discloser: an introduction, identification and management of environmental risks and opportunities, disclosure of those risks and opportunities, governance, business strategy, a consolidation-approach module setting the reporting boundary, and sign-off. Every discloser also sees the climate change module (emissions methodology, a Scope 1-2-3 inventory, breakdown by activity, energy activities, targets, and reduction initiatives). Forests and Water Security modules are opt-in and were unscored for 2026.
Is answering a CDP Supply Chain request different from answering CDP's general questionnaire?
The base questionnaire is the same, but a Supply Chain request adds a small set of extra questions shown only to organizations responding to a customer request — for example, additional detail tied to that customer's own reporting needs, or, where forests or water are in scope, questions on certified commodity volumes or the supplier's facility-level impact on that specific customer.
What happens if a first-year responder leaves a question blank?
A blank field is read as non-disclosure, not as a wrong answer — CDP's own guidance treats it that way rather than penalizing an honest gap the way it would treat an inaccurate figure. For numeric fields with no measurement available, the guidance is to leave the field blank and explain why in the accompanying comment field, rather than entering an estimate presented as measured data or entering zero (which CDP reads as "measured and zero").
Does a first-year SME response need verified emissions data to be accepted?
No. Third-party verification matters for reaching CDP's highest scoring levels — the Climate Change A List requires at least 70% of Scope 1, 2, and 3 emissions verified to a CDP-approved standard — but a response built on reasonable estimates from existing records, with the estimation basis explained, is a legitimate, scoreable first-year submission.
How does CDP's scoring scale work?
Four levels, low to high: Disclosure (D-/D) for being transparent about the basics; Awareness (C-/C) for demonstrating an evaluation of how the issue affects the business; Management (B-/B) for coordinated action; and Leadership (A-/A) for best-practice transparency and performance. A minimum score at each level is required before a response is assessed at the next.
Are SME climate change responses eligible for CDP's public A List?
No — SME scoring has historically run on a separate, non-comparable methodology and stayed private between the discloser and the requesting customer rather than being published. CDP introduced an SME-specific "A score" pathway for climate change starting in the 2026 cycle for SMEs demonstrating leading action, distinct from the full corporate A List.
When does the 2026 CDP disclosure cycle actually close?
CDP's scoring deadline — the last date for a response to be eligible for a CDP score — falls the week of September 14, 2026. A later window, the week of October 26, 2026, is the final deadline to submit an unscored response or amend one already submitted, after which the questionnaire closes for edits. A requesting customer may set its own earlier internal deadline separate from either date.
What should a first-year responder keep on file for next year?
The source records behind this year's numbers, not just the numbers: utility bills and fuel records used for Scope 1 and 2 estimates, the stated emissions methodology and any exclusions, documentation behind governance and strategy answers, and the submitted response itself. CDP's copy-forward feature auto-populates a returning discloser's prior answers, so keeping the backup makes next year's update faster and more consistent rather than a rebuild from scratch.
Primary sources
- CDP — SME Questionnaire 2026: Questionnaire Overview
- CDP — Supply Chain Membership
- CDP — What is a CDP score? (Scoring explainer)
- CDP — Disclosure 2026 (key dates and disclosure hub)
Last reviewed 2026-08-15. Statutes and schedules change — the sources above are authoritative, this page is orientation.
Want this handled rather than read about?
A scoping call decides what fits. We are a consulting firm — licensed work runs through partner CPA firms. Whoever signs and files stays yours.