Vista resources / Downloadable kit
PQC supplier response tracker
After a supplier answers your PQC questionnaire, record the claim and its supporting evidence separately. Give each unresolved question an owner and due date so it can be reviewed before procurement or rollout.
The working edition / Excel workbook
Keep the follow-up moving.
Track supplier responses, evidence, decision owners and due dates. Overdue items and unresolved questions stay visible.
Response tracker · Worked example · Due-date formulas · Dashboard · Official checks
Download Excel workbook ↓What’s inside & how to use it
Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.
On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.
Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.
How to run a supplier review
- Create a row for each product, version, deployment, and question that affects your migration.
- Send the vendor questionnaire and record who owns the response.
- Link evidence and record when a reviewer checked it. A supplier response date and an evidence review date are different facts.
- Assign unresolved issues a next action and due date. Preserve the original claim when later answers change it.
- Review open items before procurement, deployment, and material version changes.
Suggested review states
On a narrow screen, scroll the table horizontally to read every column.
| State | Use when | Next action |
|---|---|---|
| Awaiting response | The supplier has not answered the scoped question. | Follow up with the named contact. |
| Awaiting evidence | An answer exists but supporting material is missing. | Request the exact reference or test. |
| Evidence reviewed | A reviewer checked support for the scoped claim. | Record limitations and decide whether a pilot is warranted. |
| Not applicable | The function is outside the agreed scope. | Record the rationale and reviewer. |
| Exception accepted | An accountable decision-maker accepts a documented gap. | Set an expiry or review date. |
Keep the decision separate from the claim
A documented feature can still be unsuitable for your environment. Keep compatibility, operational impact, procurement conditions, and accepted exceptions alongside the evidence. “Evidence reviewed” is not equivalent to government approval or readiness to deploy.
The CSV opens in common spreadsheet tools. Store completed files in approved internal storage; they may contain sensitive architecture and commercial information. No completed responses are submitted to Vista. The example uses a fictional supplier and is not a product assessment.
Continue in Vista
Keep follow-up work beside the affected assets
Use the tracker for supplier correspondence. For an actionable gap, identify the affected Vista assets or findings and create a ticket in Remediation → Queue. Assign an owner and due date, record the supplier evidence reference, and group the tickets in a migration plan. Revisit the findings after your team makes the change.
Core includes the queue, plans and progress view. You can manage ownership and follow-through in Vista while retaining the original supplier responses in your approved document storage.