EcoVadis and Customer Security Questionnaires: What US Manufacturers Need to Know

It is a paid service. The rated company buys an annual subscription, and the fee depends on company size and the plan chosen (EcoVadis plans and pricing).

It is not a certification and not a government requirement. EcoVadis says its medals and badges "should not be understood as certification or an endorsement," and a rating is valid for 12 months from publication (EcoVadis methodology).

Scores fall into five bands: Insufficient (0 to 24), Partial (25 to 44), Good (45 to 64), Advanced (65 to 84) and Outstanding (85 to 100) (EcoVadis methodology).

Key takeaway: EcoVadis is a customer-driven rating. Treat it like a customer audit, not like a license to operate.

Electronics and technology buyers often ask suppliers to follow the Responsible Business Alliance (RBA) Code of Conduct instead of, or as well as, a rating. Version 8.0 of the code covers labor, health and safety, environment, ethics and management systems, and asks companies that adopt it to require at least their next-tier suppliers to acknowledge and implement it. Its ethics section includes privacy: complying with privacy and information security laws whenever personal information is collected, stored, processed and shared (RBA Code of Conduct).

Many large customers also send their own security questionnaire asking how you protect their drawings, data and accounts. The same kind of evidence answers most of them: a written policy, proof that it is followed, and records.

In-scope companies take a risk-based approach and give priority to impacts linked to their direct business partners. They should ask business partners with fewer than 5,000 employees for information only as a last resort, and keep any request "targeted, reasonable and proportionate" (Clifford Chance).

So for a typical US supplier the pressure does not come from the law directly. It comes from customers, some in scope and some simply wanting the assurance, who write ratings and codes of conduct into their supplier requirements and contracts.

Key takeaway: Answer to your customer and your contract, not to headlines about EU law. If a contract cites the CSDDD, check with your attorney.

Expectations are lighter for smaller companies: EcoVadis scores extra small (1 to 25 employees) and small (26 to 99 employees) companies with adjusted formulas (EcoVadis methodology).

The practical lesson: an undated policy written the week before the assessment, with no owner and no proof it is followed, earns little. A shorter policy that is dated, approved and backed by records earns more.

• Formalized: an official document that is part of how you actually run the business.
• Complete: the whole document, not an excerpt.
• Credible: clearly identifiable as your company's.
• Dated: it shows an issue or review date.
• Readable: PDF, Word, Excel, JPG or PNG under 30 MB, with real text rather than a scanned photo.

For old equipment, the EPA points businesses to electronics recyclers certified to the R2 or e-Stewards standards, both of which require third-party audits (EPA). Ask for a certificate of recycling and, for drives, a record of data destruction that follows NIST SP 800-88, the federal guide to wiping and destroying storage media (NIST SP 800-88 Rev. 2).

In North Carolina, discarded computer equipment is banned from landfills, and lithium-ion batteries join the ban on December 1, 2026 (N.C. Gen. Stat. 130A-309.10).

If you do not have a written information security policy yet, our free Information Security Policy generator gives you a dated, plain-English starting point.

Preferred Data covers the IT and data security side: the policies, the controls behind them, the records and a documented process for retiring equipment. We do not run HR, labor, anti-corruption or environmental programs, and we will tell you when a question belongs with someone else.

Key takeaway: Split the questionnaire by owner on day one. It is the fastest way to finish.