Evidence, findings, the security decision and the business decision, each with a name and a date, in one record per vendor.
The business asks for a vendor in plain words.
Evidence read first, then scored, then decided.
A dated dossier for every decision.