AMD 2 Att 4 SCRA Questionnaire.docx

Attachment 4 - SCRA Questionnaire

On behalf of the Office of Satellite and Product Operations (OSPO) and the Cyber Security Division (CSD) at NOAA, we are requiring the completion of the attached "Vendor Questionnaire" no later than May 23, 2022 at 12 PM EDT.

The questionnaire is a part of our preliminary IT acquisition requirements for Information and Communications Technology (ICT) vendors being considered for award. If you have any questions or concerns please contact Jame Chang at jame.chang@noaa.gov and Cherron Bennett-Pettus at cherron.bennett-pettus@noaa.gov directly.

Supply Chain Risk Assessment Information:

The offeror/contractor shall submit the following information with its proposal or prior to award at the Government's request:

1. Business name (include DBA) and identity, include that of each parent and/or subsidiary corporate entities.

2. Provide the identity of any proposed subcontractors, (including third party vendors suppliers, distributors, and manufacturers) involved in its supply chain.

3. Provide the identity of any telecommunications equipment or video surveillance services, suppliers, distributors and manufacturers that are affiliates or subsidiaries of the following companies within your supply chain: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company or Dahua Technology Company (or any subsidiary or affiliate of such entities).

4. Describe the degree of any foreign ownership in or control of the entities identified under (1) and (2) (primary, parent, subsidiary, suppliers, distributors and manufacturers).

5. List the names and dates of birth of the offeror's/contractor's corporate officers identified under (1) and (2), including this information for subcontractors (including but not limited to suppliers, distributors, and manufacturers).

6. Verify whether the offerer/contractor and subcontractors (including but not limited to suppliers, distributors, and manufacturers) maintain a:

i. Formal security program that includes personnel security;

ii. Information security program;

iii. Physical security program;

iv. Cyber security program; and

v. Supply chain risk management program.

7. Provide the names and locations of each facility where any information system, IT hardware and/or software to be delivered under the contract or task order was designed, manufactured, packaged and stored prior to distribution.

8. Whether a separation of duties exists during the development process of any information system, IT hardware and/or software to be delivered under the contract or task order.

9. Describe the means and methods for delivering any information system, IT hardware and/or software to be delivered under the contract or task order, including the name(s) of any entity responsible for transport or storage. This information should address whether the information system, IT hardware and/or software will be direct-shipped to the Department.

10. Whether the proposed information system, IT hardware and/or software includes a service agreement required by the contract or task order, and, if so, the identity of the contractor/subcontractor(s) who will provide this follow-on service, and how the services will be delivered/deployed (e.g., via on-site service? Remotely via the internet?)

11. Provide the identity of the business entity that will provide disposal services of any information system, IT hardware and/or software required by the contract or task order.

Attachment 4 - SCRA Questionnaire Page 2 of 3