J-27_SCRM Worksheet v3.pdf

J-27 Supply Chain Risk Management (SCRM) Checklist

Supply Chain Risk Management Checklist Program Name: U.S. Department of State Evolve IDIQ

Date of Submission:

Name of Submitter:

Company Name:

Instructions: Submitters should seek to answer “Yes” or “No” to each question below but when a question is not applicable, mark the “N/A” block. If the submitter cannot answer “Yes” but would like to submit an alternative response, select “Alt” and provide a narrative answer in the table on the last page (Table 2). Examples would include progress toward meeting the condition described in a particular question or adoption of an equivalent but different standard.

# Topic Question Yes No N/A Alt

General

1 Do you have policies and procedures that ensure timely notification of updated risk management information, including those of your suppliers, to customers?

2 Do you ensure that you are not sourcing assets on a banned list, both for products and services (e.g., ITAR, NDAA Section 889)?

Products and Services

3 Do you provide a bill of materials (BOM) for your products, services, and components which includes all logic-bearing (e.g., readable/writable/programmable) hardware, firmware, and software?

4 Upon request, are you able to provide your BOM including all logic-bearing hardware, firmware, and software?

5 Do you track changes in your products, services, and components and update applicable BOMs with those changes?

6 If violations of contractual quality standards, SCRM requirements or SCRM-related incidents in your supply chain occur, do you ensure and monitor remediation activities?

7 Do you have policies for your suppliers to notify you when there are changes to their subcontractors or their offerings (components, products, services, or support activities)?

8 For hardware components included in the product offering, do you only buy from original equipment manufacturers or licensed resellers?

9 Does your organization document and communicate security control requirements for your hardware, software, or solution offering?

10 Does your organization protect all forms of code from unauthorized access and tampering, including patch updates?

11 Does your organization provide a mechanism for verifying software release integrity, including patch updates for your software product offering?

12 Does your organization verify that third-party software provides required security requirements/controls?

13 Do you have requirements that all items being shipped have tamper-evident packaging?

14 Do you have processes in place to prevent counterfeit parts from entering your supply chain?

15 Do you have a documented Quality Management System (QMS) for your ICT supply chain operation based on an industry standard or framework?

16 Do you have an organization-wide strategy for managing end-to-end supply chain risks (from development, acquisition, life cycle support, and disposal of systems, system components, and to system services)?

17 Do you have a policy or process to ensure that none of your suppliers or third-party components are on any banned list?

Internal Controls

18 Does your organization maintain and manage a security incident reporting and response program for products you develop, manufacture, integrate, or sell?

19 Do you have a documented incident response process and a dedicated incident response team (CSIRT -Computer Security Incident Response Team)?

20 Do you have a defined governance scope for asset management, including line of business technology, facilities, devices, and all other data-generating hardware (like

Internet of Things devices)?

21 Do you have an ICT asset management program approved by company leader(s) that ensures your development environment(s) are updated with current versions and patches?

22 Do you have network access control policies and procedures in place for your information systems that are aligned with industry best practices, standards, or control frameworks?

23 Do you have defined and documented incident detection practices that outline which actions should be taken in the case of an information security or cybersecurity event?

24 Do you have policies for conducting background checks of your employees as permitted by the country in which you operate?

25 Do you have policies for conducting background checks for your suppliers or subcontractors, as permitted by the country in which you operate?

26 Are all personnel trained in security best practices? This includes, but is not limited to, insider threats, access control, and data protection.

27 Do you have processes or procedures to recover full functionality, including integrity verification, following a major cybersecurity incident?

28 Do you have documented security policies and procedures that address the control of physical access to cyber assets (network devices, data facilities, patch panels, industrial control systems, programmable logic, etc.)?

29 Do you have a documented Security Incident Response process covering physical security incidents? (e.g., potential intruder access, missing equipment, etc.)

Standards

30 Do you have controls fully aligned to NIST SP 800-161 Revision 1, Supply Chain

Risk Management Practices for Federal Information Systems and Organization?

31 Do you flow down NIST SP 800-161 R1 requirements including proof requirements to your suppliers?

32 Are you able to provide evidence of relevant and current third-party assessments or certification for supply chain risk management, such as ANSI/ASIS SCRM 1.2014, ISO 28000:2007, ISO 31000, ISO 20243, ITA SCS9001, etc.

33 Do you have a Cybersecurity Maturity Model Certification (CMMC) level 2 accreditation or are you actively seeking/preparing for it?

34 Do you hold a valid information security/cybersecurity third-party attestation or certification? (e.g., ISO 27001, SOC 2 Type 2, etc.)

35 Do you follow operational standards or frameworks for managing Information

Security/Cyber security? (e.g., NIST CSF 1.1, NIST 800-37, Rev. 2, NIST SP 800-

53, ISO IEC 27001, ISO 20243, ISO 27036,SAE AS649)

36 Do you follow operational standards or frameworks for developing secure software

(to include firmware)? (e.g., NIST SP 800-218, Microsoft SDF, OWASP etc.)

Table 1

For all answers that are answered as “Alt” provide the alternate answer in the format below:

Question

Topic Response

Table 2