19GE5027Q0007_Attachment_D_CSCRM_Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors submitting offers on solicitation 19GE5027Q0007 for Internet services supporting the International Trade Administration (ITA) at U.S. Mission China offices. The questionnaire requires vendors to provide contact information for their primary point of contact and then respond to structured questions across three sections aligned with NIST SP 800-53 and ISO 27001 standards. Section 1 captures vendor company name, POC details, job title, phone number, and email address. Section 2 addresses vendor risk management practices, requiring vendors to confirm whether their organization identifies key supply chain threats, maps suppliers to threats, maintains written SCRM requirements in supplier contracts, and verifies supplier compliance with SCRM requirements; notably, vendors without suppliers may answer "Yes" to these items. Section 3 focuses on physical and personnel security, asking vendors to confirm they conduct background checks on employees as permitted by local law, implement procedures to prevent tampering of ICT equipment in supply chain inventory, and provide insider threat literacy training to personnel.

The questionnaire is presented as a template with gray-shaded response areas in column D where vendors must provide answers, with the government reserving the right to request supporting documentation to validate responses. The file includes a scoring section and implementation status indicators related to various General Services Administration (GSA) contract vehicles, including Alliant, Alliant 2, Small Business (SB) Pool, SB HUBZone Pool, 8(a) STARS II, WOSB Pool, and VETS/VETS2 programs, though these appear to be reference categories rather than established set-asides for this specific solicitation.