ATTACHMENT 1 CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE.xlsx
XLSX spreadsheet 37 KB Posted
- Solicitation number
- 19RP3825Q0008
- Issued by
-
Department of State
About this file
This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template that vendors must complete as part of their proposal submission for federal contracts. The questionnaire consists of three sections: Contact Information, Vendor Risk Management Plan, and Physical and Personnel Security. Vendors must provide company details and POC information in Section 1, answer questions about supply chain threat management and supplier requirements in Section 2, and address physical security, background checks, and insider threat training in Section 3.
The document includes instructions for completing both the C-SCRM questionnaire and a separate Software Producer Attestation worksheet for vendors providing critical software as defined by NIST. Vendors are advised that the government may request documentation to validate their responses, and if no critical software is being provided, they should mark the Software Producer Attestation section as N/A.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| INSTRUCTIONS |
| Version 1.0 |
| "C-SCRM QUESTIONNAIRE" EXCEL WORKSHEET COMPLETION INSTRUCTIONS: |
| ● This worksheet shall be completed by the vendor responsible for submitting the offer. References to "organization" refer to the offering entity. If the offering entity is a joint venture (JV), the response may come from either the JV or from the JV managing partner. |
| ● Provide the requested inputs in the gray shaded lines of the template under column D, Vendor Response, for all Items Numbers for Sections 1-3. Offerors are advised that the Government may request documentation from the Offerors to validate the responses provided. |
| "SOFTWARE PRODUCER ATTESTATION" EXCEL WORKSHEET COMPLETION INSTRUCTIONS: |
| ● NIST White Paper "Definition of Critical Software Under Executive Order (EO) 14028" dated October 13, 2021 defines critical software. Complete this worksheet by providing the requested inputs in the gray shaded lines of the template under columns C-D if your firm or your subcontractors are offering to supply critical software to the Government as part of your firm's offer. This worksheet must be completed by each software producer that will be supplying critical software as part of your firm's offer. If critical software is not being provided by your firm or subcontractors, please enter N/A in said gray shaded lines of the template. |
_x000D_&1#&"Calibri"&14&K000000 SBU - CONTRACTING AND ACQUISITIONS
C-SCRM QUESTIONNAIRE
| CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE | |||
| SECTION 1 - CONTACT INFORMATION | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| 1.1 | Enter the name of your company. | ||
| 1.2 | Enter the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the vendor inputs on this questionnaire. | ||
| 1.3 | Enter the job title of the primary POC. | ||
| 1.4 | Enter the phone number of the primary POC in the following format: (555) 555-5555 | ||
| 1.5 | Enter the e-mail address of the primary POC. | ||
| SECTION 2 VENDOR RISK MANAGEMENT PLAN | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | NIST SP 800-53 Reference |
| 2.1 | Does your organization identify its key supply chain threats? | IR-8, SR-7 | |
| 2.2 | Does your organization map key suppliers to your supply chain threats? | IR-8, SR-7 | |
| 2.3 | Do you have a policy or process to ensure that none of your suppliers or third-party components have an active exclusion record in the System for Award Management (https://sam.gov)? | SAM.gov | |
| 2.4 | Does your organization have written SCRM requirements in contracts with your key suppliers? | SA-4 | |
| 2.5 | Does your organization verify that your suppliers meet SCRM requirements through contractual terms and conditions? | SR-6 | |
| SECTION 3 PHYSICAL AND PERSONNEL SECURITY | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | NIST SP 800-53 Reference |
| 3.1 | Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates? | PE-2, PE-3 | |
| PS-3 | |||
| 3.2 | Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory? | SR-9 | |
| AC-1 | |||
| 3.3 | Do you provide literacy training on recognizing and reporting potential indicators of insider threat? | AT-2(2) |
_x000D_&1#&"Calibri"&14&K000000 SBU - CONTRACTING AND ACQUISITIONS
File details come from the government source that posted it. Updated .