Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of their offer submission for the Software License Subscription Renewal and Support Services solicitation (19TH2026Q0057) issued by the Department of State US Embassy Bangkok. The questionnaire requires vendors to provide contact information for their primary point-of-contact, including name, title, phone number, and email address, and to respond to questions addressing three core areas: vendor risk management practices, supplier threat identification and mapping, contractual SCRM requirements, and verification mechanisms. The questionnaire also addresses physical and personnel security controls, including background check policies, information and communications technology equipment tampering prevention procedures, and insider threat literacy training programs. Responses must be provided in designated gray-shaded cells within the template, with the government reserving the right to request documentation to validate vendor responses. The questionnaire references NIST SP 800-53 security controls for each question and includes implementation status tracking across multiple General Services Administration contract vehicles including Alliant, Alliant 2, Small Business, HUBZone, 8(a) STARS II, Women Owned Small Business, and VETS programs.