Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to collect vendor compliance information for the solicitation 19TH2026Q0064 (Software License Subscriptions Renewal and Support Services) issued by the Department of State US Embassy Bangkok.

The questionnaire requires vendors to complete three sections: Section 1 requests contact information including company name, primary point-of-contact name, job title, phone number, and email address; Section 2 addresses vendor risk management practices, requiring yes/no responses regarding identification of supply chain threats, mapping of key suppliers to threats, written SCRM requirements in supplier contracts, and verification of supplier compliance with SCRM requirements; Section 3 covers physical and personnel security practices, including background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat literacy training programs. The template references NIST SP 800-53 security control standards for each questionnaire item and includes scoring mechanisms for tracking responses. Offerors are advised that the Government may request supporting documentation to validate responses. This questionnaire is mandatory for vendors responding to the RFQ with quotations due by August 11, 2026 at 12:00 PM Bangkok local time, and vendors must be registered in the System for Award Management (SAM) database prior to submission.