26Q0027 - Attachment B C-SCRM Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template that vendors must complete as part of their submission for solicitation 19PM0726Q0027, an NEC-HVAC System Preventive Maintenance contract with the Department of State. The questionnaire is organized into three sections requiring vendor responses in designated fields. Section 1 requests contact information including company name, primary point-of-contact details, job title, phone number, and email address. Section 2, Vendor Risk Management Plan, contains four items requiring yes/no responses regarding the organization's identification of supply chain threats, mapping of suppliers to threats, inclusion of written SCRM requirements in supplier contracts, and verification that suppliers meet SCRM requirements through contractual terms. Section 3, Physical and Personnel Security, includes three items addressing background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and provision of insider threat literacy training to personnel.

The questionnaire references NIST SP 800-53 controls and ISO 27001 standards as applicable benchmarks for each requirement. Vendors are instructed that responses should be submitted by the offering entity or, in the case of joint ventures, by the JV or JV managing partner. The government reserves the right to request documentation to validate vendor responses. The template includes scoring mechanisms to track response status (Yes, No, Not Applicable, Alternative, Not Reviewed) and implementation status across multiple GWACS pools including Alliant, Alliant 2 Small Business, SB HUBZone, 8(a) STARS II, WOSB, and VETS/VETS2. Quotations for the underlying HVAC preventive maintenance contract were due by September 14, 2026, at 2:00 p.m. local time, with submission required electronically to pnmprocreq@state.gov in MS-Word, MS-Excel, or PDF format not exceeding 30MB.