26Q0029 - Attachment B C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to assess vendor compliance with supply chain security requirements for federal contract opportunities. The questionnaire is part of solicitation 19PM0726Q0029 for a Fuel Monitoring System managed by the Department of State's Procurement Management and Support Center (PMSC). Vendors submitting offers are required to complete all sections of this attachment and provide responses in the designated gray-shaded cells under the "Vendor Response" column.

The questionnaire contains three primary sections. Section 1 requires vendors to provide contact information including company name, primary point-of-contact details, job title, phone number, and email address. Section 2 addresses Vendor Risk Management Plans and requires vendors to confirm whether they identify key supply chain threats, map suppliers to those threats, establish written SCRM requirements in supplier contracts, and verify supplier compliance with SCRM requirements through contractual terms (vendors without suppliers answer "Yes" to all items). Section 3 covers Physical and Personnel Security requirements, asking vendors to confirm implementation of background check policies, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat literacy training programs for employees. All responses are aligned with NIST SP 800-53 security controls and ISO 27001 standards. The template includes a scoring mechanism and a GWACS Pool Implementation Status section identifying various small business contract vehicle pools (Alliant, HUBZone, 8(a) STARS II, VETS, and WOSB).