26Q0031_Attachment A_C-SCRMQuestionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors responding to federal contract opportunities. The questionnaire is mandatory for offerors and must be completed by the vendor responsible for submitting the offer, or in the case of joint ventures, by either the JV or JV managing partner. Vendors are required to provide responses in the gray-shaded cells under the Vendor Response column for all item numbers in Sections 1-3. The government reserves the right to request documentation from offerors to validate the responses provided.

The questionnaire consists of three sections: Section 1 requests contact information including company name, primary point-of-contact name, job title, phone number, and email address; Section 2 addresses the Vendor Risk Management Plan with four yes/no questions regarding identification of supply chain threats, mapping of suppliers to threats, written SCRM requirements in supplier contracts, and verification of supplier compliance with SCRM requirements (with a note that vendors without suppliers should answer "Yes" to all questions); and Section 3 covers Physical and Personnel Security with three questions regarding employee background check policies, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat literacy training programs. Each item in Sections 2-3 includes references to relevant NIST SP 800-53 and ISO 27001 standards. The template also includes a scoring mechanism and tracks implementation status across various federal contract vehicles including Alliant, Alliant 2, STARS II, and VETS/VETS2 pools.