47QFLA24R0013_RFP Attachment 10_GREAT Support SCRM Questionaire_2024 10 31.xlsx

Instructions

QUESTIONNAIRE COMPLETION INSTRUCTIONS:

Questionnaire

CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE

SECTION 2 VENDOR RISK MANAGEMENT PLAN NIST SP 800-53 Reference FAR Clause

2.1 Does your organization identify key suppliers as related to supply chain threats? IR-8: Incident Response Plan SR-7: Supply Chain Operations Security

Special Instruction: Provide supporting documentation containing the SCRM requirements used in contractual terms and conditions with your suppliers. SA-4: Acquisition Process SR-5: Acquisition Strategies, Tools, and Methods

2.5 Will your organization have a SCRM Plan that aligns with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations as required by the RFP?

Special Instruction: Provide supporting documentation containing a table of contents for your SCRM Plan (this can be either extracted separately from the current plan or created for purposes of this submission). SR-1: Policy and Procedures SR-2: Supply Chain Risk Management Plan

2.6 Does your organization confirm 100% of your suppliers of critical Information and Communication Technology (ICT) products and services are TAA/MIA compliant? FAR 52.225-1 Buy American FAR 52.225-5 Trade Agreements

SECTION 3 CYBERSECURITY NIST SP 800-53 Control FAR Clause

3.1 Does your organization have a policy or procedure to identify information consistent with its classification in accordance with applicable legal, regulatory, or internal sensitivity requirements (CUI, classified information, etc)? RA-2: Security Categorization MP-7: Media Use

3.2 Does your organization include contractual obligations to protect information and information systems handled by your suppliers? FAR 52.204-2 Security Requirements FAR 52.204-21 Basic Safeguarding of Covered Contractor Info. Systems

3.3 Does your organization have documented procedures to detect cybersecurity threats and attacks? IR-5: Incident Monitoring RA-5: Vulnerability Monitoring and Scanning

3.4 Does your organization have a documented procedure(s) to respond to and recover from cybersecurity threats and attacks? IR-8: Incident Response Plan RA-7: Risk Response

3.5 Does your organization have personnel designated to respond to cybersecurity incidents? IR-4: Incident Handling

SECTION 4 PHYSICAL AND PERSONNEL SECURITY NIST SP 800-53 Control FAR Clause

4.1 Does your organization have a documented Security Incident Response process covering physical security incidents? (e.g., potential intruder access, missing equipment, etc.)? PE-1: Policy and Procedures PS-1: Policy and Procedures

4.2 Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates?

Special Instruction: Provide supporting documentation containing the policy/policies for conducting background checks. If this is part of a larger document, the specific policy/policies related to background checks may be extracted separately. PE-2: Physical Access Authorizations PE-3: Physical Access Control PS-3: Personnel Screening

4.3 Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory? SR-9: Tamper Resistance and Detection AC-1: Policy and Procedures

4.4 Does your organization have procedures in place for the prevention and detection of insider threats? PM-12: Insider Threat Program

Data (HIDE)

Counts Not Reviewed Yes No Not Applicable Alternative 15 0 0 0 0

DL (HIDE)

image1.png