80JSC027R0004 CLDC-014 Attachment NASA C-SCRM Plan Questionnaire.xlsx
XLSX spreadsheet 32 KB Posted
- Attached to
- Commercial Low Earth Orbit (LEO) Destination Contract (CLDC) Request for Proposal Federal contract opportunity
- Solicitation number
- 80JSC027R0004
About this file
This document is a Cyber Supply Chain Risk Management (C-SCRM) Plan Questionnaire template provided by NASA Johnson Space Center for contractors responding to the Commercial Low Earth Orbit (LEO) Destination Contract (CLDC) solicitation 80JSC027R0004. The questionnaire is designed to help contractors demonstrate compliance with NASA's security requirements for unclassified information technology resources, aligning with NIST SP 800-161 guidance. Contractors may submit either a C-SCRM plan compliant with NIST SP 800-161 or complete this questionnaire; submission of both documents is not required. For existing contractors with compliant C-SCRM plans already in place, completion of the questionnaire is not necessary.
The questionnaire contains six primary sections requiring contractor responses: Section 1 collects corporate information including company details, contract identification, and primary points of contact; Section 2 addresses supply chain provenance by verifying supplier identification, ownership verification, and U.S. ownership of critical suppliers, along with implementation of NIST SP 800-171 basic security requirements; Section 3 requires documentation of supply chain management practices, threat identification, supplier mapping, contractual SCRM requirements, and supplier risk assessments; Section 4 addresses physical and personnel security including background check policies, equipment tampering prevention, and insider threat training; Section 5 covers supply chain integrity and resilience through documented processes for defect management, product lifecycle requirements, hardware and software recycling, and supply chain resilience; and Section 6 requires comprehensive hardware and software inventory documentation with detailed component information including manufacturer details, model numbers, country of origin, and physical location. The questionnaire provides extensive dropdown options for categorizing hardware components and software types to facilitate complete inventory reporting.
View the file
Other files for this federal contract opportunity
Show all 18
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions for CO's
| The DRD, "Security Requirements for Unclassified Information Technology Resources," requires a Cyber Supply Chain Risk Management (C-SCRM) Plan consistent with the recommended template in NIST SP 800-161. This document may be found at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf. Section 3.1 provides a summary of ICT SCRM controls and references additional guidance in Appendix E, "ICT SCRM Plan Template." (ICT = Information and Communications Technology) |
| This questionnaire aligns with the above referenced NIST template and is intended to make fulfilling this requirement easier. At this time, the Office of the Chief Information Officer (OCIO) questionnaire is optional. The OCIO will accept either a plan that complies with NIST SP 800-161 or this questionnaire. Contractors DO NOT need to submit both a plan and this questionnaire. If a contractor has an existing C-SCRM plan that complies with NIST SP 800-161, there is no requirement for the contractor to complete the OCIO questionnaire. |
| For questions, please email agency-dl-ocio-cys-cp-scrm@mail.nasa.gov and Cc agency-dl-ocio-rca@mail.nasa.gov. |
C-SCRM Questionnaire
| CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE | |||
| Background: | The C-SCRM plan addresses the management, implementation, and monitoring of C-SCRM controls and the development and sustainment of systems across the System Development Lifecycle (SDLC) to support mission and business functions. At NASA, the C-SCRM plan applies to all contractor information systems and components regardless of the FIPS199 impact. | ||
| Instructions: | To meet requirements of the DRD, complete the questionnaire, or ensure the C-SCRM plan contains the requested inputs for all Items Numbers in Sections 1-6. If the response is No, provide a summary explanation and risk mitigation plan. While related, each section is designed to address a different aspect of cyber supply chain risk management. This template is intended to gather an initial and consistent baseline. Additional follow-up questions or other documentation may be requested by the Government to support the answers provided herein. | ||
| SECTION 1 - CORPORATE INFORMATION | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| 1.1 | Provide the name and address of your company. | ||
| 1.2 | Identify the contract name and number. | ||
| 1.3 | Identify if your company is the prime or sub on the identified contract. | ||
| 1.4 | Provide the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the C-SCRM Plan inputs. | ||
| 1.5 | Provide the job title of the primary POC. | ||
| 1.6 | Provide the phone number of the primary POC in the following format: (555) 555-5555 | ||
| 1.7 | Provide the e-mail address of the primary POC. | ||
| 1.8 | Identify all subsidiaries, domestic and foreign. | ||
| 1.9 | Identify all statutory (e.g., FISMA), regulatory (e.g., FIPS) and external (e.g., NIST) authority(ies) governing your organizations C-SCRM Program. | ||
| SECTION 2 - SUPPLY CHAIN PROVENANCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 2.1 | Are suppliers of all covered articles, as defined in FAR 4.2301 identified? | ||
| 2.2 | Is the company ownership of suppliers of covered articles verified? | ||
| 2.3 | Are suppliers of critical covered articles under U.S. ownership? | ||
| 2.4 | If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor? | ||
| 2.5 | Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s). | ||
| 2.6 | Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800-171, Protecting Controlled Unclassified Information in Non-Federal Systems? | ||
| SECTION 3 - SUPPLY CHAIN MANAGEMENT AND SUPPLIER GOVERNANCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 3.1 | Does your organization identify its key supply chain threats? | ||
| 3.2 | Does your organization map key suppliers to your supply chain threats? | ||
| 3.3 | Are policies/processes in place to ensure timely notification of updated risk management information previously provided to the Contracting Officer and Contracting Officer's Representative? | ||
| 3.4 | Does your organization have written SCRM requirements in contracts with your key suppliers? | ||
| 3.5 | Is there a process to verify that suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers? | ||
| 3.6 | Does your organization perform supplier reviews in the form of supply chain risk assessments before entering into a contractual agreement to acquire covered articles? | ||
| 3.7 | Does your organization perform component reviews in the form of supply chain risk assessments before acquisitions and/or use of covered articles? | ||
| SECTION 4 - PHYSICAL AND PERSONNEL SECURITY | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 4.1 | Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates? | ||
| 4.2 | Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory? | ||
| 4.3 | Does your organization provide training on recognizing and reporting potential indicators of insider threat? | ||
| SECTION 5 - SUPPLY CHAIN INTEGRITY AND RESILIENCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 5.1 | Are documented processes in place for managing third-party products and component defects throughout their lifecycle? | |
| 5.2 | Are hardware/software products or services integrity and End of Life requirements passed down to second- and third-party suppliers? | |
| 5.3 | Are processes in place for addressing reuse and/or recycle of hardware products? | |
| 5.4 | Are processes in place for addressing reuse and/or recycle of software products? | |
| 5.5 | Is a formal process documented for ensuring supply chain resilience? | |
| SECTION 6 - INVENTORY | ||
| ITEM NO. | ITEM DESCRIPTION | |
| 6.1 | Identify all contractor-owned hardware in use in performance of the contract. | |
| NOTE - Hardware acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr] | Please complete "6.1 - Hardware Inventory" | |
| 6.2 | Identify all contractor-owned software, including open-source, in use in performance of the contract. | |
| NOTE - Software acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr] | Please complete "6.2 - Software Inventory" |
6.1 - Hardware Inventory Component / Product Type Original Equipment Manufacturer (OEM) Name OEM Unique Entity Identifier (UEI) Component / Product Description Model Number Serial Number Country of Origin NDAA Sec. 889 Part A Compliant Yes / No [only applicable for telecommunications and video surveillance equipment) Physical Location
5.2 - Software Inventory Software Type Software Publisher Name Software Publisher Unique Entity Identifier (UEI) Software Title Version Number Country of Origin Physical Location
Hardware Options
| Hardware Options |
| Camera |
| Camera (Digital) |
| Camera (Surveillance) |
| Graphics Processing Unit (GPU) |
| Hard Disk Drives (HDDs) |
| Hardware & Software |
| Hardware & Software (Internet of Things (IoT)) |
| Hardware & Software (Internet Service) |
| Hardware (General) |
| IaaS |
| IT Service |
| Laptop |
| Network Card |
| Operational Technology (OT) |
| Optical Drives (CD/DVD/Blu-ray) |
| Other - Cables |
| Other - Capacitors |
| Other - Power Supply |
| Other - Resistors |
| Other - Transistors |
| PaaS |
| Peripheral - 3D Printer |
| Peripheral - External HDD |
| Peripheral - Keyboard (wired) |
| Peripheral - Keyboard (wireless/Bluetooth) |
| Peripheral - MFD |
| Peripheral - Monitor |
| Peripheral - Mouse (wired) |
| Peripheral - Mouse (wireless/Bluetooth) |
| Peripheral - Printer |
| Peripheral - Speakers |
| Peripheral - Webcam |
| Printer |
| Random Access Memory (RAM) |
| Server |
| Smart Phone |
| SmartTV |
| Solid State Drives (SSDs) |
| Sound Card |
| Tablet |
| Telecommunications (Customer Premises Equipment) |
| Telecommunications (Public Switching Equipment) |
| Telecommunications (Transmission Equipment) |
| Telephone (PBX) |
| Telephone (VoIP) |
| Television |
| USB Storage Device (FIPS 140-2) |
| Workstation |
Software Options
| Software Options |
| Super Intelligence (SI) |
| Desktop |
| External Media |
| Machine Learning (ML) |
| Software |
| Software (Application) |
| Software (Backup/Recovery and Remote Storage) |
| Software (Communication) |
| Software (Container Environment) |
| Software (Development and Design) |
| Software (Device Driver) |
| Software (Embedded) |
| Software (Endpoint Security) |
| Software (Firmware) |
| Software (Freeware) |
| Software (Graphics) |
| Software (Hypervisor) |
| Software (ICAM) |
| Software (Multimedia and Streaming) |
| Software (Network Control) |
| Software (Network Monitoring and Configuration) |
| Software (Network Protection) |
| Software (Open Source) |
| Software (Operating System) |
| Software (Operational Monitoring and Analysis) |
| Software (Remote Access and Configuration Management) |
| Software (Remote Scanning) |
| Software (SaaS) |
| Software (Shareware) |
| Software (Utilities) |
| Software (Web Browser) |
File details come from the government source that posted it. Updated .