Attachment 1 C-SCRM Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of their proposal submission. The questionnaire requires vendors to provide contact information for their primary point of contact, including name, job title, phone number, and email address. Vendors must respond to questions across three sections: vendor risk management plan, physical and personnel security, and supply chain threat identification and mitigation practices. The template includes references to NIST SP 800-53 and ISO 27001 standards for each question, with response options typically including Yes, No, Not Applicable, and Alternative answers. The questionnaire also contains a scoring mechanism and implementation status tracker for GWACS pools, including Alliant, Alliant 2 Small Business, SB HUBZone, 8(a) STARS II, Women-Owned Small Business, and VETS/VETS2 programs.

The questionnaire addresses critical security and risk management practices, including whether organizations identify supply chain threats, map suppliers to those threats, establish written SCRM requirements in supplier contracts, and verify supplier compliance. Additionally, vendors must confirm policies regarding employee background checks, procedures to prevent tampering with ICT equipment in supply chain inventory, and training programs for recognizing insider threats. The template is intended for completion by the offering entity or, in the case of joint ventures, by the JV or JV managing partner, with the government reserving the right to request supporting documentation to validate vendor responses.