Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors responding to federal contract opportunities to complete and submit as part of their proposal package.

The questionnaire consists of three sections requiring vendor responses: Section 1 requests basic contact information including company name, primary point-of-contact details, job title, phone number, and email address. Section 2 addresses the vendor's risk management plan and requires yes/no responses to questions about identifying key supply chain threats, mapping suppliers to those threats, establishing written SCRM requirements in supplier contracts, and verifying supplier compliance with SCRM requirements. Section 3 focuses on physical and personnel security practices, asking whether the organization conducts background checks on employees, has procedures to prevent tampering of ICT equipment in supply chain inventory, and provides insider threat literacy training. All responses must be entered in the gray-shaded cells under the "Vendor Response" column. The questionnaire references relevant NIST SP 800-53 security standards and ISO 27001 compliance frameworks for each item. The template includes a scoring section and tracks implementation status across various federal contracting vehicles including Alliant, Alliant 2, Small Business pools, HUBZone, 8(a) STARS II, WOSB, and VETS/VETS2 programs. Offerors are advised that the government may request supporting documentation to validate responses provided.