Attachment 1 - C-SCRM Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to assess vendor compliance with supply chain security practices. The questionnaire is intended to be completed by vendors submitting offers for the Closed Circuit Television (CCTV) and Accessories solicitation issued by the Department of State US Embassy Bangkok (Solicitation Number 19TH2026Q0079). The template requires vendors to provide contact information for a primary point of contact and to respond to questions across three sections: contact information, vendor risk management plans, and physical and personnel security practices.

Section 1 requests basic company and contact details including company name, primary point of contact name, job title, phone number, and email address. Section 2 addresses the vendor's risk management plan and requires yes/no responses regarding supply chain threat identification, mapping of key suppliers to threats, written SCRM requirements in supplier contracts, and verification of supplier compliance with SCRM requirements; vendors without suppliers may answer "Yes" to all items. Section 3 covers physical and personnel security, asking whether the organization conducts background checks on employees, implements procedures to prevent tampering with ICT equipment in inventory, and provides insider threat recognition and reporting training. The questionnaire references NIST SP 800-53 and ISO 27001 standards as compliance frameworks and includes a scoring mechanism to track responses as "Yes," "No," "Not Applicable," or "Alternative," though specific scoring methodology is not detailed in the template.