Attachment 1 - C-SCRM Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to assess vendor compliance with supply chain security requirements for federal contract opportunities.

The questionnaire is organized into three sections: Section 1 requests basic vendor contact information including company name, primary point of contact, job title, phone number, and email address. Section 2 addresses the Vendor Risk Management Plan and requires vendors to confirm whether their organizations identify key supply chain threats, map suppliers to those threats, include written SCRM requirements in supplier contracts, and verify supplier compliance with SCRM requirements through contractual terms and conditions. Section 3 focuses on Physical and Personnel Security, requiring vendors to confirm implementation of background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat literacy training programs. Each question references corresponding NIST SP 800-53 and ISO 27001 standards for regulatory alignment. The template includes response columns for Yes/No/Not Applicable answers and incorporates scoring functionality to track vendor responses across multiple pools including Alliant, Alliant 2 Small Business, SB HUBZone, 8(a) STARS II, Women Owned SB, VETS/VETS2, and other designations. Vendors are instructed to complete only the gray-shaded response areas, and the Government reserves the right to request supporting documentation to validate submitted responses.