Attachment 1 C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors responding to federal contract opportunities. The questionnaire is completed by the offering entity or joint venture managing partner and requests vendor responses in Section 1 contact information fields, including company name, primary point-of-contact name, job title, phone number, and email address. Section 2 addresses the vendor's risk management plan with four items covering supply chain threat identification, supplier mapping to threats, written SCRM requirements in supplier contracts, and supplier verification procedures for SCRM compliance; vendors without suppliers should answer "Yes" to these items. Section 3 covers physical and personnel security with three items assessing employee background check policies, procedures to prevent tampering of information and communications technology equipment in supply chain inventory, and insider threat literacy training provisions. Each questionnaire item references corresponding NIST SP 800-53 security controls or ISO 27001 standards. The document includes scoring sections for tracking responses across Yes, No, Not Applicable, and Alternative categories, as well as GWACS pool implementation status options including Alliant, Alliant 2, Small Business, HUBZone, 8(a) STARS II, WOSB, VETS, and other designations. Offerors should be advised that the Government may request documentation to validate responses provided.