Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of their proposal submission for federal contract opportunities. The questionnaire is structured in three sections requiring vendor responses in designated gray-shaded cells under column D.

Section 1 collects basic contact information including company name, primary point-of-contact name, job title, phone number, and email address. Section 2 addresses Vendor Risk Management Plan requirements, asking vendors to confirm whether their organization identifies key supply chain threats, maps suppliers to those threats, includes written SCRM requirements in supplier contracts, and verifies supplier compliance with SCRM requirements through contractual terms—with a notation that vendors without suppliers should answer "Yes" to all questions. Section 3 covers Physical and Personnel Security, requiring vendors to confirm policies for employee background checks as permitted by their operating country, procedures to prevent tampering of ICT equipment in supply chain inventory, and provision of insider threat literacy training. The template includes references to applicable NIST SP 800-53 security control standards for each requirement and contains sections for scoring responses and tracking implementation status across various GSA schedule pools (Alliant, Alliant 2, Small Business, HUBZone, 8(a) STARS II, and WOSB). The government may request supporting documentation to validate vendor responses.