Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to assess vendor security practices and supply chain risk management capabilities. The questionnaire is required as part of the solicitation response for Software License Subscriptions Renewal (Solicitation 19TH2026Q0018) issued by the Department of State US Embassy Bangkok.

The questionnaire consists of three sections that vendors must complete: Section 1 requires contact information including company name, primary point of contact, job title, phone number, and email address; Section 2 addresses Vendor Risk Management Plan with four yes/no questions regarding identification of supply chain threats, mapping of suppliers to threats, written SCRM requirements in supplier contracts, and verification of supplier compliance with SCRM requirements (with notes that vendors without suppliers should answer "Yes" to all items); and Section 3 covers Physical and Personnel Security with three yes/no questions addressing background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and provision of insider threat literacy training. The template includes references to applicable NIST SP 800-53 security controls for each question and contains scoring mechanisms, though specific implementation guidance is not detailed in the questionnaire itself. Vendors must submit completed responses in the gray-shaded vendor response column for all items in Sections 1-3, and the government reserves the right to request documentation to validate responses.