Attachment 1 - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of their offer submission. The questionnaire is intended for the vendor entity or Joint Venture managing partner to provide responses in the designated gray-shaded cells under Column D (Vendor Response) for all items in Sections 1-3.

Section 1 requires basic contact information including the company name, primary point-of-contact name, job title, phone number in the format (555) 555-5555, and email address. Section 2 addresses Vendor Risk Management Plan requirements and asks vendors to confirm whether their organization identifies key supply chain threats, maps key suppliers to those threats, maintains written SCRM requirements in supplier contracts, and verifies supplier compliance with SCRM requirements through contractual terms and conditions, with references to NIST SP 800-53 standards (IR-8, SR-7, SA-4, and SR-6). Section 3 covers Physical and Personnel Security, requiring vendors to confirm whether they conduct background checks on employees as permitted by their country of operation, have procedures in place to prevent tampering of ICT equipment in supply chain inventory, and provide insider threat literacy training to employees. The template includes a scoring mechanism with status indicators for "Not Reviewed," "Yes," "No," "Not Applicable," and "Alternative" responses. The government may request supporting documentation to validate vendor responses. This is a template only and does not address specific products or services required for the cellphone services solicitation (19WA8026Q0019) for CDC services at the U.S. Embassy Windhoek.