Attachment 2 C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) questionnaire template designed for vendors to complete as part of their proposal submission.

The questionnaire consists of three sections that vendors must complete by providing responses in designated gray-shaded cells. Section 1 requires contact information including company name, primary point-of-contact name, job title, phone number, and email address. Section 2 addresses vendor risk management practices and requires yes/no responses regarding the organization's identification of key supply chain threats, mapping of suppliers to threats, inclusion of written SCRM requirements in supplier contracts, and verification of supplier compliance with SCRM requirements. Section 3 focuses on physical and personnel security, requiring responses on background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and provision of insider threat literacy training. Each item references applicable NIST SP 800-53 security controls. The questionnaire includes administrative sections for scoring and tracking responses across implementation status categories (Satisfied, Partially Satisfied, Not Satisfied, Not Applicable, TBD, Not Reviewed) and GWACS pool designations (Alliant, Alliant 2, Small Business, HUBZone, 8(a), STARS II, WOSB, VETS, and VETS2). Vendors should note that the Government may request documentation to validate submitted responses.