Attachment 2 Cybersecurity Supply Chain Risk Management Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed to assess vendor compliance with supply chain security requirements for federal contracts. The questionnaire is organized into three sections: Section 1 requires vendors to provide basic contact information including company name, primary point of contact details, job title, phone number, and email address. Section 2 focuses on Vendor Risk Management Plans and requires vendors to confirm whether their organization identifies key supply chain threats, maps suppliers to those threats, includes written SCRM requirements in supplier contracts, and verifies supplier compliance with SCRM requirements through contractual terms and conditions. Section 3 addresses Physical and Personnel Security, asking vendors to confirm whether they conduct background checks on employees as permitted by local law, have procedures to prevent tampering with Information and Communications Technology (ICT) equipment in supply chain inventory, and provide insider threat literacy training to personnel.

The questionnaire references NIST SP 800-53 controls for each requirement and is designed to be completed by the vendor submitting the offer or, in the case of joint ventures, by the JV managing partner. All responses must be provided in the gray-shaded Vendor Response column in column D for Items 1-10. The government reserves the right to request documentation to validate vendor responses. The template includes a scoring section for tracking responses as satisfied, partially satisfied, not satisfied, or not applicable, and is marked as Sensitive But Unclassified. This questionnaire serves as an appendix to solicitations and does not specify particular products or services but rather establishes security baseline requirements applicable to this Department of State Internet Data Service Consolidation solicitation at the U.S. Embassy in Jakarta.