Attachment 5 C-SCRM Questionnaire.xlsx

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of their offer submission for the Mexican Criminal Courts Telepresence solicitation (19AQMM26Q0271) issued by the Department of State Office of Acquisition Management.

The questionnaire consists of three sections requiring vendor responses. Section 1 requests contact information including company name, primary point-of-contact details, job title, phone number, and email address. Section 2 addresses Vendor Risk Management Plan requirements aligned with NIST SP 800-53 standards, requiring vendors to confirm whether their organization identifies key supply chain threats, maps suppliers to those threats, maintains written SCRM requirements in supplier contracts, and verifies supplier compliance with SCRM requirements through contractual terms and conditions. Section 3 covers Physical and Personnel Security controls, asking vendors to confirm whether their organization conducts employee background checks as permitted by local jurisdiction, implements procedures to prevent tampering with ICT equipment in supply chain inventory, and provides insider threat recognition and reporting training to personnel. The questionnaire notes that all responses should be provided in the gray-shaded cells under the Vendor Response column, and the Government may request documentation to validate submitted responses. The template includes scoring and status tracking fields for Government use.