ATTACHMENT B - C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete and submit as part of their offer for federal contract opportunities. The questionnaire is mandatory for all offering entities, including joint ventures, with responses provided by the vendor or JV managing partner in designated gray-shaded cells under the "Vendor Response" column.

The questionnaire consists of three sections. Section 1 requires contact information including company name, primary point-of-contact details (name, job title, phone number in (555) 555-5555 format, and email address). Section 2 addresses Vendor Risk Management Plans with four yes/no questions aligned to NIST SP 800-53 standards, covering whether the organization identifies key supply chain threats, maps suppliers to threats, has written SCRM requirements in supplier contracts, and verifies supplier compliance through contractual terms. Section 3 focuses on Physical and Personnel Security with three yes/no questions regarding background check policies for employees, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat recognition and reporting literacy training programs. The template includes a scoring mechanism with fields for tracking response status (Yes, No, Not Applicable, Alternative, Not Reviewed) and counts by response type, though the actual scoring formulas contain error references. The document also includes implementation status tracking for GWACS pools (Alliant, Alliant 2 Small Business, Alliant SB HUBZone, STARS II Women Owned SB, VETS/VETS2) with satisfaction indicators. The Government reserves the right to request documentation from offerors to validate responses provided.