Attachment E.1-Attachment NASA C-SCRM Plan.pdf

RFP # 80GSFC27R0015

ATTACHMENT E.1

ATTACHMENT NASA C-SCRM PLAN QUESTIONNAIRE

AUGUST 2026

CONTRACT TBD

The DRD, "Security Requirements for Unclassified Information Technology Resources," requires a Cyber Supply Chain Risk Management (C- SCRM) Plan consistent with the recommended template in NIST SP 800-161. This document may be found at: This document may be found at: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final. Appendix A provides C- SCRM security controls, Appendix B a C-SCRM control summary and Appendix D C-SCRM Templates.

This questionnaire aligns with the above referenced NIST template and is intended to make fulfilling this requirement easier. At this time, the Office of the Chief Information Officer (OCIO) questionnaire is optional. The OCIO will accept either a plan that complies with NIST SP 800- 161 or this questionnaire. Contractors DO NOT need to submit both a plan and this questionnaire. If a contractor has an existing C-SCRM plan that complies with NIST SP 800-161, there is no requirement for the contractor to complete the OCIO questionnaire.

For questions, please email agency-dl-ocio-cys-cp-scrm@mail.nasa.gov and Cc agency-dl-ocio-rca@mail.nasa.gov.

Instructions for CO's 1 of 10

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1.5 Provide the job title of the primary POC.

1.6 Provide the phone number of the primary POC in the following format:

(555) 555-5555

1.7 Provide the e-mail address of the primary POC.

1.8 Identify all subsidiaries, domestic and foreign.

1.9 Identify all statutory (e.g., FISMA), regulatory (e.g., FIPS) and external (e.g., NIST) authority(ies) governing your organizations C-SCRM Program.

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

2.1 Are suppliers of all covered articles, as defined in FAR 4.2301 identified?

2.2 Is the company ownership of suppliers of covered articles verified?

2.3 Are suppliers of critical covered articles under U.S. ownership?

2.4 If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor?

2.5 Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s).

2.6

Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800- 171, Protecting Controlled Unclassified Information in Non-Federal Systems?

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

SECTION 3 - SUPPLY CHAIN MANAGEMENT AND SUPPLIER GOVERNANCE

SECTION 2 - SUPPLY CHAIN PROVENANCE

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 3 of 10

3.1 Does your organization identify its key supply chain threats?

3.2 Does your organization map key suppliers to your supply chain threats?

3.3 Are policies/processes in place to ensure timely notification of updated risk management information previously provided to the Contracting Officer and Contracting Officer's Representative?

3.4 Does your organization have written SCRM requirements in contracts with your key suppliers?

3.5 Is there a process to verify that suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers?

3.6 Does your organization perform supplier reviews in the form of supply chain risk assessments before entering into a contractual agreement to acquire covered articles?

3.7 Does your organization perform component reviews in the form of supply chain risk assessments before acquisitions and/or use of covered articles?

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

4.1 Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates?

4.2 Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory?

4.3 Does your organization provide training on recognizing and reporting potential indicators of insider threat?

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

SECTION 4 - PHYSICAL AND PERSONNEL SECURITY

SECTION 5 - SUPPLY CHAIN INTEGRITY AND RESILIENCE

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 4 of 10

5.1 Are documented processes in place for managing third-party products and component defects throughout their lifecycle?

5.2 Are hardware/software products or services integrity and End of Life requirements passed down to second- and third-party suppliers?

5.3 Are processes in place for addressing reuse and/or recycle of hardware products?

5.4 Are processes in place for addressing reuse and/or recycle of software products?

5.5 Is a formal process documented for ensuring supply chain resilience?

ITEM NO. ITEM DESCRIPTION

6.1

Identify all contractor-owned hardware in use in performance of the contract.

NOTE - Hardware acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page

- Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr]

6.2

Identify all contractor-owned software, including open-source, in use in performance of the contract.

NOTE - Software acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr]

Please complete "6.1 - Hardware Inventory"

Please complete "6.2 - Software Inventory"

SECTION 6 - INVENTORY

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 5 of 10

Component / Product Type

Original Equipment Manufacturer (OEM)

Name

OEM Unique Entity Identifier

(UEI)

Component / Product

Description Model Number Serial Number Country of

Origin

NDAA Sec. 889 Part A Compliant

Yes / No [only applicable for telecommunications and video surveillance equipment)

Physical Location

6.1 - Hardware Inventory CONTROLLED UNCLASSIFIED INFORMATION (CUI) 6 of 10

Software Type Software Publisher

Name

Software Publisher Unique Entity Identifier

(UEI) Software Title Version Number

Country of Origin

Physical Location

6.2 - Software Inventory CONTROLLED UNCLASSIFIED INFORMATION (CUI) 7 of 10

Hardware Options Camera Camera (Digital) Camera (Surveillance) Graphics Processing Unit (GPU) Hard Disk Drives (HDDs) Hardware & Software Hardware & Software (Internet of Things (IoT)) Hardware & Software (Internet Service) Hardware (General) IaaS IT Service Laptop Network Card Operational Technology (OT) Optical Drives (CD/DVD/Blu-ray) Other - Cables Other - Capacitors Other - Power Supply Other - Resistors Other - Transistors PaaS Peripheral - 3D Printer Peripheral - External HDD Peripheral - Keyboard (wired) Peripheral - Keyboard (wireless/Bluetooth) Peripheral - MFD Peripheral - Monitor Peripheral - Mouse (wired) Peripheral - Mouse (wireless/Bluetooth) Peripheral - Printer Peripheral - Speakers Peripheral - Webcam Printer Random Access Memory (RAM) Server Smart Phone SmartTV Solid State Drives (SSDs) Sound Card Tablet Telecommunications (Customer Premises Equipment) Telecommunications (Public Switching Equipment) Telecommunications (Transmission Equipment)

Telephone (PBX) Telephone (VoIP) Television USB Storage Device (FIPS 140-2) Workstation

Software Options Artificial Intelligence (AI) Desktop External Media Machine Learning (ML) Software Software (Application) Software (Backup/Recovery and Remote Storage) Software (Communication) Software (Container Environment) Software (Development and Design) Software (Device Driver) Software (Embedded) Software (Endpoint Security) Software (Firmware) Software (Freeware) Software (Graphics) Software (Hypervisor) Software (ICAM) Software (Multimedia and Streaming) Software (Network Control) Software (Network Monitoring and Configuration) Software (Network Protection) Software (Open Source) Software (Operating System) Software (Operational Monitoring and Analysis) Software (Remote Access and Configuration Management) Software (Remote Scanning) Software (SaaS) Software (Shareware) Software (Utilities) Software (Web Browser)