Attachment H - BSD-CS-2290-C-SCRM-Questionnaire.pdf
PDF 190 KB Posted
- Solicitation number
- RFP511373
- Issued by
-
Department of Energy
About this file
This is a Contractor Supply Chain Risk Management (C-SCRM) Questionnaire template (BSD-CS-2290) dated 01/31/2025 used to assess supplier compliance with federal cybersecurity requirements under FAR 52.204-21.
The questionnaire requires suppliers to provide detailed descriptions of their organizational practices across sixteen security control areas. These include: access control mechanisms for authorized users and devices; transaction and function limitations; external system connection verification; public information system controls; user identification and authentication procedures; information media sanitization and destruction protocols; physical access restrictions; visitor monitoring and audit logging; network boundary protection and monitoring; subnetwork segmentation for public-facing systems; timely identification and correction of system flaws; malicious code protection at system locations; malicious code protection mechanism updates; periodic and real-time scanning procedures; and verification of third-party security evaluations. The questionnaire collects supplier information including company name, address, contact person details, phone, and email. Completed assessments require a signature and date from the person completing the evaluation and are subject to review by an organizational representative. The form includes a rating system with three categories: Green, Yellow, and Red. Notably, the questionnaire specifies that completed reports may be shared with the Department of Energy (DOE) Office of Science as requested.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
C-SCRM QUESTIONNAIRE
BSD-CS-2290 – C-SCRM Questionnaire 01/31/2025
SUPPLIER INFORMATION
Company Name:
Address:
City: State: Country (if outside USA):
Name & Title of person completing this assessment:
Phone: Email:
FAR 52 204-21 Basic Safeguarding of Covered Contractor Information Systems
DESCRIBE HOW YOUR ORGANIZATION DOES THE FOLLOWING:
(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
(iii) Verify and control/limit connections to and use of external information systems.
(iv) Control information posted or processed on publicly accessible information systems.
(v) Identify information system users, processes acting on behalf of users, or devices.
(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
(xii) Identify, report, and correct information and information system flaws in a timely manner.
C-SCRM QUESTIONNAIRE
BSD-CS-2290 – C-SCRM Questionnaire 01/31/2025
FAR 52 204-21 Basic Safeguarding of Covered Contractor Information Systems
DESCRIBE HOW YOUR ORGANIZATION DOES THE FOLLOWING:
(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.
(xiv) Update malicious code protection mechanisms when new releases are available.
(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
(xvi) Verification of any security-related 3rd party evaluation and results of that evaluation.
Date: Signature (person completing assessment)
This report may be shared with the Dept. of Energy (DOE) Office of Science as requested.
Reviewed by: Organization: Date:
Rating Green: Yellow: Red:
| 2025-03-14T16:11:06-0400 | |
| Tina Richards |
File details come from the government source that posted it. Updated .