Attachment_K_-_Supplier_Risk_Questionnaire.pdf

Supplier Risk Questionnaire

Instructions: The Supplier Risk Questionnaire shall be completed by all Offerors and included with the proposal submission. The Offeror shall submit a narrative for any question answered “Yes“ and shall not exceed 2 pages for each question. For Question “Q4”, a written response shall not exceed 7 pages. The Questionnaire will be evaluated on an acceptable/unacceptable basis and must be determined acceptable to be eligible for award.

Question Response

Q1 Are any components used in support of the solicitation requirements, supplied from a manufacture or supplier not authorized to do business with the Federal Government?

Yes

No

Q2 Has the Offeror experienced a cybersecurity or supply chain incident (e.g., reportable data breech) that has affected your customers in the last 5 years?

Yes

No

Q3 Have any of the offeror’s prospective suppliers or subcontractors been debarred or suspended?

Yes

No

Q4 • List all cybersecurity or Supply Chain Risk Management (SCRM)-related industry certifications currently held by the Offeror.

• Explain how the Offeror identifies, manages, and mitigates supply chain and cybersecurity risk?

• Explain how hardware, software, firmware or embedded components, and information systems are protected from component substitution, functionality alteration, and malware insertion while in the supply chain?

• Explain how the Offeror maintains a high level of cybersecurity and SCRM readiness for performance of IT services to federal customers.

Maximum 7 pages