Attachment X DRD 2 - NASA C-SCRM Plan Questionnaire.xlsx
XLSX spreadsheet 187 KB Posted
- Attached to
- Landsat 10 Spacecraft _ DRAFT RFP
- Solicitation number
- 80GSFC26D0015
About this file
This is a Cyber Supply Chain Risk Management (C-SCRM) Plan Questionnaire template required as a Deliverable Requirements Document (DRD) for NASA contracts involving unclassified information technology resources. The questionnaire serves as an optional alternative to submitting a full C-SCRM plan compliant with NIST SP 800-161, allowing contractors to choose between either submission format but not both.
The questionnaire consists of six primary sections requiring contractor responses: Section 1 captures corporate information including company name, contract identification, and primary points of contact; Section 2 addresses supply chain provenance by verifying supplier identification, ownership verification, U.S. ownership status of critical suppliers, distributor threat analysis, foreign locations of subcontractors, and implementation of NIST SP 800-171 basic security requirements; Section 3 focuses on supply chain management governance including threat identification, supplier mapping, risk notification processes, contractual SCRM requirements, supplier verification, and component risk assessments; Section 4 covers physical and personnel security through background check policies, equipment tampering prevention, and insider threat training; Section 5 addresses supply chain integrity and resilience through defect management, end-of-life requirements, hardware and software reuse/recycling processes, and formal resilience documentation; Section 6 requires detailed hardware and software inventory listings including component specifications, original equipment manufacturer information, Unique Entity Identifiers, model numbers, serial numbers, country of origin, NDAA Section 889 compliance status for applicable equipment, and confirmation of secure software development attestations. Contractors must provide "Yes" or "No" responses with explanatory narratives required for all negative responses, and the Government reserves the right to request additional follow-up documentation supporting submitted answers.
View the file
Other files
Show all 46
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions for CO's
| The DRD, "Security Requirements for Unclassified Information Technology Resources," requires a Cyber Supply Chain Risk Management (C-SCRM) Plan consistent with the recommended template in NIST SP 800-161. This document may be found at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf. Section 3.1 provides a summary of ICT SCRM controls and references additional guidance in Appendix E, "ICT SCRM Plan Template." (ICT = Information and Communications Technology) |
| This questionnaire aligns with the above referenced NIST template and is intended to make fulfilling this requirement easier. At this time, the Office of the Chief Information Officer (OCIO) questionnaire is optional. The OCIO will accept either a plan that complies with NIST SP 800-161 or this questionnaire. Contractors DO NOT need to submit both a plan and this questionnaire. If a contractor has an existing C-SCRM plan that complies with NIST SP 800-161, there is no requirement for the contractor to complete the OCIO questionnaire. |
| For questions, please email agency-dl-ocio-cys-cp-scrm@mail.nasa.gov and Cc agency-dl-ocio-rca@mail.nasa.gov. |
&"Times New Roman,Bold"&12&A &"Times New Roman,Regular"&12&P of &N
C-SCRM Questionnaire
| CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE | |||
| Background: | The C-SCRM plan addresses the management, implementation, and monitoring of C-SCRM controls and the development and sustainment of systems across the System Development Lifecycle (SDLC) to support mission and business functions. At NASA, the C-SCRM plan applies to all contractor information systems and components regardless of the FIPS199 impact. | ||
| Instructions: | To meet requirements of the DRD, complete the questionnaire, or ensure the C-SCRM plan contains the requested inputs for all Items Numbers in Sections 1-6. If the response is No, provide a summary explanation and risk mitigation plan. While related, each section is designed to address a different aspect of cyber supply chain risk management. This template is intended to gather an initial and consistent baseline. Additional follow-up questions or other documentation may be requested by the Government to support the answers provided herein. | ||
| SECTION 1 - CORPORATE INFORMATION | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| 1.1 | Provide the name and address of your company. | ||
| 1.2 | Identify the contract name and number. | ||
| 1.3 | Identify if your company is the prime or sub on the identified contract. | ||
| 1.4 | Provide the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the C-SCRM Plan inputs. | ||
| 1.5 | Provide the job title of the primary POC. | ||
| 1.6 | Provide the phone number of the primary POC in the following format: (555) 555-5555 | ||
| 1.7 | Provide the e-mail address of the primary POC. | ||
| 1.8 | Identify all subsidiaries, domestic and foreign. | ||
| 1.9 | Identify all statutory (e.g., FISMA), regulatory (e.g., FIPS) and external (e.g., NIST) authority(ies) governing your organizations C-SCRM Program. | ||
| SECTION 2 - SUPPLY CHAIN PROVENANCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 2.1 | Are suppliers of all covered articles, as defined in FAR 4.2301 identified? | ||
| 2.2 | Is the company ownership of suppliers of covered articles verified? | ||
| 2.3 | Are suppliers of critical covered articles under U.S. ownership? | ||
| 2.4 | If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor? | ||
| 2.5 | Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s). | ||
| 2.6 | Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800-171, Protecting Controlled Unclassified Information in Non-Federal Systems? | ||
| SECTION 3 - SUPPLY CHAIN MANAGEMENT AND SUPPLIER GOVERNANCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 3.1 | Does your organization identify its key supply chain threats? | ||
| 3.2 | Does your organization map key suppliers to your supply chain threats? | ||
| 3.3 | Are policies/processes in place to ensure timely notification of updated risk management information previously provided to the Contracting Officer and Contracting Officer's Representative? | ||
| 3.4 | Does your organization have written SCRM requirements in contracts with your key suppliers? | ||
| 3.5 | Is there a process to verify that suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers? | ||
| 3.6 | Does your organization perform supplier reviews in the form of supply chain risk assessments before entering into a contractual agreement to acquire covered articles? | ||
| 3.7 | Does your organization perform component reviews in the form of supply chain risk assessments before acquisitions and/or use of covered articles? | ||
| SECTION 4 - PHYSICAL AND PERSONNEL SECURITY | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 4.1 | Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates? | ||
| 4.2 | Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory? | ||
| 4.3 | Does your organization provide training on recognizing and reporting potential indicators of insider threat? | ||
| SECTION 5 - SUPPLY CHAIN INTEGRITY AND RESILIENCE | |||
| ITEM NO. | ITEM DESCRIPTION | VENDOR RESPONSE | |
| (YES / NO) | EXPLANATION |
(REQUIRED IF THE RESPONSE IS NO)
| 5.1 | Are documented processes in place for managing third-party products and component defects throughout their lifecycle? | |
| 5.2 | Are hardware/software products or services integrity and End of Life requirements passed down to second- and third-party suppliers? | |
| 5.3 | Are processes in place for addressing reuse and/or recycle of hardware products? | |
| 5.4 | Are processes in place for addressing reuse and/or recycle of software products? | |
| 5.5 | Is a formal process documented for ensuring supply chain resilience? | |
| SECTION 6 - INVENTORY | ||
| ITEM NO. | ITEM DESCRIPTION | |
| 6.1 | Identify all contractor-owned hardware in use in performance of the contract. | |
| NOTE - Hardware acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr] | Please complete "6.1 - Hardware Inventory" | |
| 6.2 | Identify all contractor-owned software, including open-source, in use in performance of the contract. | |
| NOTE - Software acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr] | Please complete "6.2 - Software Inventory" |
&"Times New Roman,Bold"&12CONTROLLED UNCLASSIFIED INFORMATION (CUI)
&"Times New Roman,Regular"&12&A &"Times New Roman,Bold"&12&K000000CONTROLLED UNCLASSIFIED INFORMATION (CUI) &"Times New Roman,Regular"&12&P of &N
6.1 - Hardware Inventory Component / Product Type Original Equipment Manufacturer (OEM) Name OEM Unique Entity Identifier (UEI) Component / Product Description Model Number Serial Number Country of Origin NDAA Sec. 889 Part A Compliant Yes / No [only applicable for telecommunications and video surveillance equipment) Physical Location
&"Times New Roman,Regular"&12CONTROLLED UNCLASSIFIED INFORMATION (CUI)
&"Times New Roman,Regular"&12&A &"Times New Roman,Regular"&12CONTROLLED UNCLASSIFIED INFORMATION (CUI) &"Times New Roman,Regular"&12&P of &N
6.2 - Software Inventory
| Software Type | Software Publisher Name | Software Publisher Unique Entity Identifier (UEI) | Software Title | Version Number | Country of Origin | Is there a Secure Software Development Attestation Present in the Repository for Software Attestations and Artifacts (RSAA) | |
| Yes / No | Physical Location |
&"Times New Roman,Regular"&12CONTROLLED UNCLASSIFIED INFORMATION (CUI)
&"Times New Roman,Regular"&12&A &"Times New Roman,Regular"&12CONTROLLED UNCLASSIFIED INFORMATION (CUI) &"Times New Roman,Regular"&12&P of &N
Hardware Options
| Hardware Options |
| Camera |
| Camera (Digital) |
| Camera (Surveillance) |
| Graphics Processing Unit (GPU) |
| Hard Disk Drives (HDDs) |
| Hardware & Software |
| Hardware & Software (Internet of Things (IoT)) |
| Hardware & Software (Internet Service) |
| Hardware (General) |
| IaaS |
| IT Service |
| Laptop |
| Network Card |
| Operational Technology (OT) |
| Optical Drives (CD/DVD/Blu-ray) |
| Other - Cables |
| Other - Capacitors |
| Other - Power Supply |
| Other - Resistors |
| Other - Transistors |
| PaaS |
| Peripheral - 3D Printer |
| Peripheral - External HDD |
| Peripheral - Keyboard (wired) |
| Peripheral - Keyboard (wireless/Bluetooth) |
| Peripheral - MFD |
| Peripheral - Monitor |
| Peripheral - Mouse (wired) |
| Peripheral - Mouse (wireless/Bluetooth) |
| Peripheral - Printer |
| Peripheral - Speakers |
| Peripheral - Webcam |
| Printer |
| Random Access Memory (RAM) |
| Server |
| Smart Phone |
| SmartTV |
| Solid State Drives (SSDs) |
| Sound Card |
| Tablet |
| Telecommunications (Customer Premises Equipment) |
| Telecommunications (Public Switching Equipment) |
| Telecommunications (Transmission Equipment) |
| Telephone (PBX) |
| Telephone (VoIP) |
| Television |
| USB Storage Device (FIPS 140-2) |
| Workstation |
Software Options
| Software Options |
| Artificial Intelligence (AI) |
| Desktop |
| External Media |
| Machine Learning (ML) |
| Software |
| Software (Application) |
| Software (Backup/Recovery and Remote Storage) |
| Software (Communication) |
| Software (Container Environment) |
| Software (Development and Design) |
| Software (Device Driver) |
| Software (Embedded) |
| Software (Endpoint Security) |
| Software (Firmware) |
| Software (Freeware) |
| Software (Graphics) |
| Software (Hypervisor) |
| Software (ICAM) |
| Software (Multimedia and Streaming) |
| Software (Network Control) |
| Software (Network Monitoring and Configuration) |
| Software (Network Protection) |
| Software (Open Source) |
| Software (Operating System) |
| Software (Operational Monitoring and Analysis) |
| Software (Remote Access and Configuration Management) |
| Software (Remote Scanning) |
| Software (SaaS) |
| Software (Shareware) |
| Software (Utilities) |
| Software (Web Browser) |
Data (HIDE)
| Status | Score | Status | Not Reviewed | Yes | No | Not Applicable | Alternative | Total |
| ERROR:#REF! | ERROR:#REF! | Counts | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! |
| Pct | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! | ERROR:#REF! |
&"Calibri"&11&K000000_x000D_&1#&"Times New Roman"&10&K000000SENSITIVE BUT UNCLASSIFIED
Counts Not Reviewed Yes No Not Applicable Alternative 0 0 0 0 0
DL (HIDE)
| GWACS | Pool | Implementation Status | Answer |
| Alliant/ Alliant 2 | Small Business (SB) Pool | Satisfied | Yes |
| Alliant SB | HUBZone SB (HUBZone) Pool | Partially Satisfied | No |
| 8(a) STARS II | Women Owned SB (WOSB) Pool | Not Satisfied | |
| VETS/ VETS2 | Other | Not Applicable | |
| TBD | |||
| Not Reviewed |
&"Calibri"&11&K000000_x000D_&1#&"Times New Roman"&10&K000000SENSITIVE BUT UNCLASSIFIED
File details come from the government source that posted it. Updated .