C-SCRM Questionnaire.pdf
PDF 140 KB Posted
- Solicitation number
- 19GG8026Q0004
- Issued by
-
Department of State
About this file
This document is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete during a federal procurement process. The questionnaire is divided into three sections: Contact Information, Vendor Risk Management Plan, and Physical and Personnel Security. Vendors are required to provide details about their organization, including company name, primary point of contact, and responses to specific cybersecurity and supply chain risk management questions. Each section references NIST SP 800-53 security control standards, with questions covering topics such as supply chain threat identification, background check policies, equipment tampering prevention, and insider threat training. The document is marked as "Sensitive But Unclassified" and instructs vendors that the government may request additional documentation to validate their responses.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SF1449 Cover Page.pdf | ||
| Solicitation package _19GG8026Q0004.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ITEM NO. ITEM DESCRIPTION
VENDOR
RESPONSE
1.1 Enter the name of your company.
1.2 Enter the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the vendor inputs on this questionnaire.
1.3 Enter the job title of the primary POC.
1.4 Enter the phone number of the primary POC in the following format: (555) 555-5555
1.5 Enter the e-mail address of the primary POC.
ITEM NO. ITEM DESCRIPTION
VENDOR
RESPONSE
NIST SP 800-53
Reference
2.1 Does your organization identify its key supply chain threats? (Note: if you do not have suppliers, answer "Yes") IR-8, SR-7
2.2 Does your organization map key suppliers to your supply chain threats? (Note: if you do not have suppliers, answer "Yes")
IR-8, SR-7
2.3 Does your organization have written SCRM requirements in contracts with your key suppliers? (Note: if you do not have suppliers, answer "Yes")
SA-4
2.4 Does your organization verify that your suppliers meet SCRM requirements through contractual terms and conditions? (Note:
if you do not have suppliers, answer "Yes")
SR-6
ITEM NO. ITEM DESCRIPTION
VENDOR
RESPONSE
NIST SP 800-53
Reference
3.1 Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates?
PE-2, PE-3
PS-3
3.2 Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory?
SR-9
AC-1
3.3 Do you provide literacy training on recognizing and reporting potential indicators of insider threat? AT-2(2)
SECTION 3 PHYSICAL AND PERSONNEL SECURITY
CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE
SECTION 1 - CONTACT INFORMATION
SECTION 2 VENDOR RISK MANAGEMENT PLAN
Instructions:
- This worksheet shall be completed by the vendor responsible for submitting the offer. References to "organization" refer to the offering entity. If the offering entity is a joint venture
(JV), the response may come from either the JV or from the JV managing partner.
- Provide the requested inputs in the gray shaded lines of the template under column D, Vendor Response, for all Items Numbers for Sections 1-3. Offerors are advised that the
Government may request documentation from the Offerors to validate the responses provided.
#SENSITIVE BUT UNCLASSIFIED
File details come from the government source that posted it. Updated .