C-SCRM Questionnaire.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template that vendors must complete as part of their offer submission for federal contract opportunities. The questionnaire is mandatory for the U.S. Embassy Dakar Consolidated Leased Line Services solicitation (19SG2026Q0022) and requires completion by the offering entity or its joint venture managing partner.

The questionnaire consists of three sections totaling eight questions aligned with NIST SP 800-53 security controls. Section 1 requires vendor contact information including company name, primary point-of-contact name, job title, phone number, and email address. Section 2 addresses Vendor Risk Management Plan with four yes/no questions covering supply chain threat identification, supplier mapping to threats, written SCRM contract requirements with key suppliers, and verification of supplier compliance with SCRM requirements. Section 3 covers Physical and Personnel Security with three yes/no questions addressing employee background check policies, procedures to prevent tampering of ICT equipment in supply chain inventory, and insider threat literacy training provision. Vendors must complete all responses in the gray-shaded cells under the Vendor Response column for Sections 1-3, and the Government reserves the right to request documentation to validate responses. The questionnaire includes tracking fields for response status (Yes, No, Not Applicable, Alternative, Not Reviewed) and GWACS pool implementation status relevant to set-aside contracting vehicles including Alliant, Alliant 2 Small Business, 8(a) STARS II, and VETS/VETS2 programs.