C-SCRM Questionnaire.xlsx

XLSX spreadsheet 172 KB Posted Jan 23, 2025

Attached to: CUSTOMIZABLE VIRTUAL MACHINE AND CLOUD COMPUTING PLATFORM
Solicitation number: 19AQMM25B0100
Issued by: Department of State Office of Acquisition Management

About this file

Written by GovTribe AI · Jan 23, 2025

This file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template attached to RFI 1019530075, which appears to be related to a Department of State procurement for cloud computing services. The questionnaire consists of three main sections: Contact Information, Vendor Risk Management Plan, and Physical and Personnel Security.

The questionnaire requires vendors to provide company contact details and answer questions about their supply chain security practices, including how they identify and manage supply chain threats, contractual requirements with suppliers, background check policies, ICT equipment tampering prevention, and insider threat training. The document includes references to NIST SP 800-53 controls, though these appear to be for reference only and not compliance requirements. The questionnaire uses a simple yes/no response format, with special provisions for vendors who do not have suppliers in their supply chain.

View the file

Other files

File	Type	Posted
Questions and Responses-CVM.docx	DOCX document	Feb 5, 2025
State Department Secure Software Development Attestation Form.pdf	PDF	Jan 23, 2025
Customizable VM_Cloud Computing Platform_RFI.pdf	PDF	Jan 23, 2025

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

C-SCRM Questionnaire RFI 1019530075 Attachment B

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) QUESTIONNAIRE

Instructions:

- This worksheet shall be completed by the vendor responsible for submitting the offer. References to "organization" refer to the offering entity. If the offering entity is a joint venture (JV), the response may come from either the JV or from the JV managing partner.

- Provide the requested inputs in the gray shaded lines of the template under column D, Vendor Response, for all Items Numbers for Sections 1-3. Offerors are advised that the Government may request documentation from the Offerors to validate the responses provided.

SECTION 1 - CONTACT INFORMATION
ITEM NO.	ITEM DESCRIPTION	VENDOR RESPONSE
1.1	Enter the name of your company.
1.2	Enter the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the vendor inputs on this questionnaire.
1.3	Enter the job title of the primary POC.
1.4	Enter the phone number of the primary POC in the following format: (555) 555-5555
1.5	Enter the e-mail address of the primary POC.
SECTION 2 VENDOR RISK MANAGEMENT PLAN
ITEM NO.	ITEM DESCRIPTION	VENDOR RESPONSE	NIST SP 800-53 Reference

tc={AFA5E90D-3D54-4947-81FB-735479B2BB30}: [Threaded comment]

Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924

Comment:

2.1 Does your organization identify its key supply chain threats? (Note: if you do not have suppliers, answer "Yes") tc={6A5E4123-E4EF-41C5-8FFB-8CC13C11DA22}: [Threaded comment]

Comment:

Red = new addition.		IR-8, SR-7
	2.2	Does your organization map key suppliers to your supply chain threats? (Note: if you do not have suppliers, answer "Yes")		IR-8, SR-7
	2.3	Does your organization have written SCRM requirements in contracts with your key suppliers? (Note: if you do not have suppliers, answer "Yes")		SA-4
	2.4	Does your organization verify that your suppliers meet SCRM requirements through contractual terms and conditions? (Note: if you do not have suppliers, answer "Yes")		SR-6
	SECTION 3 PHYSICAL AND PERSONNEL SECURITY
	ITEM NO.	ITEM DESCRIPTION	VENDOR RESPONSE	NIST SP 800-53 Reference

tc={BFDD9C36-E00E-441A-AFAD-7712E4E33373}: [Threaded comment]

Comment:

Same comment as above.

tc={6A5E4123-E4EF-41C5-8FFB-8CC13C11DA22}: [Threaded comment]

Comment:

Red = new addition.

tc={AFA5E90D-3D54-4947-81FB-735479B2BB30}: [Threaded comment]

Comment:

Recommend deleting as it confuses vendors as some think they have to comply with these references but that is not the case, they have to comply with the question. Or we need to explain in another column how these relate to the question and what is the expectation of these references. 3.1 Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates? No PE-2, PE-3

PS-3

3.2 Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory? SR-9

AC-1

3.3 Do you provide literacy training on recognizing and reporting potential indicators of insider threat? AT-2(2)

&"Calibri"&11&K000000_x000D_&1#&"Times New Roman"&10&K000000SENSITIVE BUT UNCLASSIFIED

Data (HIDE)

Status	Score	Status	Not Reviewed	Yes	No	Not Applicable	Alternative	Total
ERROR:#REF!	ERROR:#REF!	Counts	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!
		Pct	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!	ERROR:#REF!

&"Calibri"&11&K000000_x000D_&1#&"Times New Roman"&10&K000000SENSITIVE BUT UNCLASSIFIED

Counts Not Reviewed Yes No Not Applicable Alternative 0 0 0 0 0

DL (HIDE)

GWACS	Pool	Implementation Status	Answer
Alliant/ Alliant 2	Small Business (SB) Pool	Satisfied	Yes
Alliant SB	HUBZone SB (HUBZone) Pool	Partially Satisfied	No
8(a) STARS II	Women Owned SB (WOSB) Pool	Not Satisfied
VETS/ VETS2	Other	Not Applicable
		TBD
		Not Reviewed

&"Calibri"&11&K000000_x000D_&1#&"Times New Roman"&10&K000000SENSITIVE BUT UNCLASSIFIED

File details come from the government source that posted it. Updated Jan 23, 2025.