C-SCRM Questionnaire.xlsx

The file is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire designed to assess vendor security practices and risk management capabilities. The questionnaire is structured in three sections: Contact Information, Vendor Risk Management Plan, and Physical and Personnel Security. Key elements include verifying vendor practices such as identifying supply chain threats, mapping key suppliers, implementing SCRM contract requirements, conducting employee background checks, preventing equipment tampering, and providing insider threat awareness training. The questionnaire references NIST SP 800-53 security control standards and requires vendors to provide detailed responses in designated areas, with the understanding that the government may request additional documentation to validate the responses.

This questionnaire appears to be associated with a related Department of State US Embassy Lisbon solicitation (Solicitation Number: 19P05025Q0012) for Virtual Private Network and Mobile Telecommunication Services. The solicitation seeks quotations due by May 19, 2025 at 7 pm, to be submitted to LisbonProcure@State.Gov. The government intends to award the contract using a comparative evaluation method, with prospective offerors required to submit specific documents including SF-1449 and be registered in the System for Award Management (SAM). Vendors must meet responsibility standards and compliance requirements to be eligible for potential contract award.