C-SCRM Questionnaire-with-isso-27001 Aug 2026.xlsx

This is a Cybersecurity Supply Chain Risk Management (C-SCRM) Questionnaire template designed for vendors to complete as part of the Department of State's procurement process for 45Drives Storinator storage systems. The questionnaire requires vendors to provide contact information for a primary point of contact, including name, job title, phone number, and email address, to be completed in designated gray-shaded response fields.

The questionnaire consists of three sections addressing vendor risk management practices. Section 1 captures basic company contact details. Section 2 evaluates the vendor's supply chain risk management capabilities, requiring yes/no responses regarding the organization's identification of key supply chain threats, mapping of suppliers to threats, inclusion of written SCRM requirements in supplier contracts, and verification mechanisms for supplier compliance with SCRM requirements. Section 3 addresses physical and personnel security by requesting confirmation of background check policies for employees, procedures to prevent tampering of Information and Communications Technology equipment in inventory, and provision of insider threat literacy training. All responses reference applicable NIST SP 800-53 security controls and corresponding ISO 27001 standards. The template includes administrative tracking sections for response status, scoring, and GWAC pool implementation categories (Alliant, Small Business, HUBZone, 8(a) STARS II, WOSB, VETS, and others). Vendors are advised that the Government may request supporting documentation to validate submitted responses.