Draft PBS EV - Vendor SCRM Plan Template.xlsx

Instructions

DRAFT SUPPLY CHAIN RISK MANAGEMENT PLAN TEMPLATE

The awardees will be required to update the SCRM Plan annually and submit these updates to the COR no later than 30 days after the end of each contract year, over the life of the Master Contract.

Template

DRAFT SUPPLY CHAIN RISK MANAGEMENT PLAN TEMPLATE

1.2 Do you verify the company ownership?

1.3 If so, do you confirm that the company is under U.S. ownership?

1.4 If you use distributors, do you investigate them for potential threats?

1.5 Are any subcontractors and/or suppliers located outside the United States or its territories? If 'Yes', then please list company name and foreign country location.

1.6 Do you have controls fully aligned to NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organization? If yes, please explain in Section 1.6. If no, please proceed to Section 2.1.

1.7 Please provide evidence of alignment with NIST SP-800-161.

2.4 Describe how you verify that your suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers.

3.2 How often do you review and update to those policies and procedures? When is the most recent review?

3.5 Are cybersecurity events centrally logged, tracked, and continuously monitored? Please explain how events are monitored.

3.6 Do you deploy anti-malware software throughout your environment? [Yes or No] If "no" please explain.

3.7 Do you have a documented incident response process and a dedicated incident response team (CSIRT - Computer Security Incident Response Team)? [Yes or No] If "no" please explain.

4.2 Do you have documented security policies and procedures that address the control of physical access to cyber assets (network devices, data facilities, patch panels, industrial control systems, programmable logic, etc.)? [Yes or No] If "yes" please describe.

4.3 To what industry standards/controls do you adhere? (e.g., NIST publication, ISO, UL, etc.)

4.4 How often do you review and update those policies and procedures and when was the most recent review?

4.5 Do you have a documented Security Incident Response process covering physical security incidents? (e.g., potential intruder access, missing equipment, etc.) [Yes or No] If "yes" please describe.

4.7 How do you pass on counterfeit prevention requirements to your third party suppliers?

5.2 Describe if physical security practices are formally governed, documented, maintained, and enforced?

6.2 What provisions for auditing are included within supplier contracts?

6.3 How do you pass down HW/SW products or services integrity requirements to third party suppliers?

6.4 Do you have processes in place for addressing reuse and/or recycle of HW products? [Yes or No] If "yes" please describe.

7.3 Do you currently have a data backup policy in place?

7.4 Has your organization conducted vulnerability assessments, risk assessment, or other calculations to identify what impact physical risks associated with climate change (e.g., increases in precipitation-driven flooding, extreme heat events, and inundation due to sea level rise and storm surge) might have on your assets, products, and/or services?

7.5 If yes, describe the assessment process. If assessment results are reported (CDP, GRI, Sustainability or Corporate Responsibility reports), provide the reporting platform and/or report.

7.6 Does your organization have a disaster response plan that includes contingency plans and response protocols for potential short-term acute events (e.g., hurricane, earthquake, flooding, and etc.) and long-term climate change impact (e.g.; changes in precipitation, increased average temperature, and sea level rise)?

7.7 If yes or no, how do or will you deal with potential increases in frequency, severity, or duration of weather events?

7.8 If yes, describe which assets, products, services would most significantly disrupt operations if they experienced short term acute damage (immediate failure, either temporary or catastrophic).

7.9 If yes, describe which assets, products, services, would most significantly disrupt operations if they experienced gradual long-term cumulative damage (slower degradation; greater wear and tear).

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf