DRD 2 - NASA C-SCRM Plan Questionnaire.xlsx

This file is a Cyber Supply Chain Risk Management (C-SCRM) Plan Questionnaire issued by NASA as a Deliverable Requirements Document (DRD) for contractors performing work on NASA contracts. The questionnaire is designed to fulfill the requirement for a C-SCRM Plan consistent with NIST SP 800-161 guidelines and applies to all contractor information systems and components regardless of FIPS 199 impact level. Contractors may submit either a plan compliant with NIST SP 800-161 or complete this questionnaire, but not both if they have an existing compliant plan.

The questionnaire consists of six sections addressing different aspects of cyber supply chain risk management. Section 1 requires corporate information including company name, address, contract details, and primary point of contact. Section 2 addresses supply chain provenance with yes/no questions regarding supplier identification and verification, covered articles, distributor threat analysis, and implementation of NIST SP 800-171 security requirements. Section 3 covers supply chain management and supplier governance, requiring documentation of threat identification, supplier mapping, contractual SCRM requirements, and supplier reviews. Section 4 addresses physical and personnel security through background checks, equipment tampering prevention, and insider threat training. Section 5 focuses on supply chain integrity and resilience, including processes for managing product defects, end-of-life requirements, and hardware/software reuse and recycling. Section 6 requires detailed inventory lists of all contractor-owned hardware and software used in contract performance, including manufacturer information, model numbers, country of origin, and NDAA Section 889 compliance status for applicable equipment. All negative responses require explanation and risk mitigation plans.