Enclosure 8-Optional C-SCRM Questionnaire.pdf

Solicitation 80HQTR25R7002: Enclosure 8 - Optional C-SCRM Questionnaire

*To be submitted at the start of phase-in

This questionnaire aligns with the NIST SP 800-161 template and is intended to make fulfilling this requirement easier. The OCIO will accept either a plan that complies with NIST SP 800-161 or this questionnaire. Contractors DO NOT need to submit both a plan and this questionnaire. If a contractor has an existing C-SCRM plan that complies with NIST SP 800-161, there is no requirement for the contractor to complete the OCIO questionnaire.

In accordance with Attachment K - Security Requirements for Unclassified IT Resources Data Requirements Description (DRD), the Contractor shall submit the C-SCRM plan to the ICT/C-SCRM Service Element Lead at agency-dl-ocio-cys-cp-scrm@mail.nasa.gov and copy the Contracting Officer on the email distribution.

Instructions 1 of 7

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1.4 Provide the name of the primary Point-Of-Contact (POC) for your company that the Government may contact to discuss the C-SCRM Plan inputs.

1.5 Provide the job title of the primary POC.

1.6 Provide the phone number of the primary POC in the following format:

(555) 555-5555

1.7 Provide the e-mail address of the primary POC.

1.8 Identify all subsidiaries, domestic and foreign.

1.9 Identify all statutory (e.g., FISMA), regulatory (e.g., FIPS) and external (e.g., NIST) authority(ies) governing your organizations C-SCRM Program.

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

2.1 Are suppliers of all covered articles, as defined in FAR 4.2301 identified?

2.2 Is the company ownership of suppliers of covered articles verified?

2.3 Are suppliers of critical covered articles under U.S. ownership?

2.4 If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor?

2.5 Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s).

2.6

Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800- 171, Protecting Controlled Unclassified Information in Non-Federal Systems?

SECTION 3 - SUPPLY CHAIN MANAGEMENT AND SUPPLIER GOVERNANCE

SECTION 2 - SUPPLY CHAIN PROVENANCE

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 3 of 7

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

3.1 Does your organization identify its key supply chain threats?

3.2 Does your organization map key suppliers to your supply chain threats?

3.3 Are policies/processes in place to ensure timely notification of updated risk management information previously provided to the Contracting Officer and Contracting Officer's Representative?

3.4 Does your organization have written SCRM requirements in contracts with your key suppliers?

3.5 Is there a process to verify that suppliers are meeting SCRM contractual terms and conditions, including, where applicable, requirements to be passed down to sub-suppliers?

3.6 Does your organization perform supplier reviews in the form of supply chain risk assessments before entering into a contractual agreement to acquire covered articles?

3.7 Does your organization perform component reviews in the form of supply chain risk assessments before acquisitions and/or use of covered articles?

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

4.1 Does your organization have policies for conducting background checks of your employees as permitted by the country in which your organization operates?

4.2 Does your organization have procedures in place to prevent tampering of Information and Communications Technology (ICT) equipment stored as supply chain inventory?

4.3 Does your organization provide training on recognizing and reporting potential indicators of insider threat?

SECTION 4 - PHYSICAL AND PERSONNEL SECURITY

SECTION 5 - SUPPLY CHAIN INTEGRITY AND RESILIENCE

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 4 of 7

ITEM NO. ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

5.1 Are documented processes in place for managing third-party products and component defects throughout their lifecycle?

5.2 Are hardware/software products or services integrity and End of Life requirements passed down to second- and third-party suppliers?

5.3 Are processes in place for addressing reuse and/or recycle of hardware products?

5.4 Are processes in place for addressing reuse and/or recycle of software products?

5.5 Is a formal process documented for ensuring supply chain resilience?

ITEM NO. ITEM DESCRIPTION

6.1

Identify all contractor-owned hardware in use in performance of the contract.

NOTE - Hardware acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr]

6.2

Identify all contractor-owned software, including open-source, in use in performance of the contract.

NOTE - Software acquired during the period of performance is required to follow Commercial IT Request processes. [Ref. CITR Home Page - Commercial IT Request (CITR) at https://oneplace.nasa.gov/citr]

Please complete "6.1 - Hardware Inventory"

Please complete "6.2 - Software Inventory"

SECTION 6 - INVENTORY

C-SCRM Questionnaire CONTROLLED UNCLASSIFIED INFORMATION (CUI) 5 of 7

Component / Product Type

Original Equipment Manufacturer (OEM)

Name

OEM Unique Entity Identifier

(UEI)

Component / Product

Description Model Number Serial Number Country of

Origin

NDAA Sec. 889 Part A Compliant

Yes / No [only applicable for telecommunications and video surveillance equipment)

Physical Location

6.1 - Hardware Inventory CONTROLLED UNCLASSIFIED INFORMATION (CUI) 6 of 7

Software Type Software Publisher

Name

Software Publisher Unique Entity Identifier

(UEI) Software Title Version Number

Country of Origin

Is there a Secure Software Development Attestation Present in the Repository for Software Attestations and Artifacts (RSAA)

Yes / No Physical Location

6.2 - Software Inventory CONTROLLED UNCLASSIFIED INFORMATION (CUI) 7 of 7