J-3 Cybersecurity _ Supply Chain Risk Management (C-SCRM) Deliverables.xlsx

Pre-Award Evaluation Instructio

QUESTIONNAIRE COMPLETION INSTRUCTIONS:

Pre-Award Eval. - Basic Safegua

Basic Safeguarding of Covered Contractor Information Systems Questionnaire

AC-3

AC-17

AC-20

AC-22

IA-3

IA-5

3.2 Does your organization authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems?

MP-4

MP-6

PE-3

PE-4

PE-5

PE-6

5.2 Does your organization escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices?

SI-3

SI-5

Data (HIDE)

DL (HIDE)

Post-Award Deliverable Instruct

This document is intended to evaluate a contractor's SCRM maturity.

If the requested supply chain risk management information on the next tab has previously been provided to the requesting organization, provide an updated revision covering material changes.

Critical Component is defined as: A system element that, if compromised, damaged, or failed, could cause a mission or business failure

https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/finalhttps://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final Post-Award Deliverable - C-SCRM

C-SCRM PLAN TEMPLATE

This standard is met when the prime contractor attests to having identified suppliers of critical components included in ICT supplies and services that will be sold to the government through this contract.

This standard is met when the prime contractor attests to verifying the company ownership of all suppliers of critical components included in ICT supplies and services that will be sold to the government through this contract.

This standard is met when the prime contractor attests that all suppliers of critical components included in ICT supplies and services that will be sold to the government through this contract are U.S. owned companies.

If distributors are not used, this standard is met with a response of "no".

If distributors are used, this standard is met when the prime contractor documents the process to perform a threat analysis for distributors of ICT supplies and services that will be sold to the government through this contract.

Reference NIST 800-161 4.1.4 for Threat Analysis.

This standard is met when the contractor attests that no subcontractors or suppliers are located outside the of the U.S. If any subcontractors or suppliers are located outside of the U.S., this standard is met when all subcontractors/suppliers are listed, along with the locations of each.

Reference NIST SP 800-53 SR-6, Supplier Assessments and Reviews

This standard is met when the prime contractor attests that the ICT SCRM Security Controls in Chapter 3.5 are followed.

This standard is met when the prime contractor provides a SCRM or Security plan with well defined operational controls and referenced policies or a third party assessment to demonstrate the alignment.

This question ensures that contractors have policies/procedures that are fully aligned with NIST 800-161.

This standard is met when the prime contractor demonstrates the process and policies that ensure timely notification of updated risk management information.

This question ensures that policies are regularly updated and communicated to customers to ensure regular maintenance of established processes/procedures for SCRM.

This standard is met when the prime contractor provides the QMS documentation.

This question asks whether the prime contractor has policies and procedures in place to address supply chain risks. If the company is fully compliant with ISO 9001, then we may have more confidence in their implementation, auditing, training, and change management processes. If the company is not fully compliant with ISO 9001, then we may need to dig deeper to understand whether they have effective implementation, audit plans, training, change management processes, etc. This question ensures that the prime contractor is thinking about its supply chain throughout the lifecycle.

Reference ISO 9001:2015; NIST SP 800-161

This standard is met when the prime contractor provides documented C-SCRM/SCRM requirements in contract language.

The Government wants to know that the supplier not only has a comprehensive and robust SCRM program for itself (which helps us to mitigate our own risk and meet customer expectations), but that it also requires the same from its sub-suppliers. We also want to ensure that the supplier ensures that “externally provided processes, products and services” conform to the SCRM requirements expected from the supplier and ensure that the supplier can meet the expectations of its customers. Suppliers must establish incident handling, including preparation, detection analysis, containment and recovery. We want incidents to be addressed with appropriate mitigations. Finally, we want to ensure that we are notified of changes in subcontractors because those changes could impact our ability to appropriately identify our own supply chain risks and our ability to meet the customers’ expectations.

Reference NIST SP 800-53; NIST IR 7622; SIG LITE 2020; ISO 8.4; NIST SP 800-161

This standard is met when the prime contractor provides documented processes and/or policies that ensure suppliers meet SCRM contractual terms and conditions.

Reference NIST SP 800-53; NIST IR 7622; SIG LITE 2020; ISO 8.4; NIST SP 800-161

This standard is met when the prime contractor documents the processes to verify that information is appropriately categorized.

This question assesses the risk: Breach of confidentiality ISO 27003:2013 sect 7.5.3.

Reference NIST SP 800-53: SI-12 Information Management and Retention, RA-2 Security Categorization

This standard is met when the prime contractor attests that policies and procedures are reviewed and updated annually, and the provides the date of the most recent review.

This standard is met when the prime contractor provides their incident detection and reporting documentation/practices.

This question assesses the risk of a delay in, or inability to, recover from cybersecurity events.

Reference ISO 27003:2017 sect 16.1.1

This standard is met when the prime contractor provides documentation regarding how cybersecurity events are logged, tracked, and continuously monitored.

This standard is met when the prime contractor attests that endpoint protection software is used pervasively in their environment. If not used, additional mitigation efforts must be described.

Reference NIST CSF1.1 PR.IP* Information Protection Processes and Procedures Free endpoint software can be found on this list from CISA: https://www.cisa.gov/free-cybersecurity-services-and-tools

This standard is met when the prime contractor attests to having an incident response process and dedicated incident response team. If no process or team exists, mitigation efforts must be described.

This question assesses the risk of the contractor's ability to maintain operational continuity during/after an attack.

Reference CNSSI 4009-2015 under incident handling; NIST SP 800-61.; Shared Assessments Standardized Control Assessment (SCA) sect. K.4

This standard is met when the prime contractor responds yes and provides documentation regarding the certification program and date of certification for the covered entity, or responds no.

Reference DoD 5220.22, Volume 2, August 1, 2018 (National Industrial Security Program: Industrial Security Procedures for Government Activities, Incorporating Change 1, September 30, 2020 (all applicable chapters, section, paragraphs))

This standard is met when the prime contractor documents their security policies and procedures. Reference the specific standard if security policies align to an industry standard.

See NIST SP 800-53 PE-1, PE-2, PE-3.

This standard is met when the contractor lists applicable physical security industry standards/controls that are adhered to.

Controls may align with NIST SP 800-53 Controls PE-1, PE-2 and PE-3.

Reference ONSAT-PSP-14.3, NIST 800-161 AT-3 - Security Training, ISO 27001:2013

This standard is met when the prime contractor attests that policies are reviewed and updated annually and procedures are reviewed and updated at least every three years, and the provides the date of the most recent review (within the past three years).

This standard is met when the prime contractor attests to having a documented security incident response process. If no process exists, mitigation efforts must be described.

This standard is met when the prime contractor documents the policies/practices that ensure all critical ICT components are sourced from the OEM or authorized distributors.

Reference IEC:IECEE, IECQ, ISO 28000, ISO 12931, ISO 16678

This standard is met when the prime contractor documents a policy that requires third party suppliers to provide authorized critical ICT components.

Reference IEC:IECEE, IECQ, ISO 28000, ISO 12931, ISO 16678

This standard is met when the prime contractor attests to implementing a personnel security program and lists the address(es) that this program applies to. If a third party is contracted, list the name of the company/companies used.

This standard is met when the prime contractor documents the physical security practices in place.

This standard is met when the prime contractor provides the documented policy for conducting background checks as permitted, or lists the controls used in physical security practices.

This question measures how new employees are introduced to the organization’s security principles and culture during the initial point of entry.

Examples include: NIST SP 800-53 PS-1, PS-2 and PS-3 and:

• NIST CSF: ID.AM-6, ID.GV-2

• SP 800-53: SA-3, SA-8

• SP 800-160: 3.2.1, 3.2.4, 3.3.1

• SP 800-181: K0233

• NIST CSF: PR.AT-*

• SP 800-160: 3.2.4

• SP 800-181: OV-TEA-001, OV-TEA-002; T0030, T0073, T0320; K0204, K0208, K0220, K0226, K0243, K0245, K0252; S0100, S0101; A0004, A0057

• SP 800-181: T0001, T0004

• NIST Cybersecurity Framework (2018) - https://www.nist.gov/cyberframework

This standard is met when the prime contractor provides the process documentation for managing third party products and components.

Third-party HW/SW products may not have as stringent quality control and defect analysis and therefore could be at higher risk for non-conformance or being counterfeit.

Reference NIST 800-53 SR-1, SR-2, SR-3, SR-11

This standard is met when the prime contractor documents the processes for auditing in supplier contracts.

Regular audits ensure that processes are being performed and running as desired and offer opportunities for improvements. Passing down audit requirements to suppliers ensures supplier integrity of your suppliers.

Reference NIST 800-53 and NIST 800-161 AU-1, AU-2 and AU-3, and ISO 27036; ONSAT – AIA 4.1

This standard is met when the prime contractor documents the processes for managing third party supplier integrity requirements.

Reference NIST 800-53 SR-3(3) and ISO 27036; ONSAT – AIA 4.1

This standard is met when the prime contractor provides a process document for managing reuse/recycling of hardware products.

Lack of controlled disposal procedures could increase risks of counterfeiting and unintended uses.

Reference NIST 800-53 MP-6 and R2:2013 - Sustainable Electronics Recycling International, sect 15

This standard is met when the prime contractor documents the process for ensuring supply chain resilience.

This question is intended to measure the extent to which the company has the ability to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents to its Critical ICT elements and assets.

Reference NIST 800-53 SR-1, SR-2, SR-3, CP-2 and CP-8, and 800-161 supplementary guidance; EO 13873

This standard is met when the prime contractor documents policies, practices, and software allowing remote work.

This question is intended to address how organizations provide secure access to data and information systems for employees working remotely.

Reference NIST 800-53 PE-17 and NIST 800-161 supplementary guidance

This standard is met when the prime contractor documents a data backup policy that aligns with NIST 800-53 CP-9, or an equivalent standard.

This standard is met when the prime contractor attests to conducting assessments/calculations to identify risks to assets, products and services associated with climate related risks.

This standard is met when the prime contractor provides the reporting platform or report from the assessment performed.

This standard is met when the prime contractor provides a disaster response plan that addresses short term and long term impacts from climate related risks.

Reference NIST SP 800-161 R1 Page 241

This standard is met when the prime contractor's disaster response plan (submitted as part of 7.6) includes management of potential increases in the frequency, severity and/or duration of weather events.

This standard is met when the prime contractor's disaster response plan includes a list of assets, products, and/or services that would most significantly disrupt operations if they experienced short term acute damage.

This standard is met when the prime contractor's disaster response plan includes a list of assets, products, and/or services that would most significantly disrupt operations if they experienced gradual long term cumulative damage.

https://www.cisa.gov/free-cybersecurity-services-and-tools image1.png