Attachment E.1-Attachment NASA C-SCRM Plan

RFP # 80GSFC27R0015

ATTACHMENT E.1

ATTACHMENT NASA C-SCRM PLAN QUESTIONNAIRE

AUGUST 2026

CONTRACT TBD

The DRD, "Security Requirements for Unclassified Information Technology Resources," requires a Cyber Supply Chain Risk Management (CSCRM) Plan consistent with the recommended template in NIST SP 800-161. This document may be found at: This document may be found at: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final. Appendix A provides C- SCRM security controls, Appendix B a C-SCRM control summary and Appendix D C-SCRM Templates.
This questionnaire aligns with the above referenced NIST template and is intended to make fulfilling this requirement easier. At this time, the Office of the Chief Information Officer (OCIO) questionnaire is optional. The OCIO will accept either a plan that complies with NIST SP 800161 or this questionnaire. Contractors DO NOT need to submit both a plan and this questionnaire. If a contractor has an existing C-SCRM plan that complies with NIST SP 800-161, there is no requirement for the contractor to complete the OCIO questionnaire. For questions, please email [email protected] and Cc [email protected].

Instructions for CO's

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1.5

Provide the job title of the primary POC.

1.6

Provide the phone number of the primary POC in the following format: (555) 555-5555

1.7

Provide the e-mail address of the primary POC.

1.8

Identify all subsidiaries, domestic and foreign.

1.9

Identify all statutory (e.g., FISMA), regulatory (e.g., FIPS) and external (e.g., NIST) authority(ies) governing your organizations C-SCRM Program.

SECTION 2 - SUPPLY CHAIN PROVENANCE

ITEM NO.
2.1
2.2
2.3
2.4
2.5

2.6

ITEM DESCRIPTION

VENDOR

RESPONSE

(YES / NO)

EXPLANATION

(REQUIRED IF THE RESPONSE IS NO)

Are suppliers of all covered articles, as defined in FAR 4.2301 identified? Is the company ownership of suppliers of covered articles verified? Are suppliers of critical covered articles under U.S. ownership? If distributors will be used to provide products/services to the Government, is a threat analysis performed for each distributor? Are any subcontractors and/or suppliers located outside the United States or its territories? If "yes", list company name(s) and foreign country location(s).
Are Basic Security Requirements (not Derived Security Requirements) implemented for the fourteen families in Chapter Three of NIST SP 800171, Protecting Controlled Unclassified Information in Non-Federal