[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-381845-105":53,"doc-detail-381845-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","vendor-supply-chain-risk-management-scrm-template-april-2021","VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE - April 2021","","VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE (April 2021) standardizes an ICT supplier/provider risk questionnaire developed by CISA’s ICT SCRM Task Force (WG4). The assessment template normalizes questions on implementing and applying industry standards and best practices to improve consistent, predictable, and actionable communication between vendors and customers. It enhances visibility into trust and assurance practices, supports informed decisions on acceptable risk exposure, and can highlight potential gaps through a flexible, non-prescriptive comparison of new providers.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/vendor-supply-chain-risk-management-scrm-template-april-2021/381845/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/vendor-supply-chain-risk-management-scrm-template-april-2021/381845.png","ImageObject",442,249,{"name":88,"@type":89},"Aria","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-17","2026-09-24",true,{"@type":98,"interactionType":99,"userInteractionCount":73},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose of this ICT vendor SCRM template?","Question",{"text":108,"@type":109},"It provides a standardized set of questions to communicate an ICT supply chain risk posture consistently across public and private organizations, improving predictability and decision-making.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Who developed the template?",{"text":113,"@type":109},"It was produced collaboratively by CISA’s Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, specifically Working Group 4 (WG4).",{"name":115,"@type":106,"acceptedAnswer":116},"How should the template be used by vendors and customers?",{"text":117,"@type":109},"It can be used as a flexible, non-prescriptive assessment tool to analyze risk and compare potential new providers, helping identify gaps in risk management practices.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},381845,1792197499,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":73,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":30},2336464648322,"https://ap-avatar.wpscdn.com/avatar/2200025388227c56fec?_k=1778556882303663488","VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE  \nApril 2021  \nThis page is intentionally left blank.  \nVENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE  \nAbstract The following document is the result of a collaborative effort produced by the Cybersecurity and Infrastructure Security Agency (CISA) Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, Working Group 4 (hereinafter WG4), aimed at creating a standardized template of questions as a means to communicate ICT supply chain risk posture in a consistent way among public and private organizations of all sizes. The purpose of this assessment template is to normalize a set of questions regarding an ICT Supplier/Provider implementation and application of industry standards and best practices. This will enable both vendors and customers to communicate in a way that is more consistently understood, predictable, and actionable. These questions provide enhanced visibility and transparency into entity trust and assurance practices and assist in informed decision-making about acceptable risk exposure.  \nThis assessment may be used to illuminate potential gaps in risk management practicesand provides a flexible template that can help guide supply chain risk planning in a standard way. It is meant to be non-prescriptive and no specific use case is being mandated. The suggested use is as a tool for consistently analyzing risk when comparing potential new providers. This template builds upon existing industry standards to provide step-by-step guidance and improved awareness Key categories of vendor SCRM compliance are defined within the document, building on a framework of established industry standards and other Task Force efforts, while incorporating inputs from key industry standards and best practices, such as NIST SP 800-161, the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC), and the Outsourcing Network Services Assessment Tool (ONSAT) .  \nThe graphics below illustrate the incorporation of ONSAT Tool categories and input from the ICT SCRM Qualified Bidder/Manufacturer Lists (from CISA ICT SCRM Task Force Working Group 3) across the Template categories, as well as alignment of the Template categories to the NIST SP 800-161 categories.  \nContents  \nAbstract .......................................................................................................................................................................... 3  \nIntroduction ................................................................................................................................................................... 7  \nInstructions ................................................................................................................................................................ 7  \n1. Qualifying Questions ............................................................................................................................................. 8  \n2. Supply Chain Management and Supplier Governance ....................................................................................... 8  \nGeneral....................................................................................................................................................................... 8  \nInformation Communications Technology (ICT) Supply Chain Management ........................................................ 8  \nAuthentication and Provenance ............................................................................................................................... 9  \nSupplier Governance................................................................................................................................................. 9  \n3. Secure Design and Engineering ......................................................................................................................... 10  \nProduct Offering Lifecycle Mana","cbCaipnIxfmEfzxA","https://ap.wps.com/l/cbCaipnIxfmEfzxA","pdf",1587314,47,"English","# Abstract\n# Introduction\n# Instructions\n## 1. Qualifying Questions\n## 2. Supply Chain Management and Supplier Governance\n## 3. Secure Design and Engineering\n## 4. Information Security\n## 5. Physical Security\n## 6. Personnel Security","[{\"question\":\"What is the purpose of this ICT vendor SCRM template?\",\"answer\":\"It provides a standardized set of questions to communicate an ICT supply chain risk posture consistently across public and private organizations, improving predictability and decision-making.\"},{\"question\":\"Who developed the template?\",\"answer\":\"It was produced collaboratively by CISA’s Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, specifically Working Group 4 (WG4).\"},{\"question\":\"How should the template be used by vendors and customers?\",\"answer\":\"It can be used as a flexible, non-prescriptive assessment tool to analyze risk and compare potential new providers, helping identify gaps in risk management practices.\"}]","VENDOR SUPPLY CHAIN RISK MANAGEMENT (SCRM) TEMPLATE - April 2021 | PDF",1790247441]