Supplier Assessment Questionnaire

Supplier Assessment Questionnaire template: The assessment of one supplier and the products or services it provides, before award or renewal and at each review after that, with the organization's scoping and criticality answers, the supplier's questionnaire, the organization's own research with its sources, a rating against the same core risk factors for every supplier, and the decision, with a register of every supplier assessment, as SP 800-53 SR-6 requires.

Type	Program stage	Status	Template version	NIST basis
Form or register	Mature	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The assessment of one supplier and the products or services it provides, before award or renewal and at each review after that, with the organization’s scoping and criticality answers, the supplier’s questionnaire, the organization’s own research with its sources, a rating against the same core risk factors for every supplier, and the decision, with a register of every supplier assessment, as SP 800-53 SR-6 requires.

Controls satisfied

Control	Title
SR-6	Supplier Assessments and Reviews
SR-5	Acquisition Strategies, Tools, and Methods
RA-3(1)	Supply Chain Risk Assessment

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

The register as a spreadsheet: CSV, with one column per field.

Preview (annotated)

Guidance

Use one assessment for each supplier and the products or services it provides to the organization: a hardware or software vendor, a developer, an integrator, a reseller, or a service provider. NIST’s SR-6 discussion says a supplier review covers the supplier’s security and supply chain risk management processes, its foreign ownership, control or influence (FOCI), and its ability to assess its own second- and third-tier suppliers, and considers documented processes and controls, all-source intelligence and publicly available information. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), adds that assessments apply a consistent set of core factors and criteria, so suppliers can be compared with each other and over time, and that the sources of information are documented (Appendix A, SR-6). Its Appendix D.4 is a sample supply chain risk assessment, a toolbox of questions to choose from, with five steps: information gathering and scoping, threat analysis, vulnerability analysis, impact analysis and risk response analysis. Its Table 26, the Supply Chain Risk Management Assessment Scoping Questionnaire, groups questions by who answers them, the acquirer, the supplier or the manufacturer; NIST added a fillable spreadsheet version of Table 26 to the publication’s page on December 2, 2025.

This form follows those steps. Part A is answered by the organization and sets the supplier’s criticality; Part B is the questionnaire the supplier completes; Part C is the organization’s own research, with a source for every finding; Part D rates the same core risk factors for every supplier and combines them into a risk level; Part E records the responses and the decision; Part F sets the next review. Questionnaire answers alone are not an assessment: assessors expect the organization to check them. For a cloud or other external service, complete the external service review (SA-9) as well, and use the provider’s independent attestation as evidence in Part C. Each completed assessment is an attachment to the Supply Chain Risk Management Plan of every system that relies on the supplier. The register at the end lists every supplier assessment and when it is next due.

Assessment ID	Assessment type	Supplier	Products or services assessed	Assessor	Date completed	Next assessment due
Fill in: unique ID, as in the register	Fill in: initial (before award), renewal, annual, or triggered, with the trigger	Fill in: supplier legal name	Fill in: products or services, with versions or part numbers	Fill in: name and title	Fill in: date	Fill in: date

• The Chief Information Security Officer, through the supply chain risk management team, shall assess and review the supply chain risks of each supplier, and of the systems, components or services it provides, Fill in: the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide Typical: before each contract award or renewal, and annually for suppliers of critical components and services. (SR-6)
• Every assessment shall rate all the core risk factors in Part D, and record the source of each finding. (SR-6)

Part A. Scope and criticality (completed by the organization)

A1. Request

Item	Response
Requested by	Fill in: name, title and organizational unit
Purpose of the assessment	Fill in: for example a new purchase, a contract renewal, a supplier change, or a review after a notification
Systems that use or will use the product or service	Fill in: system names and identifiers
Description of the product or service, and how it will be used	Fill in: description
Product or service type	Fill in: hardware, software, firmware, cloud or other external service, development, integration, maintenance or disposal service
Where it sits in the system	Fill in: for example inside the authorization boundary, at the boundary, or an external service the system connects to
Contract, solicitation or agreement	Fill in: number, value and term, or “not yet awarded”
Point in the life cycle	Fill in: for example market research, source selection, before award, operational use, renewal

A2. Criticality

#	Question	Answer
A2.1	Does the product or service perform a security function, such as authentication, encryption, logging or boundary protection? If so, which?	Fill in: answer
A2.2	Will it have privileged or administrative access to the organization’s networks, operational technology or sensitive platforms?	Fill in: answer
A2.3	Could its compromise or failure cause a system failure or serious degradation of a mission or business function?	Fill in: answer
A2.4	If it failed or were compromised, is there an independent, reliable way to keep the function going?	Fill in: answer
A2.5	Will it store, process or transmit sensitive information, such as personal, health or payment information, or have access to systems that do?	Fill in: answer
A2.6	Will it connect to a platform the organization provides to its customers or the public?	Fill in: answer
A2.7	Will the supplier’s staff need physical access to the organization’s facilities, or remote access to its systems?	Fill in: answer
A2.8	How widely is, or will, the product or service be used across the organization?	Fill in: answer
A2.9	Is it available from other suppliers, and what would switching cost in money and time? Is it single-source?	Fill in: answer
A2.10	Does the organization keep spares or a reserve, and how well could it obtain the product or service during a major disruption?	Fill in: answer
A2.11	Is it made or developed in a location the organization considers a geopolitical risk?	Fill in: answer
A2.12	Is it fit for purpose, able to meet the required objectives and service levels?	Fill in: answer

Criticality: Fill in: critical, if the criticality analysis (RA-9) identifies the product or service as critical or if A2.1 to A2.3 show it is; otherwise not critical.

Assessment depth: Fill in: full, for a critical product or service, or a supplier of one; standard, for any other.

Guidance

SP 800-161 Rev. 1 Appendix D.4 says the organization weighs the priority of each assessment in deciding how rigorous it is. A full assessment uses every part of this form and verifies the supplier’s key answers with evidence. A standard assessment still rates every core factor in Part D, but may rely on a shorter questionnaire (the sections of Part B marked as core) and on public sources for the rest. If a standard assessment finds a high concern, complete the full assessment.

Part B. Supplier questionnaire (completed by the supplier)

Guidance

Send Part B to the supplier with the date it is due, and tell the supplier how its answers will be protected. Ask for evidence wherever the question says so; an answer with no evidence is rated with low confidence in Part D. Sections B1, B2, B3 and B6 are core and go to every supplier; B4 applies to software, firmware and products with code, and B5 to hardware and anything shipped.

Supplier contact for this questionnaire: Fill in: name, title, business email and phone.

B1. Company and ownership (core)

#	Question	Supplier’s answer	Evidence provided
B1.1	Give your legal name, any other names you trade under, your parent company and your place of incorporation.	Fill in: answer	Fill in: evidence
B1.2	Who owns or controls your company, directly or indirectly? Is any owner a foreign government or controlled by one?	Fill in: answer	Fill in: evidence
B1.3	Where are your headquarters and the facilities that research, develop, manufacture, test, package, distribute or support the product or service?	Fill in: answer	Fill in: evidence
B1.4	Do the laws of any country where you operate require you to share technology or data with that country’s government?	Fill in: answer	Fill in: evidence
B1.5	Do any of your officers, directors, staff or contractors have personal or professional ties to a foreign government?	Fill in: answer	Fill in: evidence
B1.6	Has your company been acquired, merged or significantly restructured in the last three years, or is such a change pending?	Fill in: answer	Fill in: evidence
B1.7	In the last three years, have you been subject to fines, sanctions, debarment, or litigation related to the product or service, its security or its delivery?	Fill in: answer	Fill in: evidence

B2. Supply chain risk management (core)

#	Question	Supplier’s answer	Evidence provided
B2.1	Do you have a documented supply chain risk management program, with policies and procedures?	Fill in: answer	Fill in: evidence
B2.2	Have you identified your own critical suppliers for the product or service? How do you assess and monitor them and their suppliers?	Fill in: answer	Fill in: evidence
B2.3	Can you list the sources of the hardware, software and services you use to provide the product or service, including distributors?	Fill in: answer	Fill in: evidence
B2.4	Do you pass security and supply chain requirements down to your subcontractors and suppliers in your contracts with them?	Fill in: answer	Fill in: evidence
B2.5	Where will replacement components come from during the contract?	Fill in: answer	Fill in: evidence
B2.6	How do you make sure none of your suppliers or third-party components is on a list of prohibited sources or products?	Fill in: answer	Fill in: evidence

B3. Security program and personnel (core)

#	Question	Supplier’s answer	Evidence provided
B3.1	Which security framework or standard does your program follow, and what independent assessments, audits or certifications cover the product or service? Give the scope and period of each.	Fill in: answer	Fill in: evidence
B3.2	Have you had a security incident or breach in the last three years that affected customers or the product or service? How were customers told?	Fill in: answer	Fill in: evidence
B3.3	How do you vet staff who work on the product or service, or on the organization’s account, and do you have an insider threat program?	Fill in: answer	Fill in: evidence
B3.4	Do your staff or your suppliers access customer or production environments remotely? How is that access controlled and logged?	Fill in: answer	Fill in: evidence
B3.5	Do your staff receive security training, including role-based training for developers and administrators?	Fill in: answer	Fill in: evidence

B4. Product integrity and secure development

#	Question	Supplier’s answer	Evidence provided
B4.1	Which secure development practices or framework do you follow, for example the NIST Secure Software Development Framework (SP 800-218)?	Fill in: answer	Fill in: evidence
B4.2	How do you protect your development and build environments and tools from tampering?	Fill in: answer	Fill in: evidence
B4.3	How do you select, check and keep track of open-source and third-party components before and after you use them?	Fill in: answer	Fill in: evidence
B4.4	Can you provide a software bill of materials, or for hardware a bill of materials covering logic-bearing parts and firmware?	Fill in: answer	Fill in: evidence
B4.5	Are releases, updates and firmware digitally signed, or published with hashes customers can verify?	Fill in: answer	Fill in: evidence
B4.6	How do you receive, prioritize and fix reported vulnerabilities, and in what time frames? Do you publish a vulnerability disclosure policy?	Fill in: answer	Fill in: evidence
B4.7	Do you run a product security incident response team, and how are customers told when a product they use is affected?	Fill in: answer	Fill in: evidence
B4.8	Until what date will the product be supported with security updates?	Fill in: answer	Fill in: evidence
B4.9	If the product uses cryptography, are its modules validated under the FIPS 140 standard? Give the certificate numbers.	Fill in: answer	Fill in: evidence

B5. Logistics, delivery and counterfeit prevention

#	Question	Supplier’s answer	Evidence provided
B5.1	Do you buy hardware only from original manufacturers or their authorized distributors or resellers?	Fill in: answer	Fill in: evidence
B5.2	What controls do you have to detect and prevent counterfeit, tampered or nonconforming parts, and do you report the ones you find?	Fill in: answer	Fill in: evidence
B5.3	Can you trace part numbers and serial numbers back to their manufacturers?	Fill in: answer	Fill in: evidence
B5.4	How are finished products stored and protected from tampering before shipment, and is inventory inspected periodically?	Fill in: answer	Fill in: evidence
B5.5	Do you ship in tamper-evident packaging, with tracked delivery and a documented chain of custody?	Fill in: answer	Fill in: evidence
B5.6	How do you destroy scrap, rejected and unused parts so they cannot re-enter the supply chain?	Fill in: answer	Fill in: evidence
B5.7	Have you analyzed events, natural or human-made, that could interrupt your supply, and what are your continuity arrangements?	Fill in: answer	Fill in: evidence

B6. Notification and transparency (core)

#	Question	Supplier’s answer	Evidence provided
B6.1	Will you notify the organization of a compromise or suspected compromise in your supply chain that may affect the product or service, and how quickly?	Fill in: answer	Fill in: evidence
B6.2	Will you share the results of independent assessments or audits of the product, service, or your development or manufacturing processes?	Fill in: answer	Fill in: evidence
B6.3	Do your agreements with your own suppliers require them to notify you of compromises?	Fill in: answer	Fill in: evidence
B6.4	Who is your contact for supply chain and security notices, and how is it kept current?	Fill in: answer	Fill in: evidence

B7. Supplier attestation

The answers in Part B are accurate and complete to the best of my knowledge, and the supplier will tell Organization name of any material change to them during the contract.

Name	Title	Signature	Date
Fill in: name	Fill in: title		Fill in: date

Part C. Research and verification (completed by the organization)

#	Check	Sources used	Date checked	Finding	Confidence (high, medium or low)
C1	Ownership, corporate family and key leadership, compared with B1	Fill in: for example business registries, public filings, commercial company data	Fill in: date	Fill in: finding	Fill in: confidence
C2	Indicators of foreign ownership, control or influence	Fill in: sources	Fill in: date	Fill in: finding	Fill in: confidence
C3	Sanctions, exclusion and prohibited-source lists that apply to the organization	Fill in: the lists checked	Fill in: date	Fill in: finding	Fill in: confidence
C4	Litigation, fines, regulatory actions and fraud	Fill in: sources	Fill in: date	Fill in: finding	Fill in: confidence
C5	Breaches, incidents and intellectual property theft involving the supplier	Fill in: for example news, regulator disclosures, threat intelligence	Fill in: date	Fill in: finding	Fill in: confidence
C6	Known vulnerabilities in the products, and how fast the supplier fixed past ones	Fill in: for example the National Vulnerability Database, CISA’s Known Exploited Vulnerabilities Catalog, the supplier’s advisories	Fill in: date	Fill in: finding	Fill in: confidence
C7	Financial health and stability	Fill in: sources	Fill in: date	Fill in: finding	Fill in: confidence
C8	Quality and past performance: recalls, complaints, the organization’s own experience	Fill in: sources	Fill in: date	Fill in: finding	Fill in: confidence
C9	Reports of counterfeit or nonconforming products associated with the supplier	Fill in: sources	Fill in: date	Fill in: finding	Fill in: confidence
C10	The supplier’s independent assessments and certifications: current, from a credible assessor, covering the product or service used, and their exceptions	Fill in: the reports reviewed	Fill in: date	Fill in: finding	Fill in: confidence
C11	Supplier answers checked against evidence: which answers, and what was seen	Fill in: the evidence reviewed	Fill in: date	Fill in: finding	Fill in: confidence

• The assessor shall check, against evidence or an independent source, every supplier answer that bears on a factor rated a high concern, and for a full assessment the answers to B1.2, B2.2, B3.1, B3.2 and B6.1 at least. (SR-6)
• Each finding shall record the source it came from and the date it was checked; a factor for which nothing could be found shall be recorded as such, not left blank. (SR-6)

Guidance

SP 800-161 Rev. 1 Appendix E.3.1 says information quality matters: it should be timely, relevant, unbiased, sufficiently complete and from credible sources, and the confidence in each finding should be recorded. Keep a copy or a durable reference of each source behind a finding that affects the decision, since a source may change or disappear.

Part D. Risk analysis (completed by the organization)

D1. Core risk factors

Rate every factor for every supplier, using the answers in Parts A and B and the findings in Part C.

Factor	Considers	Questions and checks	Concern (none found, low, moderate or high)	Confidence	Notes
1. Criticality and reliance	What the product or service does for the system, alternatives, single source, reserves	A2.1 to A2.4, A2.8 to A2.10	Fill in: concern	Fill in: confidence	Fill in: notes
2. Information and access	Sensitive information, privileged, remote and physical access, connections	A2.5 to A2.7, B3.4	Fill in: concern	Fill in: confidence	Fill in: notes
3. Ownership, control or influence	Owners, foreign government control or influence, legal duties to share data, ties of key people	B1.1 to B1.6, C1, C2	Fill in: concern	Fill in: confidence	Fill in: notes
4. Geography and location	Where the work is done; instability, natural hazards and trade route disruption there	A2.11, B1.3, B5.7	Fill in: concern	Fill in: confidence	Fill in: notes
5. Company stability and past performance	Financial health, restructuring, quality, recalls, the organization’s experience	B1.6, C7, C8	Fill in: concern	Fill in: confidence	Fill in: notes
6. Compliance and legal	Fines, sanctions, exclusions, litigation, fraud	B1.7, C3, C4	Fill in: concern	Fill in: confidence	Fill in: notes
7. Security and supply chain risk management processes	The supplier’s program, independent assessments, personnel security, training	B2.1, B3.1, B3.3, B3.5, C10	Fill in: concern	Fill in: confidence	Fill in: notes
8. Sub-tier suppliers	The supplier’s ability to identify and assess its own second- and third-tier suppliers, and flow-down	B2.2 to B2.6	Fill in: concern	Fill in: confidence	Fill in: notes
9. Cybersecurity history	Incidents, breaches and theft at the supplier	B3.2, C5	Fill in: concern	Fill in: confidence	Fill in: notes
10. Product integrity and vulnerability handling	Secure development, build protection, bills of materials, signing, vulnerability response, support period	B4.1 to B4.9, C6	Fill in: concern, or “not applicable” with the reason	Fill in: confidence	Fill in: notes
11. Counterfeit and nonconforming products, and delivery	Authorized sources, counterfeit controls, traceability, packaging, chain of custody, scrap	B5.1 to B5.6, C9	Fill in: concern, or “not applicable” with the reason	Fill in: confidence	Fill in: notes
12. Notification and transparency	Compromise notice, sharing of assessment results, notice flowed down	B6.1 to B6.4	Fill in: concern	Fill in: confidence	Fill in: notes

Guidance

Factors 3, 7 and 8 are the review topics NIST’s SR-6 discussion names; factor 12 supports the notification agreements of SR-8; factor 11 supports SR-11. The other factors follow the baseline risk factors in SP 800-161 Rev. 1 Appendix E.2.2 and the topics of its Table 26. Define concern levels once, in the supply chain risk management team’s procedure, so different assessors rate alike: for example, “high” where a finding shows the supplier cannot or will not protect the product or service, or where an owner or a law gives a hostile party control over it. A high concern on one factor does not by itself make the supplier unacceptable; SP 800-161 Rev. 1 (Appendix E.2.2) cautions that the combination of findings, and the mitigations available, decide the risk.

D2. Overall risk

Element	Level	Basis
Threat: an adversary’s capability and intent to exploit the supplier, product or service, or a non-adversarial threat to it	Fill in: critical, high, moderate or low	Fill in: the findings that set the level
Vulnerability: how exposed and how easily exploited the supplier’s or product’s weaknesses are	Fill in: critical, high, moderate or low	Fill in: the findings that set the level
Impact: the harm to the organization if the product or service fails to perform as designed or is compromised	Fill in: critical, high, moderate or low	Fill in: criticality from Part A
Likelihood, from threat and vulnerability	Fill in: on the organization’s likelihood scale	Fill in: basis
Risk, from likelihood and impact	Fill in: on the organization’s risk scale	Fill in: basis

Guidance

The threat, vulnerability and impact analyses, each rated critical, high, moderate or low, follow SP 800-161 Rev. 1 Appendix D.4.1.4 to D.4.1.6, and D.4.1.7 combines threat and vulnerability into likelihood, then likelihood and impact into risk. Use the likelihood and risk scales of the organization’s risk management strategy, as the risk register does, so supplier risks can be compared with other risks.

Part E. Risk response and decision

Risk	Rating	Response (accept, mitigate, transfer or avoid)	Measures	Owner	Tracked in
Fill in: risk	Fill in: rating	Fill in: response	Fill in: for example added contract terms (SR-5), notification terms (SR-8), inspection before use (SR-10), a second source, or limits on the supplier’s access	Fill in: role	Fill in: risk register or POA&M item

Decision: Fill in: proceed; proceed with the conditions listed; or do not proceed.

Conditions: Fill in: conditions, or “none”.

• A contract for a critical component or service shall not be awarded or renewed until this assessment is complete and each risk found is accepted or has a planned response. (SR-6)
• A risk that remains above the supply chain risk tolerance of a system that relies on the supplier shall be accepted by that system’s authorizing official before award or renewal, and recorded in the system’s Supply Chain Risk Management Plan. (SR-6, SR-2a)
• The results shall be shared with other organizations only as applicable rules, policies, agreements or contracts allow or require. (SR-6)

Name	Role	Decision or recommendation	Signature	Date
Fill in: name	Assessor, supply chain risk management team	Fill in: recommendation		Fill in: date
Fill in: name	Lead of the supply chain risk management team	Fill in: recommendation		Fill in: date
Fill in: name	System owner of each system that relies on the supplier	Fill in: decision		Fill in: date
Fill in: name	Authorizing official, where a risk above tolerance is accepted	Fill in: decision		Fill in: date

Part F. Monitoring and reassessment

• The supply chain risk management team shall reassess the supplier Fill in: the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide Typical: before each contract award or renewal, and annually for suppliers of critical components and services, and when any of these occurs: a change in the supplier’s ownership or control, a merger or acquisition, a move of manufacturing, development or support to another country, a compromise notification or a breach at the supplier, a counterfeit or tampered component traced to it, a new sanctions or exclusion listing, or a change in what the organization buys from it. (SR-6)
• For suppliers of critical components and services, the team shall monitor publicly available information Fill in: frequency, for example monthly for indications of stolen information, poor development or quality control practices, information spillage or counterfeits, and record what it found. (SR-6)

Monitoring activity	Frequency	Who	Last done	Result
Public-source monitoring of the supplier	Fill in: frequency	Fill in: role	Fill in: date	Fill in: result
Review of new independent assessments from the supplier	Fill in: for example when issued	Fill in: role	Fill in: date	Fill in: result
Check against sanctions and exclusion lists	Fill in: for example before each order and quarterly	Fill in: role	Fill in: date	Fill in: result

The completed assessment, the supplier’s answers and the evidence are kept for Fill in: retention period, for example the life of the contract plus three years, with access limited to Fill in: roles, since they may contain the supplier’s proprietary information.

Federal systems

41 U.S.C. § 1326(a) makes the head of each executive agency responsible for assessing the supply chain risk posed by the acquisition and use of covered articles, and for prioritizing those assessments based on the criticality of the mission, system, component, service or asset. NIST SP 800-161 Rev. 1, Appendix E, gives federal agencies baseline risk factors (Table 28 in section E.2.2) to address, at a minimum, for assessments of critical sources and critical covered articles, and lists federal prohibition and restriction lists to examine as part of the assessment, such as the Treasury sanctions lists and the exclusions in the System for Award Management. Section E.2.1 says determining assessment priorities, evaluating impact and making risk response decisions are inherently governmental functions that cannot be outsourced, although a qualified, vetted third party may support research and documentation. Section E.2.3 sets a five-level supply chain risk severity schema, and section E.2.4 says risks at Level 3 and above are “substantial risk” under the Federal Acquisition Security Council’s rule and require sharing with the Council through its information sharing agency. Under 41 CFR 201-1.201(b), an executive agency must expeditiously submit supply chain risk information to that agency when the Council requests it, or when the agency determines there is a reasonable basis to conclude that a substantial supply chain risk exists in connection with a source or covered article. Section E.3.1 (Table 30) lists the minimum content of an assessment record. Statute checked in the United States Code, 2024 edition, and regulation in the eCFR, as of October 2026.

• Assessments of critical sources and critical covered articles shall address every baseline risk factor in SP 800-161 Rev. 1, Appendix E, Table 28, recording where each is covered in Part D and any factor added. (SR-6)
• The assessor shall check the supplier and the covered article against the federal prohibition and restriction lists that SP 800-161 Rev. 1, Appendix E, section E.2.2 names, and any other federal restriction that applies, and record the result in check C3. (SR-6)
• Agency officials shall set assessment priorities, evaluate impact and make each risk response decision; a contractor may support research and documentation but shall not make those decisions. (SR-6)
• The assessor shall assign each assessed risk a level of the supply chain risk severity schema in SP 800-161 Rev. 1, Appendix E, section E.2.3, and record the level and the reason in Part D. (SR-6)
• When an assessment finds a reasonable basis to conclude that a substantial supply chain risk exists, the Chief Information Security Officer shall submit the relevant supply chain risk information to the Federal Acquisition Security Council’s information sharing agency, as 41 CFR 201-1.201(b) requires, and escalate the assessment to senior agency officials and legal counsel. (SR-6)
• The assessment record shall include at least the content in SP 800-161 Rev. 1, Appendix E, Table 30, including the methodology used and any deviation from it, the data sources, the confidence in the findings, and review and clearance by senior leadership and legal counsel for a risk assessed as substantial. (SR-6)

SP 800-161 Rev. 1 Table 28 baseline risk factor	Where this form covers it
Purpose	Part A1
Criticality	Part A2; factor 1
Information and data	A2.5; factor 2
Reliance on the covered article or source	A2.8 to A2.10; factor 1
User or operational environment	A1; the system security plan and the Supply Chain Risk Management Plan
External agency interdependencies	Fill in: where recorded, for example A1 and the information exchange agreements
Functionality, features and components of the covered article	Factor 10
Company (source) information	Factor 5
Quality and past performance	Factor 5
Personnel	B3.3; factor 7
Physical	B5.4, B5.7; factor 4
Geopolitical	Factor 4
Foreign ownership, control or influence	Factor 3
Compliance and legal	Factor 6
Fraud, corruption, sanctions and alignment with government interests	C3, C4; factor 6
Cybersecurity	Factor 9
Counterfeit and non-conforming products	Factor 11
Supply chain relationships, visibility and controls	Factor 8

Register

Assessment ID	Supplier	Products or services	Systems that rely on it	Criticality	Assessment type	Date completed	Overall risk	Decision	Open risks and where tracked	Next assessment due	Assessor
Fill in: ID	Fill in: supplier	Fill in: products or services	Fill in: systems	Fill in: critical or not critical	Fill in: initial, renewal, annual or triggered	Fill in: date	Fill in: risk level	Fill in: proceed, proceed with conditions, or do not proceed	Fill in: number, with risk register or POA&M items	Fill in: date	Fill in: name