Subcontractor cybersecurity questionnaire template, one line per system
A subcontractor cybersecurity questionnaire for a Department of War (DoD) prime works best as short answers, one line per information system, not a forty-page survey: the SPRS score and its date, the CMMC status with its UID, date and affirmation, the information involved, incident reporting and the frameworks held. Download the columns as a CSV, fill it in or send it out, then paste it back and every line is read.
Columns the register reads
header names are matched loosely| Column | What goes in it | Needed |
|---|---|---|
| Subcontractor | the legal business name | required |
| CAGE or UEI | five characters (CAGE) or twelve (UEI) | required |
| CMMC UID | the ten letters and digits SPRS assigns each CMMC assessment; one line per system | advised |
| System or enclave | a short name for the system the line covers | optional |
| Subcontract | the subcontract or purchase order the line applies to | optional |
| SPRS score | a whole number from -203 to 110, as posted in SPRS; a score, not a status | for CUI |
| SPRS assessment date | the date of the assessment behind the score | for CUI |
| CMMC level | Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), Level 3 or none yet | strongly advised |
| CMMC status | final or conditional | strongly advised |
| CMMC status date | the CMMC Status Date in SPRS | strongly advised |
| Affirmation date | the date of the latest annual affirmation in SPRS | strongly advised |
| Affirming official | the role of the official who affirmed, a name if you like | advised |
| Information involved | the subcontractor's declaration: CUI, FCI only, neither or not sure | strongly advised |
| Prime's determination | your own reading of the same, if you have made one; the line is read by it | optional |
| 7012 incident reporting | yes (holds a medium assurance certificate), applying, or no | for CUI |
| Frameworks held | ISO 27001, SOC 2, NIST CSF 2.0, FedRAMP Moderate, CIS v8, NIST SP 800-53, NIST SP 800-171 Rev 3, separated by semicolons | optional |
| POA&M open items | a whole number, 0 if none; the count only | advised |
| POA&M close date | the planned close date, if items are open | advised |
| Contact | a name and role to ask | optional |
The four rows in the CSV
invented| Subcontractor | CAGE or UEI | CMMC UID | SPRS score | CMMC level | CMMC status |
|---|---|---|---|---|---|
| Example Machine Shop | 1AB23 | EXMS1AB231 | 96 | Level 2 (Self) | final |
| Example Software Firm | 2CD45 | none yet | |||
| Example Courier | 3EF67 | Level 1 (Self) | final | ||
| Example Plating Shop | 4GH89 | EXPS4GH891 | 84 | Level 2 (Self) | conditional |
Or skip the spreadsheet: on Solo, one collection link gives every subcontractor the same short form, no account, about five minutes, and each answer lands in the register. The form asks nothing that is CUI.