03_CLDC Integrated DRD July 2026.pdf

Draft Request for Proposal (RFP)

Commercial Low Earth Orbit (LEO) Destination Contract (CLDC)

PART III – ATTACHMENTS

SECTION J – LIST OF ATTACHMENTS

ATTACHMENT J-02 DATA REQUIREMENTS DESCRIPTIONS (DRDs)

CONTRACT DATA REQUIREMENTS LIST

National Aeronautics and Space Administration

Johnson Space Center

1.0 INTRODUCTION

This document defines the requirements for contractual data to be delivered by the contractor to the

Government. The data requirements are set forth in each Data Requirements Description (DRD) and shall govern that data required by the contract. The contractor shall furnish data defined by the DRDs as listed on the Contract Data Requirements List (CDRL) by category of data, attached hereto, and made a part of this contract. Such data shall be prepared, deliver, and maintain to NASA in accordance with the requirements set forth within this document.

This document sets forth the data requirements in each DRD and shall govern the data required under this contract. The Contractor shall furnish data defined by the DRDs listed by category of data. Such data shall be prepared, maintained, and delivered to National Aeronautics and Space Administration

(NASA) in accordance with the requirements set forth herein. NASA-Owned/Contractor-Held records shall be managed by the Contractor in accordance with Title 36 of the Code of Federal Regulations, Chapter XII B. Records Management and NPD 1440.6, NASA Records Management. The records shall be organized in accordance with the instructions in NPR.1441.1, NASA Records Management

Program Requirements as applicable. The Contractor shall disposition records and non-records in accordance with NPR 1441.1, which has been approved by NASA. All questions on records management issues shall be directed through the Contracting Officer or the Contracting Officer

Representative.

2.0 ORGANIZATION OF CONTRACT DATA REQUIREMENTS LIST

Throughout the performance of the contract, the Contract Data Requirements List (CDRL) provides a listing by number, data type, title, and Office of Primary Responsibility (OPR). Each DRD included in this CDRL prescribes content, format, and submittal requirements.

2.1 DRD NUMBERING

For the purpose of classification and control, the individual data deliverables in the CDRL are grouped into the following categories:

0XX series DRDs applicable to all contract activities

1XX series DRDs applicable to Contract Line-Item Number (CLIN) 1 Initial Development, CLIN 2

CLDS Development, Demonstration, & Certification, Certification maintenance, and any re-

Certification

2XX series DRDs applicable to CLIN 3 Mission Services

2.2 DATA TYPES

Each DRD is classified by data type as defined below:

TYPE DESCRIPTION

1 That information and documentation which requires NASA approval prior to release. Approved Type 1 information and documentation shall be controlled, and deviations from or changes to the concepts, techniques, and/or requirements stated therein shall require NASA approval prior to implementation. All work under this contract covered by Type 1 documents shall be performed in accordance with those approved documents. The Contracting Officer’s

Representative has approval authority and signs the data prior to its release.

Contractually binding documents shall only be implemented or revised via a contract modification.

2 That information and documentation for which NASA reserves a time-limited right to disapprove. Type 2 data shall be submitted to designated repository for review not less than 45 calendar days prior to its release for use or implementation. The Contractor shall clearly identify the target release date in the ‘submitted for review’ transmittal. If the Contractor has not received any comment prior to the target released date, the document may be released for appropriate use. Any NASA comment received shall be appropriately dispositioned and resubmitted prior to implementation, restarting the 45-day review period.

3 That information and documentation which does not require formal NASA review and approval. Information in this category would include statuses, analyses, test results, handbooks and other designated lists, reports, etc. While type 3 deliverables do not require NASA approval, the deliverable must satisfy all applicable contractual requirements.

2.3 DATA FIDELITY

In addition to the required frequency for data deliverable submittals, the DRD also defines the level of readiness/fidelity, which applies to the submission of DRDs:

Draft (D) - A preliminary version of a delivery for NASA review. Draft versions may contain some To

Be Determined (TBD) items.

Baseline (B) - The Contractor’s internally approved version of the product. It must be of sufficient fidelity to permit NASA disposition in accordance with the DRD Type. Baseline submittals may contain some To Be Determined (TBD) items but are of higher fidelity than a Draft version.

Final (F) - A Final version of a delivery shall reflect the Contractor’s internally approved final version of the product and is ready for NASA disposition in accordance with the DRD Type. No TBDs may be included.

3.0 STATEMENT OF GENERAL REQUIREMENTS

3.1 SUBCONTRACTOR DATA REQUIREMENT

The prime contractor is responsible for flowing down any specific data requirements that apply to subcontracts and vendor agreements.

Reference to subcontractor data in the contractor’s responses is permissible and a copy of the referenced subcontractor data must be supplied with the response document at time of delivery to

NASA.

3.2 DATA DISTRIBUTION AND TRANSMITTAL

For DRD types 1, 2, and 3, the contractor shall electronically deliver DRDs to the CDO Program

Authorized Repository as identified by the Contracting Officer. The contractor shall notify the distribution recipients when DRDs have been submitted to the CDO Program Authorized Repository.

Distribution recipients are identified within each DRD Section 11.

For each DRD, the transmittal package shall include:

1. Contract number

2. Task Order number (if applicable)

3. DRD number

4. DRD data type

5. Submission date

6. Milestone being satisfied (if applicable)

7. Document number, date and revision

8. Document title

9. File names of all files being delivered; file naming convention shall clearly identify the document being delivered; multiple files per document must be clearly related to the document

10. Distribution (Notification list as defined by the DRD distribution field)

11. Targeted release date

All Type 1 documentation shall be marked “PRELIMINARY PENDING NASA APPROVAL,” and once approved shall be reissued with “APPROVED BY NASA” and the date and approval authority annotated on the cover.

3.3 DATA FORMAT

Existing Contractor internal documents may be used to meet the data requirements of the DRD to the extent practicable. The DRDs will call out any special format requirements if they are required.

The Contractor’s submittal in response to the DRDs shall be provided in an electronic format that meets four basic requirements: “Readable,” “Printable,” “Searchable,” and “Downloadable” by NASA utilizing publicly available off-the-shelf software. If the electronic format is not supported by publicly available off-the-shelf software, the Contractor shall provide NASA with the necessary software and approach to support the four basic requirements

3.4 DATA RESTRICTION DETERMINATION AND MARKING REQUIREMENTS

The contractor shall properly mark data in accordance with the data rights clause(s) included in the contract. The contractor shall mark data deliverable sections with appropriate data restrictions and export classifications. The contractor shall not apply the most restrictive classification to the entire data delivery if only applicable to one section. If NASA does not agree with the contractor applied data restriction, the

CO shall request supporting rationale for applied data restrictions. If NASA does not agree with the rationale, the CO shall return the data to the contractor, cancel the markings, or ignore the markings consistent with the procedures set forth in the "data rights" clause(s) contained in the contract and per

U.S. export laws.

The contractor shall ensure all Controlled but Unclassified Information (CUI) is marked in accordance with NASA Procedural Requirements (NPR) 2810.7, Controlled Unclassified Information and ITS-HBK-

CUI, Controlled Unclassified Information Handbook.

If data delivered under this contract is subject to the International Traffic in Arms Regulations (ITAR), the data shall contain an “ITAR Notice” as follows:

If data delivered under this contract is subject to the Export Administration Regulations (EAR), the data shall contain the “EAR Notice” as follows:

4.0 DRD MAINTENANCE PROCEDURES

4.1 CONFIGURATION MANAGEMENT OF DRDs

The Contractor shall employ a system for organizing, identifying, and tracking all submittals of DRDs, to include any changes or revisions. Updates to DRDs shall be incorporated by resubmission of the document. Changes shall be incorporated by complete reissue with a change log in the front matter of the document.

If the DRD is a type 1 DRD, DRD deliverable submittals shall include two versions 1) a clean copy with redlines incorporated 2) and Redlined version showing the updates made since the last submittal.

4.2 CDRL OR DRD CHANGE PROCEDURES

Revisions to the CDRL or DRDs will be identified by NASA in the Document Change Log. The date of the revision, DRD number, title, and revision description will be annotated in the Document Change Log.

International Traffic in Arms Regulations (ITAR) Notice

This document contains information which falls under the purview of the United States

(U.S.) Munitions List (USML), as defined in the International Traffic in Arms

Regulations (ITAR), 22 CFR 120-130, and is export controlled. It shall not be transferred to foreign nationals, in the U.S. or abroad, without specific approval of a knowledgeable NASA export control official, and/or unless an export license/license exemption is obtained/available from the United States Department of State. Violations of these regulations are punishable by fine, imprisonment, or both.

Insert Destination Control Statement that includes export classification and corresponding export authority.

Export Administration Regulations (EAR) Notice

This document contains information within the purview of the Export Administration

Regulations (EAR), 15 CFR 730-774, and is export controlled. It may not be transferred to foreign nationals in the U.S. or abroad without specific approval of a knowledgeable NASA export control official, and/or unless an export license/license exception is obtained/available from the Bureau of Industry and Security, United States

Department of Commerce. Violations of these regulations are punishable by fine, imprisonment, or both.

Insert Destination Control Statement that includes export classification and corresponding export authority.

Revision descriptions will include the modification number, which implements the change, and a brief description of the portions of the CDRL and/or DRD affected within the “Revision” column of the

Document Change Log.

5.0 REFERENCE TO OTHER DOCUMENTS AND DATA DELIVERABLES IN DATA

SUBMITTALS

The Contractor’s submittal of a DRD deliverable may refer to other documents and/or other DRD deliverables. At the time of submission of the DRD deliverable, any referenced document within the DRD deliverable shall be made available to NASA. The Contractor shall provide NASA with access to any referenced document and the location of that data within the referenced document. Any reference made to data associated with another DRD deliverable that is required separately by the contract, shall include the

DRD number of and location of the data within the referenced DRD deliverable.

6.0 DATA REQUIREMENTS LIST (DRL)

DRD # DRD Title

Ty p e

O P

R

P ro p o sa l

C o n tr ac t

A w ar d

C B

R

P D

R if p ro p o se d

C D

R

M

TR

R

SS

R

SI

R

A P

R

D C

R

SC

R

M B

R /V

B R

L-m

M

IR

L-m

U

IR

L-

6m

FO

U

R

L- 4m

C

IR

L-

3m

M C

R

L- 3m

O R

R

L- 1m

FR

R

L-

1w

Notes:

D=Draft

B = Baseline

F = Final

CA = Contract Award

* = Whichever occurs earlier m=months; w=weeks; d=days

CLDC-001 Integrated Master Schedule 3 CDO D

CLDC-002 Commercialization Plan 3 CDO B

CLDC-003 Organizational Conflicts of Interest (OCI) Plan 1 CDO B F+30d

CLDC-004 Information Technology Security Plans 2 CDO B B ITSMP at Contract Award;

B ITSP at Contract Award + 30 days

CLDC-005 Export Control Plan 3 CDO B+30d

CLDC-006 Configuration Management Plan 1 CDO B F

CLDC-007 Environmental Compliance Reports 3 CDO If applicable

CLDC-008 Small Business Subcontracting Plan and Reports 2 CDO F

CLDC-009 Commercial Activities Management Plan 1 CDO B F* F*

CLDC-010 Government Property Management Plan 1 CDO F+30d If applicable

CLDC-011 Financial Reporting Contractor-Held Property 1 CDO If applicable

CLDC-012

Information Technology (IT) Capital Planning and

Investment Control (CPIC)

2 CDO

CLDC-013 Commercial IT Authorization Report 3 CDO B+90d

CLDC-014 Security Requirements for Unclassified IT Resources 1 CDO

CLDC-015 Program Management Plan 1 CDO F

CLDC-101 Systems Engineering Management Plan 1 CDO B

F+60d

CLDC-102 Verification, Validation, and Certification Plan 1 CDO B

F+60d

CLDC-103

NASA Standards and Specifications Compliance and

Tailoring

1 CDO D B F* F*

CLDC-104 Insight and Collaboration Implementation Plan 1 CDO B F

CLDC-105

Integrated Performance Analysis and Integrated Testing

Plan

1 CDO B F

CLDC-106 Verification Closure Notice (VCN) 1 CDO F F

CLDC-107 Software Management Plan 1 CDO B B F

CLDC-108 Human Systems Integration (HSI) 1/3 CDO

CLDC-108.1 HSI Plan 1 CDO B F

CLDC-108.2 Task Analysis 3 CDO B* B* F

CLDC-108.3 HITL Summary Report 3 CDO F

CLDC-109 Human Error Analysis 1/3 CDO

CLDC-109.1 HEA Plan 1 CDO B F

CLDC-109.2 HEA Results and Reports 3 CDO B F

CLDC-110 Acoustics Noise Control Plan 3 CDO F* F*

CLDC-111 Medical Operations Plan 1 CDO B* B* F

CLDC-112 Food and Nutrition Plan 1 CDO B F

CLDC-113 Health Stabilization Program (HSP) Plan 1 CDO B F

CLDC-114 Medical and Crew Health System Plan 2 CDO B F

See DRD

See DRD

Monthly on the 15th of each month

Delivery/Update Frequency

Updated Quarterly

IMS Monthly; SRA semi-annually & Certification milestones

Annual Revalidation

Annually by Dec 1st

Property Report by Oct 31 Annually; Property Financial Report Monthly

Reviewed and Updated Annually, if Required

See DRD

Reviewed and Updated Annually, if Required p e

O P

R

P ro p o sa l

C o n tr ac t

A w ar d

C B

R

P D

R if p ro p o se d

C D

R

M

TR

R

S S

R

SI

R

A P

R

D C

R

S C

R

M B

R /V

B R

L-m

M

IR

L-m

U

IR

L-m

FO

U

R

L-m

C

IR

L-m

M C

R

L-m

O R

R

L-m

FR

R

L-w

Notes:

D=Draft

B = Baseline

F = Final

CA = Contract Award

* = Whichever occurs earlier m=months; w=weeks; d=days

CLDC-115 Safety & Mission Assurance (SMA) Plan 1 CDO

CLDC-115.1 Destination SMA Plan 1 CDO D B F* F*

CLDC-115.2 Crew Visiting Vehicle (CVV) SMA Plan 1 CDO F

CLDC-115.3 Cargo Visiting Vehicle (CaVV) SMA Plan 1 CDO F

CLDC-116 Risk Management Plan 1 CDO D B F* F*

CLDC-117 Mishap Preparedness and Contingency Plan (MPCP) 1 CDO B* B* F

CLDC-118 Safety Data Package 1 CDO

CLDC-119 Micrometeoroid Orbital Debris (MMOD) Report 1 CDO

CLDC-119.1 Destination MMOD Report 1 CDO B^ F ^ Baseline six months prior to CDR; UAR at

CDR

CLDC-119.2 CVV MMOD Report 1 CDO B^ F ^ Baseline six months prior to CDR; UAR at

CDR

CLDC-119.3 CaVV MMOD Report 1 CDO B^ F ^ Baseline six months prior to CDR; UAR at

CDR

CLDC-120 Jettison Plan 2 CDO B F

CLDC-121

Nonconformity (NC) Reporting and Review Board

Status

3 CDO

CA+

90d

Contract Award +90 days; Quarterly thereafter

CLDC-122 Supply Chain Visibility (SCV) Reporting 3 CDO

CA+

30d

CLDC-123 Destination Disposal Plan 1 CDO B F

CLDC-124 Utilization Integration Plan 1 CDO D B* B* F

CLDC-125 Payload Users Guide 3 CDO B F

CLDC-126 Science Data Management Plan 1 CDO B F

CLDC-127 Mission Systems Plan 1 CDO B F

CLDC-128 Operations and Training Plan 1 CDO B

CLDC-129 Crew Code of Conduct 1 CDO D B F

CLDC-130 Crew Selection and Evaluation Plan 1 CDO B F

CLDC-131 Pre-Launch and Post-Landing Operations 1 CDO B F

CLDC-132 Vehicle Interface Definition Document (IDD) 3 CDO

CLDC-132.1 Destination Vehicle IDD 3 CDO B F

CLDC-132.2 Crew Visiting Vehicle (CVV) IDD 3 CDO B F

CLDC-132.3 Cargo Visiting Vehicle (CaVV) IDD 3 CDO B F

CLDC-133 Integrated Maintenance and Logistics Support 1/3 CDO

CLDC-133.1 IMLS Plan 1 CDO B F* F*

CLDC-133.2 IMLS Data 3 CDO B F

CLDC-201

Mission Integration and Operations Management Plan

(MIOMP)

2 CDO

CLDC-201.1 Destination Mission Integration and Operations Plan 2 CDO B F

CLDC-201.2 Crew Transportation MIOMP 2 CDO B F

CLDC-201.3 Cargo Transportation MIOMP 2 CDO B F

Delivery/Update Frequency

Quarterly

Thirty (30) days prior to each Safety Review

Final due one year prior to start of crew training of first mission

Every 6 months thereafter p e

O P

R

P ro p o sa l

C o n tr ac t

A w ar d

C B

R

P D

R if p ro p o se d

C D

R

M

TR

R

S S

R

SI

R

A P

R

D C

R

S C

R

M B

R /V

B R

L-m

M

IR

L-m

U

IR

L-m

FO

U

R

L-m

C

IR

L-m

M C

R

L-m

O R

R

L-m

FR

R

L-w

Notes:

D=Draft

B = Baseline

F = Final

CA = Contract Award

* = Whichever occurs earlier m=months; w=weeks; d=days

CLDC-202 Mission Resource Allocation Document (MRAD) 2/3 CDO

CLDC-202.1 Crew Visiting Vehicle MRAD 2/3 CDO See DRD for addt'l deliveries

CLDC-202.2 Cargo Visiting Vehicle MRAD 2/3 CDO

CLDC-203 Tactical Increment Execution Report (TIER) 2/3 CDO B F

CLDC-204 Imagery Plan 2/3 CDO B F

CLDC-205 Post Increment Report 2 CDO

CLDC-206 Visiting Vehicle Post Flight Report 2 CDO

CLDC-206.1 CTS Post Flight Report 2 CDO

CLDC-206.2 CaTS Post Flight Report 2 CDO

CLDC-207 Utilization Feasibility Assessment 2 CDO

CLDC-207.1 Individual Payload Feasibility Assessment 2 CDO F B: See DRD

CLDC-207.2 Payload Complement Feasibility Assessment 2 CDO B F

CLDC-208 Payloads Interface Requirements Document (IRD) 1 CDO

CLDC-208.1

Payloads/Destination Interface Requirements

Document

1 CDO B F F

B Applicability Matrix 6 weeks after payload kickoff meeting

CLDC-208.2 Payloads/CVV Interface Requirements Document 1 CDO B F F B Applicability Matrix 6 weeks after payload kickoff meeting

CLDC-208.3 Payloads/CaVV Interface Requirements Document 1 CDO B F F B Applicability Matrix 6 weeks after payload kickoff meeting

CLDC-209 Unique Payload Interface Control Document (ICD) 1 CDO

CLDC-209.1

[Unique Payload] to [Destination] Interface Control

Document (ICD)

1 CDO F

Baseline ICD 3 mo. after the payload kickoff meeting;

Final at MIR

CLDC-209.2

[Unique Payload] to Crew Visiting Vehicle (CVV)

Interface Control Document (ICD)

1 CDO F

Baseline ICD 3 mo. after the payload kickoff meeting;

Final at MIR

CLDC-209.3

[Unique Payload] to Cargo Visiting Vehicle (CaVV)

Interface Control Document (ICD)

1 CDO F

Baseline ICD 3 mo. after the payload kickoff meeting;

Final at MIR

CLDC-210 Crew Specific Activities 2/3 CDO

CLDC-210.1 Crew Selection Evaluation 2 CDO

CLDC-210.2 Crew Mission Evaluation 2 CDO

CLDC-210.3 Signed Crew Code of Conduct and Informed Consent 3 CDO

CLDC-211

Destination to Visiting Vehicle (VV) Integration (DVVI)

Documentation

1 CDO

CLDC-211.1 DVVI Plan 1 CDO B F

CLDC-211.2 DVVI Interface Requirements Document (IRD) 1 CDO B F* F*

CLDC-211.3 DVVI Data Set 1 CDO

CLDC-211.4 DVVI Interface Control Document (ICD) 1 CDO B F

CLDC-212 Crew Accommodations Plan 1 CDO B F

To be negotiated

See DRD

See DRD

See DRD

Baseline 14d after Increment; Final 45d after Increment

See DRD

See DRD

Delivery/Update Frequency

1. DRD Title: Integrated Master Schedule (IMS)

2. DRD No.: CLDC-001 3. Data Type: 3 4. OPR: CDO

5. Solicitation No.: 80JSC025R001

6. Contract No.: (Insert contract number)

7. Date Issued: Insert the date the baseline was issued.

8. Date Revised: Include the revision date (if this DRD has been revised)

9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: To provide NASA the Contractor’s integrated program schedules using established standard processes, data structures and reporting conventions to plan, manage, and report the work required in the performance of this contract.

11. Distribution:

One (1) Electronic Copy to the Commercial Destination Office (CDO) Program Authorized Repository

Send a Program Authorized Repository Upload Notification to:

1. NASA Contracting Officer (CO)

2. NASA CDO Contracting Officer Representative (COR)and Alternate COR

Initial Submission: The Draft IMS shall be due at proposal with the contents below:

• Native Schedule File, referred to as Integrated Master Schedule (IMS) through the full period of performance

• Native Schedule File Data Dictionary

• Schedule Assumptions

• Summary Master Schedule

• Schedule Risk Assessment (SRA)

Submission Frequency: The Integration Master Schedule (IMS) shall be delivered monthly and no later than the 5th Government working day of the month. An updated Native Schedule Data

Dictionary and Schedule Assumptions are required for any change following the initial submission due with the first affected IMS deliverable.

Subsequent SRA shall be delivered:

• Semi-annually, in April/October, with the delivery covering the prior month-end data

• As part of Certification milestones

Format: Native Schedule File and the Schedule Risk Assessment shall be delivered in Microsoft Project format and/or NASA approved format. For other data item deliverables, the Contractor’s format is acceptable and shall be in accordance with the Data Format section at the beginning of this attachment.

Interrelationship: Statement Of Work (SOW) Section 2.4 Schedule Management

Applicable Documents:

• Government Accountability Office (GAO) Schedule Assessment Guide o https://www.gao.gov/assets/690/687052.pdf

• Integrated Program Management Data Analysis Report (IPMDAR) Implementation & Tailoring

Guide https://www.gao.gov/assets/690/687052.pdf

Scope: The Integrated Master Schedule data contains:

1. Schedule: Integrated Master Schedule (IMS)

2. Native Schedule File Data Dictionary - Lists all defined fields, definitions, and code structures used within the Native Schedule File

3. Schedule Assumptions – Lists all major assumptions used to develop the IMS

4. Summary Master Schedule - A one-page, top level, Gantt-type schedule chart traceable to the

IMS that summarizes the contracted effort including major milestones, critical path, and schedule margin

5. Schedule Risk Assessment (SRA) - Provides probability of meeting contractual delivery dates

Contents:

1. Schedule:

a. The IMS is an integrated, logically driven, network-based schedule that is vertically and horizontally traceable. Tasks should be at a level of detail to allow for discrete progress measurement and shall include visibility into the overall development flow which typically includes design, fabrication, assembly, integration, test, and delivery phase of each end item delivery. (Note – Task/milestone titles should be clear, concise, and reflect the scope and output (i.e., deliverable) so that the task content can be understood as standalone data without its associated summary level task also being shown.) Expectation for schedule quality is to follow GAO schedule best practices and schedule health checks.

b. Tasks and milestones from subcontractors and the commercial launch vehicle providers shall be included within the prime contractor’s IMS with sufficient detail to develop a realistic critical path. Their data shall be consistent, statused monthly, and based on the same cutoff date to enable a realistic critical path.

c. The IMS shall have traceability to a Contractor specified Work Breakdown Structure (WBS) (or equivalent), subcontractor activity, and the Performance Work Statement.

This traceability should be accomplished by using data fields provided within the scheduling tool.

d. Custom/User-Defined Fields: Contractor shall reserve 7 schedule fields for the purpose of helping the Government navigate, analyze, and health-check the IMS. Fields shall include Schedule

Margin, Lifecycle Review, Payment Milestones, Government Task Agreements

(GTA)/Government Furnished Equipment (GFE), Critical Path, Mission Critical items (as defined by NASA), and Major Supplier Activity.

e. The IMS shall clearly identify tasks or activities which have a dependency on a NASA delivery or approval (for example, delivery of a GFE), and the availability of a NASA facility.

f. If schedule margin is included in the IMS, it shall be as a defined task and clearly labeled as “Schedule Margin” or “Contingency”. (Note - Schedule margin is a determined amount of time that has been added to the schedule by the management team and is to be used and controlled by the project manager to buffer against future impacts that are impossible to predict.)

g. The IMS should contain Level of Effort (LOE) identification. If LOE tasks (i.e., management, miscellaneous support, monitoring, etc.) are included within the IMS they should be clearly labeled as such. If LOE tasks are included, they shall be added in a manner that does not impact discrete tasks/milestones.

h. Critical Path: The schedule tool shall automatically calculate the longest path in the

Native Schedule File. If multiple critical paths are identified, the primary, secondary, and tertiary critical paths should be identified using a custom field for Critical Path.

i. Constraints: The IMS should use minimal constraints. However, if constraints are used, the IMS shall identify the constraints (including any deadlines) applied to tasks.

Provide justification for all constraints external to the Native Schedule file.

j. Leads/Lags: The IMS should minimize use of leads/lags duration. However, if leads/lags are used, the IMS shall provide justification.

k. Fixed Unique Identifiers (UIDs) for activities (Text field if needed) shall be traceable from month to month; UIDs should not change or be reused for another activity.

l. Maximum activity durations should not exceed 60 days. If an activity exceeds 60 days, provide justification.

2. Schedule Risk Assessment (SRA)

Report shall include:

a. The SRA shall be accomplished using a standard probabilistic management tool with

Monte-Carlo functionality. The results of the SRA must include the probability of meeting contractual deliveries and milestones in histogram/S-curve formats.

b. The SRA results should include rank order “tornado diagrams” of both the risks and tasks affecting the completion of contractual milestones and deliverables.

c. Reference Integrated Program Management Data Analysis Report (IPMDAR)

Implementation & Tailoring Guide Section 2.4.2.21

Maintenance: Updates to this document shall be incorporated by resubmission of the document. Changes shall be incorporated by complete reissue with a change log in the front matter of the document.

1. DRD Title: Commercialization Plan

2. DRD No.: CLDC-002 3. Data Type: 3 4. OPR: CDO

5. Solicitation No.: 80JSC026R0021

9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The purpose of the Commercialization Plan is to describe the approach the Contractor plans, if any, to engage with commercial entities in partnerships for the purposes of creating additional revenue streams for the completion of the Commercial Low Earth Orbit (LEO) Destination Contract

(CLDC). Additionally, the plan intends to better understand the Contractor’s overall financial health and business plan. NASA is interested in being one of many customers for the Commercial Low Earth Orbit

(LEO) Destination (CLD) System, and the CLDC Commercialization Plan will provide details necessary to ensure the proposed plan and financial status is reasonable and is in line with the proposed mission cost and cost levied to NASA.

11. Distribution:

One (1) Electronic Copy to the Commercial Destination Office (CDO) Program Authorized Repository

Send a Program Authorized Repository Upload Notification to:

Initial Submission: Baseline with Proposal.

Submission Frequency: Quarterly

Format: The Contractor’s format is acceptable and shall be in accordance with the Data Format section at the beginning of this attachment.

Interrelationship: Statement Of Work (SOW) Section 2.1

Applicable Documents: None

Scope: The Commercialization Plan describes the Contractors’ financial status, CLD Market Opportunities, the financial assumptions/requirements, how the contractor is going to provide the service to the Market

Opportunities and the revenue forecast from non-NASA entities.

The Commercialization Plan establishes measurable performance goals and metrics measured against the contractors overall commercial segment business plan and defines the following:

1. Finance Plan that executes the scope of the CLDC contract in addition to payments made by NASA under the CLDC contract. Includes:

a. Explanation of financial goals or fund raising (venture capital, partnerships, etc.)

b. Sources of planned funding, including breakdowns of planned debt and equity sources, and details on the level of commitment(s), if any, obtained from these sources.

c. Explanation of risks assumed by this financing plan and the planned approach to mitigating these risks to ensure continued successful performance under the contract.

d. Finance Plan Milestones and schedule of milestone completion

e. Company Ownership Structure

2. Financial Due Diligence documentation (provided quarterly):

a. Certified balance sheets, income and cash flow statements, changes in equity

b. Capital expenditures plans and performance to plan

c. Liquidity runway to outline available cash and monthly burn rate/(24-month outlook)

d. Workforce Overview

i. Staffing plan vs. actuals, by quantity and discipline/skill mix mapped to each major system and CLIN

3. Performance-to-plan for stated goals and metrics as defined by actual performance to plan which includes supplier and investor commitments, contracts, revenue, investments, financing, expenditures, and obligations. This should contain monthly and cum-to-date performance.

4. Variance analysis, including narrative explanation for major contributors, for planned vs. actual performance.

5. Forecasted plan for the next year, including expected supplier and investor commitments, contracts, revenue, investments, financing, expenditures, obligations, and variance recovery plans. Forecasts shall map to and explain how they are in alignment with the IMS. The forecast shall have the functionality to be mapped by module (if using a multi module architecture).

6. Revenue Forecast for 10 years

a. Revenue Generation Forecast for CLD Commercialization Opportunities (non-NASA)

i. Including secured, probable and at risk/speculative revenue

b. Correlation between Revenue Generation Forecast and Finance Plan

i. To fully understand its risk posture, NASA needs to understand the correlation between the

Revenue Generation Forecast and the fund raising/financial goals of the CLD Contractor.

7. Year-end financial report (format provided to investors/shareholders).

8. Significant or impacting updates, changes, and risks to life-cycle planning, including finances, schedule, vendor selection, revenue strategy, major expenditures, etc.

9. Portfolio of products and services to be demonstrated and offered, including timing, and pricing strategy (if updated)

10. Business Development progress in capturing non-NASA markets including a status of commercial opportunities. Status should include information on signed contracts, Letters of intent, etc.

11. List of all major subcontractors, vendors, suppliers and partners describing scope and status of signed contracts and agreements with each, as well as Subcontracting and Partnership forward plans.

12. Report common commercial pricing model used to derive the common commercial value for services

(seats, cargo, Destination services) and report the values and the details of the negotiated agreements or barters with sovereign nations and third parties in accordance with the American Taxpayer Clause.

Remarks: None.

shall be incorporated by complete reissue with a change log in the front matter of the document,

1. DRD Title: Organizational Conflicts of Interest (OCI) Plan

2. DRD No.: CLDC-003 3. Data Type: 1 4. OPR: CDO

7. Date Issued: To be filled in by

CO at contract award

8. Date Revised: To be filled in by CO at first revision of this DRD after contract award

9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The OCI Plan will communicate the Contractor’s approach to identify and resolve

OCIs. The Contractor will be held accountable for identifying, dispositioning, and reporting OCIs during contract performance.

11. Distribution:

One (1) electronic copy to the Commercial Destination Office (CDO) Program Authorized Repository

Send a Program Authorized Repository Upload Notification to:

2. NASA CDO Contracting Officer Representative (COR) and Alternate COR

Initial Submission: Baseline Plan shall be submitted with the initial proposal.

Submission Frequency: Final Plan shall be delivered 30 days after Contract Award. Subsequently, the plan shall be reviewed annually or submitted earlier if updates are required to reflect changes to the plan. If no changes to the plan are required, the Contractor shall submit a Program Authorized Repository Delivery

Notice indicating this.

Update when contractor teaming arrangements change and when new or potential OCI issues occur.

Respond to CO with each Task Order Proposal whether update to the plan is required.

Updated when requested by CO.

Format: The Contractor’s format is acceptable and shall be in accordance with Data Format section at the beginning of this attachment.

Interrelationship:

• Statement Of Work (SOW) Section 2.1

• Clause NFS 1852.209-71, Limitation of Future Contracting

• Clause NFS 1852.237-72, Access to Sensitive Information

• Clause NFS 1852.237-73, Release of Sensitive Information

• Clause FAR 52.203-13, Contractor Code of Business Ethics and Conduct

• Federal Acquisition Regulation (FAR) Subpart 9.5, Organizational and Consultant Conflicts of

Interest

• NASA FAR Supplement (NFS) 1809.500, Organizational and Consultant Conflicts of Interest.

Scope: The OCI Plan describes the contractor’s comprehensive approach to identify, avoid, mitigate, neutralize, and report potential OCI issues, including conflicts described in the solicitation and those discovered during contract performance.

Contents: The Organizational Conflicts of Interest (OCI) Plan shall meet the requirements of

FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest and include the following:

1. Point of contact for OCI issues and reports.

2. Demonstrate an understanding of (1) OCI principles and (2) the full breadth of OCI issues and the types of harm that can result. The Plan at a minimum addresses the three primary types of OCIs (i.e., biased ground rules, unequal access to information, and impaired objectivity).

3. Define company roles, responsibilities, and procedures for (1) screening (i.e., identifying/recognizing, analyzing/evaluating, resolving, and reporting) existing and new business opportunities for actual/potential OCIs and (2) monitoring and reporting all potential/actual OCIs that arise, resolving conflicts, and reporting previously unidentified

OCIs or potential OCIs to the Government.

4. Describe how employees are notified of the Plan’s requirements and how this notification will be documented. Describe the training to be provided to Contractor and subcontractor personnel regarding potential OCIs on this contract. Establish and require entrance training for new employees, refresher training for existing employees, and exit training for departing employees. Describe how completion of this training will be documented, including a copy of any training certification template that the contractor will use to document that its employees have completed training.

5. Describe how the contractor will report breaches of the protective measures in the Plan to the Contracting CO. Describe what processes the contractor will implement following any breach and indicate that final resolution of the corrective action must be approved by the CO.

6. Identify any affiliated companies/entities (e.g., a parent company or a wholly owned subsidiary) and procedures for coordinating OCIs with such affiliated companies/entities.

7. Address the process for reporting all potential/actual OCIs that arise during performance of the contract to the CO. An OCI report shall include:

a. a description of the conflict,

b. the plan for resolving the conflict, and

c. the benefits/risks to contract performance associated with plan approval/acceptance.

8. Specific resolution strategies shall be appended to the Plan upon approval by the CO.

9. Explain how the contractor will flow down the provisions of this Plan to any subcontractor that may have a conflict with regard to performing the requirements of this contract. Discuss affected subcontractors’ OCI program as it relates to this contract and specifically explain how affected subcontractors will identify, resolve, and report actual/potential OCIs associated with this contract.

10. Define organizational and employee sanctions for violations of established OCI procedures/requirements/guidelines.

11. Include an assertion from the Contractor that to the best of their knowledge no OCIs exist currently, if applicable. Provide a list of all the prime and subcontractor’s current contracts and subcontracts (NASA and non-NASA) with a description of the work performed, which would provide the CO a better understanding of other work performed by the Offeror that may give rise to an actual or potential conflict.

For each prime contract and subcontract listed, the offeror shall: (1) identify the contract number; (2) describe the scope of work in sufficient detail to ascertain the likelihood of a conflict with performance of this contract; and (3) discuss any conflicts that may arise from performance of the listed contracts and award of this contract.

12. For financial or other interests or relationships beyond Federal contracts or subcontracts that may give rise to an OCI, the offeror shall (1) address the nature and extent of the interest(s) or relationship(s); (2) list any entity or entities involved in the interest(s) or relationship(s) and award of this contract.

13. The Contractor shall address how it will avoid, neutralize, or mitigate each potential OCI listed above. Sufficient information must be provided to allow a meaningful evaluation of the potential effect of the interest on the performance of the SOW.

14. Include a requirement to update this plan as necessary to address specific

OCIs. All updates to the plan must be approved by the contracting officer and the updates/changes must be incorporated in the contract to be effective.

15. Require periodic self-audits to ensure compliance with established OCI procedures/requirements/guidelines.

16. Define records related to the OCI plan (e.g., training and audit records) that will be made available to the Government upon request. Note: The OCI Plan as outlined in this DRD is not for the purpose of addressing other very important contractual obligations such as (1) the contractor’s obligation to protect sensitive information in accordance with NFS 1852.237-72, Access to Sensitive Information, (2) the contractor’s obligation to conduct business in an ethical manner in accordance with

FAR 52.203-13, contractor’s Code of Business Ethics and Conduct, and (3) the contractor’s obligation to prevent personal conflicts of interest in accordance with

FAR 52.203-16, Preventing Personal Conflicts of Interest.

17. In an appendix to the OCI Plan identify the strategy (e.g., mitigation, limitation on future contracting) for resolving each OCI that is either identified in the solicitation or created by the requirements of the solicitation/contract and explain the effect of such strategy on performance of the contract. If using a firewall, explain how these actions will operate to successfully address the conflict without adversely affecting performance of the contract. (Note: Specific plans to limit future competition are reflected in the clause at

NFS 1852.209-71, Limitation of Future Contracting.)

Remarks: The final plan, as approved, shall be incorporated in the contract as Attachment J-07, Organizational Conflicts of Interest (OCI) Plan.

Maintenance: Updates to this document shall be incorporated by resubmission of the document. DRD deliverable submittals shall include two versions 1) a clean copy with redlines incorporated and 2) Redlined version showing the updates made since the last submittal.

1. DRD Title: Information Technology Security Plans (ITSP)

2. DRD No.: CLDC-004 3. Data Type: 2 4. OPR: CDO

9. DRD Category:

Technical ☒

Administrative ☐

S&MA ☐

10. Description/Use: These plans provide the Government insight into the Contractor’s methodology for managing all aspects of information security and ensures critical components are addressed for IT resources developed, processed, or used under this contract. The Information Technology Security Management Plan

(ITSMP) provides the approach for managing personnel and processes whereas the Information Technology

Security Plan (ITSP) provides the specific reporting requirements for all Information Technology (IT) systems utilized during work associated with this contract and necessary training requirements. Both plans will follow Clause NFS 1852.240-76, Security Requirements for Unclassified Information Technology

Resources latest revision.

11. Distribution:

One (1) Electronic Copy to the Commercial Destination Office (CDO) Authorized Repository

Send a Program Authorized Repository Upload Notification to:

Initial Submission: Baseline ITSMP – At Contract Award

Baseline ITSP - for Contractor-owned systems, within thirty (30) working days after Contract Start. Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems. For new Federal Information Systems, due with the delivery of the system.

Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the CDO Program Planning & Control Information Technology Manager and to the CDO (COR)

Submission Frequency:

ITSMP - Annual revalidation or resubmittal of ITSMP contents No Later Than (NLT) September 30th each year.

ITSP(s) - Annual revalidation or resubmittal of ITSP contents NLT September 30th each year.

Format: The Contractor’s format is acceptable and shall be in accordance with Data Format section at the beginning of this attachment

Interrelationship: Statement Of Work (SOW) Section 2.7 Information Technology (IT)

Most current versions of the following:

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems

• FAR 52.204–30, Federal Acquisition Supply Chain Security Act Orders-Prohibition

• FISMA 2014, Federal Information Security Modernization Act 2014

• NFS 1852.240-76, Security Requirements for Unclassified IT Resources

• NFS 1852.223-75, Major Breach of Safety or Security

• NFS 1852.237-72, Access to Sensitive Information

• NFS 1852.237-73, Release of Sensitive Information

• NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and

Organizations

• NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

• NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and

Organizations

• NPR 1382.1, NASA Privacy Procedural Requirements

• NPD 2810.1, NASA Information Security Policy

• NPR 2810.1, Security of Information and Information Systems

• NPR 2810.7, Controlled Unclassified Information

• NPR 7120.7, NASA Information Technology Program and Project Management Requirements

• OMB Circular A-130, Management of Federal Information Resources

Scope: All contracts that purchase, lease, network to, or otherwise utilize Government- funded IT (as defined by the Clinger-Cohen Act of 1996 and referenced by Office of Management and Budget (OMB)

Circular A-130 must comply with NASA IT Security Requirements.

An ITSP is specific to a system or group of systems, while an ITSMP is defined as the elements a contractor has outlined to meet the IT Security requirements for interfacing with other contractors and NASA, training requirements and meeting the requirements in NPR 2810.1(series), NASA Information Security Policy.

The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

Information Technology Security Management Plan (ITSMP)

The Contractor shall submit an ITSMP for its unclassified technology information resources. This plan shall describe the policy, processes, and procedures that will be followed to ensure appropriate security of

Information Technology (IT) resources that are developed, processed, or used under this contract. The

Contractor’s ITSMP shall be compliant with the IT security requirements in accordance with Federal and

NASA policies as referenced in OMB Circular A-130, Managing Information as a Strategic Resource and

NPR 2810.1(series), NASA Information Security Policy.

The ITSMP shall include, at a minimum, the following:

1. Contractor’s information security Points of Contact, including roles and responsibilities.

2. A description of policies, processes, and/or procedures for:

a. Meeting all applicable security assessment & authorization requirements, including but not limited to development and maintenance of ITSPs, including external IT systems, implementation and validation of security controls, security assessment, authorization, and continuous monitoring in accordance with NASA directives and guidance.

b. Addressing all applicable information security requirements, including vulnerability scanning and mitigation, maintaining secure operating system configuration, patch/configuration management, contingency planning, and protection of sensitive data in transit and at rest.

c. Information security, privacy, incident management and responses, including coordination with

NASA Security Operations Center (SOC), Center Chief Information Security Officer (CISO), and

Center Privacy Manager as required. The contractor shall immediately notify the NASA SOC, CO, and COR once an incident has been identified.

d. Ensure the Contractor employees meet information security requirements, such as information security awareness, rules of behavior, and elevated privilege training as required. Users are knowledgeable of NASA information security policies and procedures when handling NASA data.

Information Technology Security Plan (ITSP)

The Contractor shall submit an ITSP for its unclassified technology information resources. This plan shall describe the data protections implemented to meet the requirements in NIST Special Publication 800-171 , “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” at the revision number required at the issuance of the contract.

The ITSP shall include the following:

1. Information System Security Plan:

a. The Contractor shall have an Information Systems Security Officer who is responsible for the contractor’s system(s) in accordance with the definitions set forth in NASA Policy Directive

2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The ITSP shall be kept up to date as changes to the baseline configuration of the system occur and shall be documented in the IT Security Plan.

2. Non-Federal System Security Certification:

a. When the contractor will receive, process, store or transmit NASA non-public information, especially Controlled Unclassified Information (CUI) including Personally Identifiable

Information (PII) on a non-federal system (e.g., the contractor’s corporate system) the system must meet the requirements for data protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

b. This documentation may take the form of:

i. A third-party review/audit certifying that the non-federal system meets the requirements of

NIST SP 800-171 or equivalent standard of information protection, such as the ISO 27001 standard.

ii. A certification from another federal agency such as the DOD Cybersecurity Maturity Model

Certification (CMMC) Level 2.

3. Incident Notification:

a. The contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

4. IT Security Point of Contact:

a. The contractor shall identify a point of contact that NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

mailto:SOC@nasa.gov

5. IT Security Awareness Training:

a. Contractor employees subject to this contract, defined as those requiring physical access to

NASA facilities or electronic access to NASA systems, shall complete the NASA approved IT

Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access.

Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

6. IT Security Role Based Training:

a. Contractor employees subject to this contract shall complete NASA’s Foundational IT Security

Training in SATERN related to the following role-based functions prior to performing the role:

i. IT Security Manager

ii. Information System Owner (ISO)

iii. Information Systems Security Officer (ISSO)

iv. Information System Security Engineer (ISSE)

It is highly recommended, but not required, that Contractor employees complete advanced role-based training every other year following completion of the initial training provided by NASA.

This training is also provided by NASA but may be fulfilled externally. If fulfilled externally, the

Contractor shall provide the “External Role- Based Training Validation Form” to the center

CISO. The process for completing this form and receiving…