Attachment C - Data Requirements List.pdf

Small Satellite Cross-Link Systems

Data Requirements List

Attachment C

DATA REQUIREMENTS LIST

DRL Number: 01 Revision: BASE

Project/System: Small Satellite Cross-Link Systems Contract Number: TBD Preparation Date: TBD

Contractor: TBD Technical Approval: TBD

Attachment Number: C Exhibit Number: N/A

ITEM DRD NO. TITLE CHANGE STATUS

1 DRD 001

2 DRD 002

Security Requirements for Unclassified Information Technology Resources

3 DRD 003

Organizational Conflicts of Interest (OCI) Plan Diversity, Equity, Inclusion and Accessibility (DEIA) Plan

1. DRD Title: Security Requirements for Unclassified IT Resources

2. DRD No.: 001 3. Data Type: 1 4. OPR: OCIO

5. Solicitation No.: 80GRC024R0017 6. Contract No.: TBD

7. Date Issued: 7/26/2024 8. Date Revised: N/A 9. DRD Category:

Technical ☒ Administrative ☐

S&MA ☐

10. Description/Use: To ensure that IT security reporting requirements, including Cyber Supply Chain Risk Management (C-SCRM), are met for all IT systems utilized during work associated with this contract and necessary training requirements are fulfilled.

11. Distribution: All deliverables required by this DRD, except for the C-SCRM plan, shall be submitted electronically to the CO, COR, and NASA Organization’s Information System Security Officer (ISSO) (i.e., Security Officer). Approval will be provided by the ISSO. C-SCRM plans shall be submitted to and approved by the ICT/C- SCRM Service Element Lead at agency-dl-ocio-cys-cp-scrm@mail.nasa.gov.

Initial Submission:

Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-in.

Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems.

Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract).

Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in

IT Security Point of Contact: At the start of phase-in

IT Security Awareness Training: Training required prior to access to NASA information and systems.

IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in.

Submission Frequency:

Information System Security Plan(s) and C-SCRM Plan: As Required

Non-Federal System Certification: Annually

Information on Employees in Sensitive Positions/Assignments Report: Annually

IT Security Point of Contact: As Required

IT Security Awareness Training: Annual on anniversary date of initial training

IT Security Role Based Training: Annual on anniversary date of initial training. Evidence of completion due annually.

Format: Unless otherwise directed, the data requested in this DRD shall be delivered to the Government in soft-copy via an electronic transfer mechanism (e.g., electronic mail, flash drive, or file transfer protocol) in a format readable by a Government device utilizing the standards in NASA-STD-2804, “Minimum Interoperability Software Suite.”

Interrelationship: NASA Federal Acquisition Regulation (FAR) Supplement (NFS) 1852.204-76 SECURITY

REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (MAY 2024)

(DEVIATION)

Applicable Documents:

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems FAR 52.204–29, Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures FISMA 2014, Federal Information Security Modernization Act 2014 NFS 1852.204-76, Security Requirements for Unclassified IT Resources NFS 1852.223-75, Major Breach of Safety or Security NFS 1852.237-72, Access to Sensitive Information NFS 1852.237-73, Release of Sensitive Information NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations NPR 1382.1, NASA Privacy Procedural Requirements NPD 2810.1, Information Security Policy NPR 2810.1, Security of Information and Information Systems NPR 2810.7, Controlled Unclassified Information NPR 7120.7, NASA Information Technology Program and Project Management Requirements OMB Circular A-130, Management of Federal Information Resources

Scope: All contracts that purchase, lease, network to, or otherwise utilize covered articles, which includes Government-funded IT (as defined by the FAR) must comply with NASA IT Security and C-SCRM Requirements.

Contents: The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies

Information System Security Plan (i.e., System Security Plan, IT Security Plan, or Security Plan):

When the contractor is operating a Federal Information System (FIS) on behalf of NASA or is providing a FIS in the execution of this contract, that system must have an Information System Security Plan in accordance with NIST Special Publication (SP) 800-53, “Security and Privacy Controls for Information Systems and Organizations” at the revision number required at the issuance of the contract. This plan and supporting documents shall be entered into the NASA cybersecurity system of record pursuant to Authorization to Operate (ATO) requirements set forth in NASA Policy Directive 2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The FIS security plan and ATO must be in place before any system may operate in the NASA environment.

NON-FEDERAL SYSTEM SECURITY CERTIFICATION

When the contractor will receive, process, store or transmit NASA non-public information, especially Controlled Unclassified Information (CUI) including Personally Identifiable Information (PII) on a non-federal system (e.g., the contractor’s corporate system) the system must meet the requirements for data protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

This documentation may take the form of:

a. A third-party review/audit certifying that the non-federal system meets the requirements of NIST SP

800-171 or equivalent standard of information protection, such as the ISO 27001 standard.

b. A certification from another federal agency such as the DOD Cybersecurity Maturity Model

Certification (CMMC) Level 2.

INCIDENT NOTIFICATION

The contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

IT SECURITY POINT OF CONTACT:

The contractor shall identify a point of contact that NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

IT SECURITY AWARENESS TRAINING:

Contractor employees subject to this contract shall complete the NASA approved IT Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access. Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

IT SECURITY ROLE BASED TRAINING:

Contractor employees subject to this contract shall complete NASA’s Foundational IT Security Training in SATERN related to the following role-based functions prior to performing the role:

• IT Security Manager

• Information System Owner (ISO)

• Information Systems Security Officer (ISSO)

• Information System Security Engineer (ISSE)

It is highly recommended, but not required, that Contractor employees complete advanced role-based training every other year following completion of the initial training provided by NASA. This training is also provided by NASA but may be fulfilled externally. If fulfilled externally, the Contractor shall provide the “External Role- Based Training Validation Form” to the center CISO. The process for completing this form and receiving credit may be found at: External RBT Validation Form (sharepoint.com).

INFORMATION ON EMPLOYEES IN SENSITIVE POSITION(S)/ASSIGNMENTS REPORT:

The Information on Employees is Sensitive. IT Security (ITS) Positions/Assignments Report shall provide information annually for personnel screening as required by NPR 2810.1(series), and NPR 1600.1 on position risk.

CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) PLAN:

NIST defines C-SCRM as a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, process, and procedures. A C-SCRM plan, consistent with the recommended template in NIST SP 800-161, Section 3.1 shall be delivered prior to the processing, transmission, or storage of non-public NASA information in performance of the contract.

Remarks: None

Maintenance:

Information System Security Plan(s) shall be kept up to date as changes to the baseline configuration of the system(s) occur.

Non-Federal System Certifications shall be maintained annually or per the certifying body’s standard.

Information on Employees in Sensitive Positions/Assignments Report shall be maintained annually.

It Security Point of Contact shall be kept up to date as changes occur.

Evidence of completion of IT Security Role Based Training is due annually.

C-SCRM plans shall be kept up to date as changes occur to organizational C-SCRM processes, policies, and procedures, and/or, new components are introduced.

1. DRD Title: Organizational Conflicts of Interest (OCI) Plan

2. DRD No.: 002 3. Data Type: 1 4.OPR: OP

5. Solicitation No.: 80GRC024R0017 6. Contract No.: TBD

7. Date Issued: 07/26/2024 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: Provide an OCI plan which will communicate the contractor’s approach to identify and resolve OCIs. The contractor will be held accountable for identifying, dispositioning, and reporting OCIs during contract performance.

11. Distribution: GRC PR Contracting Officer

Initial Submission: With proposal

Submission Frequency: Once; with proposal

Format: Contractor’s format is acceptable. The electronic format shall be compatible with Microsoft Office.

Interrelationship: NASA Federal Acquisition Regulation (FAR) Supplement (NFS) 1852.209-71, Limitation of

Future Contracting, NFS 1852.237-72, Access to Sensitive Information, NFS 1852.237-73, Release of Sensitive

Information.

Applicable Documents: FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, NFS 1809.500, NASA Guide on Organizational Conflicts of Interest.

Scope: The OCI Plan describes the contractor’s comprehensive approach to identify, avoid, mitigate, neutralize, and report potential OCI issues, including conflicts described in the solicitation and those discovered during contract performance.

Contents: The OCI Plan shall meet the requirements of FAR 9.5 and include the following:

1. Point of contact for OCI issues and reports.

2. Demonstrate an understanding of (1) OCI principles and (2) the full breadth of OCI issues and the types of harm that can result. The Plan at a minimum addresses the three primary types of OCIs (i.e., biased ground rules, unequal access to information, and impaired objectivity).

3. Define company roles, responsibilities, and procedures for (1) screening (i.e., identifying/recognizing, analyzing/evaluating, resolving, and reporting) existing and new business opportunities for actual/potential

OCIs and (2) monitoring and reporting all potential/actual OCIs that arise, resolving conflicts, and reporting previously unidentified OCIs or potential OCIs to the Government.

4. Describe how employees are notified of the Plan’s requirements and how this notification will be documented.

Establish and require entrance training for new employees, refresher training for existing employees, and exit training for departing employees. Describe how completion of this training will be documented, including a copy of any training certification template that the contractor will use to document that its employees have completed training.

5. Describe how the contractor will report breaches of the protective measures in the Plan to the contracting officer. The Plan should describe what processes the contractor will implement following any breach and should indicate that final resolution of the corrective action must be approved by the contracting officer.

6. Identify any affiliated companies/entities (e.g., a parent company or a wholly owned subsidiary) and procedures for coordinating OCIs with such affiliated companies/entities.

7. Address the process for reporting all potential/actual OCIs that arise during performance of the contract. An

OCI report shall include (1) a description of the conflict, (2) the plan for resolving the conflict, and (3) the benefits/risks to contract performance associated with plan approval/acceptance. Specific resolution strategies shall be appended to the Plan upon approval by the Government.

8. Explain how the contractor will flow down the provisions of this Plan to any subcontractor that may have a conflict with regard to performing the requirements of this contract. Discuss affected subcontractors’ OCI program as it relates to this contract and specifically explain how affected subcontractors will identify, resolve, and report actual/potential OCIs associated with this contract.

9. Define organizational and employee sanctions for violations of established OCI procedures/requirements/guidelines.

10. Include an assertion from the Contractor that to the best of their knowledge no OCIs exist currently, if applicable. Provide a list of all the prime’s and subcontractor’s NASA contracts and subcontracts, which would provide the CO a better understanding of other NASA work performed by the Offeror that may give rise to an actual or potential conflict.

11. Include a requirement to update this plan as necessary to address specific OCIs. All updates to the plan must be approved by the contracting officer and the updates/changes must be incorporated in the contract to be effective.

12. Require periodic self-audits to ensure compliance with established OCI procedures/requirements/guidelines.

13. Define records related to the OCI plan (e.g., training and audit records) that will be made available to the

Government upon request. Note: The OCI Plan as outlined in paragraphs 1 through 12 above is not for the purpose of addressing other very important contractual obligations such as (1) the contractor’s obligation to protect sensitive information in accordance with NFS 1852.237-72, Access to Sensitive Information, (2) the contractor’s obligation to conduct business in an ethical manner in accordance with FAR 52.203-13, contractor’s Code of Business Ethics and Conduct, and (3) the contractor’s obligation to prevent personal conflicts of interest in accordance with FAR 52.203-16, Preventing Personal Conflicts of Interest.

14. In an appendix to the OCI Plan identify the strategy (e.g., mitigation, limitation on future contracting, etc.) for resolving each OCI that is either identified in the solicitation or created by the requirements of the solicitation/contract and explain the effect of such strategy on performance of the contract. If using a firewall, explain how these actions will operate to successfully address the conflict without adversely affecting performance of the contract. (Note: Specific plans to limit future competition are reflected in the clause at

NFS 1852.209-71, Limitation of Future Contracting.)

Remarks: N/A

Maintenance: The contractor shall review the OCI Plan on an annual basis or as directed by the contracting officer to revise the OCI Plan if necessary. Revisions are subject to Contracting Officer approval and shall be incorporated by change page or complete reissue.

1. DRD Title: Diversity, Equity, Inclusion, and Accessibility (DEIA) Plan

2. DRD No.: 003 3. Data Type: 3 4. OPR: OP

5. Solicitation No.: 80GRC024R0017 6. Contract No.: TBD

7. Date Issued: 07/26/2024 8. Date Revised: N/A 9. DRD Category:

Technical ☐

Administrative ☒

S&MA ☐

10. Description/Use: The DEIA plan demonstrates the contractor’s commitment to fairness regarding diversity, equity, inclusion, and accessibility. This plan will provide NASA with an understanding of how the contractor plans to recruit, retain, and develop a diverse high performing workforce from underserved communities. The plan shall include measurable performance metrics and objectives. The DEIA plan will be utilized as an assessment tool by the contracting officer to monitor the contractor’s progression in its commitment to diversifying its workforce.

11. Distribution: GRC PR Contracting Officer

Contracting Officer Representative (COR)

Initial Submission: Plan shall be submitted within 30 days after contract award.

Submission Frequency: Update annually

Format: Contractor’s format is acceptable.

Interrelationship: N/A

Applicable Documents: Executive Order 13985, Advancing Racial Equity and Support for Underserved

Communities Through the Federal Government

Scope: In support of the Executive Order 13985, Advancing Racial Equity and Support for Underserved

Communities Through the Federal Government, NASA is seeking to advance equity or remove barriers for members of underserved communities to access procurement opportunities. Underserved communities refer to populations sharing a particular characteristic, as well as geographic communities, that have been systematically denied a full opportunity to participate in aspects of economic, social, and civic life. Underserved Communities include Black, Latino, Indigenous, Native American, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities;

persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality.

Contents:

The DEIA Plan shall identify qualitative and quantitative approaches utilized to measure progress in the areas of

Leadership and Commitment, Diverse Talent, and Culture and Sustainability. The following shall be addressed annually:

Leadership and Commitment – Demonstrate leadership’s commitment and accountability to diversity, equity, and inclusion. Identify quantitative approaches utilized to measure progress of a Diversity and Inclusion program

1. What is the operational status of, and level of resources available to, offices or divisions within the organization that are responsible for advancing civil rights or whose mandates specifically include serving underrepresented or disadvantaged communities?

2. What actions has the organization taken to implement affirmative equity-enhancing policies, regulations, guidance, and approaches to emphasizing equity in policy- and rule-making processes?

3. Describe how the organization’s commitment will be communicated internally and externally from leadership to employees and stakeholders.

Diverse Talent – Demonstrate a pursuit of a high performing diverse workforce from underserved communities.

1. Discuss the specific diversity metrics utilized by the organization to measure performance in achieving a diverse workforce and provide the corresponding metrics for the current or most recent organizational reporting period

2. What barriers or opportunities exist to engage subject matter experts from underserved communities in industry and academia? How does the organization plan to overcome those barriers?

3. How will underserved communities be leveraged?

4. Describe recruiting activities, objectives, and outcomes (e.g., number of participants, number interviewed and hired from underserved communities).

Culture & Sustainability – Demonstrate how an inclusive and fair work environment will be cultivated and maintained.

1. Based on the data, what structures and strategies will be used to manage diversity, measure results, refine approaches, and institutionalize a culture of inclusion?

2. Identify actionable opportunities to improve data collection, use, and sharing that would allow for disaggregation, the ability to deliver services more equitably, and better understanding of how programmatic and policy decisions impact underserved communities.

3. Describe other corporate activities that seek to increase support of diversity, equity, and inclusion.

Remarks: N/A

Maintenance: Changes shall be incorporated by change page or complete reissue.