Att J.2-1 - SPARC Security Requirements for Unclassified IT Resources - I&T.pdf

ATTACHMENT J.2-1 – SPARC Security Requirements for Unclassified Information Technology (IT) Resources – Instructions and Template

DESCRIPTION/USE. To ensure that IT security reporting requirements, including Cyber Supply Chain Risk Management (C-SCRM), are met for all IT systems utilized during work associated with this contract and necessary training requirements are fulfilled.

INITIAL SUBMISSION.

a. Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-in. Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems. For new Federal Information Systems (FIS), due with the delivery of the system.

b. Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract). If the organization does not have an Information Systems Security Officer (ISSO), the attestation shall be provided to the NASA Information Owner.

c. Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in.

d. IT Security Point of Contact: At the start of phase-in.

e. IT Security Awareness Training: Training required prior to access to NASA information and systems.

f. IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in.

SUBMISSION FREQUENCY.

a. Information System Security Plan(s) and C-SCRM Plan: As Required

b. Non-Federal System Certification: Annually

c. Information on Employees in Sensitive Positions/Assignments Report:

Annually

d. IT Security Point of Contact: As Required

e. IT Security Awareness Training: Annual on anniversary date of initial training

f. IT Security Role Based Training: Annual on anniversary date of initial training.

Evidence of completion is due annually.

FORMAT. Contractor’s format is acceptable; however, the format must be compatible with Microsoft Office.

INTERELATIONSHIP. None

APPLICABLE DOCUMENTS. Current versions of the following:

SPARC Attachment J.2-1 Version 1 – August 27, 2026

FAR 52.243-93, Basic Safeguarding of Covered Contractor Information Systems FISMA 2014, Federal Information Security Modernization Act 2014 NFS 1852.204-76, Security Requirements for Unclassified IT Resources NFS 1852.223-75, Major Breach of Safety or Security NFS 1852.237-72, Access to Sensitive Information NFS 1852.237-73, Release of Sensitive Information NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations NPR 1382.1, NASA Privacy Procedural Requirements NPR 1600.1 NASA Security Program Procedural Requirements NPD 2810.1, NASA Information Security Policy NPR 2810.1F, Security of Information and Information Systems NPR 2810.7, Controlled Unclassified Information NPR 7120.7, NASA Information Technology Program and Project Management Requirements OMB Circular A-130, Management of Federal Information Resources

SCOPE. All contracts that purchase, lease, network to, or otherwise utilize covered articles, which include Government-funded IT (as defined by the FAR) must comply with NASA IT Security and C-SCRM Requirements.

CONTENTS. The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

a. Information System Security Plan (i.e., System Security Plan, IT Security Plan, or Security Plan). When the contractor is operating a Federal Information System (FIS) on behalf of NASA or is providing a FIS in the execution of this contract, that system must have an Information System Security Plan in accordance with NIST Special Publication (SP) 800-53, “Security and Privacy Controls for Information Systems and Organizations” at the revision number required at the issuance of the contract. This plan and supporting documents shall be entered into the NASA cybersecurity system of record pursuant to Authorization to Operate (ATO) requirements set forth in NASA Policy Directive 2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The FIS security plan and ATO must be in place before any system may operate in the NASA environment.

b. Non-Federal System Security Certification. When the contractor will receive, process, store or transmit NASA non-public information, especially Controlled

Unclassified Information (CUI) including Personally Identifiable Information (PII) on a non-federal system (e.g., the contractor’s corporate system) the system must meet the requirements for data protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” This documentation may take the form of:

1. A third-party review/audit certifying that the non-federal system meets the requirements of NIST SP 800-171 or equivalent standard of information protection, such as the ISO 27001 standard.

2. A certification from another federal agency such as the DOD Cybersecurity Maturity Model Certification (CMMC) Level 2.

c. Incident Notification. The contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

d. IT Security Point of Contact. The contractor shall identify a point of contact that

NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

e. IT Security Awareness Training. Contractor employees subject to this contract, defined as those requiring physical access to NASA facilities or electronic access to NASA systems, shall complete the NASA approved IT Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access. Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

f. IT Security Role Based Training. Contractor employees subject to this contract shall complete NASA’s Foundational IT Security Training in SATERN related to the following role-based functions prior to performing the role:

1. IT Security Manager

2. Information System Owner (ISO)

3. Information Systems Security Officer (ISSO)

4. Information System Security Engineer (ISSE)

It is highly recommended, but not required, that Contractor employees complete advanced role-based training every other year following completion of the initial training provided by NASA. This training is also provided by NASA. See the following site for details https://nasa.sharepoint.com/sites/itsatc/SitePages/Role- Based-Training.aspx

g. Information on Employees in Sensitive Position(s)/Assignments Report.

The Information on Employees is Sensitive. IT Security (ITS) Positions/Assignments Report shall provide information annually for personnel screening as required by NPR 2810.1(series), and NPR 1600.1 on position risk.

h. Cyber Supply Chain Risk Management (C-SCRM) Plan. NIST defines C- SCRM as a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, process, and procedures. A C-SCRM plan, consistent with the recommended template in NIST SP 800-161, Section 3.1 shall be delivered prior to the processing, transmission, or storage of non-public NASA information in performance of the contract.

MAINTENANCE.

a. Information System Security Plan(s) shall be kept up to date as changes to the baseline configuration of the system(s) occur.

b. Non-Federal System Certifications shall be maintained annually or per the certifying body’s standard.

c. Information on Employees in Sensitive Positions/Assignments Report shall be maintained annually.

d. IT Security Point of Contact shall be kept up to date as changes occur.

e. Evidence of completion of IT Security Role Based Training is due annually.

f. C-SCRM plans shall be kept up to date as changes occur to organizational C- SCRM processes, policies, and procedures, and/or new components are introduced.