Attachment_K_-_IT_Security_Applicable_Documents_List.pdf
PDF 321 KB Posted
- Attached to
- Solar Wind Plasma Sensor (SWiPS) Space Weather Follow-On (SWFO-L1) Mission 80GSFC20R0010
- Solicitation number
- 80GSFC19R0048
About this file
This document provides an Information Technology (IT) Security Applicable Documents List and related federal contract opportunity. The IT Security Applicable Documents List outlines numerous NASA Policy Directives, Procedural Requirements, Interim Directives, Technical Requirements, IT Security Handbooks, Standards, and Memoranda that are applicable to NASA IT security. The related federal contract opportunity is a solicitation for a Solar Wind Plasma Sensor (SWiPS) that will be part of the Space Weather Follow On (SWFO-L1) satellite. The SWFO-L1 Mission is a joint undertaking of NASA and NOAA to provide continuity of solar wind data and coronal mass ejection imagery, which is NOAA's highest priority for space weather observations. The SWiPS instrument will measure ion flux population with or without mass discrimination as a function of energy.
Attachment K - IT Security Applicable Documents List
View the file
Other files
Show all 30
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT K
INFORMATION TECHNOLOGY (IT) SECURITY
APPLICABLE DOCUMENTS LIST
SUPRA THERMAL ION SENSOR (STIS)
June 2016
RFP 80GSFC20R0010
CONTRACT TBD
Cont ract TBD
Attachment K
(06/ 2016)
Information Technology (IT) Security Applicable Documents List June 2016
NASA Policy Directives (NPD) and NASA Procedural Requirements (NPR)
Document Subject Effective Date
NPR 1382.1A NASA Privacy Procedural Requirements July 10, 2013
NPD 1382.17H NASA Privacy Policy June 24, 2009
NPD 1440.6I NASA Records Management September 10, 2014
NPR 1441.1E
NASA Records Management Program
Requirements January 29, 2015
NPD 2540.1H
Personal Use of Government Office Equipment
Including Information Technology February 24, 2016
NPD 2800.1B Managing Information Technology March 21, 2008
NPR 2800.1B Managing Information Technology March 20, 2009
NPD 2810.1E NASA Information Security Policy July 14, 2015
NPR 2810.1A
Security of Information Technology w/ Change 1, May 19, 2011) May 16, 2006
NPD 2830.1A NASA Enterprise Architecture November 2, 2011
NPR 2830.1A NASA Enterprise Architecture Procedures December 19, 2013
NPR 2841.1 Identity, Credential, and Access Management January 6, 2011
NASA Interim Directive (NID)
NM2810-64 NASA Interim Directive: Information Technology Security and Efficiency Requirements
May 22, 2008
NID 7120.99
NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements
December 22, 2011
NASA Interim Technical Requirements (NITR)
NITR 2800_2
Email Services and Email Forwarding
September 18, 2009
NITR 2800_1 NASA Information Technology Waiver Requirements and Procedures
August 13, 2009
IT Security Handbooks (ITS-HBK)
ITS-HBK-1382.02-01 Privacy Goals and Objectives July 27, 2012
ITS-HBK-1382.03-01
Privacy Risk Management and Compliance:
PIAs and SORNs
September 25, 2012
ITS-HBK-1382.03-02
Privacy Risk Management and Compliance:
Annual Reporting Procedures for Reviewing and
Reducing PII and Eliminating the Unnecessary
Use of SSN
September 7, 2011
ITS-HBK-1382.04-01 Privacy and Information Security: Overview August 28, 2012
ITS-HBK-1382.05-01
Privacy Incident Response and Management:
Breach Response Team Checklist
September 25, 2012
ITS-HBK-1382.06-01
Privacy Notice and Redress: Web Privacy &
Written Notice, Complaints, Access and
Redress
September 7, 2012
ITS-HBK-1382.07-01 Privacy Awareness and Training: Overview September 7, 2014
ITS-HBK-1382.08-01 Privacy Accountability: Overview August 28, 2012
ITS-HBK-1382.09-01
Privacy Rules of Behavior and Consequences:
Overview
September 7, 2012
ITS-HBK-2810.0001-B
Format and Procedures for an IT Security
Policies and Handbooks
June 19, 2014
NITR 2810.1
NASA Information Technology Security
Disclaimer
Sept 30, 2014
ITS-HBK-1441.01.01 Records Retention and Disposition: Overview Jul 02, 2014
ITS-HBK-1440.01.01 Records Planning & Management: Records Jul 02, 2014
ITS-HBK-2841.001-A Identity, Credential, and Access Management
Services
Feb 01, 2011
IT-SOP-2841.001-A Identity and Credential Service Providers
Federation Requests
Feb 01, 2011
IT-SOP-2841.002-A Identity, Credential, and Access Management
(ICAM): Service Deviation Requests
Management & Records Life Cycle-Overview
Feb 01, 2011
IT-STD-1441.1 NASA Records Retention Schedules May 07, 2014
ITS-HBK-2810.02-01 Security Assessment and Authorization May 6, 2011
ITS-HBK-2810.0002-A
Roles and Responsibilities Crosswalk &
Definitions
May 2, 2013
ITS-HBK-2810.02-02D
Information System Security Assessment and
Authorization Process
February 1, 2015
ITS-HBK-2810.02-04A
Security Assessment and Authorization:
Continuous Monitoring – Annual Security
Control Assessments
March 18, 2014
ITS-HBK-2810.02-05 Security Assessment and Authorization:
External Information Systems
October 24, 2012
ITS-HBK-2810.02-06
Security Assessment and Authorization:
Extending and Information Systems
Authorization to Operate Process and
Templates
October 24, 2012
ITS-HBK-2810.02-08A
Security Assessment and Authorization: Plan of
Action and Milestones (POA&M)
December 11, 2013
ITS-HBK-2810.03-01 Planning May 6, 2011
ITS-HBK-2810.03-02
Planning: Information System Security Plan
Template, Requirements, Guidance and
Examples
February 9, 2011
ITS-HBK-2810.04-01A
Risk Assessment: Security Categorization, Risk
Assessment, Vulnerability Scanning, Expedited
Patching & Organizationally Defined Values
October 12, 2012
ITS-HBK-2810.04-02
Risk Assessment: Procedures for Information
System Security Penetration Testing and Rules of Engagement
April 30, 2013
ITS-HBK-2810.04-03
Risk Assessment: Web Application Security
Program
April 30, 2013
ITS-HBK-2810.05-01 Systems and Service Acquisition November 21, 2011
ITS-HBK-2810.06a-01 Awareness and Training May 5, 2011
ITS-HBK-2810.07-01 Configuration Management May 6, 2011
ITS-HBK-2810.08-01 Contingency Planning May 06, 2011
ITS-HBK-2810.08-02
Contingency Planning: Guidance and
Templates for Plan Development, Maintenance and Test
February 10, 2011
ITS-HBK-2810.09-01A Incident Response and Management December 30, 2014
ITS-HBK-2810.09-02
NASA Information Security Incident
Management
August 24, 2011
ITS-HBK-2810.09-03 Targeted Collection of Electronic Data August 24, 2011
ITS-HBK-2810.09-04
Incident Response and Management:
Guidelines for Data Spillage & Sanitization
Procedures
February 27, 2014
ITS-HBK-2810.10-01 Maintenance May 6, 2011
ITS-HBK-2810.11-01 Media Protection July 13, 2012
ITS-HBK-2810.11-02 Media Protection: Digital Media Sanitization July 13, 2012
ITS-HBK-2810.12-01 Physical and Environmental Protection May 6, 2011
ITS-HBK-2810.13-01 Personnel Security May 6, 2011
ITS-HBK-2810.14-01 System and Information Integrity May 6, 2011
ITS-HBK-2810.15-01 Access Control September 4, 2012
ITS-HBK-2810.15-02A Access Control: Elevated Privileges (EP) September 20, 2012
ITS-HBK-2810.16-01 Audit and Accountability May 6, 2011
ITS-HBK-2810.17-01 Identification and Authentication Jan 17, 2011
ITS-HBK-2810.18-01 System and Communications Protection Apr 6, 2011
Standards
EA-STD 0001.0 Standard for Integrating Applications into the
NASA Access Management, Authentication, and
Authorization Infrastructure
August 1, 2008
EA-SOP 0003.0 Procedures for Submitting a NASA Agency
Forest (NAF) Deviation Request and Transition
Plan
August 1, 2008
EA-SOP 0004.0 Procedures for Submitting an Application
Integration Deviation Request and Transition
Plan
August 1, 2008
NASA-STD-2804-P Minimum Interoperability Software Suite September 22, 2014
NASA-STD-2805-P Minimum Hardware Configurations September 22, 2014
Memoranda
From To Subject Effective
Date
Posted
Date
Center Chief
Informat ion
Associate CIO for IT Security, Officers &
Associate CIO
EM ET Agent Installation
3/ 7/ 2016
3/ 7/ 2016
Acting for Ent erprise
Service s
Associate CIO for IT Security, Acting
Chief
Informat ion
Officers
Recruitment and Ret ent ion of a
Highly Qualified Federa l Workforce
11/ 05/ 2015
11/ 13/ 2015
Associate CIO for IT Security, Acting
Chief
Informat ion
Cyber Hygiene Report Actions
11/ 05/ 2015
11/ 13/ 2015
Associate CIO Chief Cyber Hygiene Report Actions 10/ 7/ 2015 10/ 7/ 2015 for IT Security, Informat ion
Acting Officers &
Ent erpri se
Service
Executives
Associate Chief Chief Information Technology Security 9/ 17/ 2015 9/ 17/ 2015
Informat ion Informat ion Division Handbook Expiration Dates
Officer for Officers
Capital Planning and Governance
Associate IT
Secu rit y Division
Director (Acting)
Chief
Informat ion
Officers
Windo w Server 2003 Waiver
Process
8/ 18/ 2015 8/ 19/ 2015
Associate IT
Secu rit y Division
Director (Acting)
Chief
Informat ion
Officers
FY15 IT Security and Privacy
AwarenessTraining Reminder
8/ 18/ 2015 8/ 19/ 2015
Date
Posted
Date
Office of the
Chief
Information
Secu rit y Officer
Senior Agency
Informat ion
Security Officer
(SASIO)
Reque st the Cancellation of HBK
2810.03-02 Planning: Information
System Security Plan Template, Requ ir ements, Guidance, and
Examples
7/27/2015 7/27/2015
(Acting) Sen ior
Agency
Information
Secu rit y Officer
Cent er/ M ission
Directorate
Chief
Information
Officer (CIO), Chief
Informat ion
Security Officers
(CISO), and
Informat ion
System Owners
(ISO)
Vulnerabilities in Unsupported or
End o f Life Soft w are
5/28/2015 5/28/2015
(Acting) Sen ior
Agency
Informat ion
Secu rit y Officer
Distribut ion Naming Pattern Memo 5/28/2015 5/28/2015
Office of the
Chief
Informat ion
Officer
(Acting) Senio r
Agency
Informat ion
Security Officer
Expired Policy 2810-02.05 Security
Assessment and Autho rization:
External Informat ion Systems
11/19/2014 11/19/2014
Sen i or Agency
Information
Secu rit y Offi ci al
(Acting)
Distribut ion Interim Guidance for Leveraging
Cloud Services Wh ile Meeting
Information Security Requ irement s
1/28/2015 1/28/2015
Valerie Burks Cent er/ M ission
Directorate CIOs
Configurat ion Guidance for
Computer Operating Systems
12/17/2012 12/17/2012
Date
Posted
Date
(Acting) Sen ior
Agency
Inform ation
Secu rit y Officer
Office of the
CISO
Extension Verification 2810-02.05 11/ 19/ 2014 11/ 19/ 2014
NASA CIO and
Deputy CIO for
IT Security
Distribu tion Updat ed Password Requ irem ents for AA Account s
7/ 2/ 2014 7/ 2/ 2014
Chief
Informat ion
Officer
Distribu tion Establishment and Maintenance of
Secure Comm unicat ions
2/ 28/ 2014 2/ 28/ 2014
Deputy Chief
Informat ion
Officer for
Informat ion
Technology
Secu rit y
Distribut ion Implementation of National
Institut e of Standards and
Technology Special Publication 800-
53, Revi sion 4
12/ 19/ 2013 12/ 19/ 2013
Chief
Informat ion
Officer
Distribut ion Minimum Secur it y Requ irem ents for Persona l Mobile Devices
8/ 27/ 2013 8/ 27/ 2013
Chief
Informat ion
Officer
Distribut ion Additional 90-day extension:
Blanket waiver for use of Filevault
2.0 to meet Data at Rest (DAR)
Encrypt ion Requirements
5/ 7/ 2013 5/ 7/ 2013
Office of the
Chief
Informat ion
Officer
Distribut ion Delegation of Authorizing Offi cial
Designat ion to Center and Mission
Directorate Chief Inform ation
4/ 2/ 2013 4/ 2/ 2013
Date
Posted
Date
Deputy CIO for
Information
Secu rit y
Distribu tion NASA ACES Secure Virt ual Team
Meeting (SVTM) Approved for
Secure Meetings and
Comm unication of SBU Data
2/ 5/ 2013 2/ 5/ 2013
Chief
Information
Officer
Distribu tion Cancellation of PDM 2012-064 Data
At Rest (DAR) Waiver Process and issuanceof a new PDM addressing
Alternate DAR Encryption Products
1/ 27/ 2013 1/ 27/ 2013
Deputy CIO for
Informat ion
Technology
Secu rit y
Center Mission
Directorate
Chief
Inform ation
Officers (CIO)
Configurat ion Guidance for
Computer Operating Syst ems
12/ 17/ 2012 12/ 17/ 2012
Associate
Deputy
Adm inistrator
All NASA
Emp loye es
Breach of Personally Identifiab le
Information (PII) [Laptop
DAR/ Encrypt ion]
11/ 13/ 2012 11/ 13/ 2012
Chief
Informat ion
Officer
All NASA Center
CIO's
Rescinding and/ or Archiving
Information Technology (IT)
Securit y Memoranda
9/ 20/ 2012 9/ 20/ 2012
Deputy CIO for
Informat ion
Secu rit y
All NASA Center
CIOs
FY201 2 FISMA Awarenessand
Training Reporting Metrics
9/ 12/ 2012 9/ 12/ 2012
OCIO Distribut ion Acceptance of other Federa l IT
Securit y Aw arenessTraining to
Satisfy NASA's
FISMA Requ irem ents
5/ 25/ 2012 5/ 25/ 2012
Charles F.
Bolden, Jr ., NASA
Adm inistrator
All NASA
Emp loye es
Protection of Sen sitive Agency
Information
4/ 3/ 2012 4/ 3/ 2012
(06/2016)
Date
Posted
Date
Assistant
Adm inistrator for Securit y and
Program
Protection, Chief
Informa tion
Officer (Acting)
NASA Center
Directors
Identity, Credent ial, and Access
Management Business Process
Leads
8/27/2009 8/27/2009
Chief
Information
Officer (Acting)
Officials-in-
Charge of
Headquarters, Center CIOs, Mission
Directorate CIOs
Securit y and Support Policy for
Sm artphones
8/3/2009 8/3/2009
Chief
Information
Officer (Acting)
Center CIOs Delegation of Waiver Authori ty and
Responsibilit y for Vulnerability
Scanning Requ ir ements
5/6/2009 5/6/2009
Chief
Information
Officer (Acting)
Officials-in-
Charge of
Headquarters
Offices, NASA
Center Directors
Roles and Responsibilities for
Pro t ecting NASA Sen sitive But
Unclassifi ed (SBU) Info rma tion
4/27/2009 4/27/2009
Deputy CIO for
IT Security
Center CIOs, Center ITSMs
FY 2009 Scanning and Vulnerability
Elimin at ion or Mitigation
2/06/2009 2/06/2009
Chief
Information
Officer
Officials-in-
Charge of
Headquarters
Offices, NASA
Center Directors
Personally Identifiable Information
(PII) Incident Reporting
1/ 14/ 2009 1/14/ 2009
(06/2016)
Date
Posted
Date
Chief All NASA Civil Policy for Use of Rem ovable Media, 11/21/2008 11/21/2008
Informa tion Service and Such as USB Thumb Drives
Officer Contra ctor
Emp loye es
Senior Agency Official-in- Personally Identifiable 9/8/2008 9/8/2008 Official for Charge of Information (PII) Responsibilities Privacy Headquarters
Offices, NASA Statement
Center Directors
Chief
Information
Officer
Center CIOs Deployment of the Software
Refresh Portal
7/30/2008 7/30/2008
Chief NASACIOs, Requirement to Log and Verify 6/9/2008 6/9/2008 Information Mission Sensitive Data Extracts Officer Directorate
CIOs, Center ITSMs, Center
Human
Resources
Directors, IEMP
Chief NASACIOs, Remote Access to Personally 6/9/2008 6/9/2008 Information Mission Identifiable Information(PII) Officer Directorate
CIOs, Center
ITSMs, Center
ITSMs, Center
Human
Resources
Directors, IEMP
Deputy CIO for
IT Security
Center ITSMs Clarification on Requirement for
Contractors to Complete NASA
Annual IT Security Awareness
Training
6/6/2008 6/6/2008
(06 / 2016 )
Date
Posted
Date
Deputy CIO for
IT Security
Center CIOs, Center ITSMs
System Security Documentation in RMS
2/20/2008 2/20/2008
Chief
Information
Officer
Center CIOs, Deputy CIOs
Information Discovery 2/4/2008 2/4/2008
Deputy CIO for
IT Security
Center CIOs, Center ITSMs
Decision to Cancel Procurement
Information Circular (PIC) 04-03
(System Administrator
Certification Program)
1/16/2008 1/16/2008
Chief
Information
Officer
Official-in-
Charge of
Headquarters
Offices, NASA
Center Directors
Release of NPD 2200.1A, Management of NASA Scientific and Technical Information
12/18/2007 12/18/2007
Deputy CIO for
IT Security
Center CIOs, Mission
DirectorateCIOs
Agency Security Configuration
Standards: Federal Desktop
Core Configurations
11/15/2007 11/15/2007
Chief
Information
Officer
Center Chief
Information
Officers
Designation of FIPS-199 Impact
Level for NASA's OA IT Voice
Systems
7/10/2007 7/10/2007
Chief
Information
Officer
Center Chief
Information
Officers
Designa tion of FIPS-199 Impact
Level for NASA OAIT Data
Center Systems
7/10/2007 7/10/2007
Chief
Information
Officer
Center Chief
Information
Officers
Designation of FIPS-199 Impact
Level for NASA OAIT LANs
7/10/2007 7/10/2007
(0 6/ 2016 )
Date
Posted
Date
Chief
Information
Officer (Acting)
Center CIOs, Mission
DirectorateCIOs
Meeting 0MB Memoranda M-
06-015 "Safeguarding
Personally Identifiable
Information;" M-06-016
"Protection of Sensitive Agency
Information," and M-06-019
"Reporting Incidents Involving
Personally Identifiable
Information and Incorporating the Cost for Security in Agency
Information Technology
Investments"
10/17/2006 10/17/2006
Deputy Administrator/Of Meeting NASA Information 7/26/2006 7/26/2006 Administrator ficial-in-Charge Technology Security of Headquarters
Offices, NASA Requirements
Center Directors
Deputy CIO for
IT Security
Center CIOs Designation of FIPS-199 Impact
Level for NASA OAIT Desktop
Systems
4/16/06 4/16/06
Chief Official-in- Policy Governing NASA's 3/16/2006 3/16/2006
Information Charge of
Headquarters
Offices, NASA
Publicly Accessible Web sites Officer, Chief of Strategic Communications Center
Directors, Center CIOs, Mission
DirectorateCIOs
Chief Center CIOs Update of NASA Web site 12/15/2005 12/15/2005
Information Linking Policy Officer, Assistant Administrator of Public Affairs
(0 6/ 2016 )
Date
Posted
Date
Chief
Information
Officer
Center CIOs Update of NASA Web site
Privacy Policy
11/28/2005 11/28/2005
Reminder: Within 30 days after contract effective date, the Contractor shall develop and deliver an IT Security Management Plan to the Contracting Officer for approval.
File details come from the government source that posted it. Updated .