Enclosure_2_IT_Security_Management_Plan_Template.pdf

SENSITIVE BUTU NCLASSIFIED (SBU)

Version 1 03-01-17

Information Technology Security Management

Plan

(Insert Contract # Here)

Issue Date

Effective Date:

Change History

Version Date Chan2e Description

1.0

IT Security Management Plan Review and Approval

This Information Technology Security Management Plan (ITSMP) for the was prepared for the exclusive use of NASA and completed on

I have reviewed the contents of this plan, and believe that it presents an accurate representation.

Reviewed by:

ISSO, or equivalent Date

Concurred by:

COR/Task Monitor Date

Approved by:

Center CISO Date

Accepted by:

Contracting Officer Date

Contents

Change History .......................................................................................................................................................................................... ii

IT Security Management Plan Review and Approval ............................................................................................................................... iii

1 Contract Identification

1.1 Contract Name

1.2 Contract Number

1.3 Responsible Organization

1.4 Contact Information

1.4.1 Physical Location

1.4.2 Points of Contact

1.5 General Contract Description

1.5.1 Information System Categorization

1.5.2 Security Categorization

1.5.3 Information System

1.5.4 Contractor Badging

1.5.5 Supply Chain Risk Management (SCRM)

1.5.6 Related Laws/Regulations/Policies

2 Security Control Implementations

3 Federal Information Security Management Act (FISMA) Reporting

Appendix A: Acronyms

SENSITIVE BUT U NCLASSIFIED(SBU)

1 Contract Identification

1.1 Contract Name

Contract Name:

Contract Abbreviation:

1.2 Contract Number

Contract Number: (Insert Contract # Here

1.3 Responsible Organization

The overarching responsible organization is NASA. The responsible organization can be the associated mission directorate, Center, division, etc.

National Aeronautics and Space Administration (NASA)

Responsible Organization:

1.4 Contact Information

1.4.1 Physical Location

Include the physical location where NASAdata residesand/or where contact with NASA data occurs. Depending on the contract and/or information systems, theremay be multiple physical locations.

Location Name Street Address City State Zip Code Country

1.4.2 Points of Contact

Title Name Telephone Email Address

Contracting Officer (CO)

Contracting Officer

Representative (COR)

Contractor Representative

1.5 General Contract Description

1.5.1 Information System Categorization1

List all information types processed, transmitted, stored and/or accessed in perfonnance of the contract.

Additional rows may be added as needed.

Information Type Confidentiality

Impact Level

(L/M/H)

Integrity

Impact Level

(L/M/H)

Availability

Impact Level

(L/M/H)

1.5.2 Security Categorization

Based on the infonnation provided in section 1.5.1, the security impact levels for each of the three securityobjectives of confidentiality, integrity, and availabilityare identified below.

Security Objective Secmity Impact Level (L/M/H)

P, nfidentiality:

OCntegrity:

Av ailability:

Table: Secunty ObJecttves Impact

Based on theinfonnation provided in the Secw·ity Objec tives Impact table above, the required protection level for Agency Conunon

Controls has been identified and is reflectedin the following System High Water Mark table. The high water mark represents the minimum level of security controls appropriate for the system.

1 Please use NIST SP 800-60 to identify the information types and theconfidentiality, integrity and availability impact levels.

Purpose/Function

1.5.6 Related Laws/Regulations/Policies

5 U.S.C. 552, Freedom of Information Act, 1967

5 U.S.C. 552a, Privacy Act, 1974

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems

FIPS 200, Minimum Security Requirements for Federal Information and Information Systems

NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems

NIST SP 800-30, Risk Management Guide for Information Technology Systems

NIST SP 800-34, Contingency Planning Guide for Information Technology Systems

NIST SP 800-37, Guide for the Security Authorization of Federal Information Systems

NIST SP 800-42, Guideline on Network Security Testing

NIST SP 800-53, Recommended Security Controls for Federal Information Systems

NIST SP 800-53A, Techniques and Procedures for Verifying the Effectiveness of Security Controls in Federal Information

Systems

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories

NIST SP 800-61, Computer Security Incident Handling Guide

NIST SP 800-64, Security Considerations in the Information System Development Life Cycle

OMB Circular A-130, Appendix III, Security of Federal Automated Information Systems

Public Law (PL) 99-474, The Computer Fraud and Abuse Act of 1986

PL 93-502 -Freedom of Information Act 1974

Presidential Decision Directive (PDD-63), Critical Infrastructure Protection Federal Information Security Management Act of 2002 (FISMA)

NPR 2810.1, Security of Information Technology

SENSITIVE BUT UNCLASSIFIED (SBU)

SENSITIVE BUT U NCLASSIFIED (SBU)

2 Security Control Implementations In completing control detail, the author should explain how the contra.ct mee ts the intent of the control description. In some cases, implementation detail is ah-eady included . The au thor may accept the pre-populated language as is, add to it, modify it, or ove1write

it. Note that if the "Contractor will be NASA-badged" is selected in Section 1.5.2, then the author should explore accepting relevant

NASA-providedimplementation detail. If the author believes that the control is not applicable to their contract, the "Not Applicable to System/Contract" box should be checked and a sho1i explanation as to why it is not applicable should be included.

Briefly describe the Justification/Implementation Detail; thisdescription should allow a reviewer to have a basic understanding of the implementation. If contractor personnel willbe NASAbadged, references to appropriate NASA policies and procedures are siifficient. See Contract Attachment entitled, IT Security Applicable

Documents List"for relevant NASA policiesand procedures.

I

Planningrelates to the definition and documentation of thekey resources and activities used to protect information and information systems. Effective security planning is both comprehensive and flexible .

(ITS-HBK-2810.03-01, ITS-HBK-2810.03-02)

PL-4: Rules of Behavior

Not Avolicable to Svstem/Contract II Justification/lmnlementation Detail

Control Descriotion NASA IT Rules of Behavior are fullydetailed in the SATERN IT Security awareness training module, which covers the appropriate use of government resources, password securi,ty software usag, e user responsibilities, and encryption requirement for sensitive data. All employees that handle NASA data are required to take this training annually. As partof thecontinuous monitoring workbook a signed acknowledgment from users indicating that they understan, d and agreeto abide by the rules of behavior is provided annually to the Center

CISO.

The SATERN IT Security awareness training module, via CD, willbe obtained annually from the Center CISOor the NASA IT Security Awareness & Training

Center(ITSATC).

System- or contract-specificdetail is provided below:

The organization

a. Establishes and makes readilyavailable to all information system users, the mies that describe their responsibilitiesand expected behavior with regard to information and information system usage; and

b. Receives signed acknowledgment from usersindicating thatthey have read, understand, and agree to abideby the mies of behavior, beforeauthorizing access to information and the information system.

Security Awareness and Training relates to the information security knowledge requirements for all users of information systems, and the development and delivery of courses and other training resources to enable and validate satisfaction of those requirements. Users areresponsible for meeting Agency security training requirements in order to gainand maintain access to any NASA information system resource.

Furthermore, certain roles, including managers and those with significantinformation security responsibilities, have to comply with additionalsecurity training andawareness requirements.

(ITS-HBK-2810.06-0 1)

AT-1: Sec urity Awareness and Training Policy and Procedures

Not Applicable to System/Contract II Justification/Implementation Detail

Control Description In accordance with the NASA FAR, external systems are subject to the requirements ofNPR 2810 and applicable requiremen,ts regulation, s policies, and guidelines are identified in the

Applicable Documents List (ADL).

If applicab,le additional organizational or contract-specific policies should be referenced here.

The organization develops, disseminates, and reviews/updates[Assignment organization define.frequency}

a. A formal, documented security awareness and training policy thataddresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

b. Formal, documented procedures to facilitate the implementation of the security awareness and training policyand associated security awareness and training controls.

AT-2: Security Awareness

Not Applicable to Svstem/Contract 11 I Justification/Imnlementation Detail

Control Description The SATERN IT Security awareness training module, via CD, will be obtained annually from the Center CISO or the NASA IT Security Awareness &

Training Center (ITSATC). All employees that handle NASA data are required to take this training annually.

The SATERN IT Security awareness training module, via CD, willbe obtained annually from the Center CISOor the NASA IT Security Awareness & Training

Center {ITSATC).

If applicab,le system- or contract-specificdetail is provided below.

The organization provides basicsecurity awareness training to all information system users(includingmanagers, senior executives, and contractors) as part of initial training for new users, when required by system changes, and [Assignment organization-definedfrequency] thereafter.

AT-3: Security Training

Not Applicable to System/Contract 11 I Jus tificatio n/Implementation Detail

Control Description System- or contract-specific detail is provided below.

The organization provides role-based security-related training (i) before authorizingaccess to the system or pe,fonning assigned duties; (ii) when required by system changes; and (iii)[Assignment organization-defined.frequency] thereafter.

Incident Response relates to dealing withthe potential for and actual damage and disruption to information systems. An"incident" is any adverse event or situation associated witha system that poses a threat to the system's integrity, availability, or confidentiality. An incidentmay result in or stem from any one of the following: a failure of security controls; an attempted or actual compromise of information; and/or waste, fraud, abuse, loss, or damage of government property or information.

(IT S-HBK-2 810.09-01)

IR-6: Incident Reporting

Not Applicable to System/Contract 11 I J us tificatio n/Imnlementation Detail

Control Description All breaches willbecommunicated to the [Center] CISO and the NASA SOC within the timefrarneappropriate to the category of information involved. If thereis PIT invo lved in the breach the SOC will be contacted with one hour.

. The SOC may be contacted at 877-NASA SEC (877-627-2732).

The Center CISO and/or the OIG handles the notification to external authorities.

If applicab,le system- or contract-specificdetail is provided below.

The organization

a. Requires personnel to report suspected security incidents to the organizational incident response capability within [Assignment organization-definedtime-period}; and

b. Reports security incidentinformation to designated authorities.

Media Protection relates to the secure use of information storage media. Storage media can take one of two forms- digital or non-digital. Non-digital media typically consists of paper, film, microfilm, microfiche, etc. Digital media is comprised of mobile computing devices, laptops, PDAs, "smart phones," and removable storage devices such as USB drives, flash drives, writeable CDs and DVDs, memory cards, external hard drives, storage cards, diskettes, magnetic tapes or any electronicdevice that canbe used to copy, save, store and/or move data from one system to another.

(ITS-HBK-2810.11-01, ITS-HBK-2810.11-02)

MP-1: Media Protedion Policy and Procedures

Not Applicable to System/Contract 11 I J us tificatio n/ImplementationDetail

Control Description

Theorganizationdevelops, disseminates, and reviews/updates [Assignment organization definedfrequency]

a. A formal, documented media protection policy thataddresses purpose, scope, roles, responsibilities, management commitment, coordination among organizationalentities, and compliance; and

b. Formal, documented procedures to facilitate the implementation of the media protection policy and associated media protection controls.

In accordance with the NASA FAR external systems are subject to the requirements of NPR 2810 and applicable requiremen,ts regulation, s policies, and guidelines are identified in the

Applicable Documents List (ADL).

If applicab,le system- or contract-specific policies should be referenced here.

MP-3: Media Marking

Not .Applicab le to Sys tem/ Co ntract 11 I Jus tificatio n/Inmlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Marks, in accordance with organizational policiesand procedures, removable information system media and information system outputindicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

b. Exempts [Assignment organization-defined list of removable media types] from markingas longas the exempted items remain within [Assignment organization-definedcontrolled areas].

MP-4: Media Storage

Not .Applicab le to Svs tem/ Co ntract 11 I Jus tificatio n/Imnlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Physically controls and securely stores [Assignment organization-defined types of digital and non-digital media] within [Assignment organization-defined controlled areas] using [Assignment organization-defined security measures];

b. Protects information system media until the mediaare destroyed or sanitized usingapproved equipment, techniques, and procedures.

MP-5: Media Transport

Not .Applicab le to Svs tem/ Co ntract 11 I Jus tificatio n/Imnlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Protects and controls[Assignment organization-defined typesof digital and non-digital media] during transport outside of controlled areas using

[Assignment organization-definedsecurity measures];

b. Maintains accountability for information system media during transport outsideof controlled areas; and

c. Restricts the activitiesassociated with transport of such media to authorized versonnel.

MP-6: Media Sanitization

Not .Applicab le to Sys tem/ Co ntract 11 I Jus tificatio n/Inmlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Sanitizes information system media, both digital and non-digital, prior to disposal, release out of organizational control, or release for reuse; and

b. Employs sanitization mechanisms with strength and integrity commensurate with the classification or sensitivity of the information.

Configuration Managementrelates to the organizationalaspects of information system baseline configurations, establishing revie w and validation,and change control. It also manages administrator roles , and the ability of individuals to make changes to the information systems' configuration.

(ITS-HBK-2810.07-01, ITS-HBK-2810.02-04)

CM-8: Information System Component Inventory

Not .Applicab le to Sys tem/ Co ntract 11 I Jus tificatio n/Inmlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization develops, documents, and maintains an inventory ofinfonnation system components that

a. Accurately reflects the current infonnation system;

b. Is consistent with theauthorization boundary of the infonnation system;

c. Is at the level of granularity deemed necessary for tracking and reporting;

d. Includes [Assignment organization-definedinfonnation deemed necessary to achieve effective property accountability]; and

e. Is available for review and auditby designated organizationalofficials.

Physical and Environmental Protection relates to the activities and requirements s1.UToundin g the development, implementation, and maintenance of physical access authorizations and controls (e.g., key and security badge distribution, visitor management, and related record keeping), and the protection, proofing, and regulation of facilities. This section also addresses protection of facilities and the essentialutilities and infrastructure which support those facilities (e.g., door locks, backup power and lighting, emergency plumbing shutoff switches, and fire suppre ssion sys tems ), andenvironmental controls for those facilities (e.g., temperature regulation, humidity monitoring), as appropriate.

(ITS-HBK-2810.12-01)

PE-3: Physical Access Control

Not Applicable to System/Contract II I Jus tificatio n/Implementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Enforces physical access authorizationsfor all physical access points

(includingdesignated entry/exit points) to the facility where the infonnation system resides (excluding thoseareaswithin the facility officially designated as publicly accessible);

b. Verifies individual accessauthorizationsbefore grantingaccess to the facility;

c. Controls entryto the facility containing the infonnation system using physical accessdevices and/or guards;

a. Controls access to areas officially designated as publicly accessible in accordance with theorganization'sassessment of risk;

b. Secures keys, combinations, and other physical accessdevices;

c. Inventories physical access devices [Assignment organization-defined freJ:Juency]; and

d. Changes combinations and keys[Assignment organization-definedfreJ Juency] and when keysare lost, combinations are compromised, or individuals are transferred or tenninated.

Personnel Security relates to the security activities that s1.UTound various facets of the employment life cycle (i.e., initial employee screening, positioncategorization, authority delegation, sanctioning, transfers, and termination). Personnel Security applies to both direct employees of the Agency as well as contracted perso nne l, and service bureaus.

(ITS-HBK-2810.13-01)

PS-2: Position Categorization

Not .Applicab le to Sys tem/ Co ntract 11 I Jus tificatio n/Inmlementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Assigns a risk designation to all positions;

b. Establishes screening criteria for individuals filling those positions; and

c. Reviewsand revises position riskdesignations [Assignment organization-definedfreJ Juency].

PS-3: Personnel Screening

Not Applicable to System/Contract II I Justification/Implementation Detail

Control Description System- or contract -specific detailis provided below.

The organization

a. Screens individuals prior to authorizing access to the infonnation system; and\

b. Rescreens individuals according to [Assignment organization-definedlistof conditions requiring rescreening and, where re-screeningis so indicated, the freJ Juency of such rescreening}.

PS-4: Personnel Termination

Not Applicable to Svstem/Contract II I Jus tificatio n/Imnlementation Detail

Control Description System- or contract -specific detail is provided below.

The organization, upon tennination of individual employment

a. Tenninates infonnation system access;

b. Conducts exitinterviews;

c. Retrieves all security-related organizational information system-related property; and

d. Retains access to organizational information and information systemsformerly controlled by tenninated individual.

PS-7: Third-Party Personnel Security

Not Applicable to Svstem/Contract II I Jus tificatio n/Imnlementation Detail

Control Description System- or contract -specific detail is provided below.

The organization

a. Establishes personnel security requirements including security roles and responsibilitiesfor third-party providers;

b. Documents personnel security requirements; and

c. Moniton; provider compliance.

PS-8: Personnel Sanctions

Not Applicable to System/Contract II I Justification/Implementation Detail

Control Description System- or contract -specific detail is provided below.

The organization employs a formal sanctionsprocessfor personnel failing to comply with established infonnation security policiesand procedures.

Access Control relates to the ability to permit ordeny access to computer systems, system locations and system information based on a user's need to know. It encompasses the management of unique account identifiers (IDs), passwords, physical access, badges and tokens, and user permissions to ensure the proper level of system access.

(ITS-HBK-2810.15-01, 1TS-HBK-2810.15-02A)

AC-2: Account Management

Not Applicable to System/Contract 11 I Jus tificatio n/Implementation Detail

Control Description System- or contract-specific detail is provided below.

The organization manages information system accounts, including

a. Identifying account types(i.e., individual, group, system, application, guest/anonymous, and temporary);

b. Establishing conditions for groupmembership;

c. Identifying authorized users of the information system and specifying access privileges;

d. Requiring appropriate approvals for requests to establish accounts;

e. Establishing, activating, modifying, disabling, and removing accounts;

f Specifically authorizing and monitoring the use of guest/anonymous and temporary accounts;

g. Notifying account managers when temporary accounts are no longer required and when information system usen; are terminated, transferred, or infonnation system usage or need-to-know/need-to-share changes;

h. Deactivating (i) temporary accounts thatare nolonger required; and (ii) accounts of terminated or transferred users;

i. Grantingaccess to the system based on (i) a validaccessauthorization; (ii) intended system usage; and (iii) other attributes as required by the organization or associated missions/businessfunctions; and

;. Reviewinf! accounts {Assif!nment orp_ani zation - de fined freauencv l.

AC-5: Separation of Duties

Not Applicable to System/Contract 11 I Jus tificatio n/Implementation Detail

Control Description System- or contract-specific detail is provided below.

SENSITIVE BUT UNCLASSIFIED (SBU)

The organization

a. Separates dutiesof individuals as necessary, to prevent malevolent activity without collusion;

b. Documents separation of duties; and

c. Implements separation of duties through assigned information systemaccess authorizations.

AC-6: Least Privilege

Not Applicable to System/Contract 11 I Justification/Implementation Detail

Control Description System- or contract-specific detail is provided below.

The organization employs the concept of least privilege, allowing onlyauthorized accesses for users(and processes acting on behalf of users) which are necessary to accomplish assigned tasksin accordance with organizational missions and business functions.

AC-20: Use of External Informa tion Systems

Not .Applicab le to System/Contract 11 I Justification/Inmlementation Detail

Control Description System- or contract-specific detail is provided below.

The organization establishes termsand conditions,consistent with any trust relationships established withotherorganizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to

a. Access the information system from the external information systems; and

b. Process, store, and/or transmit organization-controlled information using the external information systems.

3 Federal Information Security Management Act (FISMA) Reporting

The contractor shall adhere to the NASA FISMA reporting requirements and provide inputs upon request. In general this includes:

• Security Control Review/Assessment Date

• Authorization to Process/Store (ATP/S) Date2

• Contingency Plan Test Date

• Contingency Plan Test Type (Tabletop, Simulation or Full)

2 ATP / S is no t appli cable to con tactors who are no t operating an external system, rather, components used in the performance of the contract are covered under an internal, NASA infonnation system.

Appendix A: Acronyms

Acronym Defmition

ADL Applicable Documents List

CISO Chief Information Secw-ity Officer co Contracting Officer

COR Contracting Officer Representative

FIPS Federal Infonnation Processing Standards

ISSO Infonnation System Secmity Officer

ITSATC IT Secw-ity Awareness & Training Center

NIST-SP National Institute of Standards and Technology- Special Publications

NPR NASA Procedmal Requirements

SCRM Supply Chain Risk Management soc Secw-ity Operations Center

Additional Information: If there is any additional information that you wish to provide, please use the box below.