Attachment M_IT Applicable Documents List.pdf

ATTACHMENT M

APPLICABLE DOCUMENTS LIST

April 2023

DRFP 80GSFC23R0012

CONTRACT TBD

Contract TBD

Attachment M

ITS-HBK-1382.04-01 Privacy and Cybersecurity: Supporting an Integrated

Controls Framework

February 14, 2022

ITS-HBK-1382.05-01 Privacy Incident Response and Management: Breach

Response Team Checklist

July 19, 2022

ITS-HBK-1382.06-01 Web Privacy Notices and Redress July 19, 2022

ITS-HBK-1382.07-01 Privacy Awareness and Training (in discussion) November 19, 2018

ITS-HBK-1382.08-01 Privacy Accountability (in process) November 19, 2018

ITS-HBK-1382.09-01 NASA Privacy Program Plan September 2021

ITS-HBK-2810.002-

1C

Format and Procedures for IT Security Policies and

Handbooks

August 11, 2022

ITS-HBK-

AASTEP0.v1.0.0

Step 0: Prepare Policy (in process) January 07, 2022

ITS-HBK-

AASTEP1.v1.0.0

Step 1: Categorize Policy (in process) January 07, 2022

ITS-HBK-

AASTEP2.v1.0.0

Step 2: Select Policy (in process) January 07, 2022

ITS-HBK-

AASTEP3.v1.0.

Step 3: Implement Policy (in process) January 07, 2022

ITS-HBK-

AASTEP4.v1.0.0

Step 4: Assess Policy (in process) January 07, 2022

ITS-HBK-

AASTEP5.v1.0.0

Step 5: Authorize Policy (in process) January 07, 2022

ITS-HBK-

AASTEP6.v1.0.0

Step 6: Monitor Policy (in process) January 07, 2022

ITS-HBK-2810.04-

01A

Risk Assessment: Security Categorization, Risk

Assessment, Vulnerability Scanning, Expedited Patching

January 31, 2023

ITS-HBK-2810.05-

02B

System and Service Acquisition January 31, 2023

ITS-HBK-2810.06-2B Cybersecurity and Privacy Awareness, Training and

Education

September 20, 2022

ITS-HBK-2810.07-

02B

Configuration Management January 31, 2023

ITS-HBK-2810.08-1A Contingency Planning January 31, 2023

ITS-HBK-2810.09-01 Incident Response and Management (in process) September 30, 2021

ITS-HBK-2810.09-

02A

NASA Information Security Incident Management (CUI) November 01, 2019

ITS-HBK-2810.09-04 Incident Response and Management: Guidelines for Data

Spillage & Sanitization Procedures

November 06, 2019

ITS-HBK-2810.09-3A Collection of Electronic Data (in process) June 01, 2020

ITS-HBK-

2810.10.02B

Maintenance January 31, 2023

ITS-HBK-2810.11-2B Media Protection and Sanitization January 31, 2023

ITS-HBK-2810.12-2B Physical and Environmental Protection January 31, 2023

ITS-HBK-2810.13-1B Personnel Security January 31, 2023

ITS-HBK-2810.14-

03C

System and Information Integrity January 31, 2023

SP 800-187 Guide to LTE Security December 21, 2017

SP 800-185 SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and

ParallelHash

December 22, 2016

SP 800-184 Guide for Cybersecurity Event Recovery December 22, 2016

SP 800-183 Networks of 'Things' July 28, 2016

SP 800-181 Rev. 1 Workforce Framework for Cybersecurity (NICE Framework) November 16, 2020

SP 800-178 A Comparison of Attribute Based Access Control (ABAC)

Standards for Data Service Applications: Extensible Access

Control Markup Language (XACML) and Next Generation

Access Control (NGAC)

October 03, 2016

SP 800-177 Rev. 1 Trustworthy Email February 26, 2019

SP 800-175B Rev. 1 Guideline for Using Cryptographic Standards in the Federal

Government: Cryptographic Mechanisms

March 31, 2020

SP 800-175A Guideline for Using Cryptographic Standards in the Federal

Government: Directives, Mandates and Policies

August 22, 2016

SP 800-172A Assessing Enhanced Security Requirements for Controlled

Unclassified Information

March 15, 2022

SP 800-172 Enhanced Security Requirements for Protecting Controlled

Unclassified Information: A Supplement to NIST Special

Publication 800-171

February 02, 2021

SP 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal

Systems and Organizations

January 28, 2021

SP 800-171A Assessing Security Requirements for Controlled Unclassified

Information

June 13, 2018

SP 800-168 Approximate Matching: Definition and Terminology July 02, 2014

SP 800-167 Guide to Application Whitelisting October 28, 2015

SP 800-166 Derived PIV Application and Data Model Test Guidelines June 06, 2016

SP 800-163 Rev. 1 Vetting the Security of Mobile Applications April 19, 2019

SP 800-162 Guide to Attribute Based Access Control (ABAC) Definition and Considerations

August 02, 2019

SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for

Systems and Organizations

May 05, 2022

SP 800-160 Vol. 2

Rev. 1

Developing Cyber-Resilient Systems: A Systems Security

Engineering Approach

December 09, 2021

SP 800-160 Vol. 1 Systems Security Engineering: Considerations for a

Multidisciplinary Approach in the Engineering of Trustworthy

Secure Systems

March 21, 2018

SP 800-157 Guidelines for Derived Personal Identity Verification (PIV)

Credentials

December 19, 2014

SP 800-156 Representation of PIV Chain-of-Trust for Import and Export May 20, 2016

SP 800-153 Guidelines for Securing Wireless Local Area Networks

(WLANs)

February 21, 2012

SP 800-152 A Profile for U.S. Federal Cryptographic Key Management

Systems (CKMS)

October 28, 2015

SP 800-150 Guide to Cyber Threat Information Sharing October 04, 2016

SP 800-147B BIOS Protection Guidelines for Servers August 28, 2014

SP 800-147 BIOS Protection Guidelines April 29, 2011

SP 800-146 Cloud Computing Synopsis and Recommendations May 29, 2012

SP 800-145 The NIST Definition of Cloud Computing September 28, 2011

SP 800-144 Guidelines on Security and Privacy in Public Cloud

Computing

December 09, 2011

SP 800-142 Practical Combinatorial Testing October 07, 2010

SP 800-140F CMVP Approved Non-Invasive Attack Mitigation Test

Metrics: CMVP Validation Authority Updates to ISO/IEC

24759

March 20, 2020

SP 800-140E CMVP Approved Authentication Mechanisms: CMVP

Validation Authority Requirements for ISO/IEC 19790 Annex

E and ISO/IEC 24579 Section 6.17

March 20, 2020

SP 800-140D Rev. 1 CMVP Approved Sensitive Parameter Generation and

Establishment Methods: CMVP Validation Authority Updates to ISO/IEC 24759

May 20, 2022

SP 800-140C Rev. 1 CMVP Approved Security Functions: CMVP Validation

Authority Updates to ISO/IEC 24759

May 20, 2022

SP 800-140B CMVP Security Policy Requirements: CMVP Validation

Authority Updates to ISO/IEC 24759 and ISO/IEC 19790

Annex B

March 20, 2020

SP 800-140A CMVP Documentation Requirements: CMVP Validation

Authority Updates to ISO/IEC 24759

March 20, 2020

SP 800-140 FIPS 140-3 Derived Test Requirements (DTR): CMVP

Validation Authority Updates to ISO/IEC 24759

March 20, 2020

SP 800-137A Assessing Information Security Continuous Monitoring

(ISCM) Programs: Developing an ISCM Program Assessment

May 21, 2020

SP 800-137 Information Security Continuous Monitoring (ISCM) for

Federal Information Systems and Organizations

September 30, 2011

SP 800-135 Rev. 1 Recommendation for Existing Application-Specific Key

Derivation Functions

December 23, 2011

SP 800-133 Rev. 2 Recommendation for Cryptographic Key Generation June 04, 2020

SP 800-132 Recommendation for Password-Based Key Derivation: Part 1:

Storage Applications

December 22, 2010

SP 800-131A Rev. 2 Transitioning the Use of Cryptographic Algorithms and Key

Lengths

March 21, 2019

SP 800-130 A Framework for Designing Cryptographic Key Management

Systems

August 15, 2013

SP 800-128 Guide for Security-Focused Configuration Management of

Information Systems

October 10, 2019

SP 800-126 Rev. 3 The Technical Specification for the Security Content

Automation Protocol (SCAP): SCAP Version 1.3

February 14, 2018

SP 800-126 Rev. 2 The Technical Specification for the Security Content

Automation Protocol (SCAP): SCAP Version 1.2

March 19, 2012

SP 800-126A SCAP 1.3 Component Specification Version Updates: An

Annex to NIST Special Publication 800-126 Revision 3

February 14, 2018

SP 800-126 Rev. 1 The Technical Specification for the Security Content

Automation Protocol (SCAP): SCAP Version 1.1

February 25, 2011

SP 800-125B Secure Virtual Network Configuration for Virtual Machine

(VM) Protection

March 7, 2016

SP 800-125A Rev. 1 Security Recommendations for Server-based Hypervisor

Platforms

June 7, 2018

SP 800-125 Guide to Security for Full Virtualization Technologies January 28, 2011

SP 800-124 Rev. 1 Guidelines for Managing the Security of Mobile Devices in the Enterprise

June 21, 2013

SP 800-123 Guide to General Server Security July 25, 2008

SP 800-122 Guide to Protecting the Confidentiality of Personally

Identifiable Information (PII)

April 06, 2010

SP 800-121 Rev. 2 Guide to Bluetooth Security January 19, 2022

SP 800-119 Guidelines for the Secure Deployment of IPv6 December 29, 2010

SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access June 29, 2018

SP 800-115 Technical Guide to Information Security Testing and

Assessment

September 30, 2008

SP 800-114 Rev. 1 User's Guide to Telework and Bring Your Own Device

(BYOD) Security

July 29, 2016

SP 800-113 Guide to SSL VPNs July 01, 2008

SP 800-111 Guide to Storage Encryption Technologies for End User

Devices

November 15, 2007

SP 800-108 Rev. 1 Recommendation for Key Derivation Using Pseudorandom

Functions

August 17, 2022

SP 800-107 Rev. 1 Recommendation for Applications Using Approved Hash

Algorithms

August 24, 2012

SP 800-106 Randomized Hashing for Digital Signatures February 25, 2009

SP 800-102 Recommendation for Digital Signature Timeliness September 23, 2009

SP 800-101 Rev. 1 Guidelines on Mobile Device Forensics May 15, 2014

SP 800-98 Guidelines for Securing Radio Frequency Identification

(RFID) Systems

April 06, 2007

SP 800-97 Establishing Wireless Robust Security Networks: A Guide to

IEEE 802.11i

February 07, 2007

SP 800-96 PIV Card to Reader Interoperability Guidelines December 29, 2006

SP 800-95 Guide to Secure Web Services August 29, 2007

SP 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS) February 20, 2007

SP 800-92 Guide to Computer Security Log Management September 13, 2006

SP 800-90B Recommendation for the Entropy Sources Used for Random

Bit Generation

January 10, 2018

SP 800-90A Rev. 1 Recommendation for Random Number Generation Using

Deterministic Random Bit Generators

June 24, 2015

SP 800-89 Recommendation for Obtaining Assurances for Digital

Signature Applications

November 30, 2006

SP 800-88 Rev. 1 Guidelines for Media Sanitization December 17, 2014

SP 800-87 Rev. 2 Codes for Identification of Federal and Federally-Assisted

Organizations

April 19, 2018

SP 800-86 Guide to Integrating Forensic Techniques into Incident

Response

September 01, 2006

SP 800-85B PIV Data Model Test Guidelines July 31, 2006

SP 800-85A-4 PIV Card Application and Middleware Interface Test

Guidelines (SP 800-73-4 Compliance)

April 13, 2016

SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

September 21, 2006

SP 800-83 Rev. 1 Guide to Malware Incident Prevention and Handling for

Desktops and Laptops

July 22, 2013

SP 800-82 Rev. 2 Guide to Industrial Control Systems (ICS) Security June 03, 2015

SP 800-81-2 Secure Domain Name System (DNS) Deployment Guide September 18, 2013

SP 800-79-2 Guidelines for the Authorization of Personal Identity

Verification Card Issuers (PCI) and Derived PIV Credential

Issuers (DPCI)

July 30, 2015

SP 800-78-4 Cryptographic Algorithms and Key Sizes for Personal Identity

Verification

May 29, 2015

SP 800-77 Rev. 1 Guide to IPsec VPNs June 30, 2020

SP 800-76-2 Biometric Specifications for Personal Identity Verification July 11, 2013

SP 800-73-4 Interfaces for Personal Identity Verification February 12, 2016

SP 800-72 Guidelines on PDA Forensics November 01, 2004

SP 800-70 Rev. 4 National Checklist Program for IT Products: Guidelines for

Checklist Users and Developers

February 15, 2018

SP 800-67 Rev. 2 Recommendation for the Triple Data Encryption Algorithm

(TDEA) Block Cipher

November 17, 2017

SP 800-66 Rev. 1 An Introductory Resource Guide for Implementing the Health

Insurance Portability and Accountability Act (HIPAA)

Security Rule

October 23, 2008

SP 800-63-3 Digital Identity Guidelines March 02, 2020

SP 800-63C Digital Identity Guidelines: Federation and Assertions March 02, 2020

SP 800-63B Digital Identity Guidelines: Authentication and Lifecycle

Management

March 02, 2020

SP 800-63A Digital Identity Guidelines: Enrollment and Identity Proofing March 02, 2020

SP 800-61 Rev. 2 Computer Security Incident Handling Guide August 08, 2012

SP 800-60 Vol. 2

Rev. 1

Guide for Mapping Types of Information and Information

Systems to Security Categories: Appendices

August 01, 2008

SP 800-60 Vol. 1

Rev. 1

Guide for Mapping Types of Information and Information

Systems to Security Categories

August 01, 2008

SP 800-59 Guideline for Identifying an Information System as a National

Security System

August 08, 2003

SP 800-58 Security Considerations for Voice Over IP Systems January 01, 2005

SP 800-57 Part 3

Rev. 1

Recommendation for Key Management, Part 3: Application-

Specific Key Management Guidance

January 22, 2015

SP 800-57 Part 2

Rev. 1

Recommendation for Key Management: Part 2 – Best

Practices for Key Management Organizations

May 23, 2019

SP 800-57 Part 1

Rev. 5

Recommendation for Key Management: Part 1 – General May 04, 2020

SP 800-56C Rev. 2 Recommendation for Key-Derivation Methods in Key-

Establishment Schemes

August 18, 2020

SP 800-56B Rev. 2 Recommendation for Pair-Wise Key-Establishment Using

Integer Factorization Cryptography

March 21, 2019

SP 800-56A Rev. 3 Recommendation for Pair-Wise Key-Establishment Schemes

Using Discrete Logarithm Cryptography

April 16, 2018

SP 800-55 Rev. 1 Performance Measurement Guide for Information Security July 16, 2008

SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and

Organizations

December 10, 2020

SP 800-53B Control Baselines for Information Systems and Organizations December 10, 2020

SP 800-53A Rev. 5 Assessing Security and Privacy Controls in Information

Systems and Organizations

January 25, 2022

SP 800-53A Rev. 4 Assessing Security and Privacy Controls in Federal

Information Systems and Organizations: Building Effective

Assessment Plans

December 18, 2014

SP 800-52 Rev. 2 Guidelines for the Selection, Configuration, and Use of

Transport Layer Security (TLS) Implementations

August 29, 2019

SP 800-51 Rev. 1 Guide to Using Vulnerability Naming Schemes February 25, 2011

SP 800-50 Building an Information Technology Security Awareness and

Training Program

October 01, 2003

SP 800-49 Federal S/MIME V3 Client Profile November 05, 2002

SP 800-47 Rev. 1 Managing the Security of Information Exchanges July 20, 2021

SP 800-46 Rev. 2 Guide to Enterprise Telework, Remote Access, and Bring

Your Own Device (BYOD) Security

July 29, 2016

SP 800-45 Version 2 Guidelines on Electronic Mail Security February 20, 2007

SP 800-44 Version 2 Guidelines on Securing Public Web Servers October 09, 2007

SP 800-41 Rev. 1 Guidelines on Firewalls and Firewall Policy September 28, 2009

SP 800-40 Rev. 4 Guide to Enterprise Patch Management Planning: Preventive

Maintenance for Technology

April 06, 2022

SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View

March 01, 2011

SP 800-38G Recommendation for Block Cipher Modes of Operation:

Methods for Format-Preserving Encryption

August 04, 2016

SP 800-38F Recommendation for Block Cipher Modes of Operation:

Methods for Key Wrapping

December 13, 2012

SP 800-38E Recommendation for Block Cipher Modes of Operation: the

XTS-AES Mode for Confidentiality on Storage Devices

January 18, 2010

SP 800-38D Recommendation for Block Cipher Modes of Operation:

Galois/Counter Mode (GCM) and GMAC

November 28, 2007

SP 800-38C Recommendation for Block Cipher Modes of Operation: the

CCM Mode for Authentication and Confidentiality

July 20, 2007

SP 800-38B Recommendation for Block Cipher Modes of Operation: the

CMAC Mode for Authentication

October 06, 2016

SP 800-38A

Addendum

Recommendation for Block Cipher Modes of Operation:

Three Variants of Ciphertext Stealing for CBC Mode

October 21, 2010

SP 800-38A Recommendation for Block Cipher Modes of Operation:

Methods and Techniques

December 01, 2001

SP 800-37 Rev. 2 Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy

December 20, 2018

SP 800-35 Guide to Information Technology Security Services October 09, 2003

SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems November 11, 2010

SP 800-30 Rev. 1 Guide for Conducting Risk Assessments September 17, 2012

SP 800-28 Version 2 Guidelines on Active Content and Mobile Code March 07, 2008

SP 800-22 Rev. 1a A Statistical Test Suite for Random and Pseudorandom

Number Generators for Cryptographic Applications

April 30, 2010

SP 800-18 Rev. 1 Guide for Developing Security Plans for Federal Information

Systems

February 24, 2006

SP 800-16 Information Technology Security Training Requirements: A

Role- and Performance-Based Model

April 01,1998

SP 800-12 Rev. 1 An Introduction to Information Security June 22, 2017