SSP_50744-Rev_A.docx

SSP 50744

Revision A Data Impoundment and Processing Procedures

International Space Station Program

Revision A

December 2011

National Aeronautics and Space Administration International Space Station Program Johnson Space Center Houston, Texas Contract No.: NNJ09GA18B

SSP 50744

G-1

REVISION AND HISTORY PAGE

PREFACE

data impoundment and processing procedures This document implements the requirements of SSP 50190, International Space Station Program Contingency Action Plan, in providing impoundment and protection of all records and data required to support an investigation. The International Space Station (ISS) Impoundment/Classified Data Working Group (IDWG) is delegated for the overall responsibility to ensure procedures for the data impoundment and control are properly followed and to manage the overall data flows to support the contingency investigation needs.

This document is under the control of the Space Station Program Control Board (SSPCB) and future updates and revisions have been delegated to the ISS Configuration Management (CM) Manager.

INTERNATIONAL SPACE STATION PROGRAM

CONCURRENCE

december 2011

INTERNATIONAL SPACE STATION PROGRAM

LIST OF CHANGES

december 2011 All changes to paragraphs, tables, and figures in this document are shown below:

Board Name

Entry Date

Change

Paragraph(s)

September 2006

Baseline

All

January 2012

Revision A

All

TABLE OF CONTENTS

APPENDIX

TABLE

FIGURE

3.3.3.2-1 ISS Contingency Investigation Data Request Process Flowchart 3-11

SSP 50744

Revision A v INTRODUCTIOn SSP 50190, International Space Station Program Contingency Action Plan, requires that the identification, impoundment, and control of data must begin as soon as any suspected contingency involving the International Space Station (ISS) operations and/or properties occurs in order to preserve and safeguard data and evidence relevant to the suspected contingency and to support investigation activities necessary as directed by the National Aeronautics and Space Administration (NASA) Management.

PURPOSE

This document implements the requirements of SSP 50190 in providing for impoundment and protection of all records and data required to support an investigation. The ISS Impoundment/Classified Data Working Group (IDWG) is delegated the overall responsibility to ensure procedures for the data impoundment and control are properly followed and to manage the overall data flows to support the contingency investigation needs.

SCOPE

This document establishes guidelines and procedures for the ISS Program for data impoundment following a suspected ISS contingency including storage and handling of records/data, organizational responsibilities; data access control requirements and handling of specialized data/record types, and long-term data repository upon completion of the investigation. The data impoundment applies to ISS systems, ISS payloads, and crew operations/activities data. The guidelines and procedures reflect the basic approach by the ISS IDWG and will be adhered to the maximum extent possible to provide consistency and avoid confusion; however, some specifics may be tailored recognizing the unique nature of each contingency and the composition and operational requirements of the investigation board. Any tailoring to the procedures in this document for the specific investigation will be documented and approved by the approving authority of this document.

PRECEDENCE

Data impoundment and processing procedures are contained herein. In the event of conflicting statements regarding data impoundment, SSP 50190 shall take precedence.

DELEGATION OF AUTHORITY

Revisions are made whenever a change in method of operation or responsibilities is incorporated within this document. The final approval and signature authority for revisions to this document rests with the ISS Configuration Management (CM) Manager.

applicablity This document applies to all organizations and facilities involved in the suspected ISS contingency and/or related hardware and software items; this includes all relevant NASA organizations and their contractors, other government organizations and facilities, and ISS payload customers. This document will be implemented for any ISS contingency that meets the requirements defined in SSP 50190 and upon activation of this working group. The specific applicability of this document to International Partners/Participants (IP/Ps) may vary depending on agreements reached between NASA and ISS IP/Ps.

effectivity This document is effective immediately and will remain in effect until the conclusion of the ISS Program.

SSP 50744

Revision A

1-2

DOCUMENTS

applicable documents The following documents include specifications, models, standards, guidelines, handbooks, and other special publications. The documents listed in this paragraph are applicable to the extent specified herein. Inclusion of applicable documents herein does not in any way supersede the order of precedence identified in Paragraph 1.3 of this document.

reference documents The following documents contain supplemental information to guide the user in the application of this document. These reference documents may or may not be specifically cited within the text of this document.

NSTS 07700

Volume IV Space Shuttle Configuration Management Requirements, Book 1, Requirements

2-1 data impoundment and management data types Upon declaration of a contingency or a suspected contingency, all data pertinent to the contingency must be immediately impounded to preserve the integrity of the data. The responsibilities of each organization vary and the specific data to be impounded at each organization will vary accordingly depending on its responsibilities and facilities.

NPR 8621.1B, NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping w/Change 6 (10/24/2011), 5.3 Verify that the Site is Safe and Secured and Ensure Evidence is Preserved/Impounded, provides agency guidelines of sources where documentary data may be located. The following paragraphs describe data in four general types that are likely required to support an ISS contingency investigation and be impounded. Each organization, team, or working group will identify and define the specific lists of data to be preserved in its contingency action plan to ensure all impoundment is accomplished with minimum confusion. If unsure as to whether a data item should be impounded, each organization will take the conservative approach to preserve the information and prevent any contamination of the data.

Where computer system or database is used, it must be locked down until copies are made and impounded and release authorization given by the Associate Administer (AA) for the Human Exploration and Operations Mission Directorate (HEOMD), ISS Program Manager, or the investigation board chairperson to resume its normal functions per SSP 50190. Each organization, team, or working group will identify all databases and computer systems it employs in fulfilling its responsibilities, the responsible personnel for each system and their contact information, and develop the necessary processes that must be taken to secure the database and computer systems and preserve the integrity of information contained in the system.

The highest priority in the event of a contingency is to provide continued support to the safe continuation of the mission or on-going operations to protect the human life and property. Data preservation must not interfere with this priority. However, the responsible organization or teams should make every effort to record the time events, configuration and data, and to prevent or minimize compromising the integrity of the data needed for the follow-on investigations.

Evidence and Operations Data This category includes all information associated with the mishap or contingency event, including the extent of the damage, the number (if any) of personnel casualties or injuries, and the causes, if known. Data in this category must be immediately seized, placed in secure containers or in a secure room, and protected to prevent contamination by events following the contingency. This includes all relevant notes, sketches, photos, memos, faxes, electronic communications, operator and work station logbooks, procedures, hardware and software configuration to the level of specific switches and applications, data measurements, signal strength data, weather information, imagery data, and audio and video recordings including voice loop communications related to the contingency. Names, organization, and contact information of personnel present during the contingency event will be collected as impounded data. The information needs to cover all sequences of events leading up to, during, and following the contingency and includes any initial responses and corrective actions in response to the contingency. The data collection needs to include all interfacing and supporting flight and/or test equipment and any facility supports involved in the contingency. Ground Network and Space Network station site data associated with the ISS will also be impounded.

For ISS contingency occurring during a mission, JSC 29229, Flight Control Operations Handbook (FCOH) Station Operations and SOP 6.10.2.5, ISS Contingency Plan, contains detailed actions to follow to support the safe continuation of the flight and to preserve the mission data to support the investigation. SSP 50190 defines the responsibilities by the Mission Control Center (MCC), Technical Action Center (TAC), and the ISS IDWG in the proper handling and processing of the data.

planning and preparation documentation This includes all mission and operations planning and preparation information, including pre-mission analysis and test data, minutes from mission planning meetings and reviews, mission rules and requirements, and released procedures and data files. This group also includes personnel training, certification records and status, mission training and simulation records, results, and corrections if any. Flight readiness analyses and reports, flight readiness review (at team/organization and Program levels) presentations, minutes, and certificates are to be impounded. ISS Mission Management Team (IMMT) minutes can be crucial in establishing events and causes and will be impounded. If the contingency involves personnel, sensitive medical histories of the involved crewmembers or operators will be impounded to support the investigation.

manufacturing, integration, and processing data NASA and contractor engineering, manufacturing, testing, certification and acceptance records of the affected hardware, software, and equipment will be impounded. The data includes requirements, specifications, standards, materials procurement information and records, receipt, inspection information and records, fabrication and modification work orders and records, special processes, hazard reports, safety analyses, risk assessments, reliability engineering data, quality control records, assembly and checkout documentation, and configuration control data and records. Quality information includes, but not limited to, hardware and software histories including procurement and manufacturing data, refurbishment and upgrade/modification records, integration and test requirements/procedures and records, test software histories and status, problem reports and corrective actions, waivers (including Material Review Board dispositions) and deviations related to the affected hardware or software, inspection and audit records and certifications, associated personnel training records and certificates, and acceptance data packages and related records. Mission pre-flight processing requirements, procedures and records also will be impounded. This includes all hardcopies and data-recording devices used in the recording and/or storage of the data, such as tapes, discs, memory drives, audio and video recordings, and imagery data.

investigation records and data This category includes information collected or generated during the course of investigation. The information includes witness interview statements; transcripts, subject expert testimony records; imageries; special investigation analysis; test data and reports; fault trees; relevant faxes and electronic messages; and team meeting minutes, presentations, and reports. Investigation board records are managed and maintained by the board administrative personnel and are not considered as impounded data managed by the TAC and ISS IDWG.

data handling general Each organization, team, or working group responsible for the impoundment of contingency related data must ensure impounded data under their custodianship are stored in a safe and secure location to prevent damage and unauthorized access, and segregated to the maximum possibility from other irrelevant data. Adequate and appropriate containers, cabinets and shelves with locking features should be provided. A filing system must be established to systematically organize the impounded data and track the storage, release, retrieve, and re-storage efficiently and effectively. All data hardcopies, tapes, disks, or other physical data recording and storage media will be immediately collected, identified and conspicuously marked. The data will be cataloged, properly classified, inventoried, and the record submitted to the ISS IDWG using the Data Impoundment Log form ISS_CM_DM_302. This form is to record impounded data for each impound area and is submitted to the ISS TAC/IDWG. The IDWG will use this data to consolidate and determine the total of impounded records.

Each organization, team, or working group will assign a data custodian to ensure implementation of the data impoundment and proper handling within the organization, team or working group. To the extent possible, the organization should consolidate all impounded data in one location to more effectively preserve and safeguard the integrity of the data and provide efficient support to the investigation. The data custodian will ensure ISS_CM_DM_302 is maintained accurately and up to date for all data impound areas within the organization, team, or working group. The data custodian will, upon learning of the declaration of ISS contingency status, immediately contact the ISS IDWG to furnish or confirm the contact information and submit ISS_CM_DM_302 and status of impoundment implementation as soon as possible. The data custodian is critical in the successful support of the investigation and is the primary interface with the ISS IDWG to ensure the impoundment log is up to date and the data processing is functioning smoothly. The IDWG will meet all imagery requirements contained in SSP 50744 using current imagery processes and procedures.

FORMS

All forms for the Impoundment Data Process are in the Electronic Document Management System (EDMS) and are located on the CM Homepage under CM Blank Forms. The forms will be tailored to meet the unique requirements of the Investigation by the ISS IDWG when activated.

sensitive, classified, AND proprietary data Impounded data associated with the contingency must be protected in accordance with its sensitivity, criticality, and national security requirements. Data associated with the contingency will not be re-classified without formal authorization by the proper authority. All export controlled, sensitive or privileged (medical, witness statements, etc.), and proprietary data must be segregated, organized, and marked accordingly.

Each organization, team, or working group is required to ensure all classified data are handled properly in accordance with established NASA or Department of Defense (DoD) procedures. Responsible data custodian will coordinate closely with security and/or DoD representative and seek assistance in securing special areas and processes are established to ensure all classified documentation, data, and tapes are protected and available only to those with a need to know and possess the proper security clearance level. ISS IDWG will work with NASA security and DoD representative and provide assistance, if necessary, to ensure that appropriate NASA or DoD procedures are provided and consistently implemented.

database and computer systems Databases and computer systems must be immediately secured by locking down the system until copies can be made and submitted to the designated secure storage location, and the system is released by NASA AA for HEOMD or ISS Program Manager, or by the investigation board chairman when appointed. This means the systems are configuration frozen, new entries are forbidden, and in some cases, systems will be shut down until released for normal operation. Experience has taught that, as a rule, two copies are required for each data system, one primary copy will be preserved as “original” and not be touched, and one copy will be used to support the investigation needs as the working copy. In some cases for which very large numbers of tapes or memory devices are required, special request may be submitted to the NASA investigation manager (TAC manager) to allow the working copy be made for the requested data at the time of the request.

Data such as real-time recordings of telemetry, plot board charts, trajectory data, tape recordings, weather reports, digital command system and tone command tapes, acquisition aid data, signal-strength records, photographs, etc., must be condensed into legible format as soon as possible and impounded to support the investigation. Both the raw data in its original format and the legible reduced data will be considered original data and impounded. A second copy in the reduced format will be made as the working copy to support investigation activities.

Databases and tools used in the ISS by multiple disciplines to support ISS functions are the responsibility of the Information Technology (IT) Manager, ISS Information Technology Office (OH4). Additionally there are numerous databases developed by NASA and contractor organizations or teams to perform their daily responsibilities. Each organization, team or working group must identify these in their contingency planning documentation with information regarding responsible personnel and specific process to lock down the databases. The process will address procedures to freeze or shut down the system, making copies for impoundment, the security of the system and the copies, and resumption of normal operations when release is authorized.

email data Emails can be included as a record of discussions and data exchanges and are a possible source of data to support the contingency investigation. Any email (both sent and received) that is pertinent to any aspect of the contingency or to any involved hardware/software will be impounded. The area data custodian should work with any individuals possessing these emails to secure the records for impoundment. To the extent possible, the data custodian should monitor as the individual creates a personal folder in his/her email application and saves all relevant emails including attachments to this folder. The contents in the folder can then be copied to a memory storage device such as Compact Disc (CD), portable (Universal Serial Bus [USB] port) Pin Drive, or to a designated server when directed by the TAC manager or ISS IDWG. Information regarding the contents and their organization, together with information on the operating system and version, will be documented by the data custodian and provided with the impounded data.

security of data Impounded data associated with the contingency must be protected to preserve its integrity and supportability to the investigation. Except required for direct support of continued flight operations and to the extent permitted by law, no information or data will be released to any person without a need-to-know, as designated by the ISS Program Manager and Center Director, until such time as the appointment of an investigation board. To the extent provided by the law, access to the processed and reduced data associated with the investigation will be limited to personnel involved with the failure investigation until released by the investigation board chairperson.

Each organization or team/working group responsible for impounding data will identify designated areas to consolidate the impounded data and appoint a responsible person (data custodian) for the implementation of the process and safeguarding of the impounded data. The objective is to have all impounded data in one consolidated location, if possible, for each organization to permit better and more effective protection of the information. All data must be attended by authorized personnel or secured in a locked room, storage container, or filing cabinet at all times. The designated data custodian will identify a limited number of authorized personnel to area security office for the issuance of keys and ensure they are not misused. Physical access to impounded data must be controlled. Responsible designated data custodian may contact local security office to seek assistance or appoint delegated area monitors.

Access to “data impound areas” will be through the use of control access lists authorized by the organizational management or via formal data request jointly approved by the NASA ISS TAC manager and the investigation board chairperson. Paragraph 3.3 of this document describes in more detail the process for the data access and release controls. The administration and control of the access to the local impound area and data flow is the responsibility of the designated data custodian.

organization of impounded data All data must be inventoried, properly categorized and classified, and filed with sufficient information to facilitate efficient retrieval. The containers or cabinets will be labeled on the outside to indicate that contents contain impounded material and the access authorizations requirements. Any security containers with critical impound data will not be labeled indicating specific sensitive data so as not to identify its specific contents.

The minimum information for data inventories should include:

A. Location B. Identification Number (may include Box and Item Numbers) C. Data Identification D. Description of Data E. Data Media/Format F. Data Size (number of pages, discs, tapes, or bytes) G. Data Owner and Contact Information (during office hours and after work) H. Date of Impoundment I. Person Receiving the Data and Initial On a daily basis or as soon as possible as the content is updated, the inventory information must be forwarded to the ISS IDWG using ISS_CM_DM_302 provided CM Homepage, CM Blank Forms. This may be accomplished in person or via email or fax.

The original or primary copy of impounded data must be protected and be clearly identified as such. They will be filed and stored separately from the working copies to prevent inadvertent compromises. Sensitive, classified, or proprietary data will be filed, controlled, and tracked separately to ensure proper segregation and protection.

Impound Area Point Of Contacts The ISS IDWG will maintain an up-to-date listing of potential impound areas, contacts (designated impound area management and/or data custodian), and appropriate email addresses and phone numbers. Each NASA and contractor organization is responsible to maintain a list for the offices within the organization and their contractors and /or subcontractors. In the event of a contingency situation, the ISS TAC and ISS IDWG will contact all responsible Points of Contact (POC) (data custodian or management) appropriate to the specific contingency to begin implementation of data impoundment process. Each data custodian or management will, in turn, contact the responsible offices within his/her team or organization, their contractors and/or subcontractors that are associated with the contingency operation or any hardware/software item involved in the contingency. The responsibilities of the POC (data custodian or management) are identified in Section 4.0 C of this document. SSP 50190, Appendices A, B, and C, provides POCs in NASA Centers and ISS Program Offices and may be used to establish initial contacts if necessary. Data custodian or his/her management is expected to also contact ISS TAC and ISS IDWG after learning of the contingency to ensure this contact with TAC is established without delay. This list will be updated to meet the needs for the investigation of the specific contingency and provided to the investigation team. For the Johnson Space Center (JSC) area, this list will be made available to the JSC Security personnel so that proper security control measures can be put into effect at all impound sites within JSC jurisdiction.

data release/removal Access to Impounded Data Access to impound area must be controlled. This control will be enforced by storing all data impounded in the security vault in Building 420. This vault is a 24\7 alarmed facility and access to this vault will be coordinated through the JSC Security Office (JS41). The JSC Security Office will allow only designated appointed personnel access. The designated data custodian is responsible to ensure proper security measures are in place, the access control procedures are enforced, and that all accesses to the area and data checkouts and returns are logged and tracked.

The use of a pre-approved control access list allows authorized NASA and contractor personnel timely access to the data necessary for investigation related evaluation or analysis. Pre-approved authorized personnel requiring access into impound areas must be formally authorized. This may be accomplished by a management memorandum for personnel within the organization that has the need to access the data or by approval from the ISS TAC manager if the personnel requesting access is from outside of the impound area responsible organization. In the latter case, a request must be submitted to the ISS TAC manager from the personnel requesting the access with approval from his/her management; the request should specify type of data, duration of the access needs, and the justification for the request.

All other personnel requesting access to the impound area can be admitted by providing a data request form signed by the investigation board chairperson and the ISS TAC manager for non-sensitive data. Access to sensitive data will use a sensitive data request form and require additional approvals by responsible organizations (e.g., medical, legal, export control, etc.). ISS Contingency Investigation Request for Information for Sensitive and Non-Sensitive Data, form numbers ISS_CM_DM_300 and ISS_CM_DM_301 respectively. Forms can be located from the CM Homepage under CM Blank Forms cabinet. The forms can be tailored to meet unique needs of the investigation by the ISS IDWG when activated.

A large number of impounded data may be stored electronically. Approval process for access to such information will be by the same methods described above. Access to the electronic data may be through access to a computer system in the controlled-access area or through a secure web access.

Personnel requesting access to the impound areas outside the requester’s own organization will need to do the following:

A. Request that a manager or higher level authority submit a request in writing to the ISS TAC manager to authorize access to the impound area, including:

1. Signature of manager (or higher level authority),

2. A list of the specific personnel requiring access (including justification, types of data, duration of time, and location of the impound area), and

3. An approval signature block for the TAC manager (this avoids a separate memorandum from the TAC manager).

B. Once approved, provide the signed original to the ISS IDWG for record and submit a copy to the impound area(s) to which access is authorized.

Personnel names can be added or deleted from the access authorization through additional written requests approved by the TAC manager. The ISS IDWG will file the signed original and forward a copy of the approval to the appropriate impound area data custodian.

Release/Removal of Impound Data Release of the impounded data from the impound area requires an approved data request form (reference Paragraph 3.3.3.2 for data request process). This formal data release process is necessary to ensure that the data request is processed efficiently and consistently, and the data provided is correct and complete to meet the requester’s need. This process is employed for all data requests with the only exception being those by the NASA and contractor personnel on the pre-authorized access list described in the previous section in their evaluation of the data to support the investigation. In all cases, the data access and checkout flow must be logged and tracked by the impound area data custodian (or properly delegated monitor or security).

Originals may be viewed in place within the impound area and, if proper authorization exists, copies may be made and released to the reviewer. No original documentation will be allowed to leave the impound area without specific joint authorization from the investigation board chairperson and ISS TAC manager. All copies will be controlled. All data traffic will be logged with information including authorization, personnel, and data checkout and return times. All copies checked out of the impound area for viewing must be returned and properly filed when the review is complete. The responsible data custodian or the designated impound area monitor/security for the impound area is responsible to maintain the log up to date. This Impounded Data Checkout Record, ISS_CM_DM_303, will be maintained at each impound area and will be made available to TAC or ISS IDWG when requested.

This original data and any reference software necessary to retrieve the computer data will be monitored at all times by the local data custodian and the ISS IDWG. When proper authorization is given to remove or release the original or primary data (documents, records, tapes, or discs, etc.), the responsible custodian for the original data or a formally delegated area monitor or security will accompany the original data to the authorized destination and back unless the original is authorized to be transferred to another responsible data custodian. In such case, the transaction must be documented and signed by both provider and receiver. The signed transaction document will be maintained in the record by data custodian from both impound areas. The release of the original data must be through the completed data request form jointly approved by the investigation board and TAC managers, and by appropriate additional responsible organizations when sensitive data is involved.

Original documents/recordings are those that are made in real time and cannot be recreated if lost. Primary documents/recordings are those that are copied from a computer system before its release for normal operation; these are treated as “original” copies and will be protected as such. Copied data/recordings are those that are generated from the original data or master tapes and may be reproduced as printed material and used as the working copy to support the investigation activities.

Upon completion of the Program contingency investigation, the investigation board will have the sole authority to release impound area(s) and/or data/records contained within the impound area(s) and return to the original facility and/or the original owner of the data. Paragraph 3.4 of this document describes the long-term data retention requirements.

Processes Impound Area Access Process Refer to Paragraph 3.3.1 of this document for impound area access request/approval process. The following describes the guidelines for the impound area data access procedure:

A. Personnel with access authority should contact designated impound area data custodian or security personnel for access to the impound area. For those not on the pre-approved access list, a copy of the approved data request form must be provided to the custodian or on-duty data monitor or security. Those on the pre-approved access list may be required to complete any impound area developed forms to provide specific additional information to assist in the retrieval of data by the custodian or the security.

B. The custodian, designated monitor or security will verify the identification of the requester and proper access authority, assist in the data retrieval, and complete applicable fields of the data access and release log.

C. If viewing documentation, data, and tapes within the impound area, the requester will return and re-file the documentation, data, and tapes when finished. The custodian, designated monitor, or security will verify and update the log.

D. No data is allowed to leave the impound area, except for the following:

1. Authorized by the signed data request form, or

2. Needed for the investigation support by the pre-approved access personnel and meet the pre-approved data type and category criteria, or

3. Impound data area does not have proper equipment to permit viewing or reproducing of the data and must be viewed or copied at a different location. The data custodian has the responsibility to ensure proper equipment is provided within the impound area and inform ISS IDWG of the status, issues, and equipment location.

E. If data is to be released to the requester and removed from the impound area, a fresh copy of the data will be made to ensure the number of required copies in the impound area is maintained. Unless specifically approved (reference Paragraph 3.2.3), two copies must be maintained for any electronic data, one original/primary copy, and one working copy.

Data Request Process Other than data released to the NASA and contractor personnel supporting the investigation and on the pre-approved access list (reference Paragraph 3.3.1), all requests for the impounded data require an approved formal data request form. The forms can be downloaded from the CM Homepage, CM Blank Forms. Upon activation by ISS TAC, the ISS IDWG will immediately develop formal data request forms based on these templates, tailored to the specific contingency under investigation and release them for use after approval by the TAC manager and the investigation board chairperson. The basic data request process flow shown in Figure 3.3.3.2-1, ISS Contingency Investigation Data Request Process Flowchart, will be followed until modified, per formal direction from the investigation board chairperson and TAC manager.

LEGEND:

Figure 3.3.3.2-1 ISS Contingency Investigation Data Request Process Flowchart The requester must complete the appropriate data request form and submit to ISS IDWG. The request may be submitted through the designated data custodian or directly to ISS IDWG. It is critical to identify the requested data clearly and with sufficient description to avoid unnecessary delays caused by confusion. The requester may seek assistance from TAC working groups for ISS systems knowledge and proper NASA terminologies. The ISS IDWG, when requested, will assist in facilitating any meetings or teleconferences between the requester and the appropriate TAC working groups and data providers. It is important that such coordination is used only to assist the data requester to better define the request to meet the needs of the requester and that the independence of the requester will not be compromised.

The ISS IDWG, upon receiving the completed data request form, will communicate with TAC manager and the investigation board chairperson or designated members to seek priority assignment and approvals. If data requested is sensitive in nature, the ISS_CM_DM_303 form must be used. Depending on the nature of the data requested and its sensitivities, ISS IDWG will consult with responsible organization representatives and seek their acceptance and signatures.

The ISS IDWG will inform the data requester of the approval status and, if approval is granted, provide a copy to the requester and the affected impound area data custodian. The signed originals will be kept in the ISS IDWG archive as records. The impound area data custodian is responsible to retrieve the requested data and prepare a copy to be forwarded to the requester through ISS IDWG unless directed otherwise on the approved data request. The impound area data custodian will complete appropriate areas on the data request form, sign, and forward to the ISS IDWG for record.

If access to the impound area is requested, the requester will present the approved request to the impound area custodian or designated security to obtain access and copies of the requested data. The impound area custodian is responsible to make arrangements to meet the approved request, keep proper record and logs, and process the data request forms as described in the above paragraph.

The request is closed when the requester receives the requested data and the completed form signed by the managers of the investigation board and the ISS TAC. A new request is required and must be submitted if the requester requires additional data.

The ISS IDWG will hold regular meetings (daily at the beginning, may be relaxed later due to reduced data flow traffic) with all impound area custodians and brief status to the investigation board at the board tag-up meetings.

Third Party Data Requests Third party requests include congressional inquiries, requests for information for press conference preparation, requests from media, individuals, internationals, etc.

A. Information requests for congressional inquiries or press conference preparation must be submitted to the Headquarters Contingency Action Team (HCAT). HCAT will filter, prioritize, and submit requests via email or fax to TAC manager and/or the ISS IDWG. The TAC manager and ISS IDWG will review the request with the responsible organization or team/working group and forward the HCAT request to the response team manager or data custodian. The TAC manager, ISS IDWG, and the appropriate TAC working group will review the response data from the data provider and forward it to the HCAT. A copy will also be provided to the investigation board chairperson. ISS IDWG will log and track all HCAT requests and responses, and provide status to the investigation board.

B. All other third party requests including requests from the media, individuals, and internationals are handled through Freedom of Information Act (FOIA) procedures. Requests must be in writing and submitted to the appropriate Public Affairs Office (PAO)/FOIA Office. The TAC manager and ISS IDWG will assist in obtaining the information when contacted by the ISS Program Office FOIA representative. Retrieved information will be reviewed by the appropriate TAC working group for technical accuracy and provided to NASA PAO/FOIA Office for review and release per the policies and guidelines established by the PAO/FOIA office. ISS IDWG will log and track all FOIA requests and responses, and provide status at the investigation board tag-ups.

Non-Impounded Data Requests Requests for non-impounded data will be processed similarly and require joint approvals by the investigation board chairperson and TAC manager to ensure appropriate requests are processed. The approved requests will be forwarded by the ISS IDWG to appropriate responsible management of the data provider organization. ISS IDWG will log and track data flow until closure.

LONG-TERM DATA REPOSITORY

Upon completion of the investigation, all impounded data used in the investigation by the investigation board and the TAC working groups will be collected, organized, and forwarded to a designated central repository for long-term storage. This includes relevant impounded data as described in Paragraph 3.1 of this document, plus any meeting minutes, presentations, and reports by TAC and the investigation board including the final investigation board report. Additionally, to preserve the capability for future investigative activities, all impounded data is considered relevant for long-term retention unless specifically excluded by the TAC manager. TAC manager and ISS IDWG will seek from all TAC working groups and special expertise organizations for inputs on any additional data and proper electronic storage media that need to be kept for repository. As soon as the repository arrangement is finalized for the specific contingency investigation, ISS IDWG will provide further guidelines and instructions to each impound area data custodian. In addition to the central repository, each original data owning organization should arrange a separate repository for all impounded data under its responsibility in accordance with NPR 1441.1D, NASA Records Retention Schedules. The contingency investigation board data and final report is the responsibility of the investigation board and will be archived separately.

ISS TAC manager will negotiate with appropriate NASA center and identify a suitable location for this repository. The area will be environmentally controlled to preserve the data records, tapes, discs, and any data storage devices. If required, special containers providing a unique environmental control condition will be obtained. The ISS IDWG will seek appropriate TAC working group assistance to properly catalog and file the data. Inventory list and filing system will be documented and kept together with the data in the repository. Secure containers and cabinets will be obtained and will be clearly identified on the outside as contingency investigation data for security and easy retrieval. All efforts will be made to maintain the capability to read the data stored on those data storage media. This includes necessary equipment and software when reasonable. In unique cases, the TAC manager or higher management may allow special authorization if it is more efficient and effective to store a copy at the original site with the compatible equipment to retrieve the data. Same retention duration as required for the central repository will equally apply at these sites. In such case, any reduced legible data will still be required for the long-term retention at the central repository. ISS IDWG will ensure this information is documented in the inventory list together with the signed authorization. Latest version of NPR 8621.1 and NPR 1441.1 will be consulted for compliance. Section 6.0 of this document provides more detail on the basic data acquisition requirements and instructions for an ISS contingency and will be used to develop specific requirements and instructions unique to the contingency being investigated.

3-14 responsibilities The responsibilities described below pertain only to those pertinent to the implementation of the contingency data impoundment and handlings. This is not a complete listing of all responsibilities for all involved organizations or personnel; it summarizes some primary responsibilities of only those personnel having primary responsibility in this process.

A. TAC Manager – Responsible for the management of the ISS Technical Action Center in response to an ISS contingency. The TAC manager will:

1. Provide management assistance to ISS IDWG in the implementation of data impoundment and processes.

2. Implement the establishment of the data impoundment teams and assist ISS IDWG when issues arise regarding facilities and resources (personnel, hardware, software, information system, office equipments, furniture, etc.).

3. Approve addition/deletion requests of the pre-approved access list.

4. Approve formal data requests and closures and sign the appropriate blocks on the data request forms.

5. Assist ISS IDWG in identifying and negotiating arrangements for the long-term data repository.

B. ISS IDWG – The primary responsible working group in the development and management of the data impoundment guidelines and processes in the ISS TAC supporting the contingency investigation.

ISS IDWG is responsible for ensuring the implementation of the data impoundment processes by all affected government/contractor organizations, and teams/working groups, providing guidelines regarding data impoundment and handlings, managing impoundment data request and provision process, and resolving issues relating to the impoundment and data request process. ISS IDWG will:

1. Contact all applicable POCs (management or data custodian) to establish and verify all contact information of data custodians in each related organization, team/working group.

2. Contact the responsible POCs and verify that ISS Program databases such as COnfiguration Status Management Operations System (COSMOS), EDMS, Space Station Accounting and Verification (SSAV), etc., are secured and data preserved.

3. Develop data request forms tailored to the specific contingency and the needs of the investigation board.

4. Brief the investigation board, ISS TAC working groups, and any organization that has data impoundment responsibility on the roles, responsibilities and members of the ISS IDWG in the TAC. The briefing should include an overview of the process for data request and closures.

5. Develop an inventory database integrating all impounded data located in all impound area locations

6. Contact the information technology offices to arrange for data access to all impound areas, including associated hardware and software.

7. Establish a central database and tool to track and assist in the overall management of data requests.

8. Maintain continuous interfaces with responsible offices (medical, legal, security, etc.) to seek assistance on the proper handling of sensitive (medical, witness statement, legal, etc.), proprietary, and classified information. Provide guidelines and procedures to impound area data custodians.

9. Conduct daily tag up meetings with all data custodians to identify and resolve issues, coordinate processes and interfaces, exchange and update the data impoundment and release status, and investigation support needs.

10. Participate in the TAC and investigation board tag-ups to provide impoundment and data request process implementation status and issues.

11. Establish, with TAC manager assistance, and manage a central repository/library in the TAC area for all requested data and perform data custodian responsibilities for impounded data in the TAC repository/library.

12. Maintain presence and be available at all times to provide assistance to facilitate data requests and responses.

13. Work with NASA centers and ISS management to identify and establish a long-term repository for the impounded data.

14. Coordinate with NASA Records Officer at NASA Headquarters and NASA Records Manager at the NASA Center designated as the long-term repository location to establish final data acquisition requirements and specific instructions for data submittal and long-term repository (see Paragraph 3.). Oversee and monitor implementations of the processes by the data provider and the repository.

C. Data Custodian – The primary responsible person in the enforcement of data impoundment and handlings in the organization or teams/working groups.

Data custodian is the primary interface with the ISS IDWG representing the organization or team/working group. Data custodian should be familiar with the processes and procedures provided in this document and are able to assist in the interpretation of ISS data impoundment requirements and directions to his/her organization.