80LARC20R0002_EASSS 3_Exhibit B_Contract Documentation Requirements.pdf

80LARC20R0002 EXHIBIT B

EXHIBIT B - CONTRACT DOCUMENTATION REQUIREMENTS

I. DOCUMENTATION REQUIREMENTS

1. Monthly Contractor Financial Management Report

a) The Contractor shall submit a Monthly Contractor Financial Management Report in accordance with NASA Federal Acquisition Regulation Supplement (NFS) 1852.242-73, NASA Contractor Financial Management Reporting. The Contractor shall prepare and submit the form in accordance with the instructions set forth on the reverse side of the form and NASA Procedural Requirements (NPR) 9501.2E, NASA Contractor Financial Management Reporting.

b) The Contractor shall submit a separate 533M for each authorized task order.

c) The Contractor shall submit a summary 533M covering all authorized task orders.

d) The Contractor shall submit the report not later than the 10th working day following the close of the Contractor's accounting period being reported.

e) The Contractor shall complete Columns 8.a and b using estimates (forecasts) for the succeeding two months.

f) The Contractor shall ensure that estimates (forecasts) are the best projection of the actual costs to be reported in column 7.a of the subsequent month's 533M. Since NASA uses the Contractor's estimate for the current month (column 8.a of the 533M) as accrued costs in its monthly financial statements, the accuracy of these projections are critical to the integrity of NASA’s financial data.

g) The Contractor shall include a narrative explanation for variances exceeding plus or minus

10 percent (+/-10%) between estimated costs shown in the prior month and actual costs shown in the current month at the contract level. For example, the estimated costs shown for June in column 8.a in the May 533M and the actual June costs shown in column 7.a in the June 533M.

h) The Government will consider the Contractor’s accuracy of financial reporting when evaluating the Contractor’s performance in the Contractor Performance Assessment Reporting System (CPARS).

i) The minimum reporting categories indicated below shall be included in column 6 of this report.

1) Direct Labor Hours

2) Direct Labor Dollars

3) Overhead(s)

4) Subcontract

5) Material

6) Travel

7) Other Direct Cost

8) G&A

9) Total Estimated Cost

10) Fee

11) Total Estimated Cost and Fee

2. Monthly Progress Report

The Contractor shall submit monthly progress reports for the overall contract and for each task order describing progress of the task to date, noting all technical areas in which effort is being directed and indicating the status of work within these areas. Reports shall be in narrative form, brief, and informal in content. These reports shall include:

1. A narrative statement of work accomplished during the report period consisting of an overall top level narrative of the contract as well as a narrative for each task order.

2. A statement of current and potential problem areas and proposed corrective action for the overall contract and for each task order.

3. A discussion of work to be performed during the next report period for the overall contract and for each task order.

4. For each task order, a summary of:

(a) direct labor-hours and total cost expended during the current report period,

(b) cumulative direct labor-hours and total cost expended to date, and

(c) projected direct labor-hours and total cost to be expended to completion of the task order.

The monthly progress report shall be submitted within 15 working days after the end of each calendar monthly report period.

3. Final Reports and Additional Reports of Work

Each task order may require the Contractor to submit a Final Report or Additional Reports of Work, either formal or informal, which documents and summarizes the results. When a formal Final Report or Additional Report of Work is required, it shall be submitted in accordance with the instructions contained in NFS clause 1852.235-73, Final Scientific and Technical Reports or 1852.235-74, Additional Reports of Work – Research and Development as appropriate. The specified number of approval copies shall be submitted as specified in the task orders.

4. Information Technology (IT) Security Management Plan

a) In accordance with NFS 1852.204-76, Security Requirements for Unclassified Information

Technology Resources, the Contractor shall submit an IT Security Management Plan within

30 days after contract effective date for review and approval by the Center Information Security Officer (CISO).

b) The Contractor shall maintain the IT Security Management Plan throughout the term of the contract. The Contractor’s plan shall:

1) Identify how the requirements for IT security (including developing and maintaining IT system security plans, contingency plans, and performing information system security assessment).

2) Identify how the requirements, for which NASA directives specifically mandate compliance with respect to security of NASA IT resources, will be met.

3) Describe how the Contractor intends to hold its employees and subcontractors accountable for meeting all the requirements relative to the NPR 2810.1, “Security of Information Technology,” IT Security Handbooks, and CIO directives. The documents can be found at: https://www.nasa.gov/content/security-requirements-policies.

4) Describe how the Contractor will meet future or changing IT security requirements as directed by Federal Law or NASA requirements.

5) Describe how the Contractor plans to protect their corporate IT resources to ensure that they pose no adverse impact on NASA resources.

6) Describe how the Contractor will protect NASA or contract-specific information and data under its control.

7) Describe how the Contractor plans to provide documentation for any required IT security-related deliverable,

8) Describe how the Contractor will ensure compliance with all NASA IT security training and awareness requirements.

9) Describe how the Contractor will ensure compliance with NASA-established physical security requirements as they relate to IT security requirements.

10) Describe how the Contractor will ensure compliance with personnel screening requirements including assurance that employees with privileged access have the appropriate background screening.

11) Describe the Contractor’s procedures for termination of employees including assurance that all access privileges (e.g., network, remote access, virtual private network [VPN], campus computing, and other application access) are terminated.

12) State the Categorization of the information per FIPS PUB 199. Specific information on Categorization is available at NIST SP800-60 Volume 1 Guide for Mapping Types of Information and Information Systems to Security Categories and NIST SP800-60 Volume 2 Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices http://csrc.nist.gov/publications/PubsSPs.html.

c) The IT Security Management Plan shall be continuously updated to address all required regulations and submitted on an annual basis to LaRC OCIO for review and continued approval.

d) Specific guidance for contracts can be found in the following documents. These documents can be located at http://www.nasa.gov/offices/ocio/itsecurity/index.html, http://csrc.nist.gov/publications/PubsSPs.html, or https://nodis3.gsfc.nasa.gov/main_lib.html.

1) Federal Information Security Management Act (FISMA): https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma

2) NPD 1600.2, NASA Security Policy

3) NPD 2810.1, NASA Information Security Policy https://www.nasa.gov/content/security-requirements-policies http://csrc.nist.gov/publications/PubsSPs.html http://www.nasa.gov/offices/ocio/itsecurity/index.html http://csrc.nist.gov/publications/PubsSPs.html https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma

4) NASA Interim Directive (NID) 2810.107A, Use of NASA Information and Information Systems while Outside of the U.S. and Territories

5) NPR 1600.1, NASA Security Program Procedural Requirements

6) NPR 1620.2A, Facility Security Assessments

7) NPR 2810.1, Security of Information Technology

8) NIST Special Publication (SP) 800-18 Rev. 1, Guide for Developing Security Plans for

Federal Information Systems

9) NIST SP 800-35, Guide to Information Technology Security Services

10) LAPD 2810.1 Security of Information Technology

11) IT-HBK-2841-002 Identity, Credential, and Access Management (ICAM) Handbook)

12) NIST SP 800-160 Vol. 1, Systems Security Engineering: Considerations for a

Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

5. NASA Property in the Custody of Contractors (NF 1018)

a) The Contractor shall submit annually a NASA Form (NF) 1018, NASA Property in the

Custody of Contractors, in accordance with NFS 1852.245-73, Financial Reporting of NASA Property in the Custody of Contractors. The Contractor shall comply with the instructions on the Form and NFS 1845.71 and any supplemental instructions for the current reporting period issued by NASA.

b) Subcontractor use of NF 1018 is not required by this clause; however, the Contractor shall include data on property in the possession of subcontractors in the annual NF 1018.

c) The Contractor shall submit the NF 1018 no later than October 15th of each year for the period October 1 through September 30 of the following year.

d) A final report shall be submitted within 30 days after disposition of all property when contract performance is complete.

6. Employment Reports on Veterans

The Contractor shall submit a Veterans’ Employment Report (VETS-4212 Report) as required by FAR 52.222-37, Employment Reports on Veterans. Within 30 days following the VETS-4212 Report submission, the Contractor shall submit a letter to the Contracting Officer confirming that it has submitted the most recent annual VETS-4212 Report required by FAR 52.222-37.

7. Limitations on Subcontracting Report

The purpose of this report is to obtain information necessary to evaluate contractor compliance with FAR 52.219-14, Limitation on Subcontracting (DEVIATION 19-02). Accordingly, the Contractor shall submit a report to the Contracting Officer that demonstrates such compliance;

specifically the report shall contain sufficient information to demonstrate compliance with the requirement that “It will not pay more than 50 percent of the amount paid by the Government for contract performance to subcontractors that are not similarly situated entities.” The report is due annually no later than October 15th for the prior contract/fiscal year and within 15 calendar days after completion of the contract period of performance.

8. Interim Patent Rights Report

The Contractor shall submit an annual list of subject inventions required to be disclosed as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor).

9. Final Patent Rights Report

The Contractor shall submit a listing of all subject inventions required to be disclosed or certify that there were none as set forth in FAR 52.227-11 Patent Rights-Ownership by the Contractor (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor).

10. Invention Disclosure Reporting

The Contractor shall disclose each subject invention under the contract as set forth in FAR 52.227-11, Patent Rights-Ownership by the Contractor, (as modified by NFS 1852.227-11, Patent Rights-Ownership by the Contractor). The electronic and paper version of NASA Form 1679, Disclosure of Invention and New Technology (Including Software), shall be used for this reporting. Both the electronic and paper versions of this form may be accessed at http://invention.nasa.gov. Disclosures are required within two months after the inventor discloses it in writing to Contractor personnel who are responsible for patent matters.

11. Organizational Conflicts of Interest (OCI) and Personal Conflicts of Interest (PCI) Avoidance Plan

(a) The Contractor shall submit a plan for complying with the requirements of NFS 1852.237-72, Access to Sensitive Information; FAR 52.203-16, Preventing Personal Conflicts of Interest;

Section H.2, Organizational and Personal Conflicts of Interest; and Section H.3, Limitations of Future Contracting. The Contractor shall detail its approach to identifying, mitigating, neutralizing, and/or avoiding OCIs and PCIs that may arise under this contract. The Contractor shall include, at a minimum: (i) an assessment of the potential risk for various types of OCIs and PCIs that work under this contract may engender given the Contractor’s current and planned work (including subcontracts), and approach to performing work under this contract; (ii) the Contractor’s process for identifying OCIs and PCIs — the process for identifying OCIs must include how the Contractor intends to coordinate with each of its parent, subsidiaries, affiliates, office locations, divisions, joint ventures, and/or other similar entities (collectively, the “Business Units”) to determine whether OCIs currently exist; (iii) the approach for maintaining communication with each Business Unit during the performance of this contract to identify potential OCIs arising during such performance period; (iv) the approach to training and providing refresher training to its employees in identifying PCIs and OCIs, to include what actions employees are expected to take when potential PCIs and OCIs are identified by an employee; (v) the methods the Contractor will utilize for avoiding OCIs or PCIs, the adequacy of the Contractor’s areas of emphasis in avoiding OCIs and PCIs, and, if they cannot be avoided, the process the Contractor will utilize to mitigate or neutralize identified OCIs or PCIs; and (vi) the approach for ensuring the processes and procedures included herein will be applied, if applicable, to each of its subcontractors, subcontractor employees, and/or consultants (including their respective Business Units).

(b) The OCI and PCI Avoidance Plan (the Plan) submitted with Contractor’s proposal will be incorporated into the contract. Any future revisions to the Plan by the Contractor must be submitted for Government review and may not be implemented until approved by the Contracting Officer and incorporated into the contract via contract modification.

12. Staffing Pool List

The Contractor shall establish and maintain a list of all individuals who performed under this contract. The list shall include, but not be limited to, the individual’s name, contact information, organization/company, areas of expertise, evaluations/assessments/studies supported, and roles performed. The list is due no later than October 15th of each calendar year and upon completion of the contract period of performance.

II. DOCUMENT DISTRIBUTION REQUIREMENTS

(a) Unless otherwise specified elsewhere in this contract, the Contractor shall submit reports via email as specified below (include Contract Number: 80LARC20C00XX in the subject line).

(b) The following letter codes designate the recipients of reports and other documentation which are required to be delivered prepaid to Langley Research Center by the Contractor:

A - Contract Specialist, TBD

B - Contracting Officer’s Representative, TBD

C - Financial Management, LaRC-DL-NF533@mail.nasa.gov

D - NF 1018 Electronic Submission System (NESS)

E - Patent Counsel, https://invention.nasa.gov

F - Industrial Property Officer, bushra.k.ebneof@nasa.gov

G - Center Information Technology Security Manager (CITSM), kendall.e.freeman@nasa.gov;

jonathan.a.welters@nasa.gov

H - According to instructions on form

I - As required by Task Order

J - Task Monitor

K – New Technology Representative, michelle.a.dail@nasa.gov

(c) The following are the distribution requirements for reports and other documentation required to be delivered f.o.b. destination. The numeral following the letter code specifying the number of copies to be provided:

mailto:LaRC-DL-NF533@mail.nasa.gov https://invention.nasa.gov/ mailto:bushra.k.ebneof@nasa.gov mailto:kendall.e.freeman@nasa.gov mailto:jonathan.a.welters@nasa.gov mailto:michelle.a.dail@nasa.gov

DISTRIBUTION REQUIREMENTS

Document Number Document

Distribution Code and Quantity

1. Monthly Financial Management Report (NF 533M) A-1, B-1, C-1, J-1

2. Monthly Technical Progress Report A-1, B-1, I, J-1

3. Final Reports and Additional Reports of Work A-1, B-1, I, J-1

4. IT Security Management Plan A-1, B-1, G-1

5. NASA Property in the Custody of Contractors (NF 1018) A-1, B-1, D-1, F-1

6. Federal Contractor Veterans Employment Report (VETS-

4212) A-1, H-1

7. Limitations on Subcontracting Report A-1, B-1

8. Interim Patent Rights Report A-1, B-1, E-1, K-1

9. Final Patent Rights Report A-1, B-1, E-1, K-1

10. Invention Disclosure Reporting A-1, B-1, E-1, K-1

11. OCI and PCI Avoidance Plan A-1, B-1

12. Staffing Pool List A-1, B-1

(d) If delegated, the Contractor shall also furnish a copy of the transmittal letter and a copy of each Financial Management Report to the delegated Administrative Contracting Officer of the cognizant DoD (or other agency) contract administrative services component.