Draft Data Requirements Description - Security Requirements for Unclassified IT Resources.pdf

This is a Data Requirements Description (DRD) document outlining security requirements for unclassified IT resources for NASA. The DRD establishes IT security reporting requirements including Cyber Supply Chain Risk Management (C-SCRM) for IT systems used during contract work.

The document details several key requirements including: submission of Information System Security and C-SCRM plans at phase-in, annual security certifications for non-federal systems handling NASA information, IT security awareness training requirements, incident reporting procedures, and specific role-based training requirements for IT Security Manager, ISO, ISSO, and ISSE positions. All deliverables must be submitted electronically to NASA's Information System Security Officer (ISSO) or Information Owner. The document references numerous applicable security standards including FISMA 2014, NIST Special Publications, and NASA procedural requirements. Contractors must maintain annual certifications, complete required security training, and keep security plans updated as systems change. The C-SCRM plan must follow NIST SP 800-161 guidelines for managing cybersecurity risks in the supply chain.