Attachment 9_IT Security Management Plan.pdf
PDF 610 KB Posted
- Solicitation number
- 80AFRC22R0003
About this file
This draft request for proposal and related information technology security management plan attachment outline the requirements for facilities operations and maintenance services at the National Aeronautics and Space Administration Armstrong Flight Research Center. The contractor will be responsible for all facility operations, maintenance, repair, janitorial services, grounds-keeping services, and other directly related miscellaneous services for buildings, utilities, structures, assets and equipment. The IT security management plan attachment provides guidance on developing and delivering a plan to ensure compliance with NASA and federal IT security requirements for personnel and processes associated with contract performance. It details requirements for title, revisions, scope, contract and subcontract management, compliance with risk assessments, security clearance processes, training, access controls, currency of the security system, issue resolution, data management, use of unauthorized devices, and record keeping. Comments on the draft RFP are due by April 26, 2022.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Data Requirements Description (DRD)
1. DRD Title: Information Technology (IT) Security Management Plan
2. DRD No.: DRD-01 3. Data Type: 1 4. OPR: Center Information Security Office
5. Solicitation No.: 80AFRC22R0003
6. Contract No.: (Insert contract number)
7. Date Issued: January 3, 2022
8. Date Revised: 9. DRD Category:
Technical ☐ Administrative ☒
S&MA ☐
10. Description/Use: Ensure compliance to Information Technology (IT) Security as defined and required by NASA and the United States Government is managed by Contractor and its agents, e.g. employees and subcontractors.
11. Distribution: Contracting Officer (CO), Contracting Officer’s Representative (COR), Chief Information Security Officer (CISO)
Initial Submission: First day of contract phase-in. CISO approved plan will become a contract attachment.
Submission Frequency: As necessary
Format: NASA Template
Interrelationship: N/A
Applicable Documents: NFS 1852.204-76, NPR 2810.1A - Security of Information Technology; AFPD-2800.2-001
- Managing Information Technology, NIST SP 800-64 – Security Considerations in Information System Development Life Cycle, OMB Circular A-130, Appendix III - Security of Federal Automated Information Resources
Scope: In accordance with NFS 1852.204-76 Security Requirements for Unclassified Information Technology Resources, the Contractor shall develop and deliver an IT Security Management Plan.
Contents:
A. In accordance with the contract the Contractor shall maintain an IT Security Management Plan describing and addressing how the Contractor will manage personnel and processes associated with IT Security requirements related to the performance of the contract.
B. The IT Security Management Plan shall address how the contract requirements will be met and shall address at a minimum:
1. Title, contract number, preparer, NASA concurrence signatures, approver(s), revision with date, page numbers, table of contents, list of applicable definitions, revision history, introduction, scope.
2. Contract and subcontract management, including requirement review and execution.
3. Supplier control - flow down of contract requirements to subcontractors/suppliers, with necessary means to assure compliance over the duration of the contract.
4. Compliance with AFRC and NASA Information Technology related purchase supply chain risk assessment process.
5. Description of the method to periodically demonstrate that the Contractor IT Security system, strategy, and measures are effective and compliant with contract requirements.
6. Employee security clearance process, assurance for meeting Public Trust Position (ref SF Form 85).
DRAFT
7. Compliance with NASA required annual, role-based and employee remedial training requirements.
8. Access and control of NASA and Government electronic assets, data bases, websites, email system, and accounts.
9. Description of how the Contractor shall ensure currency and effectiveness of its IT Security system. (The
Contractor shall, anticipate and upon discovery, identify conflicts with contract requirements, then immediately provide recommended solutions in writing to the COR and IT Security Office. Recommendations can include suggestions to improve the AFRC governing system, processes, and policies).
10. Description of resolving a discrepancy/issue, the strategy for timely implementation for effective corrective actions coordinated with NASA and report method to the COR, Contractor staff and AFC IT Security Office (typically the TOM).
11. Description of data management strategy; contractor shall comply with all NASA data being stored and managed using AFRC or NASA authorized services.
12. Shall document compliance with NASA Policy regarding use of unauthorized devices, e.g. personal computers, cell phones, watches, scanners, USB or other connecting devices, video/cameras, memory devices, broadcast, recording, and “cloud” products and privately-owned software applications.
13. Reference (NPR 2810.1, Security of Information Technology) - The Contractor shall employ, and demonstrate compliance with the following Federal Security documents:
a. NIST 800 series documents
b. Federal Information Security Management Act (FISMA)
c. FIPS 200 Minimum Security Requirements for Federal Information and Information systems
d. FIPS 199, Standards for Security Categorization of Federal Information and Information systems
14. Handling of customer supplied material, product, and equipment.
15. Description of how the approved IT Security Management Plan and all revisions are fully implemented upon approval and will serve as a focal point for IT Security related matters to the COR and AFRC IT Security Office.
C. Description of how the Contractor shall support the Government audit/surveillance of Contractor plans, procedures and processes when deemed necessary by the Government.
D. The IT Security Management Plan shall describe how the Contractor shall manage and provide a documented IT Security and related records system for all tasks defined in contract subordinate to the AFRC IT Security system, processes, policies, and management. (The document(s), processes, and procedures including revisions are subject to AFRC approval/acceptance prior to start of work or implementation.
E. The IT Security Management Plan may be transmitted electronically, PDF (signed) and Word formats, unless COR requires otherwise. Government will provide email addresses. Submit the IT Security Management Plan and revisions via encrypted email to:
1. Contracting Officer (CO)
2. Contracting Officer’s Representative (COR)
3. IT Security Office, Code 640
Note: The Contractor can expect at least 10 business days for review to conclude in either approval or rejection.
AFRC reserves the right to reject or disapprove the IT Security Management Plan and/or associated processes utilized in performance of the contract, if either fails to comply with requirements or exhibits significant adverse trends in product/service quality, conflicts with, or does not otherwise conform with contract, compromises security, degrades protection (or results in loss) of intellectual property, or can cause/has caused safety issues or injury, death, damage, or loss of resources to public or NASA or Contractor including employees. The Contractor shall furnish all resources to ensure continuous implementation of the IT Security Management Plan as approved.
Remarks: N/A
Maintenance: Changes shall be incorporated by complete reissue.
DRAFT
File details come from the government source that posted it. Updated .