Attachment_D_-_L10_MOC_IT_Security_Guidance_1.pdf
PDF 383 KB Posted
- Attached to
- RFI - Landsat 10 MOC & Ops _ FAQs
- Solicitation number
- DOIGFBO260017
About this file
This is an internal pre-decisional IT Security Guidance document for the Landsat 10 (L10) Mission Operations Center (MOC) prepared jointly by NASA and USGS as of April 8, 2026.
The document establishes IT security requirements and framework for the L10 MOC system. The guidance mandates implementation of the NIST Risk Management Framework (RMF) with ongoing FedRamp compliance and Federal Information Security Modernization Act (FISMA) adherence. IT systems must leverage Zero Trust Architecture (ZTA) per Executive Order M-22-09 and employ Continuous Diagnostics and Mitigation tools including Hardware Asset Management, Security Information and Event Management, endpoint protection, and vulnerability management aligned with established timelines. Security documentation typically required includes FIPS-199 assessments, Interface Control Documents, Interconnection Security Agreements, System Security Plans, Business Impact Analyses, and Privacy Impact Assessments, though the current study deliverables do not require completion of these documents. The MOC will operate within defined boundaries: NASA boundaries connect via Communications Service Office networks to NSN stations and launch facilities; USGS boundaries encompass the MOC, DPAS, and GN systems. Data protection requirements include encrypted commanding using AES-256 or better encryption, protection of telemetry downlink via SSL/TSL tunnels, and handling of controlled unclassified information, personally identifiable information, and ITAR-controlled data per dissemination controls. The document notes that Landsat 9 received a Moderate Impact System rating; L10's security level will be determined through a FIPS 199 assessment during Phase A. A joint Agency Security Working Group will oversee implementation, with NIST 800-53 Revision 5 security controls serving as the compliance basis for annual assessments. The guidance incorporates directives including M-21-31 (logging and retention), BOD 22-01 (known exploited vulnerabilities), and BOD 23-01 (visibility and vulnerability detection).
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
LNext Landsat Next
Pre-decisional – For NASA & USGS Internal Use Only
L10 MOC IT Security Guidance
April 8, 2026
L10 Landsat 10
Topics
Overview and Outline
Security Documentation
MOC Boundaries and Authorizations
Directives and Mandates
Data Protection
Existing Missions IT Security Overview
Overview/Outline
Assessment and Authorization (A&A)
NIST RMF Framework
Ongoing FedRamp Compliance
Federal Information Security Modernization Act (FISMA)
Risk Identification or Plan of Action and Milestones (POAM)
Continuous Authorization to Operate (ATO) – Annual Renewal
Evaluation of Controls (Self-Assessment)
IT systems will leverage modern Security architecture and controls
I.E. Zero Trust Architecture (ZTA)
IT systems will require Continuous Diagnostics and Mitigation tools
Hardware Asset Management (HWAM)
Security Information and Event Management (SIEM)
Endpoint Protection
Vulnerability Management
• In accordance with mandated identification and mitigation timelines
Security Documentation
The deliverables of this study do not require any security documents to be completed
The following documents are typically required as part of the ground systems security plan
FIPS-199
Interface Control Document (ICD)
Interconnection Security Agreement (ISA)
Memorandum of Understanding/Agreement (MOU/A)
Information System Contingency Plan (ISCP)
Business Impact Analysis (BIA)
System Security Plan (SSP)
Continuity Of Operations Plan (COOP)
Privacy Impact Assessment (PIA)
Etc
For L10, it’s expected that the MOC will provide content that will be used to construct these documents or use the documents in the overall security compliance
MOC Boundaries and Authorizations
IT security boundaries for the L10 MOC system have not been defined at this time
NASA boundaries consist of mission networks that provide connection to NASA elements using NASA communications service office (CSO) networks
• Connect to NSN stations, FDF, Spacecraft Vendor facility, launch facility, Space Network, etc.
USGS boundaries consist of the MOC, DPAS and GN systems
Will require M-22-09 Zero Trust Architecture
Conceptual diagram that was used for Landsat 9 during development:
Directives and Mandates
Adapt and implement dynamic Directives and Mandates as required. Examples include:
M-22-09
ZTA
Multi-Factor Authentication
Data in Transit
Data at Rest
M-21-31
Logging capabilities and retention
BOD 22-01
Known Exploited Vulnerabilities
BOD 23-01
Visibility and Vulnerability Detection
Data Protection
Dissemination Controls
Data handling in accordance with labeling and privacy handling (CUI/PII/ITAR)
TLM and CMD Data Protections
Encrypted commanding (encryption takes place in MOC before being sent to stations)
Encryption standard is notionally AES-256 or better
Some S/C information (i.e. – S/C ID) is considered protected information, but much of this will be handled in
T&C data formatting/definitions instead of specific transport protections
TLM D/L is unencrypted, but will need to be protected in transit between stations and MOC (SSL/TSL tunnel or better)
Potential for requirement for TLM D/L encryption
Existing Missions IT Security Overview
Landsat IT Security implementation and review is a joint USGS and NASA endeavor
A joint Agency Security Working Group will be put in place and will continue to meet through the life of the mission
All government security standards (e.g., FISMA 2002) and industry practices will be implemented on all IT systems, including MOC systems
NIST 800-53 Rev5 (or latest) Security Controls will be the basis of annual compliance and adherence to federal security standards
Security standards for the MOC at GSFC will be a high watermark of USGS and NASA IT Security requirements
• Security Standards for the NASA Exclusive Elements (CSO, FDF, CARA, etc…) comply with there applicable NASA IT Security
Requirements
Landsat 9 Rated as Moderate Impact System for Security Planning and Implementation activities by both Agencies
Security level not defined for Landsat 10 at this time
A FIPS 199 assessment will be performed as the mission progresses through phase A
MOC Vendor Security Analysis
USGS encourages the most efficient methods for implementing security for the Landsat
10 MOC
Any feedback is greatly appreciated
| Slide 1: L10 MOC IT Security Guidance |
| Slide 2: Topics |
| Slide 3: Overview/Outline |
| Slide 4: Security Documentation |
| Slide 5: MOC Boundaries and Authorizations |
| Slide 6: Directives and Mandates |
| Slide 7: Data Protection |
| Slide 8: Existing Missions IT Security Overview |
| Slide 9: MOC Vendor Security Analysis |
File details come from the government source that posted it. Updated .