Attachment F - IT DRD.pdf

ATTACHMENT F

SECURITY REQUIREMENTS FOR UNCLASSIFIED IT

RESOURCES DATA REQUIREMENTS DESCRIPTIONS (DRD)

AUGUST 2024

RFP 80GSFC24R0036

CONTRACT TBD

1. DRD Title: Security Requirements for Unclassified IT Resources

2. DRD No.: 1 3. Data Type: 1 4. OPR: OCIO

5. Solicitation No.: 80GSFC24R0036 6. Contract No.: (Insert contract number)

7. Date Issued: 8/9/2024 8. Date Revised: N/A 9. DRD Category:

Technical ☒ Administrative ☐

S&MA ☐

10. Description/Use: To ensure that IT security reporting requirements, including Cyber Supply Chain Risk Management (C-SCRM), are met for all IT systems utilized during work associated with this contract and necessary training requirements are fulfilled.

11. Distribution: All deliverables required by this DRD, except for the C-SCRM plan, shall be submitted electronically to the CO, COR, and NASA Organization’s Information System Security Officer (ISSO) (i.e., Security Officer). Approval will be provided by the ISSO. If the organization does not have an ISSO, approval will be provided by the NASA Information Owner. C-SCRM plans shall be submitted to and approved by the ICT/C-SCRM Service Element Lead at agency-dl-ocio-cys-cp-scrm@mail.nasa.gov.

Initial Submission:

Information System Security and C-SCRM Plan(s): For contractor-owned systems, due at the start of phase-in.

Initial submission not required for existing, approved plans for Government-owned and Contractor-managed systems.

For new Federal Information Systems, due with the delivery of the system.

Non-Federal System Certification: Prior to any transfer of NASA non-public information to the contractor, the contractor shall provide documentation of the certification of the non-federal system to the security officer of the NASA organization that owns the information (typically the organization responsible for the contract).

If the organization does not have an ISSO, the attestation shall be provided to the NASA Information Owner.

Information on Employees in Sensitive Positions/Assignments Report: At the start of phase-in

IT Security Point of Contact: At the start of phase-in

IT Security Awareness Training: Training required prior to access to NASA information and systems.

IT Security Role Based Training: Foundational training is provided prior to performance of assigned role. Initial evidence showing completion due at the end of phase-in.

Submission Frequency:

Information System Security Plan(s) and C-SCRM Plan: As Required

Non-Federal System Certification: Annually

Information on Employees in Sensitive Positions/Assignments Report: Annually

IT Security Point of Contact: As Required

IT Security Awareness Training: Annual on anniversary date of initial training

IT Security Role Based Training: Annual on anniversary date of initial training. Evidence of completion due annually.

Format: Unless otherwise directed, the data requested in this DRD shall be delivered to the Government in soft-copy via an electronic transfer mechanism (e.g., electronic mail, flash drive, or file transfer protocol) in a format readable by a Government device utilizing the standards in NASA-STD-2804, “Minimum Interoperability Software Suite.”

Interrelationship: SOW Section II. Functional Requirements for GMAO Research and Development Support

Applicable Documents: Most current versions of the following:

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems FAR 52.204–29, Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures FISMA 2014, Federal Information Security Modernization Act 2014 NFS 1852.204-76, Security Requirements for Unclassified IT Resources NFS 1852.223-75, Major Breach of Safety or Security NFS 1852.237-72, Access to Sensitive Information NFS 1852.237-73, Release of Sensitive Information NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations NPR 1382.1, NASA Privacy Procedural Requirements NPD 2810.1, Information Security Policy NPR 2810.1, Security of Information and Information Systems NPR 2810.7, Controlled Unclassified Information NPR 7120.7, NASA Information Technology Program and Project Management Requirements OMB Circular A-130, Management of Federal Information Resources

Scope: All contracts that purchase, lease, network to, or otherwise utilize covered articles, which includes Government-funded IT (as defined by the FAR) must comply with NASA IT Security and C-SCRM Requirements.

Contents: The Federal Information Security Modernization Act (FISMA) and Executive Branch policy require external providers that process, store, or transmit federal information or operate information systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies.

Information System Security Plan (i.e., System Security Plan, IT Security Plan, or Security Plan):

When the contractor is operating a Federal Information System (FIS) on behalf of NASA or is providing a FIS in the execution of this contract, that system must have an Information System Security Plan in accordance with NIST Special Publication (SP) 800-53, “Security and Privacy Controls for Information Systems and Organizations” at the revision number required at the issuance of the contract. This plan and supporting documents shall be entered into the NASA cybersecurity system of record pursuant to Authorization to Operate (ATO) requirements set forth in NASA Policy Directive 2810.1, “NASA Information Security Policy” and NASA Procedural Requirement (NPR) 2810.1, “Security of Information and Information Systems.” The FIS security plan and ATO must be in place before any system may operate in the NASA environment.

NON-FEDERAL SYSTEM SECURITY CERTIFICATION

When the contractor will receive, process, store or transmit NASA non-public information, especially Controlled Unclassified Information (CUI) including Personally Identifiable Information (PII) on a non-federal system (e.g., the https://www.acquisition.gov/far/4.2301 contractor’s corporate system) the system must meet the requirements for data protections detailed in NIST Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

This documentation may take the form of:

a. A third-party review/audit certifying that the non-federal system meets the requirements of NIST SP

800-171 or equivalent standard of information protection, such as the ISO 27001 standard.

b. A certification from another federal agency such as the DOD Cybersecurity Maturity Model

Certification (CMMC) Level 2.

INCIDENT NOTIFICATION

The contractor shall report immediately upon notification any incident involving NASA information on nonfederal (contractor) systems to SOC@nasa.gov.

IT SECURITY POINT OF CONTACT:

The contractor shall identify a point of contact that NASA may reach in its attempt to address IT and cybersecurity issues. The point of contact shall have the authority to ensure the immediate notification of the NASA Security Operations Center of any incident involving NASA information.

IT SECURITY AWARENESS TRAINING:

Contractor employees subject to this contract, defined as those requiring physical access to NASA facilities or electronic access to NASA systems, shall complete the NASA approved IT Security Awareness Training annually. NASA Cybersecurity and Privacy Awareness training is available through the SATERN online system and must be completed prior to access to NASA information and systems. Completion of the training is tracked automatedly by NASA and must recur each year by the anniversary of the initial training as a condition of continued access. Cybersecurity and Privacy training is updated throughout the year as needed, so there is no defined training period.

IT SECURITY ROLE BASED TRAINING:

Contractor employees subject to this contract shall complete NASA’s Foundational IT Security Training in SATERN related to the following role-based functions prior to performing the role:

• IT Security Manager

• Information System Owner (ISO)

• Information Systems Security Officer (ISSO)

• Information System Security Engineer (ISSE)

It is highly recommended, but not required, that Contractor employees complete advanced role-based training every other year following completion of the initial training provided by NASA. This training is also provided by NASA but may be fulfilled externally. If fulfilled externally, the Contractor shall provide the “External Role- Based Training Validation Form” to the center CISO. The process for completing this form and receiving credit may be found at: External RBT Validation Form (sharepoint.com).

INFORMATION ON EMPLOYEES IN SENSITIVE POSITION(S)/ASSIGNMENTS REPORT:

The Information on Employees is Sensitive. IT Security (ITS) Positions/Assignments Report shall provide information annually for personnel screening as required by NPR 2810.1(series), and NPR 1600.1 on position risk.

CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) PLAN:

NIST defines C-SCRM as a systematic process for managing exposure to cybersecurity risks throughout the supply mailto:SOC@nasa.gov https://nasa.sharepoint.com/sites/itsatc/SitePages/RBT-Validation-Form.aspx?OR=Teams-HL&CT=1706898835470&clickparams=eyJBcHBOYW1lIjoiVGVhbXMtRGVza3RvcCIsIkFwcFZlcnNpb24iOiIyNy8yMzExMzAyNjIwMiIsIkhhc0ZlZGVyYXRlZFVzZXIiOmZhbHNlfQ%3D%3D chain and developing appropriate response strategies, policies, process, and procedures. A C-SCRM plan, consistent with the recommended template in NIST SP 800-161, Section 3.1 shall be delivered prior to the processing, transmission, or storage of non-public NASA information in performance of the contract.

Remarks: None

Maintenance:

Information System Security Plan(s) shall be kept up to date as changes to the baseline configuration of the system(s) occur.

Non-Federal System Certifications shall be maintained annually or per the certifying body’s standard.

Information on Employees in Sensitive Positions/Assignments Report shall be maintained annually.

It Security Point of Contact shall be kept up to date as changes occur.

Evidence of completion of IT Security Role Based Training is due annually.

C-SCRM plans shall be kept up to date as changes occur to organizational C-SCRM processes, policies, and procedures, and/or, new components are introduced.